MITRE ATT&CKsoftware (malware)
S9043 Mini Shai-Hulud
- Domain
- enterprise
- Platforms
- Containers, IaaS, Linux, macOS, SaaS, Windows
- Version
- 1.0
- Created
- 2026-07-29
Description
Mini Shai-Hulud is a credential stealer and self-replicating supply chain worm, derived from Shai-Hulud, that has been used by TeamPCP to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. Mini Shai-Hulud can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. Mini Shai-Hulud also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.
Related
Uses · MITRE ATT&CK (55)
- T1059.013 Container CLI/API sub-technique
- T1546.018 Python Startup Hooks sub-technique
- T1677 Poisoned Pipeline Execution technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1021.007 Cloud Services sub-technique
- T1649 Steal or Forge Authentication Certificates technique
- T1614.001 System Language Discovery sub-technique
- T1213.003 Code Repositories sub-technique
- T1614 System Location Discovery technique
- T1552.007 Container API sub-technique
- T1609 Container Administration Command technique
- T1555.005 Password Managers sub-technique
- T1053.006 Systemd Timers sub-technique
- T1059.007 JavaScript sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1132.001 Standard Encoding sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1195.001 Compromise Software Dependencies and Development Tools sub-technique
- T1059.006 Python sub-technique
- T1567.001 Exfiltration to Code Repository sub-technique
- T1497.001 System Checks sub-technique
- T1087.004 Cloud Account sub-technique
- T1560 Archive Collected Data technique
- T1560.001 Archive via Utility sub-technique
- T1559 Inter-Process Communication technique
- T1003.007 Proc Filesystem sub-technique
Referenced by MITRE ATT&CK · uses (1)
- G1056 TeamPCP group
References
- https://www.ic3.gov/CSA/2026/260702.pdf FBI TeamPCP JUL 2026
- https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/ Flashpoint Mini Shai-Hulud MAY 2026
- https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown Hunt.io TeamPCP Toolkit MAY 2026
- https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised Wiz Mini Shai-Hulud MAY 2026
- https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html Trend Micro TeamPCP MAY 2026
- https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/ Phoenix TeamPCP 20 MAY 2026