Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Excerpt
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles | Wiz Blog Wiz Platform Solutions Pricing Resources Customers Company Sign in Under attack? Get a demo Blog Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements. Rami…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | d09535857a741bbb976bdc084a9a021713133291 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-111497 | High | Score 82/100 | First seen |
| IP | 193.32.204.199 | High | Score 85/100 | First seen |
| SHA1 | 1dc5af9cce950aad1eb1546ecce8565b117540c4 | Medium | Score 53/100 | First seen |
| SHA1 | f3da2b8b357dcda02fd455d314be2a95007516a6 | Medium | Score 53/100 | First seen |
| SHA1 | c665b778b2d822453293003e7ca0bbb2cb08e39d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…