SHELBY malware: GitHub C2, data theft

Elastic Security Labs has discovered a complex malware campaign, REF8685, targeting Iraq’s telecom sector. The campaign uses a new malware family, SHELBY, which exploits GitHub for command-and-control (C2), data exfiltration, and command retrieval.

SHELBY malware

The SHELBY malware family includes two key components: SHELBYLOADER and SHELBYC2.

The attack starts with a phishing email containing a malicious attachment (details.zip). When opened, it installs files in the %AppData%\Local\Microsoft\HTTPApi directory, including HTTPApi.dll (SHELBYC2) and HTTPService.dll (SHELBYLOADER).

SHELBYLOADER uses multiple techniques to evade detection, such as WMI queries, process enumeration, file system checks, and disk size analysis.

After execution, it ensures persistence by adding a registry entry and creates a unique identifier based on system-specific information.

The malware’s command-and-control (C2) uses GitHub’s API with a private repository and a Personal Access Token (PAT) for authentication, bypassing standard Git tools.

SHELBYC2, the backdoor, is loaded into memory using reflection and decrypted with an AES key from a file downloaded from the C2 server. It supports commands like file download, upload, and loading additional .NET binaries.

The C2 design of the malware has a critical flaw: access to the Personal Access Token (PAT) could allow attackers to control infected machines or steal sensitive data, exposing victims to more risks.

The REF8685 campaign employs sophisticated social engineering, using compromised internal email accounts for convincing phishing attacks. The attackers have also targeted other entities, including an international airport in the UAE.

Elastic Security Labs has released YARA rules for detecting SHELBY malware variants. With signs of ongoing development, future updates may address current vulnerabilities and add new capabilities.

This campaign highlights the evolving tactics of threat actors, emphasizing the need for strong email security, employee training, and continuous network monitoring.

IOCs

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!