An unexpected malware infection has thrown hackers into the spotlight, exposing tools, infrastructure, and phishing materials connected to a Blind Eagle-linked campaign targeting Colombia. The breakthrough came when a separate info-stealing program compromised an attacker’s workstation, leaving enough digital footprints for investigators to follow the operation’s trail.
Inside the Attack Chain
Phishing emails pretending to be from Colombian judicial bodies and traffic authorities were central to the attack. Recipients were urged to open password-protected archive files—a tactic that evades automated scanning and often slows down detection efforts. These archives, once accessed, unleashed a chain of malicious actions: self-extracting archives, VBScript and hidden PowerShell components, file writes into ProgramData, and ultimately the misuse of InstallUtil.exe, a signed Windows utility, to launch malware.
The cybercriminals employed modular remote-access tools (RATs) such as AsyncRAT, DcRat, Remcos, and XWorm. On the attacker’s machine, not just build artifacts but phishing templates mimicking judicial and traffic violation notices made use of email lures to direct targets to attacker-controlled sites. Bulk-email software like SendBlaster was also part of the mix, serving at least test message deliveries to the operation’s own email addresses—indicating tight internal testing or staging.
Operational Slip-Ups Illuminate the Infrastructure
A GitHub account under the handle cabeto850128 was leveraged to stage parts of the malware—particularly by separating a legitimate AutoIt interpreter from malicious script logic. Commit metadata from that repository exposed an email address that turned up repeatedly in stolen data logs and in association with a compromised computer dubbed “Ghost,” giving analysts a rare peek into the inner mechanics of the campaign.
Logs taken from infostealer activity revealed browser histories, saved credentials, and local file system content. Threat researchers also found HTML and Word templates styled to look like official Colombian notices, alongside deliverables hosted on services such as GitHub, cloud storage platforms, and raw-content endpoints. Multiple domains—some under cloud services or using transient hosting methods—were flagged for serving payloads or acting as command-and-control nodes.
What Security Teams Should Watch For
Signs of these operations may include suspicious password-protected archives mentioned in email bodies, mislabelled files with executable content, and scripts launched via WScript or CScript that trigger hidden PowerShell instances or bypass execution policies. InstallUtil.exe, AutoIt3.exe, and unusual script files dropped into ProgramData are red flags. Networking indicators include requests to domain names with raw hosting content or relay services, especially for RAT command-and-control or dropper payloads.
Organizations affected by Blind Eagle-type campaigns—particularly in Colombia—need to strengthen detection rules around fake notice lures, implement stricter validation of attachments, and avoid relying on domain reputation alone. Training end users to verify messages from official notices through independent channels is also critical.
Indicators of Compromise (IoCs): key staging repositories under cabeto850128 on GitHub; payload URL paths via raw.githubusercontent entries; RAT command-and-control domains like dccomicrat81[.]duckdns.org; phishing domains mimicking governmental or traffic agencies; dropper files with invoice or PDF-themed names; and alternate storage usage across Bitbucket or AWS S3.
This case demonstrates how threat actors’ own operational slip-ups—like infected workstations and exposed metadata—can become a treasure trove for defenders seeking to understand and disrupt malware infrastructure.
Why It Matters: The exposure of Blind Eagle’s infrastructure could cripple its phishing reach and RAT deployment. It highlights the value of threat intelligence that connects artifacts across platforms. What to watch now: whether exposed domains are taken down, how other strain variants adapt their delivery chains, and how quickly organizations update rules to flag indicators like password-protected attachments or misused executable tools.
