Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens
In research published October 25, Wiz said it had tracked the campaign, dubbed Gheist, since September 15 and recovered the branches from more than 850 compromised accounts.
In research published October 25, Wiz said it had tracked the campaign, dubbed Gheist, since September 15 and recovered the branches from more than 850 compromised accounts.
The operation targeted every repository the stolen tokens could reach, from personal projects to private enterprise repositories.
Wiz identified infostealer logs and earlier supply chain compromises, such as the March compromise of the Trivy security scanner , as sources of the stolen tokens.
They then downloaded the log through GitHub's application programming interface (API) and deleted the run seconds later, so the campaign needed no external command-and-control (C2) server.
The campaign's main obstacle has been a GitHub control introduced July 28 that places potentially malicious workflow runs in public repositories on hold until a collaborator approves them.
In those environments, Wiz observed workflows completing on attacker-created branches before the runs were removed.
Some of the accounts were also being used for malware distribution and cryptomining, and the protection does not extend to private repositories or GitHub Enterprise Server.
Read more on stolen supply chain secrets: TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets In enterprise organizations, Wiz observed the attackers cycling through user and automation account tokens and cloning private repositories.
One added support for deployment environments, exposing environment-scoped secrets that are often production credentials.
The attackers used the tokens to create branches and commit a GitHub Actions workflow that printed repository secrets into its own log, and hours later, cloud credentials from the same organizations were used to enumerate Amazon Web Services' Secrets Manager.
What happened
In research published October 25, Wiz said it had tracked the campaign, dubbed Gheist, since September 15 and recovered the branches from more than 850 compromised accounts.
The operation targeted every repository the stolen tokens could reach, from personal projects to private enterprise repositories.
Wiz identified infostealer logs and earlier supply chain compromises, such as the March compromise of the Trivy security scanner , as sources of the stolen tokens.
What changed
They then downloaded the log through GitHub's application programming interface (API) and deleted the run seconds later, so the campaign needed no external command-and-control (C2) server.
The campaign's main obstacle has been a GitHub control introduced July 28 that places potentially malicious workflow runs in public repositories on hold until a collaborator approves them.
In those environments, Wiz observed workflows completing on attacker-created branches before the runs were removed.
Who is affected
Some of the accounts were also being used for malware distribution and cryptomining, and the protection does not extend to private repositories or GitHub Enterprise Server.
Why it matters
Read more on stolen supply chain secrets: TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets In enterprise organizations, Wiz observed the attackers cycling through user and automation account tokens and cloning private repositories.
One added support for deployment environments, exposing environment-scoped secrets that are often production credentials.
Technical details
The attackers used the tokens to create branches and commit a GitHub Actions workflow that printed repository secrets into its own log, and hours later, cloud credentials from the same organizations were used to enumerate Amazon Web Services' Secrets Manager.
Attribution
Infosecurity Magazine: In research published October 25, Wiz said it had tracked the campaign, dubbed Gheist, since September 15 and recovered the branches from more than 850 compromised accounts.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.