cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

Microsoft Restores 73 GitHub Repositories After Suspected Supply-Chain Compromise

· Original article ↗

Summary

Microsoft temporarily removed 73 GitHub repositories after a suspected Miasma/Shai-Hulud supply-chain compromise, disrupting CI and Azure Functions workflows. The repositories were restored; Microsoft said it was investigating and notified potentially affected customers

Key points

  • Microsoft removed 73 repositories across several of its GitHub organizations on June 5; the repositories were restored after the incident.
  • The removal disrupted CI pipelines and access to Azure/functions-action, causing Azure Functions workflows to fail.
  • Microsoft said it removed the repositories while investigating potential malicious content, notified some potentially affected customers, and would continue investigating.
  • Researchers linked the incident to the Miasma/Shai-Hulud supply-chain campaign; Microsoft’s investigation was ongoing.
  • OpenSourceMalware reported that the durabletask repository and its PyPI package had been compromised in May, with three malicious versions published; this was not confirmed by Microsoft.
  • Cloudsmith concluded that Microsoft’s Azure GitHub environment and durabletask were compromised through Miasma.

Article Details

Victim Organization
Microsoft
Incident Type
Suspected software supply-chain compromise affecting Microsoft GitHub repositories and the durabletask package, followed by temporary repository removal.
Operational Impact
Removal of 73 repositories briefly disrupted CI pipelines and Azure Functions deployment workflows. The disruption was contained within 105 seconds; the repositories were later restored and described as clean and safe to use.
Claim Status
alleged

MITRE ATT&CK

T1195.001 · Compromise Software Dependencies and Development ToolsResearchers reported that the durabletask package was compromised and malicious versions were pushed, consistent with compromise of software dependencies.

People

Adnan KhanSecurity engineer who said the June 5 incident affecting Microsoft repositories appeared to be part of the Miasma malware campaign.

Malware

Miasma73 GitHub repositories across several of its organizations after a suspected compromise tied to the Miasma/Shai-Hulud supply-chain campaign, briefly disrupting CI pipelines and Azure Functions workflows.Shai-HuludGitHub repositories across several of its organizations after a suspected compromise tied to the Miasma/Shai-Hulud supply-chain campaign, briefly disrupting CI pipelines and Azure Functions workflows.

Vendors

MicrosoftMicrosoft removed 73 GitHub repositories across several of its organizations after a suspected compromise tied to the Miasma/Shai-Hulud supply-chain campaign, briefly disrupting CI pipelines and Azure Functions

Products

Azure Functionscompromise tied to the Miasma/Shai-Hulud supply-chain campaign, briefly disrupting CI pipelines and Azure Functions workflows.GitHubMicrosoft removed 73 GitHub repositories across several of its organizations after a suspected compromise tied to the Miasma/Shai-Hulud supply-chain campaign, briefly disrupting CI pipelines and Azure FunctionsPyPI#Microsoft

Related Articles