Blind Eagle’s Malware Operator Got Hacked — Researchers Found His Arsenal

• The Mess: Researchers traced Blind Eagle’s GitHub malware infrastructure to an operator workstation that had apparently been compromised by an unrelated infostealer. The stolen machine exposed RAT builders, phishing templates, crypters, bulk-mail tools and operational infrastructure.
• The Damage: The exposed workstation revealed how Blind Eagle runs its campaigns — from malware construction and phishing to payload staging and command-and-control infrastructure.
• The Fix: Monitor GitHub-based payload staging, suspicious AutoIt execution, DuckDNS connections and browser credential theft, especially in financial environments.

The malware operator was hunting victims.

Someone else was hunting him.

And the second attacker won.

Researchers from LevelBlue followed a GitHub account used by Blind Eagle, also tracked as APT-C-36, and eventually found something much more interesting than another malware sample.

They found evidence from the operator’s own workstation.

The machine appeared to have been compromised by an unrelated commodity infostealer — the same general type of malware Blind Eagle uses against its victims.

That’s how researchers got a look behind the curtain.

The GitHub Account Was Only the Beginning

Blind Eagle had been using GitHub to stage components of its malware delivery chain.

The account looked relatively ordinary.

The commit metadata wasn’t.

Researchers extracted an email address from GitHub commit information and used it as a pivot into other datasets.

That eventually led to a leaked stealer log containing information from an infected computer.

And that computer was apparently connected to the operation.

The result was a rare view of the infrastructure from the operator’s side rather than the victim’s side.

RATs Everywhere

The recovered machine contained directories for multiple remote-access trojans.

Researchers found tooling associated with malware including:

• AsyncRAT
• Remcos
• njRAT
• LimeRAT
• other RAT components

There were also builders and supporting files.

This wasn’t someone casually experimenting with malware.

The collection looked like an operational workstation used to prepare and deliver malicious campaigns.

The Phishing Factory Was There Too

The machine also contained phishing templates, bulk-email software and infrastructure information.

That matters because Blind Eagle’s operation isn’t simply:

malware → victim

It’s a production pipeline.

phishing lure → delivery → loader → RAT → credential theft → banking fraud

The recovered artifacts exposed several pieces of that pipeline.

Researchers identified infrastructure involving GitHub, Bitbucket, AWS S3 and DuckDNS.

Legitimate services were being used to make malicious traffic look less suspicious.

GitHub Became the Malware CDN

One of the more interesting techniques involved a bare AutoIt3 interpreter hosted separately from the malicious script.

The legitimate AutoIt binary could retain a known-good signature and hash.

The malicious logic arrived separately.

That gives the attacker flexibility.

Change the script.

Keep the legitimate interpreter.

Avoid repackaging the executable every time.

Blind Eagle’s recent campaigns also used GitHub-hosted components to stage payloads.

The RAT Can Hide the Banking Session

This isn’t just credential theft.

Researchers previously documented an upgraded AsyncRAT variant used by Blind Eagle with a Hidden VNC capability.

The malware can create a separate hidden Windows desktop and allow the operator to interact with it remotely.

It can also clone browser profiles containing authentication material.

That gives the attacker a way to operate inside an already authenticated banking environment without necessarily controlling the victim’s visible desktop.

That’s particularly nasty for financial targets.

The victim can be sitting in front of the computer while the attacker operates elsewhere.

Blind Eagle Keeps Changing the Loader

The group has also been rotating its obfuscation techniques.

Researchers identified multiple loader families using different encryption and obfuscation mechanisms.

One campaign used a custom JavaScript-based scheme.

Another used heavily obfuscated VBScript.

Another used AutoIt and process hollowing.

The underlying objective stayed the same:

deliver the RAT without making static detection easy.

The Operator Made One Big Mistake

Operational security.

The attacker left enough breadcrumbs across infrastructure to connect:

GitHub account → email → stealer log → infected workstation → malware tools → phishing infrastructure → C2

The irony is almost perfect.

Blind Eagle uses information-stealing malware against other people.

Then the operator’s own machine appears in someone else’s infostealer dump.

Researchers simply followed the trail.

This Is Why OPSEC Matters

Threat actors don’t need to expose their entire infrastructure in one place.

One reused email address can be enough.

One GitHub commit can be enough.

One leaked credential can be enough.

One compromised workstation can reveal years of operational history.

The malware itself may be heavily obfuscated.

The infrastructure usually isn’t.

Humans still leave breadcrumbs.

What Defenders Should Hunt

Security teams should watch for:

• suspicious AutoIt3 execution
• PowerShell-launched downloaders
• GitHub repositories used as payload staging
• unusual DuckDNS connections
• unexpected browser-profile access
• RAT-related persistence
• hidden desktop activity
• phishing infrastructure targeting financial institutions

Blind Eagle has primarily focused on Latin American targets, particularly financial organizations, with Colombia remaining a major target.

Bugstoday Opinion

There is something beautifully stupid about this incident.

Blind Eagle built an operation designed to steal other people’s credentials.

Then somebody else’s infostealer stole theirs.

The result was better threat intelligence than the attackers probably wanted to provide.

Researchers didn’t need to break into a command server.

They didn’t need to defeat the RAT.

They didn’t need a zero-day.

They followed an email address from a GitHub commit and eventually found the operator’s own digital mess.

And that mess contained the tools, templates and infrastructure behind the operation.

Bugstoday verdict: malware operators love stealing credentials because they know credentials unlock everything. The Blind Eagle case proves the same rule applies to them. Your weakest password, reused account or careless GitHub commit can become somebody else’s attack chain.

Today’s Bugs. Tomorrow’s Breaches.