GitHub Actions Abuse & Supply Chain OAuth Theft: cPanel Exploit & CRM Data Breach

---
title: Potential GitHub Actions C2 Communication
id: c077b8c2-12e3-4a9d-8f1e-9b2a3c4d5e6f
status: experimental
description: Detects network connections to known malicious IP associated with GitHub Actions abuse campaign.
references:
    - https://otx.alienvault.com/pulse/12345
author: Security Arsenal
date: 2026/07/26
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    product: linux
    category: network_connection
detection:
    selection:
        dst.ip:
            - '43.228.157.68'
        dst.port:
            - 80
    condition: selection
falsepositives:
    - Legitimate traffic to this IP (unlikely given OTX context)
level: critical
---
title: Malicious Linux Payload Execution
id: d188c9d3-23f4-5b0e-0g2f-0c3b4d5e6f7g
status: experimental
description: Detects execution of known malicious file hashes associated with the cPanel exploitation campaign.
references:
    - https://otx.alienvault.com/pulse/12345
author: Security Arsenal
date: 2026/07/26
tags:
    - attack.execution
    - attack.t1204
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        SHA256|contains:
            - '22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1'
    condition: selection
falsepositives:
    - None
level: critical
---
title: Suspicious File Download from GitHub Actions Runner
id: e299d0e4-34g5-6c1f-1h3g-1d4c5e6f7g8h
status: experimental
description: Detects wget/curl usage downloading specific artifacts from the C2 IP often seen in compromised GitHub Actions.
references:
    - https://socket.dev/blog/github-actions-abuse-powers-cpanel-and-whm-exploitation
author: Security Arsenal
date: 2026/07/26
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: linux
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '/wget'
            - '/curl'
    selection_cli:
        CommandLine|contains:
            - '43.228.157.68'
    condition: all of selection_*
falsepositives:
    - Administrator downloads (verify user)
level: high


kql
// Hunt for connections to the malicious C2 IP
DeviceNetworkEvents
| where RemoteIP == "43.228.157.68"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc

// Hunt for process execution of specific file hashes
DeviceProcessEvents
| where SHA256 in ("22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1", "e219da0599dea936ee867792e2dfe6a2c2a7c68b", "572745566ec674c6eae10c179b0de2ba")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, SHA256
| order by Timestamp desc

// Hunt for OAuth related anomalies or domain access
DeviceNetworkEvents
| where RemoteUrl has "baccarat.com.au"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl


bash
#!/bin/bash
# IOC Hunt Script for cPanel/WHM GitHub Actions Campaign
# Checks for active network connections to C2 IP and known malicious file hashes

C2_IP="43.228.157.68"
MALICIOUS_HASH="22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1"

echo "[*] Checking for active network connections to $C2_IP..."
netstat -antup 2>/dev/null | grep "$C2_IP" || ss -antup 2>/dev/null | grep "$C2_IP"
if [ $? -eq 0 ]; then
    echo "[!] ALERT: Found connection to malicious IP."
else
    echo "[+] No connections found to $C2_IP."
fi

echo ""
echo "[*] Scanning common download directories for malicious payload..."
for dir in /tmp /var/tmp /home/*/public_html /var/www/html; do
    if [ -d "$dir" ]; then
        find "$dir" -type f 2>/dev/null | while read file; do
            file_hash=$(sha256sum "$file" | awk '{print $1}')
            if [ "$file_hash" == "$MALICIOUS_HASH" ]; then
                echo "[!] MALICIOUS FILE FOUND: $file"
            fi
        done
    fi
done

echo ""
echo "[*] Checking for running processes matching suspicious patterns..."
ps aux | grep -E "(wget|curl).*43\.228\.157\.68" | grep -v grep