Blind Eagle Photo Studio Scheduled Task Persistence

Duo Tech@duotech

•updated Jul 23, 2026•1•0•8

Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.