kitty-monitor
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Both run a backdoor called kitty-monitor, which polls GitHub’s commit search every hour for signed remote commands.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniques
Execution
The monitor polls GitHub commit search for signed instructions and can download and execute follow-on Python payloads.
Persistence
5 techniques
Persistence
The monitor polls GitHub commit search for signed instructions and can download and execute follow-on Python payloads.
The payload also installs OS-level background services: a systemd user service on Linux, a LaunchAgent on macOS.
on macOS, it can install com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
Privilege Escalation
5 techniques
Privilege Escalation
The monitor polls GitHub commit search for signed instructions and can download and execute follow-on Python payloads.
The payload also installs OS-level background services: a systemd user service on Linux, a LaunchAgent on macOS.
on macOS, it can install com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
Command and Control
2 techniques
Command and Control
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A persistent backdoor component installed as an OS-level background service on Linux and macOS that polls GitHub commit search for signed remote commands.
Persistent GitHub commit-search C2 daemon used by the Shai-Hulud campaign. It survives token rotation by polling GitHub for signed commands, downloading referenced payloads, and executing them.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.