Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader

LevelBlue's follow-up investigation links a GitHub staging account to an operator workstation exposed in an infostealer leak, revealing a small production pipeline: multiple RAT builds (AsyncRAT, DcRat, Remcos, XWorm), phishing templates impersonating Colombian institutions, bulk-mailing tests, crypter purchases, and staging across GitHub/Bitbucket/AWS/creainovada.xyz with DuckDNS C2; the report includes IOCs, a reconstructed multi-stage execution chain (VBScript → PowerShell → InstallUtil.exe), and concrete detection/hunting recommendations.