APT-C-36: Latin America’s Persistent Cyber-Espionage Force

APT-C-36 is a suspected South American threat group, also known as Blind Eagle, that has run espionage and financially motivated operations since at least 2018. It mainly targets government bodies and financial firms in Colombia and other Latin American countries. Its main method is phishing, often used to install commodity remote access tools.

What is APT-C-36?

APT-C-36, also known as TAG-144, Blind Eagle, and Blind Spider, has emerged as one of the most persistent cyber-espionage actors in Latin America. Active since approximately 2018, the group has been noted for targeting government and financial entities in South America.

Unlike many advanced persistent threat groups of global powers, APT-C-36 works in its own operational context. It blends espionage objectives with financially driven campaigns. The group’s evolution reflects the maturity of Latin American cyber actors. It also shows why local cyberspace activity matters in global threat intelligence.

Identity and Motivation

It is suspected that APT-C-36 operates out of South America, and it mainly targets Colombia and other countries in the region. Its activities show a hybrid motivation. It collects intelligence for political and strategic purposes, and it steals money to fund operations.

The group focuses on, but is not limited to, government ministries, financial services, telecommunications providers, and educational institutions. Phishing is the group’s signature method. Recent activity shows greater use of living-off-the-land methods and commercially available remote access tools (RATs), such as AsyncRAT, QuasarRAT, and BitRAT.

The actor’s stated motivations fall under two broad categories: 1. Espionage: Collecting intelligence from government and critical infrastructure networks. 2. Financial Gain: Stealing credentials and sensitive data from banking and corporate networks for financial purposes.

APT-C-36’s operations suggest an opportunistic component as it often impersonates tax authorities, law enforcement, or telecommunications companies to entice targets to launch malicious payloads.

What tactics does APT-C-36 use?

APT-C-36 typically works with a focus on simplicity, consistency, and flexibility. The group may not be as technically advanced as leading advanced persistent threats. Its familiarity with local socio-political contexts gives it a significant strategic advantage.

Exfiltration and Impact: The primary objective is data theft. Stolen credentials are either employed for additional access, or subsequently exposed for sale on dark web markets. The group’s attacks have disrupted operations across government institutions and private sector companies alike.

Initial Access: Spearphishing continues to be the main mode of access. The group sends emails that pose as government tax notifications or legal documents, often containing malicious PDF or ZIP attachments. Some effects include links that lead to counterfeit credential-harvesting sites.

Execution and Persistence: Once the victim accesses the attachment or link, a PowerShell-based script is executed to download the second stage payload. Persistence is established by means of scheduled tasks, registry changes, and abuse of legitimate remote administration tools.

Command and Control (C2): APT-C-36 employs HTTPS-based communications, VPNs, and dynamic DNS services to obfuscate their infrastructure. They frequently use cloud services and remote administration tools to blend any malicious activity in with normal network traffic.

Malware and Tools: The group uses a combination of open-source and commodity RATs (AsyncRAT, QuasarRAT, njRAT, and BitRAT). It also uses custom droppers designed to evade local antivirus solutions. These RATs enable remote access, credential theft, and document exfiltration.

What are the notable APT-C-36 operations?

Over the years, the APT-C-36 group has adapted its tactics, while maintaining a consistent tempo of operations in South America:

• 2023 – Tax Authority Phishing Campaign: The group impersonated Colombia`s DIAN (Dirección de Impuestos y Aduanas Nacionales). It sent phishing emails with PDF attachments to recipients. The payload used AsyncRAT to extract credentials from government employees.
• 2024 – Financial Institution Breach: A new wave of phishing emails targeted banking networks in South America. The emails used fake legal notifications as lures and compromised credentials allowed lateral movement within internal banking systems, which resulted in data exfiltration.
• 2025 – Public Sector Espionage Campaign: APT-C-36 may have conducted operational spearphishing campaigns within Colombian ministries. The spearphishing attacks were conducted utilizing PowerShell loaders and encrypted C2 channels, indicating a shift to a more stealthy and sustainable approach.

The operations show that the actor does more than espionage or financial theft. It also understands local government bureaucratic flows and communication norms at a competitive, sophisticated level.

Recent Developments and Evolution

APT-C-36 continues to evolve and change within the cybersecurity space. The group has added operational security (OPSEC) improvements, such as:

• Infrastructure rotation: Frequent new domain registrations and temporary servers to avoid blacklisting.
• Encryption: Usage of HTTPS and cloud-based C2 communications to enhance stealth.
• Tool diversification: Use of more commodity malware versus custom software reduces traceability and lowers development costs.

The tools the group chose and the techniques it used, mainly social engineering, show that it lacks global threat sophistication but has strong regional relevance. The localization makes it very effective against Latin American targets. It uses culturally familiar institutions and regionally common dialects.

User sophistication and institutional defenses also vary across Latin America, which helps the group.

Strategic Impact and Defensive Takeaways

APT-C-36 is a manifest of a growing class of regionally driven APTs that straddle the line between espionage and financially motivated activity. In remaining successful, it indicates that regional actors can sustain long-duration campaigns, while applying minimal resources by exploiting social trust and utilizing publicly available modules.

There are a number of clear defensive implications:

1. Localized Awareness Campaigns: Organizations in Latin America should develop and support awareness training focused on the local landscape of phishing techniques for government impersonation attacks.
2. Behavioral Detection Over Signature-Based Security: To detect commodity malware, focus on behavior-based indicators of attack. Examples are abnormal PowerShell execution or signs of command and control connections.
3. Network Segmentation and Zero Trust Models: Through segmentations, the lateral movement is limited. Focusing on a Zero Trust model is important to monitor user activity and privilege escalation activity.
4. Regional Intelligence Sharing: Work together as Latin American CERTs and private sector organizations to disrupt APT-C-36’s infrastructure and identify overlaps quickly.

Conclusion

APT-C-36 (Blind Eagle) shows how a regional threat actor can grow into a persistent, adaptive, and effective espionage effort. Its campaigns reflect a nuanced understanding of the socio-technical environment in Latin America. They also show a pragmatic use of resources.

In 2025, APT-C-36 remains an active and maturing threat. This is due less to exploits or exploitable malware than to its persistent in-context targeting and social engineering abilities.

For cybersecurity professionals and policymakers, this group is a case study in the growing significance of regional APT ecosystems. It shows that local defense strategies, information sharing, and investment in user awareness are all necessary. They are needed to counter threats that arise from the same cultural and linguistic context they exploit.

You can download and review the sheet for all the details!