Woodgnat Mistic Backdoor & Shai-Hulud NPM Supply Chain Attack: OTX Pulse Analysis

Threat Summary

Recent OTX pulses indicate a convergence of sophisticated Initial Access Broker (IAB) activity and software supply chain compromises targeting the technology sector. The primary threat actor, Woodgnat, has been observed deploying a new stealthy backdoor, Backdoor.Mistic, alongside ModeloRAT. These tools facilitate access for major ransomware operations including Qilin, Akira, and Black Basta via DLL sideloading techniques.

Concurrently, a separate threat actor, Shai-Hulud, has weaponized the open-source ecosystem by compromising the intercom-client npm package (v7.0.4). This supply chain attack leverages a preinstall hook to download the Bun runtime and harvest GitHub developer tokens using the gh auth token command. This intelligence suggests a coordinated effort to harvest high-value credentials and establish persistent access for follow-on ransomware deployment.

Threat Actor / Malware Profile

Woodgnat (Initial Access Broker)

Objective: Establish stealthy persistence on corporate networks to sell access to Ransomware-as-a-Service (RaaS) affiliates.
Malware Families: Backdoor.Mistic, ModeloRAT, GateKeeper, MintsLoader.
Distribution: Social engineering lures leading to sideloading payloads.
Persistence: Uses DLL sideloading to bypass detection; associated with loaders like MintsLoader.
C2 Communication: Connects to domains such as mail.authorized-logins.net and update.update-fall.com.
Targeting: Insurance, Education, and Technology sectors.

Shai-Hulud (Supply Chain Actor)

Objective: Theft of source code repositories via GitHub credentials.
Mechanism: Malicious NPM package (intercom-client@7.0.4).
Payload Behavior: Executes a preinstall script to download the Bun runtime, then exfiltrates the gh auth token.
C2 Technique: Uses GitHub's own "commit search" API for C2 communication, blending into legitimate traffic.
Targeting: Software developers and Technology organizations.

IOC Analysis

Domains & Hostnames: The pulses list multiple C2 and infrastructure domains (e.g., grande-luna.top, zero.masscan.cloud). SOC teams should immediately block these at the perimeter and DNS layer.
File Hashes (SHA256): Specific hashes for the Mistic backdoor and phishing documents are provided. These should be added to EDR allowlist/blocklist configurations for immediate scanning of endpoints.
Operationalization: Use SIEM tools (e.g., Splunk, Sentinel) to correlate network connections to the listed hostnames with process execution logs.
Decoding: The hashes represent compiled payloads (exe/dll) and potentially malicious documents used in phishing campaigns.

Detection Engineering

YAML

---
title: Potential Woodgnat Mistic Backdoor C2 Activity
description: Detects network connections to known Woodgnat C2 infrastructure associated with Mistic backdoor and ModeloRAT.
author: Security Arsenal
status: stable
date: 2026/07/24
references:
    - https://otx.alienvault.com/pulse/67981234/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'authorized-logins.net'
            - 'grande-luna.top'
            - 'oeannon.com'
            - 'thomphon.com'
            - 'human-check.top'
            - 'update-fall.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Shai-Hulud NPM Supply Chain Attack via Bun Runtime
description: Detects the execution of Bun runtime initiated by NPM scripts, indicative of the Shai-Hulud intercom-client compromise.
author: Security Arsenal
status: stable
date: 2026/07/24
references:
    - https://otx.alienvault.com/pulse/67981235/
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_child:
        Image|endswith:
            - '\bun.exe'
            - '\bunx.exe'
        CommandLine|contains: 'gh auth token'
    condition: all of selection_*
falsepositives:
    - Legitimate developer usage of Bun and GitHub CLI
level: high
---
title: Mistic Backdoor/Phishing Payload Execution
status: stable
description: Detects execution of files with known SHA256 hashes from Woodgnat and Q2 2026 Phishing campaigns.
author: Security Arsenal
date: 2026/07/24
references:
    - https://otx.alienvault.com/pulse/67981234/
    - https://otx.alienvault.com/pulse/67981236/
tags:
    - attack.initial_access
    - attack.t1204
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
            - '.doc'
            - '.docx'
        Hashes|contains:
            - '3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be'
            - '11420d6d693bf8b19195e6b98fedd03b9bcbc770b6988bc64cb788bfabe1a49d'
            - '5db1ecbbb2c90c51d81bda138d4300b90ea5eb2885cce1bd921d692214aecbc6'
            - 'b5a3346082ac566b4494e6175f1cd9873b64abe6c902db49bd4e8088876c9ead'
    condition: selection
falsepositives:
    - Unknown
level: critical


kql
// Hunt for Woodgnat C2 Connections and Shai-Hulud Infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("authorized-logins.net", "grande-luna.top", "oeannon.com", "thomphon.com", "human-check.top", "update-fall.com", "zero.masscan.cloud", "x2mails.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
;
// Hunt for GitHub Token Theft Behavior
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains "gh auth token"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessParentFileName


powershell
<#
.SYNOPSIS
    IOC Hunt Script for Woodgnat and Shai-Hulud Activity
.DESCRIPTION
    Scans the file system for specific SHA256 hashes and checks node_modules for the compromised intercom-client package.
#>

$TargetHashes = @(
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "11420d6d693bf8b19195e6b98fedd03b9bcbc770b6988bc64cb788bfabe1a49d",
    "5db1ecbbb2c90c51d81bda138d4300b90ea5eb2885cce1bd921d692214aecbc6",
    "b5a3346082ac566b4494e6175f1cd9873b64abe6c902db49bd4e8088876c9ead"
)

Write-Host "[*] Checking for malicious file hashes..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 | Where-Object { $TargetHashes -contains $_.Hash } | Select-Object Path, Hash

Write-Host "[*] Checking for compromised NPM package 'intercom-client'..."
$PackageJsonPaths = Get-ChildItem -Path C:\ -Filter "package." -Recurse -ErrorAction SilentlyContinue
foreach ($ in $PackageJsonPaths) {
    $content = Get-Content $.FullName -Raw | ConvertFrom-Json
    if ($content.dependencies."intercom-client" -eq "7.0.4") {
        Write-Host "[!] CRITICAL: Compromised package found at $($.FullName)"
    }
}

Response Priorities

Immediate: Block all listed domains and hostnames at the proxy and firewall level. Initiate a scan for the specific SHA256 file hashes provided in the IOCs across all endpoints.
24h: Audit developer environments for the presence of intercom-client@7.0.4. If found, rotate GitHub tokens immediately and revoke SSH keys associated with compromised accounts.
1 Week: Implement software composition analysis (SCA) scans within CI/CD pipelines to detect malicious package versions. Review and harden RDP and external-facing services against Woodgnat's sideloading initial access vectors.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub