#ParsedReport #CompletenessMedium
07-10-2026

The campaign that never stopped: tracking GhostAction from 2025 to 2026

https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/

Report completeness: Medium

Actors/Campaigns:
Ghostaction
Mini_shai-hulud

Threats:
Supply_chain_technique
Shai-hulud
Interactsh_tool
Xmrig_miner

Victims:
Public github repositories, Software development

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1027.002, T1036, T1048.003, T1053, T1059.004, T1071.001, T1078.004, T1105, T1140, have more...

IOCs:
File: 2
Domain: 4
IP: 2
Url: 1
Coin: 1

Soft:
curl, plesk, DockerHub, Telegram, Slack, Discord, Cloudflare, version, Docker

Crypto:
monero

Algorithms:
xor, base64

Win API:
NAME