Procedure examples

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.

APT-C-36 has used encoded and obfuscated files, images, and executables.

APT-C-36 has used junk characters to obfuscate malicious scripts.

APT-C-36 has disguised its scheduled tasks as those used by Google.

APT-C-36 has disguised malicious executables to appear as legitimate files.

APT-C-36 has used WMI to execute PowerShell.

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.

APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.

APT-C-36 has used VPNs in their operational infrastructure.

APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.

APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

APT-C-36 has used port 4050 for C2 communications.

APT-C-36 has used side-loading to execute the HijackLoader payload.

APT-C-36 has acquired domains to host malicious payloads.

APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.

APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.

APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.

APT-C-36 has staged malware implants on group-owned repositories and sites.

APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.

APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.