Hackers’ Own Malware Infection Exposes Their RATs, Phishing Kits and Attack Infrastructure

A malware investigation has exposed the tools and infrastructure used by suspected operators behind a Blind Eagle-linked campaign targeting Colombia and the wider region.

The break came after an apparent attacker workstation was infected by a separate information-stealing program, leaving a record of its activity.

The operation used phishing emails impersonating Colombian judicial bodies and traffic authorities.

Victims were directed to password-protected archives, a technique also seen in recent password-protected archive attacks that can reduce automated email scanning and delay detection.

LevelBlue said in a report shared with Cyber Security News (CSN) that its analysts traced a GitHub commit email address to a stolen-data log.

The recovered material showed browser history, local folders and credentials from a device associated with the campaign’s operational trail.

The findings do not prove a person’s identity. Instead, they map the workflow behind the attacks, showing how phishing content, remote-access malware, email delivery tools and file-hosting services can become a repeatable system.

Hackers’ Own Malware Infection

The investigation began with the GitHub account cabeto850128, which staged parts of a loader by separating a legitimate AutoIt interpreter from its script logic.

Commit metadata exposed an email address, providing a starting point without breaking into an account or decoding the malware.

That address appeared in the ALIEN TXTBASE stealer-log collection and was independently associated with an infostealer-compromised computer named “Ghost.”

A stealer log can capture saved browser data and local files, offering an unusual look at material attackers normally keep out of sight.

A folder labelled Rats contained builds and artifacts linked to several remote-access tools, including AsyncRAT, DcRat, Remcos and XWorm.

The collection suggests the operator could change payloads, instead of depending on one malware family or delivery route. The machine also held HTML and Word templates copying Colombian judicial and traffic-notice themes.

Those lures pushed recipients to sites controlled by the operation, echoing earlier Blind Eagle phishing activity in which official-looking notices persuaded targets to run malicious files.

Other traces showed the work behind a campaign. SendBlaster bulk-email software had an external relay and recorded a test delivery to the same operational email address.

Browser history showed activity involving hosting, email marketing, file storage and services designed to make programs harder to detect.

Those details matter because a GitHub repository may be only one visible piece of an attack. The operation can move files between familiar services, use new domains, and refresh lures while keeping its basic process intact.

Phishing Chain and Defensive Priorities

The verified samples used a multi-step chain. A self-extracting archive launched VBScript and hidden PowerShell, wrote script content into ProgramData, then reached InstallUtil.exe, a signed Windows utility that can be abused to run malicious code.

This resembles GitHub-hosted malware delivery methods that exploit trust in developer platforms. Researchers also found a tracking file pairing build labels with payload links, pointing to a simple internal dispatch system.

Related samples contacted code repositories and cloud storage, illustrating why a reputable hosting name alone is not a reliable safety signal.

Organizations should flag messages carrying password-protected archives when the password appears in the email body.

They should also inspect file signatures rather than trusting extensions, particularly when supposed document, HTML or VBS files are actually archives or executable containers.

Security teams should investigate WScript or CScript launching PowerShell with hidden-window and execution-policy-bypass options.

InstallUtil.exe started after PowerShell or a script host, scripts written to ProgramData, and AutoIt3.exe running with unusual data files are useful endpoint signals.

Network controls should block or alert on the listed indicators and examine unusual downloads from raw-content services.

The report advises against relying only on domain reputation, a lesson reinforced by trusted-platform malware abuse where attackers use legitimate services as temporary delivery points.

For Colombian organizations, training and detection rules should cover fake court notices, traffic infractions and tax-themed messages.

A user receiving an unexpected notice should verify it through a known official channel, rather than opening an attached archive or following its embedded link.

Indicators of compromise (IoCs):-

Type	Indicator	Description
GitHub staging repository	github[.]com/cabeto850128/comicsam	Repository used to host the AutoIt3 interpreter and loader payload.
GitHub staging repository	github[.]com/cabeto850128/jacobo	Later repository created on the same account that reused the archivo.zip filename with different content.
File name	archivo.zip	Archive name uploaded to the later GitHub repository.
Payload URL	raw.githubusercontent[.]com/cabeto850128/comicsam/.../kiSBJ4DDvg.pif	Raw GitHub path that delivered the payload as installer.exe, identified as a bare AutoIt3 executable.
Config URL	raw.githubusercontent[.]com/cabeto850128/comicsam/.../CdBhhfa.html	Raw GitHub path that delivered the configuration as config.data.
Prior staging IP	64.89.160[.]17	IP address associated with earlier staging activity.
C2 domain	dccomicrat81[.]duckdns.org	AsyncRAT command-and-control domain.
Secondary staging domain	creainovada[.]xyz	Domain serving per-build instruction and payload paths for multiple RAT builds.
Staging URL	creainovada[.]xyz/instructions/Wscript.txt	Payload-serving path observed during related sample detonation.
Alternate staging path	bitbucket[.]org/adssgfdsg/testing/downloads/img_test.jpg	Bitbucket-hosted path using the same bare-loader technique.
Alternate staging path	bbuseruploads.s3.amazonaws.com/...img_test.jpg	Pre-signed AWS S3 staging location using the img_test.jpg naming pattern.
Malicious dropper sample	Ad20240730000024566F002152112200602430D-pdf.vbs	Self-extracting RAR sample using an invoice or PDF-themed filename and unpacking to VBScript.
Phishing domain	consultanotificacionesjuridicas[.]site	Domain used in judicial-notification themed phishing material.
Phishing domain	simpmit[.]co	Domain used in traffic-violation phishing lures.
File name	NUEVO4343.txt	Local tracking file linking RAT build labels with delivery URLs.
File name	caratsimithtml.txt	Local source file containing a traffic-violation phishing template.
Crypter-related domain	data-encoder[.]com	Domain associated with research or purchase activity involving a commercial crypter service.
Discord storage identifier	respaldojunio13	Discord server name referenced as a low-cost location for file storage.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers’ Own Malware Infection Exposes Their RATs, Phishing Kits and Attack Infrastructure appeared first on Cyber Security News.