LevelBlue Blind Eagle Proton66 JUN 2025

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

APT-C-36 has acquired domains to host malicious payloads.

APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.

APT-C-36 has staged malware implants on group-owned repositories and sites.

APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.