Full Report
This is a collaborative follow-up to our original post, developed jointly with Emmanuel C., an independent security researcher not affiliated with LevelBlue, who contributed additional infrastructure and tooling findings based on an analysis of the same GitHub staging account.
Analysis Summary
# Threat Actor: Blind Eagle (APT-C-36)
## Attribution & Identity
* **Actor Identification:** Blind Eagle (also tracked as APT-C-36).
* **Associated Identification:** The investigation linked the actor to the GitHub account `cabeto850128` via commit metadata containing a specific email address.
* **Operational Security (OPSEC) Note:** The actor's workstation was reportedly compromised by an unrelated commodity infostealer, leading to the leak of their credentials and tools in a collection known as "ALIEN TXTBASE."
## Activity Summary
The actor was observed using GitHub as a staging platform for malware loaders to evade detection by leveraging a legitimate service. While the account was created in November 2024, it showed a significant spike in activity starting in May 2026. The actor utilized phishing campaigns featuring judicial and traffic violation lures to deliver Remote Access Trojans (RATs) and information stealers.
## Tactics, Techniques & Procedures
* **Phishing:** Use of judicial notification lures and traffic violation themes (HTML templates).
* **Staging on Legitimate Services:** Utilizing GitHub repositories (`comicsam`, `jacobo`) to host malicious payloads and loaders.
* **Evasion:** Frequent use of crypters and "FUD" (Fully Undetectable) tools to bypass antivirus signatures.
* **Archive Exploitation:** Delivering payloads via SFX RAR archives containing VBScripts.
* **Persistence/Execution:** Use of VBScript and LNK files to initiate the infection chain.
**MITRE ATT&CK IDs:**
* **T1566.001:** Phishing: Spearphishing Attachment
* **T1102.002:** Web Service: Bidirectional Communication (GitHub staging)
* **T1204.002:** User Execution: Malicious File
* **T1059.005:** Command and Scripting Interpreter: Visual Basic
## Targeting
* **Sectors:** Legal/Judicial, Transportation/Government (implied by lure themes). Historically, Blind Eagle targets financial and government institutions.
* **Geography:** Primarily South America (specifically Colombia and Ecuador, based on historical activity and the Spanish-language lures identified).
* **Victims:** General users and organizations susceptible to judicial and traffic-themed social engineering.
## Tools & Infrastructure
* **Malware/RATs:** Blind Eagle traditionally uses AsyncRAT, NjRAT, and various commodity infostealers.
* **Tools:** RAT-building software, bulk-email senders, and phishing HTML templates.
* **Infrastructure:**
* `cabeto850128[.]github[.]io` (Malware staging)
* `consultanotificacionesjuridicas[.]site` (Phishing domain)
* `simpmit[.]co` (Phishing domain - traffic violation theme)
* GitHub Repositories: `comicsam`, `jacobo`, `test`
## Implications
Blind Eagle continues to be a persistent threat in the LATAM region. Their shift toward using legitimate infrastructure like GitHub for staging reflects a broader trend of "living off trusted sites" to bypass traditional perimeter security. The exposure of their own workstation via a stealer log highlights that even advanced threat actors are susceptible to commodity malware, providing a unique window into their development and distribution cycle.
## Mitigations
* **Network Filtering:** Monitor or restrict access to GitHub's raw content domains (`raw.githubusercontent.com`) if not required for business operations.
* **Email Security:** Implement advanced phishing protection to identify and block ZIP/RAR attachments containing VBScript or LNK files.
* **Endpoint Defense:** Deploy EDR solutions capable of detecting script-based execution (e.g., `wscript.exe` or `cscript.exe`) initiating network connections.
* **User Training:** Educate employees on identifying Spanish-language social engineering lures related to legal or traffic summons.