APT-C-36
IntrusionSet · ATTACK:enterprise:G0099
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0099",
"title": "APT-C-36",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0099",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--c4d50cdf-87ce-407d-86d8-862883485842",
"external_id": "G0099",
"domain": "enterprise",
"created": "2020-05-05T18:53:08.166Z",
"modified": "2026-07-31T18:48:17.693Z",
"version": "2.0",
"aliases": [
"APT-C-36",
"Blind Eagle",
"TAG-144",
"AguilaCiega",
"APT-Q-98"
],
"tactics": [
],
"source_references": [
{
"source_name": "Blind Eagle"
},
{
"source_name": "TAG-144"
},
{
"source_name": "AguilaCiega"
},
{
"source_name": "APT-Q-98"
},
{
"source_name": "Check Point Blind Eagle MAR 2025",
"url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
},
{
"source_name": "Kaspersky BlindEagle AUG 2024",
"url": "https://securelist.com/blindeagle-apt/113414/"
},
{
"source_name": "Recorded Future TAG-144 AUG 2025",
"url": "https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"
},
{
"source_name": "QiAnXin APT-C-36 Feb2019",
"url": "https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"
}
]
}Explicit source assertions (47)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00c26d3c-72ba-4197-acd1-690691d452aa
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14079096-32c8-45e2-ab0d-a6b968fb77f9
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20599767-204a-4cbf-ada7-0f931ee925e4
Check Point Blind Eagle MAR 2025 · Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025 · QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1683.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--223a1766-5e04-4e75-95e0-a4e92375d70c
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23f9a212-8dce-4677-a8c4-2e72e86a4ce8
Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34529aa9-4431-4b7f-af18-e53c5b8b71aa
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0434
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f010259-666c-403b-b5c7-603b319583da
QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f21f508-5f35-4d99-a133-8abbf02cf6d5
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45263d4b-48de-4c14-a90b-2de28daad829
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S9017
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48e24403-e88b-4d73-9830-e1fe3d200b86
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1588.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ba6ae62-55e8-4ea2-a58c-75f15620e031
Check Point Blind Eagle MAR 2025 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1584.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f3415da-2f9f-41fb-bda3-0e154a9c33da
LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--540768f8-311c-4b43-8afa-d29a614ed27b
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S9019
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ba60c32-24f6-49d2-b4ae-06ca26adfbaa
Check Point Blind Eagle MAR 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cabd775-7d78-4150-b529-bb8cfb747013
QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f3cac8e-55b8-4fb9-b0dd-e83939aa81ad
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S9016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61b8e32a-4c38-41d9-a78d-904fce4a97e4
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c89f28c-963b-44ef-8dda-5916aa17b7e9
Check Point Blind Eagle MAR 2025 · QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7236a497-3b27-452c-ba91-d979251be07d
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b4b8d0b-fbc3-469a-ab62-72c5c4c4653d
Kaspersky BlindEagle AUG 2024 · QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c689316-1b25-4ca6-9cff-e36a88c0d6b3
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96ebe8fc-85be-4652-b6dd-24f318b83129
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c7833f5-6e00-4118-9f9d-c7f23e1c8857
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1683.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1341215-8297-453b-af5d-070f0f908305
LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3db41d0-a023-479f-b8eb-9065063ad7dc
Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa5d5fcd-db19-4593-a958-b09853ceb372
QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abff6712-78bf-4a73-a950-0547442ff301
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afabeca2-f30b-40c6-a2d5-aee4be37aa29
Check Point Blind Eagle MAR 2025 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcf302f3-bffc-4c59-84cf-dbd0477ec207
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd590dd0-7fec-4526-96f1-96a91ca15954
Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd8f6713-f3f2-4caf-b775-18e1062ce8bb
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c303e231-4201-4c17-a3fa-bcb0bbdad0d9
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3afb812-f91e-44de-8a11-fc0fa73e0deb
Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3bedbae-b1e1-4a35-8c59-d181dca093e4
QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6822435-d621-415c-8cb9-42473760fc33
Kaspersky BlindEagle AUG 2024 · LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d10d70ee-38f4-43b4-85a2-bab4f944c645
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4922804-7216-4e83-b0c0-6e61b09d5fc0
Kaspersky BlindEagle AUG 2024 · LevelBlue Blind Eagle Proton66 JUN 2025 · QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7647e3e-d554-44e0-97e0-b8d5abab3cab
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da940fad-4778-4d61-b030-9618512c3537
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db0f9f05-6f76-47c3-81bf-a59d85045188
QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1586.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7ec67f5-d78a-4ba6-b9f7-b0ca43773ac1
Recorded Future TAG-144 AUG 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1593
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eba94ce8-cfb7-415d-a990-10c91d90d3e2
LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee00cd55-254b-4780-be47-e0f78a327c93
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S9018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f28f2a62-d7e0-4624-9bce-fc6d72f31df4
Check Point Blind Eagle MAR 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6947e72-9277-4896-b7cd-9dece3503980
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fda5d0ef-e6ee-4331-a201-5379a981259a
Kaspersky BlindEagle AUG 2024 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe9d5dc8-d96e-40a2-a715-8331c56322d7
Kaspersky BlindEagle AUG 2024