Cisco SD-WAN Zero-Day & GitHub Actions Abuse: Supply Chain Credential Theft

Threat Summary

Recent OTX pulses indicate a coordinated surge in high-impact attacks focusing on credential theft and infrastructure manipulation through supply chain vectors. The activity spans three distinct but thematically linked campaigns: a zero-day exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245) for privilege escalation, a large-scale abuse of GitHub Actions to deploy payloads targeting cPanel/WHM, and a supply chain breach involving LastPass and Klue that leveraged stolen OAuth tokens to access CRM data.

The collective objective of these campaigns is the extraction of sensitive credentials and data. Actors are moving beyond traditional endpoints, targeting CI/CD pipelines and SD-WAN orchestration layers to gain persistent, high-privileged access to enterprise environments. The convergence of zero-day exploits (CVE-2026-20245) and infrastructure abuse (GitHub Actions) suggests a shift toward "Living-off-the-Land" (LotL) techniques in cloud-native environments.

Threat Actor / Malware Profile

• Adversary Profile: Unknown (Multiple actors utilizing similar exploitation vectors).
• Attack Vectors:
  • Zero-Day Exploitation: Leveraging CVE-2026-20245 in Cisco Catalyst SD-WAN Manager to bypass authentication and escalate privileges via file upload mechanisms.
  • Supply Chain / CI/CD Abuse: Compromising GitHub repositories to inject malicious workflows, using GitHub-hosted runners as attack infrastructure to scan and exploit cPanel/WHM instances.
  • Third-Party Token Theft: Exploiting compromised OAuth tokens from a vendor (Klue) to pivot into SaaS environments (Salesforce).
• Payload Behavior:
  • Linux Payloads: Downloads architecture-specific binaries (amd64/arm64) from C2 infrastructure (43.228.157.68).
  • Privilege Escalation: Manipulation of default account passwords and exploitation of file upload flaws to gain root/system access.
  • Data Exfiltration: Unauthorized access to CRM data (Customer names, emails, company names) via API calls using hijacked OAuth sessions.
• C2 Communication: Connections to HTTP endpoints hosted on 43.228.157.68 for payload retrieval and result exfiltration (/api/dl/amd64, /api/github-results).
• Persistence: Established via unauthorized peering connections (SD-WAN) and persistent malicious GitHub workflows triggered by repository events.

IOC Analysis

The provided indicators highlight a mix of software vulnerabilities, infrastructure artifacts, and specific file droppers.

• CVEs (Vulnerability Indicators):
  • CVE-2026-20245: Critical privilege escalation in Cisco Catalyst SD-WAN Manager.
  • CVE-2026-41940: Vulnerability exploited in cPanel/WHM campaigns.
  • CVE-2026-20127, CVE-2026-20182: Associated vulnerabilities observed in the SD-WAN attack chain.
• Network Infrastructure (IPs/URLs):
  • 43.228.157.68: Actively serving malicious Linux payloads and receiving heartbeat/results from compromised GitHub runners. Action: Block immediate inbound/outbound traffic to this IP.
  • baccarat.com.au: Domain flagged in the supply chain incident context. Action: Investigate internal DNS logs for resolution requests.
• File Hashes (Droppers/Payloads):
  • b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b (SHA256): Artifact associated with the Cisco SD-WAN exploit.
  • 22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1 (SHA256): Linux payload downloaded by the GitHub Actions campaign.

SOC Operationalization: Feed these hashes into EDR quarantine mechanisms. Block the IP range at the firewall. Investigate any GitHub Action logs in your environment referencing external URLs not matching the organization's allow-list.

Detection Engineering

Sigma Rules

title: Potential Malicious Linux Payload Download from C2
id: 5c5a9b1c-8b3a-4f1c-9b2a-3c4d5e6f7a8b
description: Detects processes initiating network connections to known C2 infrastructure associated with GitHub Actions abuse campaigns.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67231a1c8b3a4f1c9b2a3c4d
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: linux
    service: network_connections
detection:
    selection:
        dst.ip:
            - '43.228.157.68'
    condition: selection
falsepositives:
    - Legitimate administrative access to this specific IP (Unlikely)
level: critical
---
title: Cisco SD-WAN Manager Exploitation Artifact
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects the presence of a specific file hash associated with the CVE-2026-20245 exploit chain on Linux systems.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67231a1c8b3a4f1c9b2a3c4d
tags:
    - attack.initial_access
    - attack.cve-2026-20245
logsource:
    product: linux
    service: file_integrity
detection:
    selection:
        TargetFilename|contains: '/tmp/'
        sha256:
            - 'b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b'
    condition: selection
falsepositives:
    - None
level: critical
---
title: Suspicious Domain Resolution - Supply Chain Indicator
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
description: Detects DNS queries for a domain associated with the LastPass/Klue supply chain incident.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67231a1c8b3a4f1c9b2a3c4d
tags:
    - attack.discovery
logsource:
    product: dns
    service: query
detection:
    selection:
    query|contains: 'baccarat.com.au'
    condition: selection
falsepositives:
    - Legitimate visits to the domain (Low risk)
level: medium

KQL (Microsoft Sentinel)

// Hunt for connections to known malicious C2 IP
DeviceNetworkEvents
| where RemoteIP == "43.228.157.68"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc
;
// Hunt for specific file hashes present in pulses
DeviceProcessEvents
| where SHA256 in ("b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b", "22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| order by Timestamp desc

PowerShell Hunt Script

<#
.SYNOPSIS
    IOC Hunter for SD-WAN and GitHub Actions Campaign
.DESCRIPTION
    Scans the file system for specific SHA256 hashes and checks for active network connections to the C2 IP.
#>

$MaliciousHashes = @(
    "b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b",
    "22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1"
)

$C2IP = "43.228.157.68"

Write-Host "[+] Starting IOC Scan..." -ForegroundColor Cyan

# Scan for file hashes
Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 | Where-Object { $MaliciousHashes -contains $_.Hash } | ForEach-Object {
    Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
}

# Check active network connections
Write-Host "[+] Checking active network connections to $C2IP ..." -ForegroundColor Yellow
$netstat = netstat -ano | Select-String "$C2IP"
if ($netstat) {
    Write-Host "[!] ACTIVE CONNECTION DETECTED TO C2 IP:" -ForegroundColor Red
    $netstat | ForEach-Object { Write-Host $_ }
} else {
    Write-Host "[-] No active connections to C2 IP found." -ForegroundColor Green
}

Write-Host "[+] Scan Complete." -ForegroundColor Cyan

Response Priorities

• Immediate:

  • Block IP address 43.228.157.68 at all perimeter firewalls and proxy servers.
  • Quarantine any endpoints matching the provided SHA256 hashes.
  • Suspend or review all GitHub Actions workflows that utilize actions/checkout or third-party actions with write permissions.

• 24 Hours:

  • Conduct a credential audit for all accounts associated with Cisco SD-WAN management interfaces. Force password resets if default passwords were used.
  • Review Salesforce/OAuth logs for any access originating from unusual IP ranges or associated with the "Klue" integration.
  • Hunt for the presence of the specific file hashes across Linux endpoints in the environment.

• 1 Week:

  • Patch Cisco Catalyst SD-WAN Manager once the fix for CVE-2026-20245 is available.
  • Implement strict allow-listing for GitHub Actions and review third-party marketplace integrations.
  • Enforce MFA for all CI/CD pipeline access and OAuth token generation.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub