Mini Shai-Hulud

Mini Shai-Hulud has compressed collected credentials to reduce transmission size and to make string content harder to detect in memory forensics captures.^[3]

Mini Shai-Hulud has the ability to automatically compile gathered credentials from configuration files and password vaults within an archive and exfiltrate stolen data leveraging both a primary and fallback C2.^[5]

Mini Shai-Hulud has established persistence through modifying software binaries to include AI coding agents’ configuration or setting files that act as hooks, tasks or execution triggers.^[5]

Mini Shai-Hulud has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities kubectl get secrets.^[2][4]

Mini Shai-Hulud has wiped data on devices that fall within specified parameters to include those that resolve to specific geolocations including Iran and Israel.^[3][4] Mini Shai-Hulud has also implemented a dead-man’s switch that wipes the victims home directory if the operator revokes a GitHub token created by the adversary. ^[5]

Mini Shai-Hulud has the ability to decrypt obfuscated payloads.^[2]

Mini Shai-Hulud has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.^[5]

Mini Shai-Hulud has utilized execution guardrails in order to prevent operating in restricted geolocations to include Russia by checking the devices language and terminating when a forbidden value is detected.^[1][4] Mini Shai-Hulud has also utilized designated instructions that execute when victim hosts match geolocations to include wiping victim devices when the device is determined to be located within Iran or Israel.^[3]

Mini Shai-Hulud has exfiltrated encrypted archives over C2 domains.^[2][3][4]

Mini Shai-Hulud has established Fallback Channels to exfiltrate data to Github when other configured infrastructure is found to be unreachable.^[1][2][3][4]

Mini Shai-Hulud has enumerated home directories, file paths and files associated with storing or containing credentials and other secrets.^[3]

Mini Shai-Hulud has the ability to download additional payloads from adversary controlled or compromised infrastructure.^[1][3][4]

Mini Shai-Hulud has executed via the use of subprocess.run and fed input through standard input stdin which acted as a pipe to send data from the parent process and the child process sys.executable within memory.^[2][3]

Mini Shai-Hulud has utilized Github Actions to propagate through the use of triggered workflows.^[1][4][5]

Mini Shai-Hulud has stolen application access tokens and other tokens to include those associated with CI/CD.^{[1][2][3][4][5]}

Mini Shai-Hulud has collected victim client certificates to assist in signed authentication assertion with Azure environments.^[3]

Mini Shai-Hulud has gathered system information of victim hosts through the use of common discovery commands to include hostname, uname-a and printenv.^[2] Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.^[3][4]

Mini Shai-Hulud has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.^[3]

Mini Shai-Hulud has discovered network configuration through the use of system commands to include ip addr, and ip route.^[2]

Mini Shai-Hulud has leveraged commands such as whoami to identify the system owner.^[2]

Mini Shai-Hulud has queried the system timezone configuration and timezone data files to include /etc/localtime, and locale settings to determine the geolocation of the compromised host.^[3][4]

Mini Shai-Hulud has examined commit messages for a keyword followed by base64 encoded segments to validate communications and to execute subsequent actions to include exfiltration.^[3]

Mini Shai-Hulud has evaded sandbox detection by applying a 1-in-6 probability gate that generates a random number which will only trigger the wiper functionality when the set number outcome is met even in environments that match parameters of a geopolitical target.^[3]