HACKERAI Malware: GitHub Gists Used for Covert C2

Introduction: HACKERAI Malware — Why It Matters

HACKERAI Malware is a newly identified malware framework that reportedly uses GitHub Gists as a command-and-control (C2) channel. According to research attributed to Acronis, it can retrieve attacker instructions and upload stolen information through legitimate GitHub services, helping malicious traffic blend with normal cloud activity.

The campaign reportedly targeted telecom, government, defense, energy, and critical infrastructure organizations across South Asia. Victims were approached through fake telecom services, government updates, VPN tools, and software installers.

Who Is Behind HACKERAI?

Acronis researchers identified HACKERAI alongside related malware families called PATCHCORD and SHEETCORD. The activity has been assessed with moderate confidence as linked to APT36, also known as Transparent Tribe, or to a closely related Pakistan-linked threat actor.

The attribution remains an assessment rather than a definitive identification.

HACKERAI Malware: Technical Breakdown

How the GitHub Gist C2 Channel Works

HACKERAI reportedly uses GitHub Gists to exchange information rather than relying only on dedicated attacker-controlled servers. The malware can check the legitimate platform for commands and use it to send collected information back to operators.

This can complicate network detection because connections to widely used cloud services may appear less suspicious than traffic to an unfamiliar command server.

Capabilities and Persistence

The reported capabilities include:

• Collecting system information.
• Retrieving and executing remote commands.
• Uploading stolen information through the C2 channel.
• Maintaining persistence by modifying browser shortcuts.
• Using phishing archives and disguised installers as an entry point.

Unexpected browser shortcut changes can provide a useful host-level detection signal even when network traffic appears normal.

Timeline of Events

Researchers identified the malware while investigating a wider espionage campaign affecting multiple sensitive sectors in South Asia.

Potential Risks & Impact

Information and Operational Risk

A successful infection could expose system information and allow remote command execution. For organizations operating critical systems, that access could support reconnaissance, further compromise, or theft of sensitive information.

Business and Compliance Risk

A compromise can create risks involving intelligence loss, disruption, and investigation costs. Security teams should preserve relevant logs and evidence if suspicious activity is detected.

Official Response / Statement

The supplied material identifies Acronis as the research source but does not provide a separate victim statement, government advisory, or official response from affected organizations. No such statement should be inferred without independent confirmation.

Acronis publishes threat research and cyberthreat updates covering emerging campaigns and malware activity. Acronis Threat Research Unit

Industry Context: Why Cloud-Based C2 Is Increasing

HACKERAI Malware reflects a wider challenge: attackers can abuse legitimate online platforms instead of building every part of their infrastructure themselves. Acronis has also documented campaigns involving legitimate cloud services for command-and-control or data movement, showing why trusted SaaS traffic can require behavioral analysis.

Readers can follow similar developments through Cyber Incidents and review defensive guidance in Learn & Protect.

How to Protect Yourself / Your Organization

1. Monitor unusual GitHub activity from endpoints that normally have no business reason to access Gists.
2. Alert on unexpected browser shortcut modifications.
3. Restrict execution of installers and archives received through unsolicited messages.
4. Train employees to verify government, telecom, VPN, and software-update claims before opening files.
5. Review outbound connections to cloud platforms for unusual processes, timing, or volume.
6. Use application allowlisting and least-privilege controls to reduce the impact of remote command execution.
7. Preserve endpoint, DNS, proxy, and authentication logs for investigation.
8. Review the site’s security resources for additional defensive practices.

Indicators of Compromise (IoCs)

The supplied research summary does not provide specific domains, IP addresses, file hashes, GitHub account names, or other machine-readable IoCs. Defenders should therefore avoid treating generic GitHub access as a standalone indicator.

Useful behavioral indicators include:

• Unexpected GitHub Gist activity from a workstation.
• Browser shortcuts modified without an approved change.
• Suspicious installers or phishing archives.
• Unknown processes repeatedly connecting to GitHub.
• System-information collection followed by outbound data transfer.

Key Takeaways

• HACKERAI reportedly uses GitHub Gists as a covert C2 mechanism.
• The campaign targeted sensitive sectors across South Asia.
• Acronis identified HACKERAI alongside PATCHCORD and SHEETCORD.
• The activity has a moderate-confidence association with APT36 or a related Pakistan-linked actor.

Conclusion: HACKERAI Malware and What Happens Next

HACKERAI Malware highlights how legitimate cloud platforms can be repurposed for covert command-and-control and data theft. The key defensive challenge is distinguishing normal SaaS activity from malicious behavior without simply blocking widely used services.

Security teams should watch for targeted phishing, suspicious installers, browser shortcut changes, and unusual GitHub activity. Further technical reporting or official advisories could provide additional attribution details and machine-readable IoCs as the investigation develops. Readers can follow new developments through Cyber Incidents coverage.