Harden-Runner

Reported Context (9)

Harden-Runner gives security teams visibility into outbound connections and correlates activity with CI workflow steps. Its network policies can restrict destinations, and its monitoring helps teams investigate Python and CI/CD Users Urged to Update After emSign CA Incident
Harden-Runner provides network and process visibility during CI/CD runs and correlates outbound connections with the responsible repository, workflow, and step. The C2 address in this campaign, 193.32.204.199, has been GhostAction Adds Git-History Credential Harvesting to Malicious GitHub Workflows
Harden-Runner provides network and process visibility during supported CI/CD runs, helping teams investigate suspicious activity and correlate outbound connections with the responsible workflow step. StepSecurity Reports Credential-Stealing Backdoor in @subql/common 5.8.3
Harden-Runner now supports those runners. Step Security Adds Harden-Runner Support for AWS CodeBuild GitHub Actions Runners
Deny lists close that gap. The Harden-Runner GitHub Action v2.21.0 adds a denied-endpoints input that blocks the destinations you list and leaves everything else reachable. Step Security Adds Deny-List Egress Policies to Harden-Runner

CVE (1)

Malware (5)

People (4)

Threat Actors (3)

MITRE ATT&CK (21)

Vendors (8)

Products (31)

Tools (1)

Industries (14)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.