Blind Eagle (APT-C-36) Evolving Toolkit: AsyncRAT, njRAT & LimeRAT Campaign Targeting Colombian Finance — OTX Detection Pack

---
title: Blind Eagle VBScript Dropper Execution Spawning Scripting or AutoIt Loader
id: 7c1e4a2b-9f3d-4e5a-b8c6-aptc360001
status: experimental
description: Detects wscript/cscript execution of VBScript droppers that spawn AutoIt3, mshta, or powershell — consistent with Blind Eagle (APT-C-36) VBScript dropper staging a RunPE AutoIt loader, per OTX pulse.
author: Security Arsenal Threat Intel
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_child:
    Image|endswith:
      - '\autoit3.exe'
      - '\autoit3_x64.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Enterprise logon scripts and administrative automation
level: high
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1218
---
title: Bare AutoIt3 Interpreter Executing Script From Suspicious Path (Blind Eagle RunPE Loader)
id: 7c1e4a2b-9f3d-4e5a-b8c6-aptc360002
status: experimental
description: Detects AutoIt3 interpreter executing scripts from Temp, Public, or AppData paths, or renamed AutoIt binaries — matches Blind Eagle's RunPE process-hollowing loader staged via GitHub (OTX pulse, Aug 2026).
author: Security Arsenal Threat Intel
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'autoit3'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\AppData\Roaming\'
      - 'github'
      - 'raw.githubusercontent'
  filter_legit:
    Image|startswith:
      - 'C:\Program Files\AutoIt3\'
      - 'C:\Program Files (x86)\AutoIt3\'
  condition: selection_cmd and selection_path and not filter_legit
falsepositives:
  - Legitimate AutoIt-based software packaging (rare outside Program Files)
level: high
tags:
  - attack.defense_evasion
  - attack.t1055.012
  - attack.t1059.010
---
title: Dynamic DNS C2 Resolution From Non-Browser Process (Blind Eagle DuckDNS)
id: 7c1e4a2b-9f3d-4e5a-b8c6-aptc360003
status: experimental
description: Detects DNS queries to DuckDNS dynamic domains from processes other than browsers/DNS clients — consistent with AsyncRAT, njRAT, and LimeRAT C2 used by Blind Eagle (e.g., rema200426.duckdns.org).
author: Security Arsenal Threat Intel
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving
date: 2026/08/17
logsource:
  category: dns_query
  product: windows
detection:
  selection_query:
    QueryName|contains:
      - 'rema200426.duckdns.org'
  selection_dyn:
    QueryName|endswith:
      - '.duckdns.org'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\svchost.exe'
  condition: (selection_query or selection_dyn) and not filter_browsers
falsepositives:
  - Developer tooling and IoT agents using dynamic DNS legitimately
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1568.002

// Blind Eagle (APT-C-36) hunt: C2 resolution + VBScript-to-AutoIt loader chain
let duckdns_ioc = "rema200426.duckdns.org";
let ioc_hashes = dynamic(["a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff",
                          "a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4"]);
let C2Hits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has "duckdns.org" or RemoteUrl == duckdns_ioc
| extend Hunt = "DuckDNS C2 connection"
| project Hunt, TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where SHA256 in (ioc_hashes) or InitiatingProcessSHA256 in (ioc_hashes)
| extend Hunt = "Known IOC hash execution"
| project Hunt, TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName;
let LoaderChain = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("wscript.exe","cscript.exe")
| where FileName has_any ("autoit3","powershell.exe","mshta.exe","regsvr32.exe","rundll32.exe")
| extend Hunt = "VBScript dropper spawning loader"
| project Hunt, TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine;
let AutoItRunPE = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has "autoit3"
| where ProcessCommandLine has_any ("\\Temp\\","\\Public\\","Roaming","githubusercontent")
| extend Hunt = "AutoIt3 RunPE loader from suspicious path"
| project Hunt, TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256;
C2Hits
| union HashHits, LoaderChain, AutoItRunPE
| sort by TimeGenerated desc

# Blind Eagle (APT-C-36) endpoint hunt — run elevated on suspect hosts
# Checks: IOC hashes, DuckDNS C2 connections, AutoIt loader artifacts, persistence, VBScript droppers

$iocHashes = @(
  'a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff',
  'a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4'
)
$c2 = 'rema200426.duckdns.org'
$findings = @()

Write-Host '[*] Checking DNS cache and active connections for DuckDNS C2...'
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -like '*duckdns.org*' }
if ($dns) { $findings += $dns | ForEach-Object { "DNS-CACHE: $($_.Entry) -> $($_.Data)" } }
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  ForEach-Object { $r = try { (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost } catch { '' }
                   if ($r -like '*duckdns.org*' -or $r -eq $c2) { "NET-CONN: PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort) ($r)" } }
if ($conns) { $findings += $conns }

Write-Host '[*] Hunting IOC file hashes in staging locations...'
$paths = @("$env:TEMP", "$env:APPDATA", 'C:\Users\Public', "$env:LOCALAPPDATA\Temp")
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue -Include *.exe,*.dll,*.vbs,*.js,*.au3,*.a3x |
      ForEach-Object { $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                       if ($iocHashes -contains $h) { $findings += "IOC-HASH HIT: $($_.FullName)" } }
  }
}

Write-Host '[*] Checking Run keys for RAT persistence (njRAT/AsyncRAT style)...'
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
  Get-ItemProperty $k -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty |
    Where-Object { $_.Definition -match 'Temp|Public|AppData|autoit|\.vbs|\.js' } |
    ForEach-Object { $findings += "RUNKEY: $k -> $($_.Name)" }
}

Write-Host '[*] Checking scheduled tasks for suspicious script/AutoIt actions...'
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
  $a = ($_.Actions | Out-String)
  if ($a -match 'wscript|cscript|autoit3|AppData|Public|duckdns') { $findings += "TASK: $($_.TaskName) :: $($a.Trim())" }
}

Write-Host '[*] Checking for stray AutoIt3 binaries outside Program Files...'
Get-ChildItem -Path 'C:\Users','C:\ProgramData' -Recurse -Filter 'autoit3*.exe' -ErrorAction SilentlyContinue |
  ForEach-Object { $findings += "AUTOIT: $($_.FullName)" }

Write-Host "`n===== HUNT RESULTS ====="
if ($findings.Count -eq 0) { Write-Host '[+] No Blind Eagle artifacts found.' } else { $findings | ForEach-Object { Write-Host "[!] $_" } }