3 days Ago
Beware the Shelby malware family. It has been quite the few weeks when it comes to data-stealing malware reports, what with a million Windows devices infected via GitHub, the bypassing of Windows Defender security protections, and even an alert about time-traveling hackers . I honestly thought that last article would be the strangest headline I’d write for a while, but then came a security warning by order of the Peaky Blinders.
Here’s what you need to know about the Shelby malware family. Fans of the long-running British TV drama Peaky Blinders mourned when the final series was aired in 2022. Although a Peaky Blinders movie should be released before too long, there are plenty of us fans who miss the weekly fix of Shelby family shenanigans.
The very bad news, I’m afraid, is that the Shelby family is now back. Bad because, unfortunately, it’s the Shelby malware family. A new report from Seth Goodwin, the senior research engineer for intelligence at Elastic Security Labs, has confirmed that a data-stealing malware campaign has been observed using accounts and domains in the name of Arthur Shelby.
Arthur was Tommy Shelby’s brother in the TV show, best known for his use of extreme violence and shouts of “by order of the Peaky Blinders.” The Shelby accounts have now been shut down by GitHub, who I have approached for a statement. Once again, this is a highly technical and detailed report best suited to professional defenders, but please go read it if you are of a technical inclination.
Otherwise, here’s the TL;DR version. The Shelby malware family uses, or perhaps more appropriately abuses, GitHub in order to establish a command-and-control foothold, to steal data and retrieve commands. An analysis of unused code along with the dynamic nature of the payload loading would suggest, Goodwin said, that “the malware is under active development, indicating future updates may address any issues with contemporary versions.
” Those issues include a critical flaw, Goodwin revealed, “anyone with the personal access token can control infected machines, exposing a significant security vulnerability.” In the campaign observed by Elastic Security Labs, a phishing email was used with a call to action regarding network alarms along with a zipped file containing a Windows executable to start the attack chain. You should, therefore, take all the usual precautions when receiving unexpected emails with urgent calls to action — by order of the Peaky Blinders.
.
