Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Threat Intelligence | Shai-Hulud Supply Chain Poisoning: Cloud Credential Theft and…
Excerpt
Threat Intelligence | Shai-Hulud Supply Chain Poisoning: Cloud Credential Theft and Self-Propagation Analysis Background On May 19, 2026, while conducting continuous threat hunting across the npm ecosystem, the MistEye security monitoring system once again identified a batch of malicious npm packages masquerading as well-known open-source projects. Investigation revealed that all of these malicious packages were published by the npm account atool, which released 637 malicious…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 1916faa365f2788b6e193514872d51a242876569 | High | Score 56/100 | First seen |
| SHA256 | e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 | Medium | Score 53/100 | First seen |
| URL | http://169.254.169.254 | High | Score 58/100 | First seen |
| URL | https://t.m-kosche.com/api/public/otel/v1/traces; | High | Score 58/100 | First seen |
| URL | https://t.m-kosche.com:443/api/public/otel/v1/traces | High | Score 58/100 | First seen |
| SHA1 | 7cb42f57561c321ecb09b4552802ae0ac55b3a7a | High | Score 56/100 | First seen |
| SHA256 | a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…