Blind Eagle’s GitHub Loader Reveals a Persistent Operator

Summary

An investigation into a GitHub-based malware loader uncovered a sophisticated production pipeline operated by a threat actor likely linked to Blind Eagle. The operator abuses legitimate services including GitHub, Bitbucket, and AWS S3 to host malicious payloads and staging content. The campaign involves multiple RAT families, phishing templates targeting Colombian institutions, and commercial crypters used to improve evasion.

Investigation

The investigation began by pivoting from an email address found in GitHub commit metadata to a leaked stealer log. This exposed a compromised workstation named Ghost containing multiple RAT build directories, phishing templates, and bulk-email tooling. Analysis of the system revealed the actor’s end-to-end workflow, spanning lure development, malware preparation, and infrastructure management.

Mitigation

Defenders should configure email filtering to identify password-protected archives when the password is supplied directly in the message body. Security teams should monitor suspicious process relationships, particularly wscript.exe or cscript.exe launching hidden PowerShell sessions. Alerts should also detect unusual InstallUtil.exe execution and restrict outbound access to raw content services such as raw.githubusercontent.com.

Response

If malicious activity is detected, the affected endpoint should be isolated immediately to prevent further lateral movement or data exfiltration. Responders should hunt across the environment for known C2 domains and malicious file hashes. Email gateway logs should also be reviewed for similar judicial or tax-themed phishing lures, and credentials should be reset for users who interacted with suspicious links.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access via a spearphishing attachment. To establish persistence and prepare for process injection, the attacker uses a PowerShell script to drop a malicious payload into the %ProgramData% directory to evade standard user-profile monitoring. Following the file drop, the attacker executes InstallUtil.exe (a legitimate .NET utility) to run a malicious DLL, attempting to bypass application whitelisting by using a trusted Microsoft binary.

• Regression Test Script:

  # Simulation Script: Triggering InstallUtil and ProgramData File Write
  
  $ErrorActionPreference = "Stop"
  $TargetFile = "$env:ProgramDatamalicious_payload.ps1"
  $InstallUtilPath = "$env:SystemRootMicrosoft.NETFramework64v4.0.30319InstallUtil.exe"
  
  Write-Host "[*] Starting Detection Validation Simulation..." -ForegroundColor Cyan
  
  # Step 1: Simulate Script Writing to %ProgramData% via PowerShell (Triggers selection_scriptwriting)
  Write-Host "[*] Step 1: Dropping payload to $TargetFile" -ForegroundColor Yellow
  "Write-Host 'Malicious Payload Executed'" | Out-File -FilePath $TargetFile -Encoding ascii
  
  # Step 2: Simulate Execution of InstallUtil.exe (Triggers selection_installutil)
  # We use a dummy argument to simulate legitimate-looking usage
  Write-Host "[*] Step 2: Executing InstallUtil.exe" -ForegroundColor Yellow
  Start-Process -FilePath $InstallUtilPath -ArgumentList "/U" -Wait
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  $TargetFile = "$env:ProgramDatamalicious_payload.ps1"
  if (Test-Path $TargetFile) {
      Remove-Item $TargetFile -Force
      Write-Host "[+] Cleaned up $TargetFile" -ForegroundColor Green
  } else {
      Write-Host "[-] Target file not found, nothing to clean." -ForegroundColor Red
  }