Malware Infection Exposes Attackers' Toolkit, Infrastructure
A security investigation uncovered the tools and infrastructure of a Blind Eagle-linked campaign after an operator's workstation was compromised by a separate information-stealer.
An investigation into a campaign linked to the threat group Blind Eagle has inadvertently exposed the arsenal of tools and the operational infrastructure used by its operators. The breakthrough occurred when a suspected operator workstation was infected by an unrelated information-stealing malware, which then logged the attacker's own activities. This compromise provided researchers with an unprecedented look into the methods and resources employed in their operations, which primarily targeted Colombia and surrounding regions.
The campaign utilized sophisticated phishing tactics, with emails impersonating official Colombian judicial bodies and traffic authorities. These malicious messages directed victims to download password-protected archives. This technique is increasingly common, as it helps evade automated email scanning and delays detection by security systems. Analysts from LevelBlue were able to trace a GitHub commit email address, exposed through metadata, to a stolen-data log from the information-stealer. This log contained browser history, local files, and credentials from the compromised device, mapping the workflow behind the attacks.
The recovered data revealed a diverse range of remote-access tools (RATs), including AsyncRAT, DcRat, Remcos, and XWorm, suggesting the operators could easily switch payloads and delivery methods. The compromised machine also contained HTML and Word document templates designed to mimic official Colombian notices, further enhancing the phishing lures. These templates were used to trick targets into visiting malicious websites controlled by the attackers, a tactic consistent with previous Blind Eagle phishing operations.
Further analysis of the data showed the use of SendBlaster bulk-email software for sending out phishing campaigns, with logs indicating test deliveries to the same operational email address. Browser history revealed activity related to hosting services, email marketing platforms, and file storage solutions, all employed to make their malicious programs harder to detect and track. This demonstrates how attackers can maintain a consistent operational process while moving files between familiar services and refreshing their attack vectors.
The phishing chain involved a multi-step process, often beginning with a self-extracting archive that would launch VBScript and PowerShell commands. These scripts would then write malicious content into the ProgramData directory and abuse legitimate Windows utilities like InstallUtil.exe to execute malicious code. This method leverages trust in signed Windows binaries to bypass security controls, a technique also observed in other malware delivery schemes hosted on platforms like GitHub.
Researchers also identified a tracking file that correlated build labels with payload links, indicating a simple internal dispatch system for managing different malware variants. The samples contacted code repositories and cloud storage services, underscoring the risk of relying solely on the reputation of hosting providers. The findings highlight the need for organizations to be vigilant against password-protected archives, inspect file signatures carefully, and monitor for unusual script execution patterns.
Defensive priorities include flagging emails with password-protected archives where the password is provided within the email body. Security teams should also prioritize inspecting file signatures, especially when file extensions are misleading. Endpoint detection should focus on suspicious WScript or CScript activity launching PowerShell with hidden windows, scripts written to ProgramData, and AutoIt3.exe executing with unusual data files. Network controls should block or alert on known indicators of compromise and scrutinize unusual downloads from raw content services.
For organizations in Colombia, specific training and detection rules should be implemented to counter fake court notices, traffic infractions, and tax-themed messages. Users are advised to verify any unexpected official notices through known, trusted channels rather than immediately opening attachments or clicking embedded links. This incident serves as a stark reminder that attackers can leverage legitimate services and common techniques to mask their malicious activities.