GitHub Actions Weaponization Campaign Targets cPanel and WHM Servers — Detection and Defense Guide

---
title: Suspicious GitHub Actions Workflow Modification from External IP
id: 9a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects GitHub Actions workflow files being modified from external IPs, indicating potential repository compromise
references:
  - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1059.004
logsource:
  category: web
  product: github
detection:
  selection:
    request_uri|contains: '/workflows/'
    http_method|contains:
      - 'PUT'
      - 'POST'
    c_ip|notstartswith:
      - '192.168.'
      - '10.'
      - '172.16.'
    file_extension:
      - '.yml'
      - '.yaml'
  condition: selection
falsepositives:
  - Legitimate developers working remotely
  - Automated CI/CD tools pushing workflow updates
level: high
---
title: Malicious Packagist Package Installation from Compromised Developer
id: b1c2d3e4-f5a6-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects installation of Packagist packages from dinushchathurya account during July 2026 campaign window
references:
  - https://packagist.org/packages/dinushchathurya/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/composer'
    CommandLine|contains:
      - 'dinushchathurya'
      - 'packagist.org/dinushchathurya'
  timeframe: 7d
  condition: selection
falsepositives:
  - Legitimate use of this developer's packages prior to compromise
level: critical
---
title: GitHub Actions Runner Executing cPanel/WHM Enumeration Commands
id: c3d4e5f6-a7b8-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects GitHub Actions runners executing commands typically used to enumerate cPanel/WHM configurations
references:
  - https://docs.cpanel.net/cpanel/whm/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.discovery
  - attack.t1018
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'actions-runner'
    CommandLine|contains:
      - '/usr/local/cpanel'
      - '/scripts/whoowns'
      - '/usr/local/cpanel/bin/whmapi1'
      - 'whmapi1 list_accounts'
      - 'uapi User list_pops'
  condition: selection
falsepositives:
  - Legitimate CI/CD testing against cPanel environments
level: high

-- Hunt for GitHub Actions workflow executions involving compromised Packagist packages
let TimeWindow = 7d;
GitHub_CL
| where TimeGenerated > ago(TimeWindow)
| where Action == "workflow_run"
| extend repo_name = tostring(coalesce(Repository_Name, Repository))
| where repo_name has "dinushchathurya" or 
        Payload has "dinushchathurya" or 
        Payload has "packagist.org/dinushchathurya"
| project TimeGenerated, Actor, Action, repo_name, HeadBranch, Payload
| order by TimeGenerated desc
;

-- Detect cPanel/WHM access anomalies from GitHub Actions runner IP ranges
let GitHubIPRanges = dynamic(["140.82.112.0/20", "192.30.252.0/22", "185.199.108.0/22", "143.55.64.0/20"]);
Syslog
| where TimeGenerated > ago(3d)
| where Facility == "authpriv" or Facility == "auth"
| where ProcessName contains "cpanel" or ProcessName contains "whm" or SyslogMessage contains "whostmgrd"
| parse SyslogMessage with * "from " SourceIP ":" *
| extend ParsedIP = tostring(SourceIP)
| where ipv4_is_in_range(ParsedIP, GitHubIPRanges)
| project TimeGenerated, HostName, ProcessName, SyslogMessage, ParsedIP
| order by TimeGenerated desc
;

-- Detect Packagist package installations of compromised packages
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "composer"
| where ProcessCommandLine has "dinushchathurya" or 
        ProcessCommandLine has "require" and ProcessCommandLine has "packagist"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for composer installations of the compromised developer packages
SELECT 
  Timestamp, 
  Username, 
  Exe, 
  CommandLine
FROM process_logs(pslist())
WHERE Exe =~ "composer"
  AND (CommandLine =~ "dinushchathurya" OR CommandLine =~ "packagist.*dinushchathurya")
  AND Timestamp > now() - 7*24*60*60
;

-- Scan for suspicious GitHub Actions workflow files in repositories
SELECT 
  FullPath, 
  Mtime, 
  Size, 
  hash(path=FullPath) AS Hash
FROM glob(globs=["/home/*/.github/workflows/*.yml", "/var/www/html/.github/workflows/*.yaml"])
WHERE Mtime > now() - 7*24*60*60
  AND FullPath =~ ".*"
;

-- Detect network connections to cPanel/WHM management ports from unexpected processes
SELECT 
  Pid, 
  Name, 
  RemoteAddr, 
  RemotePort, 
  State, 
  Started
FROM netstat()
WHERE RemotePort IN (2082, 2083, 2086, 2087, 2095, 2096)  -- cPanel/WHM ports
  AND Name !~ "(whostmgrd|cpanel|cpsrvd)"
  AND Started > now() - 24*60*60

#!/bin/bash
# GitHub Actions / cPanel Compromise Assessment Script
# Version: 1.0
# Date: 2026-07-15
# Purpose: Identify and remediate indicators of the GitHub Actions weaponization campaign

# Set logging
LOG_FILE="/var/log/github_actions_assessment_$(date +%Y%m%d_%H%M%S).log"
echo "Assessment started at $(date)" | tee -a "$LOG_FILE"

# Function to check for compromised Packagist packages
check_composer_packages() {
    echo "[*] Checking for compromised composer packages..." | tee -a "$LOG_FILE"
    
    # Find composer. files
    find /home /var/www /opt -name "composer." -type f 2>/dev/null | while read -r file; do
        # Check for dinushchathurya packages
        if grep -q "dinushchathurya" "$file" 2>/dev/null; then
            echo "[!] FOUND COMPROMISED PACKAGE REFERENCE IN: $file" | tee -a "$LOG_FILE"
            echo "    Contents:" | tee -a "$LOG_FILE"
            grep "dinushchathurya" "$file" | tee -a "$LOG_FILE"
            # Backup and remove
            cp "$file" "${file}.malicious_$(date +%s)"
            echo "[+] Backed up to: ${file}.malicious_$(date +%s)" | tee -a "$LOG_FILE"
        fi
    done
}

# Function to check GitHub Actions workflow files
check_github_workflows() {
    echo "[*] Checking for suspicious GitHub Actions workflows..." | tee -a "$LOG_FILE"
    
    # Common workflow locations
    WORKFLOW_DIRS=("/root/.github/workflows" "/home/*/.github/workflows" "/var/www/html/.github/workflows")
    
    for dir in "${WORKFLOW_DIRS[@]}"; do
        for workflow in $dir/*.yml $dir/*.yaml 2>/dev/null; do
            if [ -f "$workflow" ]; then
                # Check for suspicious command execution patterns
                if grep -qiE "(curl.*bash|wget.*sh|eval.*base64|powershell.*encodedcommand)" "$workflow"; then
                    echo "[!] SUSPICIOUS WORKFLOW FOUND: $workflow" | tee -a "$LOG_FILE"
                    echo "    Contains command execution patterns" | tee -a "$LOG_FILE"
                fi
                
                # Check for modifications in last 7 days
                SEVEN_DAYS_AGO=$(date -d '7 days ago' +%s)
                FILE_MOD=$(stat -c %Y "$workflow" 2>/dev/null)
                if [ "$FILE_MOD" -gt "$SEVEN_DAYS_AGO" ]; then
                    echo "[!] RECENTLY MODIFIED WORKFLOW: $workflow" | tee -a "$LOG_FILE"
                    echo "    Last modified: $(stat -c %y "$workflow")" | tee -a "$LOG_FILE"
                fi
            fi
        done
    done
}

# Function to check cPanel/WHM access logs
check_cpanel_access() {
    echo "[*] Checking cPanel/WHM access logs for GitHub Actions IPs..." | tee -a "$LOG_FILE"
    
    if [ -d "/usr/local/cpanel/logs" ]; then
        # GitHub Actions IP ranges
        GITHUB_PATTERNS="140.82.112|192.30.252|185.199.108|143.55.64"
        
        for log in /usr/local/cpanel/logs/access_log /usr/local/cpanel/logs/whostmgrd_log; do
            if [ -f "$log" ]; then
                echo "    Checking $log..." | tee -a "$LOG_FILE"
                grep -E "$GITHUB_PATTERNS" "$log" | tail -20 | tee -a "$LOG_FILE"
            fi
        done
    fi
}

# Function to remove compromised packages
remove_compromised_packages() {
    echo "[*] Removing compromised packages..." | tee -a "$LOG_FILE"
    
    # Find and remove vendor directories containing dinushchathurya packages
    find /home /var/www /opt -path "*/vendor/dinushchathurya/*" -type d 2>/dev/null | while read -r dir; do
        echo "[!] Found compromised package directory: $dir" | tee -a "$LOG_FILE"
        # Remove the entire vendor/dinushchathurya directory
        rm -rf "$(dirname "$dir")/dinushchathurya"
        echo "[+] Removed: $(dirname "$dir")/dinushchathurya" | tee -a "$LOG_FILE"
    done
    
    # Recommend composer update
    echo "[*] RECOMMENDATION: Run 'composer update --no-dev' in affected project directories" | tee -a "$LOG_FILE"
}

# Main execution
check_composer_packages
check_github_workflows  
check_cpanel_access
remove_compromised_packages

echo "Assessment completed at $(date)" | tee -a "$LOG_FILE"
echo "Log saved to: $LOG_FILE"