#ParsedReport #CompletenessHigh
31-08-2026

Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader

https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-inside-the-operator-behind-blind-eagles-github-loader

Report completeness: High

Actors/Campaigns:
Blindeagle

Threats:
Remcos_rat
Fud-crypter
Cassandra_crypter_tool
Polycrypt
Asyncrat
Process_injection_technique
Lolbin_technique
Dcrat
Spear-phishing_technique

Victims:
Government institutions, Judicial institutions, Tax authorities, Traffic violation recipients

Industry:
Energy, Critical_infrastructure, Government

Geo:
Colombia, Colombian

TTPs:
Tactics: 4
Technics: 12

IOCs:
File: 11
Domain: 6
Url: 8
IP: 1

Soft:
Telegram, HubSpot, Discord, Windows Defender

Algorithms:
sha256, base64

Languages:
vbscript, powershell, visual_basic, autoit