Shai-Hulud

☆ pin

Also known as CHAINDROP

Reports

First seen

Jun 8, 2026

Last seen

Aug 10, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Technology ×2 Other ×1

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×2T1555 Credentials from Password Stores ×2T1005 Data from Local System ×2T1059.007 Command and Scripting Interpreter: JavaScript ×1T1566 Phishing ×1T1567.002 Exfiltration Over Web Service - Cloud Storage ×1T1003 OS Credential Dumping ×1T1027 Obfuscated Files or Information ×1T1552.007 Unsecured Credentials: Containerized Secrets ×1T1053.006 Scheduled Task/Job: Systemd Timers ×1T1547.014 Launch Agent ×1T1598 Phishing for Information ×1

Indicators

cve ×3filename ×2domain ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-12537 CVE-2026-54316 CVE-2026-64638

Recent reports

High