Skip to content

Dual-channel exfiltration

Named by 2 kept items in this workspace.

Search every workspace for Dual-channel exfiltration. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
    writeup2026-05-19

    Encrypted data (PBKDF2-derived key, 200,000 iterations, SHA-256) exfiltrated via GitHub API dead-drop (commits to antvis/G2 repo with spoofed python-requests/2.31.0 User-Agent and campaign fingerprint string) or fallback direct HTTPS to t.m-kosche.com disguised as OpenTelemetry endpoint (api/public/

  • Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
    writeup

    Simultaneous attempt over HTTPS POST (chunked, HMAC-SHA256 authenticated) to a typosquatted domain and DNS TXT queries to a direct C2 IP; either channel succeeding is sufficient

All techniques in this workspace.