Shai-Hulud
Also known as CHAINDROP
Reports
6
First seen
Jun 8, 2026
Last seen
Oct 8, 2026
Motivation
Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1555 Credentials from Password Stores ×5T1005 Data from Local System ×4T1041 Exfiltration Over C2 Channel ×4T1195 Supply Chain Compromise ×3T1003 OS Credential Dumping ×2T1195.001 Compromise Software Dependencies and Development Tools ×2T1570 Lateral Tool Transfer ×2T1566 Phishing ×1T1555.005 Credentials from Password Stores: Cloud Credentials ×1T1078 Valid Accounts ×1T1071 Application Layer Protocol ×1T1195.003 Compromise Software Supply Chain ×1
Indicators
domain ×4cve ×3filename ×3
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
Critical