S9043: Mini Shai-Hulud

Mini Shai-Hulud has established persistence on macOS hosts by installing a gh-token-monitor daemon through LaunchAgent that polls GitHub every 60 seconds.[1]

Mini Shai-Hulud has the ability to exfiltrate stolen credentials via the Session messenger network.[1]

Mini Shai-Hulud has used compromised accounts for Docker Hub and GitHub to publish malicious software packages.[2]

Mini Shai-Hulud has utilized Python startup hooks to include the .pth import mechanism for execution.[2]

Mini Shai-Hulud has the ability to decrypt obfuscated payloads.[2]

Mini Shai-Hulud has leveraged commands such as `whoami` to identify the system owner.[2]

Mini Shai-Hulud has discovered network configuration through the use of system commands to include `ip addr`, and `ip route`.[2]

Mini Shai-Hulud has compressed collected credentials and data within tar archive files prior to exfiltration.[2]

Mini Shai-Hulud has enumerated home directories, file paths and files associated with storing or containing credentials and other secrets.[3]

Mini Shai-Hulud has suppressed output so that nothing is printed to terminal and has utilized silent exiting when environmental variables match restricted values.[3]

Mini Shai-Hulud has leveraged a user-agent string that mimics a standard git client to avoid detection within network logs.[3]

Mini Shai-Hulud has examined commit messages for a keyword followed by base64 encoded segments to validate communications and to execute subsequent actions to include exfiltration.[3]

Mini Shai-Hulud has gathered unsecured API keys stored in container orchestrators.[3]

Mini Shai-Hulud has utilized the Docker command-line tool to gather details of the victim environment and collect credentials.[3]

Mini Shai-Hulud has enumerated cloud accounts and subscriptions accessible to the targeted identity.[3]

Mini Shai-Hulud has compressed collected credentials to reduce transmission size and to make string content harder to detect in memory forensics captures.[3]

Mini Shai-Hulud has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.[3]

Mini Shai-Hulud has gathered and downloaded data stored on both compromised and publicly accessible code repositories.[4]

Mini Shai-Hulud has utilized Python scripts to execute payloads.[1][4]

Mini Shai-Hulud has gathered system information of victim hosts through the use of common discovery commands to include `hostname`, `uname-a` and `printenv`.[2] Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.[3][4]

Mini Shai-Hulud has the ability to check system details for its language configuration and terminates actions when the system is configured for the Russian language.[1][4]

Mini Shai-Hulud has utilized execution guardrails in order to prevent operating in restricted geolocations to include Russia by checking the devices language and terminating when a forbidden value is detected.[1][4] Mini Shai-Hulud has also utilized designated instructions that execute when victim hosts match geolocations to include wiping victim devices when the device is determined to be located within Iran or Israel.[3]

Mini Shai-Hulud has evaded execution in virtual environments and sandboxes through checking system information to include the number of CPUs and exiting at times when there were less than four and other times when there were less than two CPUs.[1][3][4]

Mini Shai-Hulud has used base64 encoding to obfuscate URLs used for C2.[3][4]

Mini Shai-Hulud has gathered credentials stored in password managers to include password vaults.[1][3][4]

Mini Shai-Hulud has accessed and propagated to AWS EC2 instances via SSM Send-Command.[4]

Mini Shai-Hulud has exfiltrated encrypted archives over C2 domains.[2][3][4]

Mini Shai-Hulud has established Fallback Channels to exfiltrate data to Github when other configured infrastructure is found to be unreachable.[1][2][3][4]

Mini Shai-Hulud has queried the system timezone configuration and timezone data files to include `/etc/localtime`, and locale settings to determine the geolocation of the compromised host.[3][4]

Mini Shai-Hulud has the ability to download additional payloads from adversary controlled or compromised infrastructure.[1][3][4]

Mini Shai-Hulud has leveraged JavaScript runtime to execute malicious scripts.[2][5]

Mini Shai-Hulud has used a hybrid AES-256-GCM and RSA OAEP-SHA256 encryption to archive gathered data. Mini Shai-Hulud has also utilized custom MD5-keystream XOR cipher to encrypt data.[2] Mini Shai-Hulud has also been deployed via an obfuscated script using Bun JavaScript runtime.[5]

Mini Shai-Hulud has stolen application access tokens and other tokens to include those associated with CI/CD.[1][2][3][4][5]

Mini Shai-Hulud has the ability to authenticate using stolen application access tokens.[1][4][5]

Mini Shai-Hulud has published itself on compromised victim code repositories to propagate malicious versions of packages to other victims.[2][5][5]

Mini Shai-Hulud has scraped runner process memory to extract short-lived identity tokens, which it then exchanged for per-package npm trusted-publisher tokens.[5]

Mini Shai-Hulud has utilized Github Actions to propagate through the use of triggered workflows.[1][4][5]

Mini Shai-Hulud has captured credentials stored in cloud secret stores.[1][2][3][4][5]

Mini Shai-Hulud has collected credentials stored within configuration files.[2][4] Mini Shai-Hulud has also gathered credentials from files stored in common credential file paths to include targeting git-credentials, azureProfile.json, and application_default_credentials.json.[3][5]

Mini Shai-Hulud has gathered unsecured credentials to include SSH private keys within .ssh.[2][3][5]

Mini Shai-Hulud has gathered credentials and secrets from AWS, Google Cloud Platform (GCP) and Azure metadata API.[3][5]

Mini Shai-Hulud has exfiltrated data through the use of the victim’s own GitHub repository by creating a new public repository using a unique naming convention from a curated list of key words or themes.[2][3][4][5]

Mini Shai-Hulud has has exfiltrated data through the use of HTTPS POST requests to C2 domains.[2][5]

Mini Shai-Hulud has leveraged GitHub commit-search API to recover fallback C2 domains stored in auto-created public Github repositories.[1][2][3][4][5]

Mini Shai-Hulud has obtained persistence on Linux devices by writing the `gh-token-monitor` daemon within `~/.config/systemd/user/gh-token-monitor.service` that polls GitHub every 60 seconds.[1] Mini Shai-Hulud has also leveraged a daemon called “kitty-monitor.service” to maintain persistence within Linux hosts.[5]

Mini Shai-Hulud has created .service files using Systemd on victim Linux hosts to establish persistence.[1][3][5]

Mini Shai-Hulud has established persistence through modifying software binaries to include AI coding agents’ configuration or setting files that act as hooks, tasks or execution triggers.[5]

Mini Shai-Hulud has the ability to automatically compile gathered credentials from configuration files and password vaults within an archive and exfiltrate stolen data leveraging both a primary and fallback C2.[5]

Mini Shai-Hulud has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities `kubectl get secrets`.[2][4]

Mini Shai-Hulud has wiped data on devices that fall within specified parameters to include those that resolve to specific geolocations including Iran and Israel.[3][4] Mini Shai-Hulud has also implemented a dead-man’s switch that wipes the victims home directory if the operator revokes a GitHub token created by the adversary. [5]

Mini Shai-Hulud has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.[2][3]

Mini Shai-Hulud has evaded sandbox detection by applying a 1-in-6 probability gate that generates a random number which will only trigger the wiper functionality when the set number outcome is met even in environments that match parameters of a geopolitical target.[3]

Mini Shai-Hulud has deleted all artifacts to include gathered credential archives to reduce disk persistence and detection.[2]

Mini Shai-Hulud has collected victim client certificates to assist in signed authentication assertion with Azure environments.[3]

Mini Shai-Hulud has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.[5]