The Hunters Got Hunted: An Infostealer Turned a Hacking Crew Inside Out

There is a certain poetry to how this one unravelled. A cybercrime operator linked to Blind Eagle, a group that has spent years phishing Colombian government agencies and businesses, made the mistake every one of their victims makes: they got infected by an information-stealing program. And a stealer does not care whose computer it lands on. It quietly hoovered up the attacker’s browser history, local files, and credentials, then dumped them into the same underground data pools that researchers monitor. The security firm LevelBlue picked up the thread and, in effect, got to read the crew’s workshop from the inside.

The pivot point was almost mundane. Analysts traced an email address buried in a GitHub commit, the digital fingerprint left when someone uploads code, to a leaked stealer log. Have I Been Pwned placed that same address in six separate breaches. From there, the picture of an entire operation came into view, and it looked less like a lone genius in a hoodie than a small, methodical production line.

A malware workshop, laid bare

The compromised machine was a tour of the modern cybercrime toolkit. There was a folder simply labelled “Rats,” stocked with builds of several off-the-shelf remote-access trojans, AsyncRAT, DcRat, Remcos, and XWorm, so the operator could swap payloads at will rather than lean on one. There were HTML and Word templates faithfully mimicking notices from Colombia’s judicial council and Bogotá’s traffic authority, the bait for the phishing emails. There was bulk-mailing software, with a test message sent to the operator’s own address, and browsing history showing shopping trips for hosting, file storage, and crypter services designed to make malware harder to detect. Even a plain text file tying build names to their download links turned up, a crude internal dispatch log.

The attack chain those tools produced was equally telling. A self-extracting archive kicked off hidden scripts, wrote itself into a system folder, and then abused a legitimate, signed Windows utility to run its code, borrowing Windows’ own trust to slip past defenses. Crucially, the crew staged its files on services no one blocks, GitHub, Bitbucket, Amazon’s cloud, even Discord. That is the real lesson buried here: a download coming from a reputable name is not a safe download.

What it does and doesn’t prove

It is worth being precise about what this exposes. LevelBlue is careful to say the findings do not unmask a person; they map a workflow. This is a portrait of how the operation runs, not a name to put in handcuffs, and the staging account was still active even after the research came out, a reminder that visibility is not the same as shutdown.

Still, the value is real. Seeing an attacker’s own kit shows just how modular and repeatable this business has become, and it hands defenders a concrete checklist: distrust password-protected archives whose password sits in the email body, inspect what a file truly is rather than what its extension claims, and watch for script hosts quietly launching PowerShell. For anyone in Colombia, the human rule is simplest of all. An unexpected court summons or traffic fine in your inbox deserves a phone call to the real agency, not a click. So what finally exposed a crew that preys on careless clicks? One careless click of their own.