www.hendryadrian.com
Still Circling: Blind Eagle's Toolkit Keeps Evolving
LevelBlue SpiderLabs reports that Blind Eagle has continued evolving its delivery chains in 2026, including new obfuscation schemes, a GitHub-staged AutoIt loader, and a heavily upgraded AsyncRAT build. The cluster still relies on recurring “Photo Studio” persistence artifacts and shared infrastructure patterns while adding WNF injection, HVNC banking fraud, browser profile cloning, and a Chrome App-Bound Encryption bypass. #BlindEagle #Proton66 #AsyncRAT #PhotoStudioVBS #JC-46
