Updated December 13 with news of a zero-day exploit that impacts Windows users, along with further technical details regarding the Shai-Hulud 2.0 Dune Worm attacks, and the original reporting of the Microsoft mitigation recommendations for rapid password replacement.
In response to what the Microsoft Defender Security Research Team has called “one of the most significant cloud-native ecosystem compromises observed recently,” it has urged organizations to act rapidly and replace passwords. Here’s what you need to know about the so-called Shai-Hulud 2.0 Dune Worm attacks.
Microsoft Issues Critical Warning Following Shai-Hulud 2.0 Dune Worm Attacks
On September 23, the Cybersecurity Infrastructure and Security Agency, which refers to itself as America’s Cyber Defense Agency, issued an urgent alert regarding a self-replicating worm, known as Shai-Hulud, targeting Application Programming Interface keys for cloud services such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Fast-forward to now, and the Microsoft Defender Security Research Team has published new guidance for “detecting, investigating, and defending against the supply chain attack,” as Shai-Hulud 2.0 enters the cyber equation.
“The Shai‑Hulud 2.0 campaign builds on earlier supply chain compromises,” Microsoft said, “but introduces more automation, faster propagation, and a broader target set.” This includes executing malicious code during the pre-install phase of the infected npm managed packages, which means that it happens before any security checks can be made. “Stolen credentials are exfiltrated to public attacker-controlled repositories,” the warning continued, “which could lead to further compromise.”
This supply chain attack is, Adi Bleih, a security researcher for external risk management at Check Point, told me, unusually aggressive as a result. “By activating before installation completes and exfiltrating secrets into attacker-controlled GitHub repositories,” Bleih said, “the operators gained rapid access to significant volumes of cloud and developer credentials.”
ReversingLabs Dissects Dune Worm
Tomislav Peričin, chief software architect at ReversingLabs, has published an in-depth technical analysis of Sha1-Hulud: The Second Coming. “The same worm capabilities used in the first wave are also present in the malware of this second wave,” Peričin explained, “in that, once a package is infected, it spawns attacks of its own by allowing the worm to propagate through other open source packages the author maintains.” Peričin confirmed that the ReversingLabs analysis has identified in excess of 27,000 new GitHub repositories created by the Dune Worm during these latest attacks, intended for storing exfiltrated data from compromised users.
According to the RL analysis, Shai-Hulud 2.0 has four main stages:
- After compromising an account, the worm looks for other packages maintained by the same account and creates new package versions with a “postinstall script, adding a malicious bundle.js” that is executed when users install the package itself.
- The worm’s script looks for environment tokens using the popular open-source TruffleHog tool capable of detecting “more than 800 different types of secrets, to identify the victims’ secrets.”
- These are then exfiltrated to the aforementioned GutHub repositories and double Base64-encoded.
- Finally, the Shai-Hulud 2.0 worm will try to create public copies of the repositories, described as Shai-hulud Migration. “The intent appears to be both exposure of source code and secrets embedded in private repos,” Peričin said, “possibly for the purpose of harvesting and re-use by malicious actors.”
Ken Johnson, chief technology officer of DryRun Security, meanwhile, confirmed that Shai-Hulud 2.0 is the third attack to have been attributed to a threat group identified as S1ngularity. “This second version of the Shai-Hulud worm tells us the attackers are refining their techniques and improving upon their previous mistakes,” Johnson advised. As such, it’s a “massively dangerous and disruptive campaign.”
You Can Patch This Zero-Day, But Not Using Microsoft Updates
Bad cybersecurity news, especially for Microsoft users, sadly always seems to follow the London bus model: one critical story turns up, and then others quickly follow. Such is the case with the warnings regarding the Shai-Hulud 2.0 Dune Storm, now followed by an alert about a zero-day affecting the Windows Remote Access Connection Manager and lacking an official fix from Microsoft as of yet. Which is n to the same as having no fix, it must be said, and more of that in a moment. But first, what is the new RasMan vulnerability?
Researchers have revealed that, while analyzing an already patched Windows RasMan privilege escalation vulnerability, CVE-2025-59230, another popped into clear view. Not an escalation issue this time, but rather a denial-of-service one. RasMan, in case you were wondering, is not a little-known superhero from the Microsoft Universe, but a service that manages remote network and VPN connections. As such, it is a highly critical thing that you really do not want to be disrupted. This is unfortunate, as there is no Microsoft patch to fix the latest vulnerability, although there is an exploit that works and is being distributed online already.
“We found an exploit for (CVE-2025-59230) that nicely demonstrated local arbitrary code execution as Local System when launched as a non-admin Windows user,” ACROS Security CEO and co-founder of the 0patch micro-patching service, Mitja Kolsek, said. But that’s not the concern here: “This exploit also included an exploit for another vulnerability that turned out to have remained unpatched to this day,” Kolsek confirmed.
The vulnerability, the ACREOS team found, could be traced back to flawed coding logic, oh, what a surprise, not. Essentially, it causes a memory access violation that then crashes the RasMan service. This of a highly technical bent can see how this works, in glorious detail, in a report published by Kolcek December 12.
I have approached Microsoft for a comment about patch availability, but in the meantime, you can use a free micro-patch from 0patch until any official fix becomes available.
Microsoft Defender Security Research Team Recommendations For Shai-Hulud 2.0 Mitigations
The Microsoft Defender Security Research Team mitigation recommendations are unequivocal:
- Rapidly rotate and revoke exposed credentials.
- Review the Key Vault assets on the critical asset management page and investigate any relevant logs for unauthorized access.
- Isolate affected CI/CD agents or workspaces.
- Prioritize high-risk attack paths to reduce further exposure.
- Remove unnecessary roles and permissions granted to identities assigned to CI/CD pipelines; specifically review access to key vaults.
Don’t delay, absorb all the Microsoft advice and act rapidly as has been recommended. You know it makes sense.
