FragNetsia, Shai-Hulud, and the Opexus Database Deletion Attack
· 22:10 · Watch on YouTube ↗
Summary
The panel discusses FragNetsia, a Linux kernel flaw enabling local privilege escalation and cache persistence; the Shai-Hulud supply-chain worm and its variants; and two former Opexus employees reportedly convicted after deleting 96 federal databases.
Key points
- The panel describes FragNetsia as a Linux kernel vulnerability that lets local unprivileged users alter cached kernel-page data and escalate to root.
- Because the exploit changes in-memory page-cache data rather than disk contents, integrity checks may miss it; the panel says altered cached files may remain after patching until the cache is flushed or the system reboots.
- The speakers report that Team PCP released the Shai-Hulud worm's source code and offered a $1,000 challenge for hackers to use it to cause downstream damage.
- The worm targets NPM and PyPI, harvests AWS, Kubernetes, and GitHub tokens, and can publish poisoned package updates. The panel distinguishes a mini variant focused on CI/CD pipelines and trusted publishing.
- The speakers say Muneeb and Shohaib Akhtar were convicted after using still-active privileged access, minutes after being fired, to delete 96 federal databases containing investigation files and records for 45 agencies, including DHS and EEOC.
- The discussion highlights timely access revocation during employee offboarding as a key security control.
Article Details
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe video describes exploiting a Linux kernel vulnerability to escalate from local unprivileged access to root.T1195.002 · Compromise Software Supply ChainThe Shai-Hulud worm is described as publishing poisoned updates to legitimate packages in NPM and PyPI ecosystems.
Threat Actors
Muneeb AkhtarThe speakers say Muneeb Akhtar was convicted for a retaliatory attack on former employer Opexus, in which still-active privileged access was used to delete 96 federal databases.Shohaib AkhtarThe speakers say Shohaib Akhtar was convicted for a retaliatory attack on former employer Opexus, in which still-active privileged access was used to delete 96 federal databases.TeamPCPThe speakers identify Team PCP as a hacking group that released the Shai-Hulud worm source code and offered cash for downstream damage caused using it.