A malware investigation has exposed the tools and infrastructure used by suspected operators behind a Blind Eagle-linked campaign targeting Colombia and the wider region.

The break came after an apparent attacker workstation was infected by a separate information-stealing program, leaving a record of its activity.

The operation used phishing emails impersonating Colombian judicial bodies and traffic authorities.

Victims were directed to password-protected archives, a technique also seen in recent password-protected archive attacks that can reduce automated email scanning and delay detection.

LevelBlue said in a report shared with Cyber Security News (CSN) that its analysts traced a GitHub commit email address to a stolen-data log.

The recovered material showed browser history, local folders and credentials from a device associated with the campaign’s operational trail.

GitHub's raw commit-patch (Source - LevelBlue) — GitHub’s raw commit-patch (Source – LevelBlue)

The findings do not prove a person’s identity. Instead, they map the workflow behind the attacks, showing how phishing content, remote-access malware, email delivery tools and file-hosting services can become a repeatable system.

Hackers’ Own Malware Infection

The investigation began with the GitHub account cabeto850128, which staged parts of a loader by separating a legitimate AutoIt interpreter from its script logic.

Commit metadata exposed an email address, providing a starting point without breaking into an account or decoding the malware.

That address appeared in the ALIEN TXTBASE stealer-log collection and was independently associated with an infostealer-compromised computer named “Ghost.”

A stealer log can capture saved browser data and local files, offering an unusual look at material attackers normally keep out of sight.

Have I Been Pwned confirms the address across six breaches (Source - LevelBlue) — Have I Been Pwned confirms the address across six breaches (Source – LevelBlue)

A folder labelled Rats contained builds and artifacts linked to several remote-access tools, including AsyncRAT, DcRat, Remcos and XWorm.

The collection suggests the operator could change payloads, instead of depending on one malware family or delivery route. The machine also held HTML and Word templates copying Colombian judicial and traffic-notice themes.

Those lures pushed recipients to sites controlled by the operation, echoing earlier Blind Eagle phishing activity in which official-looking notices persuaded targets to run malicious files.

Other traces showed the work behind a campaign. SendBlaster bulk-email software had an external relay and recorded a test delivery to the same operational email address.

Browser history showed activity involving hosting, email marketing, file storage and services designed to make programs harder to detect.

Those details matter because a GitHub repository may be only one visible piece of an attack. The operation can move files between familiar services, use new domains, and refresh lures while keeping its basic process intact.

Phishing Chain and Defensive Priorities

The verified samples used a multi-step chain. A self-extracting archive launched VBScript and hidden PowerShell, wrote script content into ProgramData, then reached InstallUtil.exe, a signed Windows utility that can be abused to run malicious code.

This resembles GitHub-hosted malware delivery methods that exploit trust in developer platforms. Researchers also found a tracking file pairing build labels with payload links, pointing to a simple internal dispatch system.

Related samples contacted code repositories and cloud storage, illustrating why a reputable hosting name alone is not a reliable safety signal.

Eexecution chain (Source - LevelBlue) — Eexecution chain (Source – LevelBlue)

Organizations should flag messages carrying password-protected archives when the password appears in the email body.

They should also inspect file signatures rather than trusting extensions, particularly when supposed document, HTML or VBS files are actually archives or executable containers.

Security teams should investigate WScript or CScript launching PowerShell with hidden-window and execution-policy-bypass options.

InstallUtil.exe started after PowerShell or a script host, scripts written to ProgramData, and AutoIt3.exe running with unusual data files are useful endpoint signals.

Network controls should block or alert on the listed indicators and examine unusual downloads from raw-content services.

The report advises against relying only on domain reputation, a lesson reinforced by trusted-platform malware abuse where attackers use legitimate services as temporary delivery points.

For Colombian organizations, training and detection rules should cover fake court notices, traffic infractions and tax-themed messages.

A user receiving an unexpected notice should verify it through a known official channel, rather than opening an attached archive or following its embedded link.

Indicators of compromise (IoCs):-

Type	Indicator	Description
GitHub staging repository	`github[.]com/cabeto850128/comicsam`	Repository used to host the AutoIt3 interpreter and loader payload.
GitHub staging repository	`github[.]com/cabeto850128/jacobo`	Later repository created on the same account that reused the `archivo.zip` filename with different content.
File name	`archivo.zip`	Archive name uploaded to the later GitHub repository.
Payload URL	`raw.githubusercontent[.]com/cabeto850128/comicsam/.../kiSBJ4DDvg.pif`	Raw GitHub path that delivered the payload as `installer.exe`, identified as a bare AutoIt3 executable.
Config URL	`raw.githubusercontent[.]com/cabeto850128/comicsam/.../CdBhhfa.html`	Raw GitHub path that delivered the configuration as `config.data`.
Prior staging IP	`64.89.160[.]17`	IP address associated with earlier staging activity.
C2 domain	`dccomicrat81[.]duckdns.org`	AsyncRAT command-and-control domain.
Secondary staging domain	`creainovada[.]xyz`	Domain serving per-build instruction and payload paths for multiple RAT builds.
Staging URL	`creainovada[.]xyz/instructions/Wscript.txt`	Payload-serving path observed during related sample detonation.
Alternate staging path	`bitbucket[.]org/adssgfdsg/testing/downloads/img_test.jpg`	Bitbucket-hosted path using the same bare-loader technique.
Alternate staging path	`bbuseruploads.s3.amazonaws.com/...img_test.jpg`	Pre-signed AWS S3 staging location using the `img_test.jpg` naming pattern.
Malicious dropper sample	`Ad20240730000024566F002152112200602430D-pdf.vbs`	Self-extracting RAR sample using an invoice or PDF-themed filename and unpacking to VBScript.
Phishing domain	`consultanotificacionesjuridicas[.]site`	Domain used in judicial-notification themed phishing material.
Phishing domain	`simpmit[.]co`	Domain used in traffic-violation phishing lures.
File name	`NUEVO4343.txt`	Local tracking file linking RAT build labels with delivery URLs.
File name	`caratsimithtml.txt`	Local source file containing a traffic-violation phishing template.
Crypter-related domain	`data-encoder[.]com`	Domain associated with research or purchase activity involving a commercial crypter service.
Discord storage identifier	`respaldojunio13`	Discord server name referenced as a low-cost location for file storage.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers’ Own Malware Infection Exposes Their RATs, Phishing Kits and Attack Infrastructure appeared first on Cyber Security News.