# Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer

> Retrospective overview of how attackers weaponize software supply chains, covering CCleaner (2017), SolarWinds Orion SUNBURST (2020), Codecov Bash Uploader (2021), Kaseya VSA (2021), MOVEit Transfer CVE-2023-34362 (2023) and the npm Shai-Hulud worm (2025). This is trend and educational context, not a new incident.

- **Published:** 2026-11-07T11:35:07Z
- **Last reviewed:** 2026-11-07T11:35:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5509
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5509.png
- **ID:** TL-2026-5509
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** REvil
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)
- **CVEs:** CVE-2023-34362, CVE-2021-30116, CVE-2021-30117, CVE-2021-30118

## Description

The Netlas overview (2025-12-26) summarizes recurring supply-chain compromise patterns: trojanized signed releases, build-pipeline tampering, CI script modification, compromised maintainer credentials, typosquatting, dependency confusion, and exploitation of vendor platforms that fan out to many downstream customers. It is a retrospective article and does not report a new incident, CVE, actor or IOC set. The IOCs and dates below come from the primary sources cited for each incident.

CCleaner (2017): trojanized CCleaner 5.33 (released 2017-08-15) and CCleaner Cloud 1.07.3191 were distributed from official Piriform/Avast infrastructure until 5.34 shipped on 2017-09-12. Cisco Talos found the Floxif-based CCBkdr backdoor, which fetched shellcode from a C2 server. Avast/press estimates are about 2.27 million affected users.

SolarWinds Orion (2020): the SUNBURST backdoor was inserted into the signed solarwinds.orion.core.businesslayer.dll in Orion 2019.4 HF5 through 2020.2 HF1. It used delayed execution, DGA-style subdomains of avsvmcloud.com for C2, and selective activation, with follow-on access to Azure AD/M365 (SAML token abuse). CISA issued Emergency Directive 21-01 on 2020-12-13, and the US Government attributed the campaign to Russia's SVR on 2021-04-15. The article cites 18,000+ organizations.

Codecov (2021): between 2021-01-31 and 2021-04-01 an attacker modified the Bash Uploader using a credential exposed in a Docker image creation error. The altered script sent git remote and environment variables to attacker IPs with curl. Detection came from a customer's SHA-256 comparison of the script, and disclosure followed on 2021-04-15.

Kaseya VSA (2021-07-02): REvil/Sodinokibi pushed ransomware to MSP customers by exploiting VSA zero-days (CVE-2021-30116 and related CVE-2021-30117/30118/30120/30121). The article cites 1,500+ downstream organizations.

MOVEit Transfer (2023): CL0P exploited SQL injection CVE-2023-34362 starting 2023-05-27, deployed the LEMURLOOT web shell (human2.aspx) and bulk-exfiltrated data. CISA added it to KEV on 2023-06-02.

npm Shai-Hulud (2025): a self-replicating worm that runs a post-install bundle.js, uses TruffleHog to harvest GitHub/npm/cloud secrets, and publishes them to attacker-controlled GitHub repositories or webhook endpoints. Shai-Hulud 2.0 (about 2025-11-21 to 11-24) moved to preinstall scripts (setup_bun.js, bun_environment.js). The article cites 33,000+ unique secrets exposed.

The article also covers event-stream/flatmap-stream (2018), left-pad (2016), colors/faker maintainer sabotage, 287 typosquatted npm packages, torchtriton dependency confusion, and defenses (SBOM, Sigstore/SLSA, hash verification, least-privilege short-lived CI credentials).

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1505.003 Server Software Component: Web Shell
- T1027 Obfuscated Files or Information
- T1553.002 Subvert Trust Controls: Code Signing
- T1552.001 Unsecured Credentials: Credentials In Files
- T1071.001 Application Layer Protocol: Web Protocols
- T1568.002 Dynamic Resolution: Domain Generation Algorithms

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shai-Hulud npm Worm Lifecycle Script and TruffleHog Execution** (`TL-2026-5509-SPL-002`)

Detects node/bun executing the Shai-Hulud payload files setup_bun.js, bun_environment.js or bundle.js under an npm lifecycle script, and TruffleHog launched by node/bun/shell, which the worm uses to harvest GitHub, npm and cloud secrets from developer and CI hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.007, T1552.001
- **Data sources:** sysmon, DeviceProcessEvents, process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (((Image="*node.exe" OR Image="*bun.exe" OR Image="*/node" OR Image="*/bun") AND (CommandLine="*setup_bun.js*" OR CommandLine="*bun_environment.js*" OR (CommandLine="*bundle.js*" AND ParentCommandLine="*npm*"))) OR (Image="*trufflehog*" AND (ParentImage="*node.exe" OR ParentImage="*bun.exe" OR ParentImage="*/node" OR ParentImage="*/bun" OR ParentImage="*/sh" OR ParentImage="*/bash")))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ('node','node.exe','bun','bun.exe') and (ProcessCommandLine contains 'setup_bun.js' or ProcessCommandLine contains 'bun_environment.js' or (ProcessCommandLine contains 'bundle.js' and InitiatingProcessCommandLine has_any ('npm','pnpm','yarn'))))
    or (FileName in~ ('trufflehog','trufflehog.exe') and InitiatingProcessFileName in~ ('node','node.exe','bun','bun.exe','sh','bash'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Shai-Hulud npm Worm Lifecycle Script and TruffleHog Execution
id: b4a2d3e5-6c7f-4a81-9ba2-1d3e4f5a6b72
status: experimental
description: Detects execution of Shai-Hulud payload files (setup_bun.js, bun_environment.js, bundle.js under npm) and TruffleHog launched by node or bun for secret harvesting.
references:
    - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1059.007
    - attack.credential-access
    - attack.t1552.001
    - attack.tool.trufflehog
logsource:
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - 'node.exe'
            - 'bun.exe'
            - '/node'
            - '/bun'
    selection_loader:
        CommandLine|contains:
            - 'setup_bun.js'
            - 'bun_environment.js'
    selection_bundle:
        CommandLine|contains: 'bundle.js'
        ParentCommandLine|contains:
            - 'npm'
            - 'pnpm'
            - 'yarn'
    selection_trufflehog:
        Image|contains: 'trufflehog'
        ParentImage|endswith:
            - 'node.exe'
            - 'bun.exe'
            - '/node'
            - '/bun'
            - '/sh'
            - '/bash'
    condition: (selection_img and (selection_loader or selection_bundle)) or selection_trufflehog
falsepositives:
    - Developers legitimately running TruffleHog from a Node-based wrapper
    - Projects that ship a build artifact named bundle.js and run it from an npm script
level: high
```

**Known false positives:**

- Developers legitimately running TruffleHog from a Node-based wrapper
- Projects that ship a build artifact named bundle.js and run it from an npm script

**Tuning notes:** Drop the bundle.js branch on build servers that legitimately run webpack output. Allowlist sanctioned secret-scanning pipelines by parent command line. Correlate hits with the npm install that preceded them and rotate every secret reachable from the host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SUNBURST Trojanized SolarWinds Orion Component and Orion Host Shell Spawn (locked: unlock with TL Creds)
- Codecov Bash Uploader Environment and Git Remote Exfiltration via curl (locked: unlock with TL Creds)
- Network Contact with Codecov and MOVEit Campaign IPs (locked: unlock with TL Creds)
- Shai-Hulud Malicious GitHub Workflow and Payload File Creation (locked: unlock with TL Creds)
- Kaseya VSA Agent Spawning REvil Deployment and Defender Tampering Commands (locked: unlock with TL Creds)
- Node or Bun Process Exfiltrating to webhook.site (Shai-Hulud) (locked: unlock with TL Creds)
- MOVEit Transfer LEMURLOOT [indicator] Web Shell Access (CVE-2023-34362) (locked: unlock with TL Creds)
- SUNBURST DGA-Style C2 and Secondary Domain DNS Resolution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `178.62.86[.]114`
- Domain: `avsvmcloud[.]com`
- URL: `hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Supply Chain Attack - How Attackers Weaponize Software Supply Chains (Netlas)](https://netlas.io/blog/supply_chain_attack/)
- [CISA AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a)
- [CISA AA23-158A: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a)
- [Codecov Security Update (Bash Uploader incident)](https://about.codecov.io/security-update/)
- [Talos: CCleaner Command and Control Causes Concern / Avast distributes malware](https://blog.talosintelligence.com/avast-distributes-malware/)
- [Tenable: CVE-2021-30116 Multiple Zero-Day Vulnerabilities in Kaseya VSA Exploited to Distribute REvil Ransomware](https://tenable.com/blog/cve-2021-30116-multiple-zero-day-vulnerabilities-in-kaseya-vsa-exploited-to-distribute-ransomware)
- [Trend Micro: IT Management Platform Kaseya Hit with Sodinokibi/REvil Ransomware](https://www.trendmicro.com/en_ph/research/21/g/it-management-platform-kaseya-hit-with-sodinokibi-revil-ransomwa.html)
- [Datadog Security Labs: Shai-Hulud 2.0 npm worm](https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/)
- [Check Point: Shai-Hulud 2.0 - Inside The Second Coming](https://blog.checkpoint.com/research/shai-hulud-2-0-inside-the-second-coming-the-most-aggressive-npm-supply-chain-attack-of-2025/)
- [Blackpoint Cyber: Inside the Shai-Hulud NPM Supply Chain Attack](https://blackpointcyber.com/blog/inside-the-shai-hulud-npm-supply-chain-attack/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5509