Procedure examples

Shai-Hulud has utilized double-base64 encoding to store stolen secrets within the Github Action Logs within the victim account. Shai-Hulud has also leveraged three layers of base64 encoding of exfiltrated data for anti-forensic purposes.

Shai-Hulud has masqueraded as a legitimate Bun installer.

Shai-Hulud has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.

Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.

Shai-Hulud has utilized PowerShell `Invoke-WebRequest` to download and install the malicious payload.

Shai-Hulud has utilized Linux shell commands to modify configuration files.

Shai-Hulud has used JavaScript to create JSON file output and run scripts using node.js.

Shai-Hulud has utilized curl to install Bun over HTTPS.

Shai-Hulud has leveraged compromised accounts to log into cloud services to access cloud hosted repositories.

Shai-Hulud has gathered victim system information.

Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.

Shai-Hulud has downloaded packages from code repositories. Shai-Hulud has also downloaded and executed the secrets-discovery tool TruffleHog to gather sensitive data.

Shai-Hulud has the ability to automatically collect host data, secrets, system information, and endpoints.

Shai-Hulud has published itself on compromised code repository maintainers within infected packages in attempts to propagate to other victims. Shai-Hulud has also modified versions of code packages.

Shai-Hulud has downloaded existing packages from code repositories and extracted data stored within them.

Shai-Hulud has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder. Shai-Hulud has also utilized the `shred` command on Linux devices.

Shai-Hulud has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.

Shai-Hulud has stopped `systemd-resolved` in order to manipulate DNS and firewalls.

Shai-Hulud has inserted a new lifecycle hook to include `postinstall`. Shai-Hulud has also leveraged the NPM lifecycle hook `preinstall`.

Shai-Hulud has attempted to gain root access by leveraging `sudo` and `/etc/sudoers.d`.

Shai-Hulud has leveraged captured valid NPM tokens to enumerate and update packages on compromised accounts. Shai-Hulud has also utilized stolen GitHub access tokens to access compromised accounts.

Shai-Hulud has gathered sensitive data stored in the Node.JS file `process.env` to include credentials and API keys. Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include `~/.aws/credentials`, `application_default_credentials.json`, and `azureProfile.json`. Shai-Hulud has also targeted credentials and tokens stored in NPM files `.npmrc` and GitHub config files.

Shai-Hulud has queried the AWS and GCP metadata endpoints for instances and service credentials.

Shai-Hulud has suppressed victim NPM warnings using `process[“exit’](0x0);` which results in having all errors exit with code 0.

Shai-Hulud has gathered secrets from AWS Secrets and GCP Secret Manager. Shai-Hulud has also gathered data from Azure Key Vault.

Shai-Hulud has suppressed NPM warnings by silently exiting through the use of the NPM success code that has a setting that all errors exit with `code 0`.

Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets. Shai-Hulud has also posted stolen credentials to public GitHub repositories.

Shai-Hulud has exfiltrated repository secrets to `webhook[.]site`.

Shai-Hulud has the ability to search open sites and code repositories for compromised credentials. Shai-Hulud has discovered packages associated with compromised accounts. Shai-Hulud has also searched code repositories for other compromised repositories that include predefined parameters or markers to include “Second Coming” combined with an 18-character alphanumeric string.

Shai-Hulud has published malicious gzip-compressed tarball (.tgz) following modification of packages within compromised accounts. Shai-Hulud has also modified packages within compromised accounts.

Shai-Hulud has also leveraged GitHub actions from stolen accounts in order to create a malicious Github workflow within `.github/workflows/discussion.yaml`.

Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.

Shai-Hulud has replaced DNS configuration from `/tmp/resolved.conf` in order to gain control of network-level control within CI environments and has flushed iptables rules using `sudo iptables -F OUTPUT` and `sudo iptables -F DOCKER-USER`.