APT-C-36__2023__APT_Blind_Eagles_Malware_Arsenal_Technical_Analysis_of_the_New.pdf

APT Blind Eagle (aka APT-C-36) employs a multi-stage espionage campaign: a JavaScript ActiveX downloader launches PowerShell from a Discord CDN-hosted script, subsequent PowerShell stages load AMSI-bypassing DLLs, store encrypted payloads in the registry, drop a VBScript and batch file for persistence in the Startup folder, and eventually decrypt and execute a payload that results in njRAT (Bladabindi). The report includes deobfuscated code snippets, a YARA rule, IoCs (multiple SHA256 hashes, Discord URL, DuckDNS C2), and mapped MITRE ATT&CK techniques to support detection and response.