Blind Eagle (APT-C-36) Evolved Toolkit: AsyncRAT, njRAT & LimeRAT via AutoIt RunPE and DuckDNS C2 — OTX Detection Pack

---
title: APT-C-36 RunPE Loader - Bare AutoIt3 Interpreter Execution
id: 7c1f9e2a-4b3d-4e5f-9a01-be2026a00001
status: experimental
description: Detects execution of a bare AutoIt3 interpreter with a script payload outside standard install paths, matching Blind Eagle (APT-C-36) RunPE loaders staged via GitHub during the May-July 2026 campaign
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
    - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\AutoIt3.exe'
    selection_script:
        CommandLine|contains:
            - '.au3'
            - '.a3x'
    filter_legit_path:
        Image|startswith:
            - 'C:\Program Files\AutoIt3\'
            - 'C:\Program Files (x86)\AutoIt3\'
    condition: selection_image and selection_script and not filter_legit_path
falsepositives:
    - Legitimate AutoIt automation deployed outside standard install paths
level: high
tags:
    - attack.defense_evasion
    - attack.t1059
    - attack.t1055
    - attack.t1218
---
title: Blind Eagle VBScript Dropper Spawning Execution or Injection Tooling
id: 8d2a0f3b-5c4e-4f6a-0b12-be2026a00002
status: experimental
description: Detects wscript/cscript/mshta (the VBScript dropper stage used by APT-C-36) spawning command interpreters, script engines, or the AutoIt RunPE loader
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
    - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\AutoIt3.exe'
            - '\msbuild.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legacy logon scripts and enterprise VBScript administration tooling
level: high
tags:
    - attack.t1059.005
    - attack.t1204.002
    - attack.execution
---
title: Non-Browser Process Accessing Chrome Credential Store
id: 9e3b1a4c-6d5f-4a7b-1c23-be2026a00003
status: experimental
description: Detects non-Chrome processes opening Chrome Login Data, Local State, or Cookies files, consistent with the Chrome credential theft module in Blind Eagle (APT-C-36) njRAT/AsyncRAT payloads
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
    - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\Google\Chrome\User Data\'
        TargetFilename|endswith:
            - '\Login Data'
            - '\Local State'
            - '\Cookies'
    filter_browser:
        Image|endswith: '\chrome.exe'
    condition: selection and not filter_browser
falsepositives:
    - EDR/AV scanners, backup agents, browser extension hosts. Baseline and exclude known security tooling by hash and signer.
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1539

// Blind Eagle (APT-C-36) hunt: DuckDNS C2, VBScript/AutoIt execution chain, known payload hashes
let Lookback = 14d;
let C2Hosts = dynamic(["rema200426.duckdns.org"]);
let PayloadHashes = dynamic(["a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff", "a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4"]);
let NetworkSignals = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (C2Hosts) or RemoteUrl endswith ".duckdns.org"
    | project TimeGenerated, DeviceName, SignalType = "DuckDNS_C2",
        Details = strcat(InitiatingProcessFileName, " -> ", RemoteUrl, " (", RemoteIP, ":", RemotePort, ")");
let ExecutionSignals = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "AutoIt3.exe" and ProcessCommandLine has_any (".au3", ".a3x"))
        or (InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
            and FileName in~ ("powershell.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe", "AutoIt3.exe"))
    | project TimeGenerated, DeviceName, SignalType = "Dropper_Execution",
        Details = strcat(InitiatingProcessFileName, " -> ", FileName, " | ", ProcessCommandLine);
let HashSignals = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in~ (PayloadHashes)
    | project TimeGenerated, DeviceName, SignalType = "Known_Payload_Hash",
        Details = strcat(FileName, " SHA256=", SHA256, " | parent=", InitiatingProcessFileName);
union NetworkSignals, ExecutionSignals, HashSignals
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Signals = make_set(SignalType), Evidence = make_list(Details) by DeviceName
| order by LastSeen desc;

#requires -RunAsAdministrator
<#
.SYNOPSIS
    Blind Eagle (APT-C-36) host hunt: VBScript droppers, bare AutoIt3 RunPE loader,
    DuckDNS C2 sessions, persistence artifacts, Chrome credential-theft traces.
#>
$ErrorActionPreference = 'SilentlyContinue'
$Findings = New-Object System.Collections.Generic.List[object]

function Add-Finding($Type, $Detail) {
    $script:Findings.Add([pscustomobject]@{ Host = $env:COMPUTERNAME; FindingType = $Type; Detail = $Detail })
    Write-Host "[HIT] $Type :: $Detail" -ForegroundColor Red
}

Write-Host "[*] APT-C-36 hunt on $env:COMPUTERNAME - $(Get-Date)" -ForegroundColor Cyan

# --- 1. DuckDNS C2: resolution, DNS cache, live sessions ---
$C2 = 'rema200426.duckdns.org'
$dns = Resolve-DnsName -Name $C2
if ($dns) { Add-Finding 'C2-Resolution' ($dns | Out-String).Trim() }
Get-DnsClientCache | Where-Object Entry -like '*duckdns.org*' | ForEach-Object {
    Add-Finding 'DNS-Cache' ($_.Entry + ' -> ' + $_.Data)
}
$ips = @($dns | Where-Object IPAddress | Select-Object -ExpandProperty IPAddress)
Get-NetTCPConnection -State Established | Where-Object { $ips -contains $_.RemoteAddress } | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess
    Add-Finding 'C2-Session' ($p.ProcessName + ' (PID ' + $p.Id + ') -> ' + $_.RemoteAddress + ':' + $_.RemotePort)
}

# --- 2. Persistence: Run/RunOnce keys invoking scripts or AutoIt ---
$keys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($k in $keys) {
    $props = Get-ItemProperty -Path $k
    if ($props) {
        $props.PSObject.Properties | Where-Object { $_.Value -match 'wscript|cscript|mshta|\.vbs|\.js|AutoIt3|\.au3|duckdns|AppData|Temp' } | ForEach-Object {
            Add-Finding 'Persistence-Registry' ($k + ' :: ' + $_.Name + ' = ' + $_.Value)
        }
    }
}

# --- 3. Scheduled tasks invoking script interpreters (Photo Studio-style persistence) ---
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'wscript|cscript|mshta|AutoIt3|powershell' -and $_.State -ne 'Disabled' } | ForEach-Object {
    Add-Finding 'Persistence-Task' ($_.TaskName + ' -> ' + $_.Actions.Execute + ' ' + $_.Actions.Arguments)
}

# --- 4. Staged scripts / bare AutoIt3 interpreter in common drop locations ---
$staging = @($env:TEMP, $env:APPDATA, $env:LOCALAPPDATA, 'C:\ProgramData', "$env:USERPROFILE\Downloads", 'C:\Users\Public')
Get-ChildItem -Path $staging -Recurse -Depth 3 -Include '*.au3','*.a3x','AutoIt3*.exe','*.vbs','*.vbe','*.js','*.jse' |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-120) } | ForEach-Object {
        Add-Finding 'Staged-File' ($_.FullName + ' [' + $_.LastWriteTime + ']')
    }

# --- 5. Known payload hashes on disk ---
$hashes = @(
    'a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff',
    'a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4'
)
Get-ChildItem -Path $staging -Recurse -Depth 3 -Include '*.exe','*.dll' | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($hashes -contains $h) { Add-Finding 'Known-Payload' ($_.FullName + ' SHA256=' + $h) }
}

# --- 6. Chrome credential store copies outside the user profile (theft staging) ---
Get-ChildItem -Path $staging -Recurse -Depth 4 -Include 'Login Data','Local State' | ForEach-Object {
    Add-Finding 'Credential-Theft-Artifact' $_.FullName
}

Write-Host "`n[*] Hunt complete. Findings: $($Findings.Count)" -ForegroundColor Cyan
$Findings | Format-Table -AutoSize
$Findings | Export-Csv -Path "$env:TEMP\APT-C-36_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation