{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Compromise of the software supply chain through developer credential theft allows for stealthy, persistent access that can affect every downstream user; identifying these injections before they reach production is a critical security obligation." }, "name": "Development Pipeline Credential Abuse and Injection", "type": "investigation", "labels": [ "hunt", "attack.t1555", "attack.t1195", "attack.t1078", "credential access", "defense evasion", "execution", "initial access" ], "series": { "slug": "eset-apt-activity-report-q2-2026-q3-2026", "index": 1, "title": "ESET APT Activity Report Q2 2026\u2013Q3 2026", "total": 2 }, "related": [ { "hunt": "initial-access-mdaemon-exploit", "reason": "Mail server exploitation is a separate initial access vector mentioned in the same report.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A simple alert on a GitHub push is too noisy; this hunt correlates push activity with rare secret enumeration and high-risk sign-in context across two telemetry surfaces (GitHub API and Entra/Okta auth), using stack-counting to isolate anomalous developer behavior.", "coverage": [ { "stage": "credential-access-developer-harvesting", "steps": [ "secret-access-prevalence", "high-risk-authentication" ], "status": "covered" }, { "stage": "initial-access-supply-chain-injection", "steps": [ "github-push-events", "manual-commit-review" ], "status": "covered" }, { "stage": "initial-access-mdaemon-exploit", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "initial-access-recruitment-phishing", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "execution-backdoor-deployment", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-llm-safety-trigger", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "MDaemon Mail Server Exploitation", "slug": "initial-access-mdaemon-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "MDaemon mail servers", "HELLAGE backdoor", "HELLTAG backdoor" ] }, { "name": "Recruitment-Themed Phishing", "slug": "initial-access-recruitment-phishing", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "recruitment-themed social engineering", "AI-generated phishing lure images" ] }, { "name": "Developer Credential Harvesting", "slug": "credential-access-developer-harvesting", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "harvesting developer credentials", "private source code repositories" ] }, { "name": "Source Code Injection", "slug": "initial-access-supply-chain-injection", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "injecting malicious code into public and private source code repositories" ] }, { "name": "Backdoor Execution", "slug": "execution-backdoor-deployment", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "PteroBox", "PteroPSDoor", "Rezzuar", "HELLAGE", "HELLTAG" ] }, { "name": "AI Guardrail Evasion Decoy", "slug": "defense-evasion-llm-safety-trigger", "tactic": "defense-evasion", "techniques": [ "T1027" ], "observables": [ "decoy request for instructions on building a nuclear weapon into a script comment" ] } ], "summary": "APT groups in Q2-Q3 2026 targeted development environments via credential harvesting and source code injection, exploited MDaemon mail servers to deploy backdoors, and utilized AI-generated content and decoys for social engineering and defense evasion. Notable activities include North Korean DeceptiveDevelopment's supply chain attacks and the first documented destructive operation by Belarus-aligned FrostyNeighbor." }, "severity": "critical", "rationale": "Focus the hunt on critical repositories that control deployment pipelines and prioritize accounts with maintainer access.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has compromised developer credentials to harvest sensitive repository secrets and inject malicious code into private source code repositories, bypassing standard CI/CD protections.", "parameters": { "scope_actors": { "from": { "ref": "lead-pivot", "kind": "manual", "observed": "2026-10-28" }, "type": "list[string]", "default": [], "description": "Developer accounts identified in the lead query to pivot on." }, "target_repos": { "from": { "ref": "inventory", "kind": "manual", "observed": "2026-10-28" }, "type": "list[string]", "default": [], "description": "Critical repositories to focus on; empty means all." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-10-28" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/", "name": "ESET APT Activity Report Q2 2026\u2013Q3 2026" } ], "blind_spots": [ { "id": "limited-diff-visibility", "risk": "The GitHub audit log confirms a push occurred but does not contain the code diff itself, requiring manual inspection.", "stage": "initial-access-supply-chain-injection", "question": "what specific lines of code were modified", "requires": "direct repository audit of file diffs" }, { "id": "mfa-bypass-visibility", "risk": "Sophisticated session hijacking may appear as a successful login without explicit MFA failure logs.", "stage": "credential-access-developer-harvesting", "question": "whether the actor bypassed MFA or used a session cookie hijack", "requires": "hb_auth_signin mfa result detail" } ] }, "name": "Development Pipeline Credential Abuse and Injection", "description": "This hunt targets the code-injection tradecraft observed in North Korea-aligned campaigns where compromised developer credentials grant access to repositories and secrets. The hunt identifies unauthorized repository modifications in the GitHub audit log and correlates them with anomalous sign-in patterns and secret enumeration. The flow isolates the supply chain risk at the point of injection and pivots to identity telemetry to confirm the compromise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "eset-apt-activity-report-q2-2026-q3-2026", "index": 1, "title": "ESET APT Activity Report Q2 2026\u2013Q3 2026", "total": 2 }, "coverage": [ { "stage": "credential-access-developer-harvesting", "steps": [ "secret-access-prevalence", "high-risk-authentication" ], "status": "covered" }, { "stage": "initial-access-supply-chain-injection", "steps": [ "github-push-events", "manual-commit-review" ], "status": "covered" }, { "stage": "initial-access-mdaemon-exploit", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "initial-access-recruitment-phishing", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "execution-backdoor-deployment", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-llm-safety-trigger", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" } ], "rationale": "An adversary has compromised developer credentials to harvest sensitive repository secrets and inject malicious code into private source code repositories, bypassing standard CI/CD protections.", "blind_spots": [ { "id": "limited-diff-visibility", "risk": "The GitHub audit log confirms a push occurred but does not contain the code diff itself, requiring manual inspection.", "stage": "initial-access-supply-chain-injection", "question": "what specific lines of code were modified", "requires": "direct repository audit of file diffs" }, { "id": "mfa-bypass-visibility", "risk": "Sophisticated session hijacking may appear as a successful login without explicit MFA failure logs.", "stage": "credential-access-developer-harvesting", "question": "whether the actor bypassed MFA or used a session cookie hijack", "requires": "hb_auth_signin mfa result detail" } ], "scoping_notes": "Focus the hunt on critical repositories that control deployment pipelines and prioritize accounts with maintainer access.", "beyond_detection": "A simple alert on a GitHub push is too noisy; this hunt correlates push activity with rare secret enumeration and high-risk sign-in context across two telemetry surfaces (GitHub API and Entra/Okta auth), using stack-counting to isolate anomalous developer behavior." } }, { "id": "github-push-events", "type": "query", "label": "Detect unauthorized pushes and repository updates", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT actor_user_name, resource_name, src_endpoint_ip, api_operation, user_agent, time FROM hb_cloud_api_activity WHERE provider = 'github' AND activity_id = 3 AND (LOWER(api_operation) LIKE '%push%' OR LOWER(api_operation) LIKE '%update%' OR LOWER(api_operation) LIKE '%commit%') AND ('{{target_repos}}' = '' OR instr(',' || '{{target_repos}}' || ',', ',' || resource_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_cloud_api_activity", "description": "Detect unauthorized pushes or commits to source code repositories.", "expected_signal": "Push events from developer accounts, particularly those associated with critical production repositories. Silence suggests no modifications were logged via the GitHub API." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Detect unauthorized pushes and repository updates", "reads": [ "actor_user_name", "resource_name", "src_endpoint_ip", "api_operation", "user_agent", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT actor_user_name, resource_name, src_endpoint_ip, api_operation, user_agent, time FROM hb_cloud_api_activity WHERE provider = 'github' AND activity_id = 3 AND (LOWER(api_operation) LIKE '%push%' OR LOWER(api_operation) LIKE '%update%' OR LOWER(api_operation) LIKE '%commit%') AND ('{{target_repos}}' = '' OR instr(',' || '{{target_repos}}' || ',', ',' || resource_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Push events from developer accounts, particularly those associated with critical production repositories. Silence suggests no modifications were logged via the GitHub API.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "secret-access-prevalence", "type": "query", "label": "Prevalence of secret enumeration", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(api_operation) AS operation, COUNT(DISTINCT actor_user_name) AS users, COUNT(*) AS calls, MIN(time) AS first_seen FROM hb_cloud_api_activity WHERE provider = 'github' AND activity_id = 2 AND (LOWER(api_operation) LIKE '%secret%' OR LOWER(api_operation) LIKE '%key%' OR LOWER(api_operation) LIKE '%token%') AND ('{{scope_actors}}' = '' OR instr(',' || '{{scope_actors}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY operation HAVING users <= 3 ORDER BY users ASC", "surface": "hb_cloud_api_activity", "description": "Identify if the actors were reading repository secrets, highlighting users who perform these operations rarely.", "expected_signal": "Developers reading repository secrets outside of standard automated patterns. Silence suggests no rare secret harvesting was detected." }, "parents": [ { "id": "github-push-events" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Prevalence of secret enumeration", "reads": [ "api_operation", "actor_user_name", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT LOWER(api_operation) AS operation, COUNT(DISTINCT actor_user_name) AS users, COUNT(*) AS calls, MIN(time) AS first_seen FROM hb_cloud_api_activity WHERE provider = 'github' AND activity_id = 2 AND (LOWER(api_operation) LIKE '%secret%' OR LOWER(api_operation) LIKE '%key%' OR LOWER(api_operation) LIKE '%token%') AND ('{{scope_actors}}' = '' OR instr(',' || '{{scope_actors}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY operation HAVING users <= 3 ORDER BY users ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Developers reading repository secrets outside of standard automated patterns. Silence suggests no rare secret harvesting was detected.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "api_operation" ], "rare_below": 3 }, "verified_at": "2026-10-29" } }, { "id": "high-risk-authentication", "type": "query", "label": "High-risk authentication context", "config": { "dsl": "sqlite", "role": "enrichment", "source": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, risk_state, status, time FROM hb_auth_signin WHERE provider IN ('github', 'azure_ad', 'okta') AND (risk_state != 'none' OR status != 'Success') AND ('{{scope_actors}}' = '' OR instr(',' || '{{scope_actors}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Check for sign-in anomalies such as high risk levels or unusual source IPs for the actors in question.", "expected_signal": "A sign-in with an 'atRisk' state or a failed authentication attempt preceding the push activity. Silence means no anomalous logins were detected." }, "parents": [ { "id": "github-push-events" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "High-risk authentication context", "reads": [ "actor_user_name", "src_endpoint_ip", "src_location_country", "risk_state", "status", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, risk_state, status, time FROM hb_auth_signin WHERE provider IN ('github', 'azure_ad', 'okta') AND (risk_state != 'none' OR status != 'Success') AND ('{{scope_actors}}' = '' OR instr(',' || '{{scope_actors}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A sign-in with an 'atRisk' state or a failed authentication attempt preceding the push activity. Silence means no anomalous logins were detected.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "triage-session-compromise", "type": "analytic", "label": "Triage session compromise", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "github-push-events", "secret-access-prevalence", "high-risk-authentication" ], "objective": "Determine if pushes were performed by developer accounts that also show signs of rare secret harvesting or high-risk authentication. Look for time-boxed correlation between a risky authentication event and the first secret-access or push event for each account.", "description": "Weigh the evidence from push events, secret access, and auth logs.", "max_iterations": 6, "expected_signal": "A per-account verdict citing API calls and auth anomalies.", "success_criteria": "A verdict of malicious or suspicious for any account involved in push events from anomalous sources or after rare secret access." }, "parents": [ { "id": "secret-access-prevalence", "kind": "merge" }, { "id": "high-risk-authentication", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one developer account", "condition": "the triage verdict is malicious for at least one developer account", "blind_spot": "limited-diff-visibility", "confidence": "high", "description": "Direct the hunt based on the agent triage.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-session-compromise" } ] }, { "id": "revoke-developer-sessions", "type": "action", "label": "Revoke developer sessions", "config": { "target": "identity", "description": "Immediately stop the actor by revoking sessions and tokens.", "instructions": "Revoke all active Personal Access Tokens (PATs) and web sessions for the compromised developer account in GitHub.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-commit-review", "type": "task", "label": "Manual commit and diff review", "config": { "assignee": "analyst", "description": "Verify the content of the commits to determine if malicious code was successfully injected.", "instructions": "Manually inspect the repository diffs for the commits identified in the lead query. Look for unauthorized changes to build scripts or dependencies." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "revoke-developer-sessions" } ] }, { "id": "close-out", "type": "task", "label": "Record remediation and findings", "config": { "assignee": "analyst", "description": "Document findings and determine if the lead query should be promoted.", "instructions": "Document the scope of the exposure and the remediation steps taken. Determine if the lead query warrants a permanent detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-commit-review" } ] } ] }