Threat actor
Blind Eagle
espionage
Tracked by CyberSIXT since 27 Aug 2025
- Articles · all time
- 3
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
Names and sources
- APT-C-36
- Named by CyberSIXT coverage
- APT-C-36
- Named by Malpedia · apt-c-36
- Blind Eagle
- Named by Malpedia · apt-c-36
- APT-C-36
- Named by MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0
- Blind Eagle
- Named by MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0
- APT-C-36
- Named by MITRE ATT&CK® · G0099
- APT-Q-98
- Named by MITRE ATT&CK® · G0099
- AguilaCiega
- Named by MITRE ATT&CK® · G0099
All 11 names
- Blind Eagle
- Named by MITRE ATT&CK® · G0099
- TAG-144
- Named by MITRE ATT&CK® · G0099
- G0099
- Named by MITRE ATT&CK®
Attributed facts
- motivation
- espionage (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- sector
- Financial (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- sector
- Government (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- sector
- Manufacturing (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- sector
- Petroleum (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- sector
- Private sector (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- Target country
- Chile (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- Target country
- Colombia (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- Target country
- Ecuador (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- Target country
- Panama (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
- Target country
- Spain (MISP Galaxy · ae1c64ff-5a37-4291-97f8-ea402c63efd0)
Malware and tools
QuasarRAT (MITRE ATT&CK® · G0099) Remcos (MITRE ATT&CK® · G0099) njRAT (MITRE ATT&CK® · G0099) Imminent Monitor (MITRE ATT&CK® · G0099) AsyncRAT (MITRE ATT&CK® · G0099) Caminho (MITRE ATT&CK® · G0099) DCRAT (MITRE ATT&CK® · G0099) HeartCrypt (MITRE ATT&CK® · G0099) PureCrypter (MITRE ATT&CK® · G0099) Imminent Monitor RAT (Malpedia · apt-c-36) LimeRAT (Malpedia · apt-c-36)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0099
Tactics pending refresh
- T1027
- Obfuscated Files or Information
- T1027.003
- Steganography
- T1027.013
- Encrypted/Encoded File
- T1027.016
- Junk Code Insertion
- T1036.004
- Masquerade Task or Service
- T1036.005
- Match Legitimate Resource Name or Location
- T1047
- Windows Management Instrumentation
- T1053.005
- Scheduled Task
- T1055.012
- Process Hollowing
- T1059.001
- PowerShell
- T1059.005
- Visual Basic
- T1059.007
- JavaScript
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- A Persistent Threat: Blind Eagle Hacking Group Continues to Target ColombiaSecurityOnline
- TAG-144: Actors Attacking Government Entities With New Tactics, Techniques, and ProceduresGBHackers
- Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS InfraThe Hacker News · first in our coverage