A malware investigation has exposed the tools and infrastructure used by suspected operators behind a Blind Eagle-linked campaign targeting Colombia and the wider region.
The break came after an apparent attacker workstation was infected by a separate information-stealing program, leaving a record of its activity.
The operation used phishing emails impersonating Colombian judicial bodies and traffic authorities.
Victims were directed to password-protected archives, a technique also seen in recent password-protected archive attacks that can reduce automated email scanning and delay detection.
LevelBlue said in a report shared with Cyber Security News (CSN) that its analysts traced a GitHub commit email address to a stolen-data log.
The recovered material showed browser history, local folders and credentials from a device associated with the campaign’s operational trail.
The findings do not prove a person’s identity. Instead, they map the workflow behind the attacks, showing how phishing content, remote-access malware, email delivery tools and file-hosting services can become a repeatable system.
Hackers’ Own Malware Infection
The investigation began with the GitHub account cabeto850128, which staged parts of a loader by separating a legitimate AutoIt interpreter from its script logic.
Commit metadata exposed an email address, providing a starting point without breaking into an account or decoding the malware.
That address appeared in the ALIEN TXTBASE stealer-log collection and was independently associated with an infostealer-compromised computer named “Ghost.”
A stealer log can capture saved browser data and local files, offering an unusual look at material attackers normally keep out of sight.
A folder labelled Rats contained builds and artifacts linked to several remote-access tools, including AsyncRAT, DcRat, Remcos and XWorm.
The collection suggests the operator could change payloads, instead of depending on one malware family or delivery route. The machine also held HTML and Word templates copying Colombian judicial and traffic-notice themes.
Those lures pushed recipients to sites controlled by the operation, echoing earlier Blind Eagle phishing activity in which official-looking notices persuaded targets to run malicious files.
Other traces showed the work behind a campaign. SendBlaster bulk-email software had an external relay and recorded a test delivery to the same operational email address.
Browser history showed activity involving hosting, email marketing, file storage and services designed to make programs harder to detect.
Those details matter because a GitHub repository may be only one visible piece of an attack. The operation can move files between familiar services, use new domains, and refresh lures while keeping its basic process intact.
Phishing Chain and Defensive Priorities
The verified samples used a multi-step chain. A self-extracting archive launched VBScript and hidden PowerShell, wrote script content into ProgramData, then reached InstallUtil.exe, a signed Windows utility that can be abused to run malicious code.
This resembles GitHub-hosted malware delivery methods that exploit trust in developer platforms. Researchers also found a tracking file pairing build labels with payload links, pointing to a simple internal dispatch system.
Related samples contacted code repositories and cloud storage, illustrating why a reputable hosting name alone is not a reliable safety signal.
Organizations should flag messages carrying password-protected archives when the password appears in the email body.
They should also inspect file signatures rather than trusting extensions, particularly when supposed document, HTML or VBS files are actually archives or executable containers.
Security teams should investigate WScript or CScript launching PowerShell with hidden-window and execution-policy-bypass options.
InstallUtil.exe started after PowerShell or a script host, scripts written to ProgramData, and AutoIt3.exe running with unusual data files are useful endpoint signals.
Network controls should block or alert on the listed indicators and examine unusual downloads from raw-content services.
The report advises against relying only on domain reputation, a lesson reinforced by trusted-platform malware abuse where attackers use legitimate services as temporary delivery points.
For Colombian organizations, training and detection rules should cover fake court notices, traffic infractions and tax-themed messages.
A user receiving an unexpected notice should verify it through a known official channel, rather than opening an attached archive or following its embedded link.
Indicators of compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
Click Here For The Original Source.
