Blind Eagle JC-46 payload staging - HTTP GET for GitHub raw comicsam payload

Duo Tech@duotech

•updated Jul 23, 2026•1•0•5

Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.