Malware
SHELBY Malware Uses GitHub C2 and PAT Tokens – Immediate Defender Actions
SHELBY infects machines via a phishing attachment that installs a loader which retrieves a backdoor from GitHub using a PAT token. The token grants full control, exposing a critical flaw. Defenders should block PAT token usage, monitor GitHub repos, and update detection rules.
What Happened
A phishing email from an Iraqi telecom sent a JPerf-3.0.0.exe attachment. The executable installed a benign .NET launcher that side‑loaded a malicious DLL and began communicating with GitHub for command and control.
How It Works
The loader (HTTPService.dll) pulls a value from GitHub, decrypts the backdoor (HTTPApi.dll), and loads it into memory via reflection, avoiding disk writes. Both components are obfuscated with Obfuscar, but can be deobfuscated with de4dot. The critical flaw is that any holder of the PAT token can issue commands to all infected hosts.
Impact
Both loader and backdoor have low detection rates on VirusTotal. The malware is actively developed, with unused code and dynamic payload loading suggesting future updates. The PAT token vulnerability exposes all infected systems to arbitrary control.
What to Do
- Block outbound traffic to GitHub repositories used by SHELBY.
- Detect and quarantine JPerf-3.0.0.exe and related files (Microsoft.Http.Api.exe, HTTPService.dll, HTTPApi.dll).
- Implement strict PAT token management; revoke any tokens that may be compromised.
- Use de4dot to analyze new SHELBY samples and update signatures.
- Deploy memory‑resident detection techniques and monitor for loader activity.
Related articles
Elastic Security Labs Releases NETWIRE Configuration Extractor to Aid Detection
Elastic Security Labs has released a free tool that dynamically extracts encrypted configuration data from the NETWIRE RAT, a malware variant that has risen in prevalence since 2022. The extractor uses YARA and Capstone to locate RC4 keys and decrypt payloads, enabling defenders to expose C2 endpoints and credentials quickly.
Read briefing
FakeGit Malware Campaign Resurfaces with 17,610 Malicious GitHub Repositories
The FakeGit operation has reactivated, pushing SmartLoader and StealC infostealer via 17,610 GitHub repos in 34 hours. Legitimate developers’ accounts are being hijacked, and the malware spreads through deceptive README links. Defenders should audit GitHub repos, block SmartLoader downloads, and monitor for StealC activity.
Read briefing
DOUBLELOADER Malware Uses ALCATRAZ Obfuscation – What Defenders Need to Know
Elastic Security Labs uncovered DOUBLELOADER, a backdoor that uses the ALCATRAZ obfuscator and ships with the RHADAMANTHYS infostealer. The malware injects into explorer.exe, gathers system data, and beacons to a hard‑coded IP. Defenders should scan for the .0Dev section, use de‑obfuscation tools, and block outbound traffic to the beacon address.
Read briefing
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing