APT-C-36__2019__apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en.pdf

APT‑C‑36 (aka Blind Eagle) ran a targeted spear‑phishing campaign since April 2018 against Colombian government institutions and major corporations by sending password‑protected RARs containing MHTML macro documents that drop and persist a .NET Imminent Monitor RAT. The report details the infection chain (encrypted RAR → MHTML macro → downloader → 1.exe → Imminent payload), C2 infrastructure (mentes.publicvm.com and others), extensive IOCs (MD5s, domains, IPs), victim list, and assessed attacker provenance (Spanish locale, UTC‑4), plus recommended detection artefacts and TTP mapping.