Recorded Future TAG-144 AUG 2025

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.

APT-C-36 has used junk characters to obfuscate malicious scripts.

APT-C-36 has used VPNs in their operational infrastructure.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

AsyncRAT has been executed through victims opening malicious file attachments.

APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.

AsyncRAT has been delivered via malicious email attachments.

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

APT-C-36 has acquired domains to host malicious payloads.

APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.

APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.