high
advisory
Shai-Hulud Campaign Activity
Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.
What's new
- 1. new IOCs Aug 7, 03:17 via unit42
- 2. new IOCs Aug 6, 15:16 via unit42
- 3. new IOCs Aug 5, 21:25 via sonatype
- 4. new IOCs Aug 5, 09:15 via securityweek
- 5. new product Aug 5, 01:58 via microsoft-threat-intel
This brief tracks activity attributed to the Shai-Hulud campaign. Sightings and indicators from separate reports are folded in as they are published, rather than creating a separate brief per report.
Recommendation
Review the collected indicators and references and hunt for Shai-Hulud delivery patterns across endpoint and network telemetry.
Indicators of compromise
8
domain
5
hash_sha256
7
ip
| Type | Value |
|---|---|
| hash_sha256 | a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60 |
| hash_sha256 | a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86 |
| hash_sha256 | fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd |
| hash_sha256 | b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903 |
| hash_sha256 | c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd |
| ip | 37.27.122.124 |
| ip | 57.128.246.79 |
| domain | check.torproject.org |
| domain | archive.torproject.org |
| ip | 85.137.53.71 |
| domain | ipfs.io |
| domain | rentry.co |
| domain | npm-cache.com |
| domain | eth-mainnet.nodereal.io |
| domain | go.getblock.io |
| domain | eth.llamarpc.com |
| ip | 104.21.35.216 |
| ip | 35.175.164.77 |
| ip | 185.44.207.215 |
| ip | 172.67.167.200 |