APT-C-13

Executive Summary

APT-C‑13, also known as APT‑C‑36 or Blind Eagle, is a state‑backed adversary that uses spear phishing with malicious .url files and WebDAV abuse to deliver remote access trojans and command‑and‑control infrastructure. The group rapidly adapts zero‑day exploits, leverages nested SSH/Tor tunnels, and maintains persistence through disguised scheduled tasks, targeting a wide spectrum of sectors across the Middle East, North Africa, and beyond.

Goals & Targeting

The primary objective of APT‑C‑13 is global cyber espionage, securing intelligence from governments, critical infrastructure, defense contractors, and research organizations. The group targets sectors that can yield geopolitical leverage or economic advantage, including energy, telecommunications, finance, healthcare, and advanced manufacturing. By exploiting zero‑day vulnerabilities rapidly, leveraging decentralized Tor‑based C2 channels, and maintaining persistence through legitimate‑looking services, the actor seeks to remain covert while extracting actionable intelligence for state sponsors.

Key Capabilities

• Delivery via malicious .url files
• Triggering WebDAV requests for exfiltration or download notifications
• Rapid adaptation of zero‑day exploit variants within days
• Spear-phishing with malicious document attachments
• File-based malware delivery using Remote Access Trojans
• Targeting both public and private sector entities in the Middle East/North Africa
• Use of nested SSH and Tor tunnel architecture for covert communications
• Persistence via scheduled tasks masquerading as legitimate applications
• Obfuscation of Tor traffic with obfs4 protocol

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

APT‑C‑13 exhibits a pattern of rapid campaign deployment, often leveraging newly disclosed zero‑day vulnerabilities within days of public disclosure. The actor preferentially targets high‑profile government and critical infrastructure entities while also venturing into private industry where valuable data resides. Campaign lifecycles are short but intense, with evidence of 1,600+ infections from a single December 2024 deployment against Colombian institutions. Their operations maintain operational security through anonymizing techniques such as Tor hubs mapped to internal SMB/RDP services and the use of legitimate process names in scheduled tasks.

IOC Patterns

• Malicious .url file artefacts
• WebDAV request patterns used for exfiltration or notification
• CVE-2024-43451 exploitation activity
• NTLMv2 hash exposure indicators
• Spear phishing email with malicious document attachment
• Obfuscated Tor traffic using obfs4

Recommended Actions

• Apply the Microsoft patch for CVE‑2024‑43451 immediately.
• Deploy endpoint protection with heuristics for .url file execution and WebDAV access patterns.
• Implement advanced email filtering, including attachment sandboxing and spoof detection to block spear‑phishing documents.
• Monitor network traffic for anomalous WebDAV requests or outbound connections to onion domains.
• Configure scheduled task monitoring to flag tasks that mimic legitimate software (e.g., Opera GX, Dropbox).
• Utilize threat intelligence feeds for .url file indicators, Tor hidden service lists, and CVE activity.
• Conduct security awareness training emphasizing spear‑phishing detection and safe attachment handling.
• Enforce least privilege and MFA on all privileged accounts to mitigate credential compromise.

Suggested Tags