APT-C-36Threat actor
- aguilaciega
- apt-q-98
- Blind Eagle
- TAG-144
Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.From MISP Galaxy
Last reported 1 month ago, by Risky Business News3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1027.017SVG Smuggling
“SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”
- T1110.003Password Spraying
“AWS password spraying campaign: A password spraying campaign has targeted the root user accounts of AWS tenants.”
- T1684Social Engineering
“Spring Ring campaign: A hacking group has targeted more than 150 employees across at least 10 companies as part of a coordinated social engineering campaign.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“Blind Eagle's GitHub loader: Researchers analyze a malware loader spread via boobytrapped GitHub projects, supposedly used by the Blind Eagle APT.”
-
Where Expertise Meets Algorithm: The Insikt Group® Intelligence Edge“Recent research includes identifying five distinct activity clusters by TAG-144 (Blind Eagle) targeting Colombia government institutions.”
-
Mapa de actividad de malware en América Latina“El incidente más destacado en Colombia fue con una empresa de aviación, atacada por el grupo APT Blind Eagle.”
Indicators in its reports
named in the reports above- zet[.]netin 1 report
- www.virtualizor[.]comin 1 report
- eldomador.bsky[.]socialin 1 report
- infosec[.]exchangein 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.