GITSHELLPAD GitHub C2 Polling

Tim Peck@timpeck

•updated Jan 26, 2026•2•0•57

Detects network connections to the GitHub API attempting to fetch a 'command.txt' file. This behavior is characteristic of the GITSHELLPAD backdoor, which uses private GitHub repositories for command and control (C2) communication as seen in the Gopher Strike campaign.