12 minhigh
Still Circling: Blind Eagle's Toolkit Keeps Evolving
Blind Eagle (APT-C-36) has evolved its toolkit with three new obfuscation schemes, a GitHub-staged AutoIt3 RunPE loader, and a significantly upgraded AsyncRAT build codenamed JC-46 featuring WNF-based process injection, HVNC banking-fraud with browser profile cloning, and a Chrome App-Bound Encryption v20 bypass. A shared internal builder is evidenced by identical 'Photo Studio' persistence artifacts across three separately obfuscated toolchains. The group continues to rely on VBScript-to-PowerShell delivery chains and commodity RATs while selectively investing in components that directly serve banking-fraud objectives.
Sens:▲ 24hConf:
Showing defanged values
- domainrema200426[.]duckdns[.]orgJC-46 AsyncRAT C2 domain using DuckDNS; registration pattern suggests use since at least April 2020
- filenamePhotoStudio.vbsShared persistence file dropped to %LOCALAPPDATA%\PhotoStudioVBS\ across three independently obfuscated loader families; high-confidence pivot indicator
- ip178[.]16[.]52[.]80Open-directory staging server hosting the triple-language dropper (hold.bat/hold.vbs/hold.js) with custom AES S-box
- ip181[.]235[.]8[.]24Open-directory staging server hosting the custom stream-cipher loader family and JC-46 chain
- ip46[.]246[.]84[.]5Open-directory staging server for XOR-0xE0 + AES-256-ECB self-mutating VBS dropper; historically resolved AsyncRAT C2 via frootvpn.com since March 2023
- ip64[.]89[.]160[.]17Open-directory staging server hosting the AutoIt3 RunPE loader chain staged via GitHub
- sha256a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fffSHA-256 hash of Paralell.dll — JC-46 WNF process injector (.NET, CryptoObfuscator-protected)
- sha256a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4SHA-256 hash of Client1.exe — JC-46 AsyncRAT payload with HVNC, browser cloning, and Chrome ABE v20 bypass
- urlhxxps://raw[.]githubusercontent[.]com/cabeto850128/comicsam/refs/heads/main/CdBhhfa[.]htmlGitHub raw content URL used to download malicious AutoIt script mislabeled with .html extension
- urlhxxps://raw[.]githubusercontent[.]com/cabeto850128/comicsam/refs/heads/main/kiSBJ4DDvg[.]pifGitHub raw content URL used to download bare AutoIt3.exe interpreter renamed as .pif file
Detection / Hunteropenrouter
What Happened
A hacking group called Blind Eagle, which targets Spanish-speaking countries in Latin America, has upgraded its malicious software toolkit with new ways to hide its code from security tools. The group uses fake emails to trick people into running scripts that eventually install remote access software on their computers. The new version of their software can secretly take control of a victim's computer screen, clone their web browser to access banking sessions without the victim knowing, and bypass Google Chrome's newest protections against password theft. The group also uses GitHub, a popular code-sharing website, to deliver parts of their malware in a way that bypasses security filters. Organizations in Latin America, especially those still using older security configurations that allow scripting languages to run freely, are most at risk. Defenders should focus on monitoring for specific behavioral patterns rather than trying to keep up with the group's constantly changing file signatures, and should avoid automatically trusting downloads from GitHub.
Key Takeaways
- Blind Eagle (APT-C-36) continues targeting Latin America with three new obfuscation schemes including a hand-rolled AES-256 cipher with a non-standard S-box and RCON table that defeats standard Rijndael constant fingerprinting.
- A shared internal builder is evidenced by identical 'Photo Studio' persistence artifacts (scheduled task name, PhotoStudio.vbs, PhotoStudioVBS folder) reused byte-for-byte across three independently obfuscated toolchains.
- JC-46, a materially upgraded AsyncRAT build, introduces Windows Notification Facility (WNF) process injection via NtUpdateWnfStateData to bypass EDR CreateRemoteThread heuristics, plus a full HVNC banking-fraud module with browser profile cloning and Chrome App-Bound Encryption (ABE) v20 bypass.
- A bare AutoIt3 interpreter is staged via raw.githubusercontent.com, separating the clean-signed interpreter from the malicious script to evade hash-based detection.
- File hashes for the self-mutating dropper family are worthless beyond a single execution due to on-disk re-encryption and identifier randomization on every run.
Affected Systems
- Windows systems with VBScript and PowerShell enabled
- Chromium-based browsers (Chrome 127+, ABE v20 targeted)
- Windows environments with legacy scripting hosts enabled by default
- Spanish-language Windows environments (Colombian and broader Latin American targets)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Spanish-language phishing delivers VBScript dropper (envifa.vbs, 31agosto.vbs, hold.vbs, or System3.vbs) to victim
- Execution: VBScript assembles in-memory AES decryption stub in PowerShell; self-mutating variant re-encrypts and renames identifiers on each run
- Defense Evasion: Multi-layer obfuscation including custom stream cipher, hand-rolled AES-256 with non-standard S-box/RCON, or Base28 encoding to evade signature detection
- Persistence: Scheduled task 'Photo Studio' created to run PhotoStudio.vbs from %LOCALAPPDATA%\PhotoStudioVBS\ at logon
- Process Injection: Payload injected via process hollowing into RegSvcs.exe/MSBuild.exe/AppLaunch.exe/jsc.exe, or WNF-based injection via NtUpdateWnfStateData for EDR evasion
- C2 and Fraud: AsyncRAT (JC-46) establishes C2 to DuckDNS domain; HVNC module creates hidden desktop, clones browser profile for banking fraud, and deploys Spanish-language distraction overlay
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide formal detection rules but describes behavioral detection patterns in prose, including wscript/cscript spawning PowerShell, rare Microsoft binaries performing injection, AutoIt3 executing non-.au3 files from user-writable directories, and the 'Photo Studio' persistence artifacts.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Standard EDR heuristics for CreateRemoteThread-based injection will miss the WNF-based injection path. However, parent-process spoofing via STARTUPINFOEX attribute lists, process hollowing into signed Microsoft binaries, and AutoIt3 executing from user-writable directories are visible to most EDR products if configured to alert on them. |
| Network Visibility | Medium | C2 traffic to DuckDNS domains and staging server connections are visible, but the use of raw.githubusercontent.com for staging blends with legitimate traffic unless specifically correlated with subsequent execution patterns. |
| Detection Difficulty | Hard | The actor uses four-layer obfuscation, custom AES implementations, self-mutating scripts that invalidate hash IOCs, WNF injection that bypasses standard remote-thread heuristics, parent PID spoofing, and legitimate services (GitHub) for staging. Detection requires behavioral correlation across multiple telemetry sources rather than simple signature matching. |
Required Log Sources
- Windows Security Event ID 4688 (Process Creation) with command-line logging
- Windows Sysmon Event ID 1 (Process Creation) with parent process tracking
- Windows Sysmon Event ID 8 (RemoteThread Creation) — may not fire for WNF injection
- Windows Sysmon Event ID 10 (Process Access) for OpenProcess on explorer.exe
- Windows Task Scheduler operational logs for scheduled task creation
- PowerShell Script Block Logging (Event ID 4104)
- DNS resolution logs for DuckDNS domains
- EDR process telemetry with parent-child relationship tracking
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for wscript.exe or cscript.exe spawning PowerShell with inline -Command execution, particularly when followed by execution of rarely-used Microsoft signed binaries such as RegSvcs.exe, MSBuild.exe, jsc.exe, or AppLaunch.exe. | Sysmon Event ID 1 (Process Creation) and Event ID 4688 with command-line logging | Execution | Medium — legitimate administrative scripts may use similar patterns, but the specific combination of VBScript-to-PowerShell-to-rare-binary is uncommon in normal operations. |
| Consider hunting for the 'Photo Studio' scheduled task name or files written to %LOCALAPPDATA%\PhotoStudioVBS, as these persistence artifacts are shared across multiple independently obfuscated loader families. | Windows Task Scheduler operational logs, Sysmon Event ID 11 (File Creation), filesystem monitoring | Persistence | Low — the specific 'Photo Studio' / 'PhotoStudioVBS' naming pattern is a builder artifact reused across campaigns and unlikely to appear in legitimate software. |
| Consider hunting for AutoIt3.exe processes executing with non-.au3 file arguments from user-writable directories such as %TEMP% or %LOCALAPPDATA%, regardless of the file's source. | Sysmon Event ID 1 (Process Creation) with command-line and image path logging | Execution | Low to Medium — legitimate AutoIt usage typically involves .au3 extensions and standard installation paths; execution from user-writable directories with non-standard extensions is anomalous. |
| Consider hunting for processes creating extended STARTUPINFOEX attribute lists with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS pointing to explorer.exe, which indicates parent-process-ID spoofing. | EDR process telemetry, Sysmon Event ID 1 with parent process correlation | Defense Evasion | Low — legitimate applications rarely spoof parent process IDs; this is a strong indicator of malicious process injection activity. |
| Consider hunting for non-browser processes accessing Chromium profile directories (cookies, Login Data, Local State, Web Data) or invoking NCrypt/BCrypt APIs to decrypt Chrome App-Bound Encryption keys, which would indicate credential theft activity. | EDR file access monitoring, Sysmon Event ID 10 (Process Access) or Event ID 11 (File Creation) on browser profile paths, API call monitoring | Credential Access | Medium — some legitimate security or management tools may access browser profile data; correlate with process reputation and behavioral context. |
Control Gaps
- Hash-based detection is ineffective against self-mutating droppers that change their file hash on every execution
- Standard Rijndael/AES constant fingerprinting (YARA rules) will fail against the custom S-box and RCON table implementation
- EDR CreateRemoteThread-based injection heuristics will not detect WNF-based injection via NtUpdateWnfStateData
- Domain reputation controls that allow-list raw.githubusercontent.com will miss GitHub-staged payloads
- Signature-based detection of Base64 blobs will miss the custom Base28 encoding scheme
- AutoIt3.exe hash allow-listing will not flag the bare interpreter used with a separately downloaded malicious script
Key Behavioral Indicators
- wscript.exe or cscript.exe spawning powershell.exe with inline -Command parameter
- PowerShell using Add-Type to compile inline C# for process hollowing
- Rare Microsoft signed binaries (RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) spawned from scripting hosts performing process injection
- AutoIt3.exe executing from user-writable directories with non-.au3 file extensions
- Scheduled task named 'Photo Studio' with action pointing to wscript.exe and PhotoStudio.vbs
- Files written to %LOCALAPPDATA%\PhotoStudioVBS\ directory
- Parent process ID spoofing: processes with STARTUPINFOEX attribute lists using explorer.exe as parent
- Non-browser processes accessing Chromium profile files (cookies, Login Data, Local State)
- Processes invoking NCrypt/BCrypt APIs with MS_KEY_STORAGE_PROVIDER for ABE key decryption
- Hidden desktop creation via CreateDesktopW followed by explorer.exe spawning on non-default desktop
- Browser process suspension (NtSuspendProcess) followed by robocopy of profile directory
- Chrome launched with --user-data-dir pointing to non-default profile and --no-sandbox flag
- zv-prefixed identifier pattern in VBScript files indicating self-mutating dropper family
- 0xE0 XOR key constant in VBScript string decryption tables
False Positive Assessment
Low — The 'Photo Studio' persistence artifacts, zv-prefixed identifier patterns, and specific staging IPs are highly specific to Blind Eagle's builder output. Behavioral detections for wscript-to-PowerShell-to-rare-binary chains and AutoIt3 execution from user-writable directories carry slightly higher false positive risk but are uncommon in normal enterprise operations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for the 'Photo Studio' scheduled task name, %LOCALAPPDATA%\PhotoStudioVBS\ directory, and the listed staging IP addresses to identify any existing compromises.
- Consider blocking network traffic to the four identified staging servers (46.246.84.5, 181.235.8.24, 178.16.52.80, 64.89.160.17) and the C2 domain rema200426.duckdns.org at your firewall or proxy, if consistent with your network security policies.
- If your EDR supports it, consider adding monitoring or alerting rules for AutoIt3.exe executing scripts from user-writable directories with non-.au3 file extensions.
- Consider hunting for the two SHA-256 hashes (Paralell.dll and Client1.exe) across your endpoint inventory to identify any hosts already compromised with the JC-46 payload.
Infrastructure Hardening
- Evaluate whether raw.githubusercontent.com can be removed from allow-lists or have download activity correlated with subsequent process execution, particularly for non-developer endpoints.
- Consider implementing DNS monitoring or blocking for DuckDNS dynamic DNS domains if they are not used by legitimate services in your environment.
- If supported by your web filtering solution, consider inspecting downloads from code-sharing platforms for executable content regardless of the platform's reputation.
- Evaluate whether VBScript and PowerShell execution can be constrained via Constrained Language Mode or application whitelisting (e.g., AppLocker/WDAC) for non-administrative users.
User Protection
- Consider ensuring Chrome is updated to the latest version and evaluating whether additional browser security extensions that detect profile cloning or unauthorized cookie access would benefit high-risk users.
- If your EDR supports behavioral detection of credential access, consider enabling alerts for non-browser processes accessing Chromium profile directories.
- Evaluate whether Windows Defender real-time protection and tamper protection are enabled organization-wide, as the JC-46 payload attempts to disable real-time protection and add exclusions.
- Consider enabling PowerShell Script Block Logging (Event ID 4104) and Script Transcription if not already deployed, to capture inline decryption and injection payloads.
Security Awareness
- Consider reinforcing phishing awareness training for Spanish-speaking employees, emphasizing that Blind Eagle targets Latin American users with socially engineered lures.
- If applicable to your awareness program, consider educating users about the risk of browser update overlay screens that prevent interaction with the desktop, as the JC-46 HVNC module uses this technique.
- Consider reminding users not to execute unexpected script attachments or enable macro/script content in documents received via email, particularly those with Spanish-language content.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping18 techniques
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Command and Control
Additional IOCs
- File Paths:
%LOCALAPPDATA%\PhotoStudioVBS\PhotoStudio.vbs- Shared persistence path observed across three loader families; durable host indicator of builder outputC:\Users\Public\Downloads\installer.exe- Downloaded AutoIt3 interpreter renamed as installer.exe via PowerShell from GitHubC:\Users\Public\Downloads\config.data- Downloaded malicious AutoIt script mislabeled as config.data via PowerShell from GitHub
- Command Lines:
- Purpose: Download AutoIt3 interpreter and malicious script from GitHub, then execute interpreter with script as argument | Tools:
powershell.exe,Invoke-WebRequest,Start-Process| Stage: Initial Access / Staging - Purpose: Execute VBScript dropper via Windows Script Host for persistence | Tools:
wscript.exe| Stage: Persistence |wscript.exe
- Purpose: Download AutoIt3 interpreter and malicious script from GitHub, then execute interpreter with script as argument | Tools:
- Other:
Photo Studio- Scheduled task name used for persistence across three independently obfuscated loader familiesPhotoStudioVBS- Scheduled task tag/folder name for persistence, shared across multiple toolchainsC:\Users\UserPC\source\repos\JC-46\JC-46\Paralell\Paralell\bin\Debug\CryptoObfuscator_Output\Paralell.pdb- PDB path leaked in Paralell.dll build; reveals developer username (UserPC), project name (JC-46), and use of CryptoObfuscator
Related
Stay currentSubscribe via RSS