CTI · corroborated · 2026-08-31

Blind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRAT

Full story & timeline

MITRE ATT&CK

• T1059 Command and Scripting Interpreter Execution
• T1086 PowerShell Execution
• T1118 InstallUtil Stealth
• T1204 User Execution Execution
• T1193 Spearphishing Attachment Initial Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Blind Eagle VBScript Dropper via wscript.exe from Archive Extraction
id: b7e2d4f1-9c3a-4b8e-a1d5-6f8c2e4a3b71
status: experimental
description: >
  Detects VBScript execution by wscript.exe from paths typically associated with
  self-extracting archive extraction (Temp, Downloads, AppData\Local\Temp), as used
  by the Blind Eagle-linked loader to deploy AsyncRAT. The campaign uses self-extracting
  RAR archives disguised as invoice/PDF attachments that launch VBScript-based droppers.
references:
  - https://cyberpress.org
  - https://gbhackers.com
author: Tia N. List
date: 2026-08-31
tags:
  - attack.t1059
  - attack.t1193
logsource:
  product: windows
  category: process_creation
detection:
  selection_wscript:
    Image|endswith: '\wscript.exe'
    CommandLine|contains:
      - '.vbs'
      - '.vbe'
  selection_paths:
    - CommandLine|contains:
        - '\AppData\Local\Temp\'
        - '\Temp\'
        - '\Downloads\'
        - '\AppData\Roaming\'
    - ParentImage|endswith:
        - '\rar.exe'
        - '\7z.exe'
        - '\7zFM.exe'
  condition: selection_wscript and selection_paths
falsepositives:
  - Legitimate VBScript files executed from temporary directories
level: high

References

• https://cyberpress.org
• https://gbhackers.com