12 minhigh
Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader
LevelBlue SpiderLabs traced a Blind Eagle GitHub staging account (cabeto850128) to an operator email address exposed in commit metadata. That email appeared in stealer logs from an unrelated infostealer infection on the operator's own workstation (hostname 'Ghost'). The recovered stealer log revealed a full operational toolkit: multiple RAT build folders, phishing templates impersonating Colombian government institutions, configured bulk-email software (SendBlaster), commercial crypter purchases, and an internal dispatch file tracking seven RAT variants against delivery URLs. The malware execution chain uses SFX RAR droppers, VBScript, encoded PowerShell, and InstallUtil.exe as a LOLBin, with AsyncRAT C2 over DuckDNS infrastructure.
Sens:▲ 24h
Showing defanged values
- domainconsultanotificacionesjuridicas[.]sitePhishing domain used in judicial notification lure templates impersonating Colombia's Consejo Superior de la Judicatura. Templates stored locally on operator's compromised workstation.
- domaincreainovada[.]xyzSecondary staging domain hosting per-build instruction payloads for at least 7 RAT variants. Confirmed live during sample detonation returning 200 OK for payload files.
- domaindata-encoder[.]comCommercial 'FUD Crypter 2024' service researched by the operator to lower AV detection rates of malicious payloads.
- domaindccomicrat81[.]duckdns[.]orgAsyncRAT C2 domain resolved via DuckDNS. Hostname combines 'comic' (echoing comicsam GitHub repo) with 'rat' (echoing DcRat family), linking staging account to operational infrastructure.
- domaindsttbid[.]comSMTP relay server configured in SendBlaster bulk-email application on the operator's workstation. Used for phishing campaign delivery on port 587 with SSL.
- domainsimpmit[.]coPhishing domain used in traffic violation lure impersonating Bogotá's Secretaría Distrital de Movilidad. Linked directly from HTML phishing template stored on operator's machine.
- emailcabeto850128[@]gmail[.]comOperator email address exposed in GitHub commit metadata for the cabeto850128 account. Appeared in ALIEN TXTBASE stealer logs and was used as a test recipient in SendBlaster bulk email configuration.
- filenameAd20240730000024566F002152112200602430D-pdf.vbsMalicious SFX RAR dropper sample with invoice/PDF-themed filename. Unpacks to VBScript that initiates the multi-stage execution chain.
- ip181[.]53[.]99[.]51IP address of the operator's compromised workstation (hostname 'Ghost'), identified from the stealer log archive filename [CO]181.53.99.51.rar.
- ip64[.]89[.]160[.]17Prior staging IP address associated with the operator's infrastructure from the original investigation.
Detection / Hunteropenrouter
What Happened
Researchers discovered that a person running malware campaigns against Colombian targets had their own computer infected by a different information-stealing virus. That infection exposed the operator's files, including ready-to-use phishing templates disguised as government notices, multiple remote access trojan (RAT) building tools, bulk email software for sending phishing messages, and evidence of paid subscriptions to tools that make malware harder for antivirus software to detect. The operator had been using GitHub and other trusted cloud services to store malware components in a way that blends in with legitimate traffic. Organizations in Colombia or with Colombian users should be alert to phishing emails about judicial notifications or traffic violations that ask recipients to download password-protected files on a Windows computer.
Key Takeaways
- An operator linked to Blind Eagle was exposed after their own workstation was compromised by an unrelated infostealer, revealing RAT build folders, phishing templates, bulk-email software, and crypter purchases.
- The operator abuses trusted cloud platforms (GitHub, Bitbucket, AWS S3, Discord) as bare-file CDNs to stage loader components, splitting the AutoIt interpreter from script logic to avoid detection.
- The execution chain uses living-off-the-land binaries: SFX RAR dropper launches VBScript, which invokes PowerShell with a Base64-encoded payload, ultimately landing in InstallUtil.exe for process injection.
- A single internal dispatch file (NUEVO4343.txt) tracked at least seven RAT build variants (AsyncRAT, DcRat, Remcos, XWorm, NJRat, QuasarRAT) against delivery URLs on creainovada.xyz.
- The operator researched and purchased commercial crypters (MI6 Crypter, FUD Crypter) and .NET obfuscation tools (Cassandra Protector) to lower AV detection rates.
Affected Systems
- Windows endpoints targeted via SFX RAR droppers and VBScript/PowerShell execution chains
- Colombian government and judicial institution impersonation targets (Consejo Superior de la Judicatura, Secretaría Distrital de Movilidad, DIAN)
- Organizations with Colombian business units or users receiving judicial notification or traffic violation themed phishing
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email impersonating Colombian judicial or traffic violation institutions delivers password-protected SFX RAR archive
- Execution: SFX RAR dropper unpacks VBScript which launches PowerShell with Base64-encoded payload using -WindowStyle Hidden and -ExecutionPolicy Bypass
- Persistence/Staging: PowerShell copies a second .vbs file into %ProgramData% and executes a second wscript/PowerShell pass
- Defense Evasion: Execution lands in InstallUtil.exe, a signed .NET utility abused for process injection because it is trusted by default
- Command and Control: AsyncRAT establishes SSL-based C2 connection to dccomicrat81.duckdns.org using certificate fingerprint consistent with AsyncRAT
- Resource Development: Operator maintains multiple RAT variants (AsyncRAT, DcRat, Remcos, XWorm, NJRat) staged across GitHub, Bitbucket, AWS S3, and creainovada.xyz
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No formal detection rules are provided. The article offers behavioral detection guidance in prose form covering email gateway, endpoint process monitoring, and network alerting recommendations.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The execution chain involves wscript.exe spawning powershell.exe with hidden window and bypass flags, followed by InstallUtil.exe execution. These process relationships are visible to most EDR products. However, the use of trusted cloud CDNs (GitHub, Bitbucket, S3) for initial staging may not trigger endpoint alerts without specific URL-based rules. |
| Network Visibility | Medium | C2 traffic to DuckDNS domains and staging traffic to creainovada.xyz are detectable via proxy or DNS logs. However, payload retrieval from raw.githubusercontent.com, bitbucket.org, and s3.amazonaws.com blends with legitimate traffic and requires content inspection rather than domain reputation alone. |
| Detection Difficulty | Moderate | The LOLBin chain (wscript → PowerShell → InstallUtil) produces high-fidelity process telemetry that is straightforward to alert on. The difficulty increases for staging detection because the operator rotates across multiple trusted cloud platforms, requiring content-based inspection rather than domain blocklists. |
Required Log Sources
- Windows Security event logs (process creation, Sysmon Event ID 1)
- PowerShell script block logging (Event ID 4104)
- DNS query logs
- Web proxy logs with URL and user-agent fields
- Email gateway logs with attachment inspection
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for wscript.exe or cscript.exe spawning powershell.exe with -WindowStyle Hidden and -ExecutionPolicy Bypass flags, as this combination is rarely seen in legitimate scripting and indicates the documented execution chain. | Sysmon Event ID 1 (Process Creation) or EDR process telemetry with command-line arguments | Execution | Low. Legitimate administrative scripts rarely combine both hidden window and bypass flags simultaneously. |
| Consider hunting for InstallUtil.exe executing with a parent process of powershell.exe or wscript.exe, as InstallUtil is not commonly invoked directly by end users and its appearance in this ancestry chain indicates process injection activity. | Sysmon Event ID 1 (Process Creation) with parent-child process relationships | Defense Evasion | Low to Medium. Software deployment tools may legitimately invoke InstallUtil, but not typically from a scripting host parent. |
| Consider hunting for script files (.vbs, .ps1) being written to %ProgramData% by wscript.exe or an Office process, as the documented chain copies a second-stage VBScript to this location. | Sysmon Event ID 11 (FileCreate) or EDR file write telemetry | Execution | Low. %ProgramData% is not a standard location for script creation by scripting host processes. |
| Consider hunting for AutoIt3.exe executing alongside non-standard data files with extensions like .html or .data, as the operator splits the interpreter from script logic using mislabeled file extensions. | EDR process-file access telemetry or Sysmon Event ID 7 (Image Loaded) for AutoIt3.exe | Execution | Medium. Legitimate AutoIt applications exist, but pairing with mislabeled data files is atypical. |
| Consider hunting for DNS queries to *.duckdns.org domains from endpoint processes, particularly wscript.exe or powershell.exe, as this actor and similar commodity RAT operators rely on DuckDNS for C2 resolution. | DNS query logs or EDR DNS telemetry with process context | Command and Control | Medium. DuckDNS is a legitimate dynamic DNS service used by hobbyists and home labs. |
Control Gaps
- Domain reputation-based web filtering will not catch payloads hosted on raw.githubusercontent.com, bitbucket.org, or s3.amazonaws.com without content inspection
- Attachment scanning may be bypassed by password-protected archives where the password is delivered in the email body
- File extension-based filtering will miss SFX RAR archives disguised as .vbs or .pdf files without magic-byte inspection
- Standard AV signatures may be evaded by commercial crypters applied to payload binaries before delivery
Key Behavioral Indicators
- Process ancestry: wscript.exe → powershell.exe → InstallUtil.exe
- PowerShell execution with both -WindowStyle Hidden and -ExecutionPolicy Bypass flags
- Script file creation in %ProgramData% by scripting host processes
- AutoIt3.exe interpreter executing with non-standard data file extensions (.html, .data, .pif)
- Inbound email containing password-protected archive with password in message body
- Files with .vbs or .pdf extensions that have RAR archive magic bytes
False Positive Assessment
Low. The process chain (wscript → PowerShell with hidden/bypass → InstallUtil) is highly specific and rarely seen in legitimate activity. DuckDNS domains and trusted CDN staging paths carry moderate FP risk individually, but the combination of indicators provides strong correlation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the C2 domain dccomicrat81.duckdns.org and staging domain creainovada.xyz at your DNS resolver, proxy, and firewall layers.
- Consider blocking or alerting on the phishing domains consultanotificacionesjuridicas.site and simpmit.co at email gateway and web proxy layers.
- If your EDR supports indicator blocking, consider adding the identified staging URLs on raw.githubusercontent.com/cabeto850128/, bitbucket.org/adssgfdsg/, and creainovada.xyz paths to blocklists.
- Consider searching email gateway and proxy logs for the identified IOCs to identify potential existing compromises.
Infrastructure Hardening
- Evaluate whether egress filtering can restrict endpoint connections to raw.githubusercontent.com and similar raw content domains, or at minimum alert on scripting processes (wscript.exe, powershell.exe) initiating those connections.
- Consider implementing content inspection (magic-byte validation) on downloaded files rather than relying on file extension or domain reputation alone, particularly for trusted cloud storage platforms.
- If applicable to your email infrastructure, consider flagging or blocking inbound mail containing password-protected archives where the extraction password is included in the message body.
- Consider elevated scrutiny for DuckDNS-registered domains in DNS and proxy logs, given their frequent abuse by commodity RAT operators for C2.
User Protection
- Consider deploying EDR detection rules for the wscript.exe → powershell.exe → InstallUtil.exe process chain if your platform supports custom process ancestry rules.
- If your EDR supports host isolation, consider preparing isolation playbooks for endpoints that match the documented LOLBin execution chain.
- Evaluate whether your AV solution can perform magic-byte inspection on files with .vbs, .pdf, or .html extensions to detect disguised SFX RAR archives.
Security Awareness
- For organizations with Colombian users or business units, consider incorporating specific awareness training on judicial notification, traffic violation, and DIAN tax-themed phishing lures used by this actor.
- Consider training users to report emails that instruct them to use a PC or laptop specifically, as this detail indicates the lure is designed around Windows payload execution behavior.
- Consider reminding users that legitimate government institutions do not typically deliver password-protected archives via email with the password included in the message body.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Tactic
Command and Control
Additional IOCs
- Domains:
data-encoder[.]com- Commercial 'FUD Crypter 2024' service researched by the operator to lower AV detection rates of malicious payloads.
- Urls:
raw.githubusercontent.com/cabeto850128/comicsam/.../kiSBJ4DDvg.pif- Payload URL on GitHub delivering the AutoIt3 interpreter as installer.exe. Bare file hosted on trusted CDN to evade reputation-based blocking.raw.githubusercontent.com/cabeto850128/comicsam/.../CdBhhfa.html- Config URL on GitHub delivering the loader script logic as config.data. Separated from interpreter to allow independent updates.creainovada.xyz/instructions/Wscript.txt- Payload instruction file on staging domain, confirmed returning 200 OK during sample detonation.creainovada.xyz/instructions/jnuiotodos.pdf- Delivery URL for NJRat build variant, tracked in operator's NUEVO4343.txt dispatch file.creainovada.xyz/instructions/qasart31.pdf- Delivery URL for QuasarRAT build variant, tracked in operator's NUEVO4343.txt dispatch file.creainovada.xyz/start/Rundll32.txt- Delivery URL for Remcos build variant, tracked in operator's NUEVO4343.txt dispatch file.
- File Paths:
%ProgramData%- Directory where the second-stage VBScript file is copied by the PowerShell payload during the execution chain.
- Command Lines:
- Purpose: Execute Base64-encoded PowerShell payload from VBScript dropper with hidden window and bypassed execution policy | Tools:
powershell.exe,wscript.exe| Stage: Execution |powershell.exe -w hidden -ExecutionPolicy Bypass -EncodedCommand
- Purpose: Execute Base64-encoded PowerShell payload from VBScript dropper with hidden window and bypassed execution policy | Tools:
- Other:
cabeto850128/comicsam- GitHub repository used to stage AutoIt3 interpreter and separate loader script logic files. Created May 25, 2026.cabeto850128/jacobo- Later GitHub repository created August 6, 2026, reusing archivo.zip filename with different contents. Indicates continued activity after original investigation.respaldojunio13- Discord server used by the operator as low-cost file storage for build artifacts.[email protected]- Sender email address used in judicial notification phishing template impersonating Colombian judicial institutions.