Infostealer on Attacker Workstation Exposes Blind Eagle Campaign

An information stealer hit the workstation of a suspected criminal operator, exposing the complete infrastructure of a phishing campaign linked to the threat cluster known as Blind Eagle. The incident, analyzed in a LevelBlue report published by CyberSecurityNews, yielded a detailed operational map: GitHub used as a staging point, four RAT families in a local folder, phishing templates themed on Colombian judicial entities, and a multi-step execution chain that exploits signed Windows tools.

The disclosure date coincides with the report's publication. The case is significant because it reverses the direction of intelligence flow: stealer logs, normally a tool for stealing victim credentials, become a primary source of intelligence on the attacker.

Intelligence Blowback: When the Stealer Hits the Sniper

According to the cited report, "the breakthrough came after an apparent attacker workstation was infected by a separate information-stealing program, leaving a record of its activity." The exfiltrated logs ended up in the ALIEN TXTBASE collection, an aggregator of data stolen by information stealers.

GitHub commit metadata exposed an operational email address. This same address appears in the ALIEN TXTBASE collection and has been associated with a computer compromised by an infostealer dubbed 'Ghost.' Have I Been Pwned confirms the address appears in six distinct breaches. The report notes, however, that "the findings do not prove a person's identity. Instead, they map the workflow behind the attacks" — a crucial distinction separating operational intelligence from personal attribution.

The compromised machine revealed an ecosystem of criminal tools archived with near-industrial organization. The SendBlaster bulk-email software was configured with an external relay; logs showed a test delivery sent to the same operational address exposed in the GitHub metadata. A local tracking file paired build labels with payload links, documenting systematic distribution management.

The Delivery Chain: From Protected Archives to InstallUtil.exe

The kill chain reconstructed by the report unfolds in five stages. A self-extracting archive — typically password-protected and delivered via email — extracts a VBScript. The script launches PowerShell in hidden mode, which writes the payload to a ProgramData subdirectory. From there, execution passes to InstallUtil.exe, a legitimate .NET Framework tool used to install and uninstall server components.

The use of InstallUtil.exe as a LOLBin is particularly relevant for defenses: the file is Microsoft-signed, carries high reputation in whitelist-based security systems, and its execution does not trigger reputation-based alerts. Detection therefore requires behavioral analysis — monitoring the parent-child process chain (self-extracting archive → VBScript → PowerShell → .NET utility) rather than verifying a single digital signature.

The GitHub repositories 'comicsam' and 'jacobo' served as temporary hosting. The architecture separated the AutoIt interpreter from the actual script, a technique that complicates static analysis and hinders automatic signature generation. Payloads were accessible via raw.githubusercontent, leveraging HTTPS and GitHub's domain reputation to evade network filters.

Colombian Templates and RAT Rotation

The 'Rats' folder contained builds and artifacts from four remote access trojan families: AsyncRAT, DcRat, Remcos, and XWorm. The simultaneous presence of multiple RATs, as the report notes, "suggests the operator could swap payloads rather than relying on a single malware family or delivery route." This flexibility indicates a structured operation, not a script kiddie with a single tool.

Phishing templates found on the machine mimicked Colombian judicial and traffic authority entities. The associated domains — consultanotificacionesjuridicas[.]site and simpmit[.]co — were crafted to imitate official notification channels. The social engineering model exploits the psychological pressure exerted by seemingly government communications, a recurring pattern in campaigns targeting Latin America.

The report does not specify how many targets actually received or opened these messages. The templates were recovered from the compromised workstation, but it is not documented whether they were deployed in production or remain in a preparation phase.

The WebDAV Context: Parallel Techniques and CVE-2025-33053

The Blind Eagle case fits into a broader technical context. CVE-2025-33053, a WebDAV vulnerability with a CVSS score of 8.8 according to the National Vulnerability Database, was patched by Microsoft in June 2025 and appears in CISA's Known Exploited Vulnerabilities catalog with two operational dates: addition on June 10, 2025, and a mandatory action deadline of July 1, 2025. The underlying technique — external control of file paths in WebDAV — was subject to in-depth analysis by Rapid7 on a separate exposed server.

Rapid7 retrieved 1,048 files from a WebDAV server functioning as a malware delivery lab, including 11 test samples for CVE-2025-33053 and 59 .url files for testing alternatives to iediagcmd.exe. The Rapid7 report, referencing a different incident (targeting Mexico, not Colombia), shows comparable methodologies: legitimate platforms used as staging points, systematic vulnerability testing, and — per the direct quote — an operator who "used LLMs to operate more like a modern software product team." This methodological convergence across different actors and targets suggests a diffusion of practices rather than a single chain of command.

No direct evidence emerges, however, that CVE-2025-33053 was employed in the specific Colombian campaign. The vulnerability remains correlated technical context, not a link in the Blind Eagle chain.

"Organizations should flag messages carrying password-protected archives when the password appears in the email body." — CyberSecurityNews/LevelBlue report

Why It Matters

The cited report does not document specific remedial measures for targeted organizations. It does not specify the exact nature of exfiltrated data beyond metadata and folder structure. It does not clarify whether the stealer infection on the attacker's workstation resulted from operational error — opening a malicious attachment, executing an unverified file — or intentional targeting by another criminal operator.

The dossier also does not provide a complete campaign timeline: start date, escalation phases, any pauses or reactivations remain unreconstructable from the exposed data. The real identity of the operator behind the 'cabeto850128' account is unproven, and the precise relationship between this operator and the Blind Eagle threat cluster is not explicitly stated by the source.

The report indicates one verifiable action: organizations should flag messages carrying password-protected archives when the password appears in the email body. This pattern — a password in clear text within the message — is an indicator of phishing with a self-extracting archive. The recommendation applies to the email channel, not to systems or endpoints.

For security teams, the case illustrates a broader principle: detection of LOLBins like InstallUtil.exe requires telemetry on the parent-child process chain, not just file reputation. For the threat intelligence sector, it confirms that stealer logs — aggregated, correlated, verified — can degrade attacker operational security at marginal cost compared to traditional HUMINT or SIGINT sources.

Questions and Answers

Does the report prove who the attacker is?

No. The report explicitly states the findings "do not prove a person's identity." The analysis stops at mapping the operational workflow: tools, platforms, techniques, and infrastructure.

Were the RATs found used in real attacks?

Not documented. Builds and artifacts were recovered from the 'Rats' folder, but the report does not confirm they were actually deployed against victims. They could be test, development, or backup builds.

Was GitHub compromised in this incident?

No. GitHub was used as a legitimate hosting platform. The 'cabeto850128' account created public or accessible repositories to host loader components. The platform itself suffered no intrusion.

Sources

• https://cybersecuritynews.com/hackers-own-malware-infection/
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html
• https://thehackernews.com/2026/06/threatsday-bulletin-worm-code-leaked-ai.html
• https://www.cybersecuritydive.com/news/iran-cyberattacks-espionage-us-israel-uae/820990/
• https://thehackernews.com/2026/03/threatsday-bulletin-pqc-push-ai-vuln.html
• https://nvd.nist.gov/vuln/detail/CVE-2025-33053
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/
• https://thehackernews.com/2025/06/microsoft-patches-67-vulnerabilities.html
• https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html

Information is based on the cited source and current as of publication.

Sources