hxxps://api.github[.]com/repos/URL
Reported by 2 independent sources · first reported by Elastic Security Labs · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH“…with the threat actor's private GitHub repository through the REST API with the following information:API Endpoint Template: hxxps://api.github[.]com/repos/[owner]/[repo]/contents/[path]?ref=[branch]&t=[timestamp]”
-
The Shelby Strategy“hxxps://api.github[.]com/repos/<owner>/<repo>/contents/<unique identifier>/<file>”
Indicators reported together
named in the same reports- hxxp://ip-api[.]com/jsonin 1 report
- arthurshelby[.]clickin 1 report
- s.grldiyrsmvsggojzmi4wmyi.inevyrcfknfvit2qfvcvinjriffe6ib6hyqdambqgaydambahy7cama.arthurshelby[.]clickin 1 report
- feb5d225fa38efe2…f22b45a4cc3ain 1 report
- 5c384109d3e578a0…4a734445685cin 1 report
- telecom[.]digitalin 1 report
- speed-test[.]clickin 1 report
- airport[.]cloudin 1 report
- airport[.]proin 1 report
- 2.56.126[.]151in 1 report
- 2.56.126[.]157in 1 report
- connect[.]onlinein 1 report
- 2.56.126[.]188in 1 report
- 172.86.68[.]55in 1 report
- 195.16.74[.]138in 1 report
- meeting[.]onlinein 1 report
- tell[.]comin 1 report
- 0e25efeb4e330481…536f71ead17ain 1 report
- 0354862d83a61c8e…0f143b04091fin 1 report
- fb8d4c24bcfd853e…81f5f31b6025in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.