CyberNew CyberNew
Threat Intelligence & APT Dark Reading 3 weeks ago

Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"An attacker stole about 170 private GitHub repositories from the French security firm CrowdSec after compromising a former employee's computer with the Shai-Hulud worm and stealing an OAuth token for his GitHub account. CrowdSec acknowledged the breach, which happened in May, last week in a blog post outlining the attack and how it happened. Attackers stole a GitHub API token from the former..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

An attacker stole about 170 private GitHub repositories from the French security firm CrowdSec after compromising a former employee's computer with the Shai-Hulud worm and stealing an OAuth token for his GitHub account.

CrowdSec acknowledged the breach, which happened in May, last week in a blog post outlining the attack and how it happened. Attackers stole a GitHub API token from the former employee's machine that retained permission to read CrowdSec’s private repositories, and then downloaded the contents of those repositories over the course of just several minutes, according to the post.

CrowdSec discovered the breach only on Sept. 16, when a user published an archive containing source code from the CrowdSec GitHub on pwnforum, an underground cybercrime marketplace. The Fuites Info team subsequently contacted CrowdSec about the leak, and the company began investigating. Fuites Info shared a post of its own about it last week following the company's public disclosure.

Related:ShinyHunters Hacked Cl0p. Now What About Cl0p's Victims?

"At that point, we know with a high degree of certainty that the leak is limited to CrowdSecurity’s source code, including 130+ public repositories and many private ones," CrowdSec CEO Philippe Humeau wrote in the post, adding that none of CrowdSec's infrastructure or databases had been accessed or compromised. The attackers don't appear to have altered CrowdSec's source code for their own purposes either, "whether in the open source software, our private source code, or the build pipelines," he wrote.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →