#ParsedReport #CompletenessHigh
09-10-2026

GhostAction Attack Escalates By Targeting GitHub Users

https://opensourcemalware.com/blog/ghostaction-attack-escalates

Report completeness: High

Actors/Campaigns:
Ghostaction

Threats:
Supply_chain_technique
Devopsgpt_tool
Xmrig_miner

Victims:
Github users, Gitlab users, Software development sector, Open source projects

Geo:
Hong kong, Turkey

TTPs:
Tactics: 8
Technics: 10

IOCs:
Url: 5
Domain: 11
IP: 3
File: 6
Hash: 1
Coin: 1

Soft:
nginx, Cloudflare, Ubuntu, OpenSSH, curl, Anthropic, OpenAI, Slack, SendGrid, plesk, have more...

Algorithms:
sha256, xor

Functions:
InternetDB

Win API:
NAME

Languages:
rust, python