Mini Shai-Hulud
[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) is a credential stealer and self-replicating supply chain worm, derived from [Shai-Hulud](https://attack.mitre.org/software/S9008), that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. [Mini… Fuente: MITRE ATT&CK
Actividad en Jábega · 12 semanas
2 noticias · vista por primera vez el 25 sept 2026 · la última, el 26 sept 2026
Noticias
- GitHub Actions re-enabled with Mini Shai-Hulud payload still activeBleepingComputer · 26 sept 2026
- Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud MalwareThe Hacker News · 25 sept 2026
Técnicas MITRE ATT&CK
Acceso inicial
T1078.004Cloud Accounts 35 reglas SigmaT1195.001Compromise Software Dependencies and Development Tools 2 reglas Sigma
Ejecución
T1053.006Systemd TimersT1059.006Python 10 reglas SigmaT1059.007JavaScript 26 reglas SigmaT1059.013Container CLI/APIT1559Inter-Process Communication 5 reglas SigmaT1609Container Administration Command 3 reglas SigmaT1677Poisoned Pipeline Execution
Persistencia
T1205Traffic SignalingT1543.001Launch Agent 2 reglas SigmaT1543.002Systemd Service 3 reglas SigmaT1546Event Triggered Execution 62 reglas SigmaT1546.018Python Startup HooksT1554Compromise Host Software Binary 4 reglas Sigma
Acceso a credenciales
T1003.007Proc FilesystemT1528Steal Application Access Token 13 reglas SigmaT1552.001Credentials In Files 20 reglas SigmaT1552.004Private Keys 6 reglas SigmaT1552.005Cloud Instance Metadata APIT1552.007Container API 3 reglas SigmaT1555.005Password Managers 1 reglas SigmaT1555.006Cloud Secrets Management StoresT1649Steal or Forge Authentication Certificates 4 reglas Sigma
Descubrimiento
T1016System Network Configuration Discovery 4 reglas SigmaT1033System Owner/User Discovery 26 reglas SigmaT1082System Information Discovery 18 reglas SigmaT1083File and Directory Discovery 17 reglas SigmaT1087.004Cloud Account 2 reglas SigmaT1124System Time Discovery 1 reglas SigmaT1497Virtualization/Sandbox Evasion 3 reglas SigmaT1497.001System Checks 3 reglas SigmaT1614System Location Discovery 2 reglas SigmaT1614.001System Language Discovery 2 reglas Sigma
Movimiento lateral
Recopilación
T1119Automated Collection 5 reglas SigmaT1213.003Code Repositories 4 reglas SigmaT1560Archive Collected Data 11 reglas SigmaT1560.001Archive via Utility 10 reglas Sigma
Mando y control
T1008Fallback Channels 4 reglas SigmaT1071.001Web Protocols 39 reglas SigmaT1090.003Multi-hop Proxy 3 reglas SigmaT1102.001Dead Drop Resolver 4 reglas SigmaT1105Ingress Tool Transfer 40 reglas SigmaT1132.001Standard Encoding 4 reglas Sigma
Exfiltración
T1041Exfiltration Over C2 Channel 4 reglas SigmaT1567.001Exfiltration to Code Repository 1 reglas Sigma
Impacto
Stealth
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗