Executive Summary
Researchers and threat actors, including the Shai-Hulud worm, are increasingly repurposing legitimate CI/CD infrastructure for Command and Control (C2). By deploying the official, digitally signed `gitlab-runner.exe` binary onto compromised Windows endpoints, attackers can establish a persistent backdoor that blends with legitimate developer traffic. The Shai-Hulud worm has notably weaponized this technique at scale, affecting over 25,000 repositories by using public CI infrastructure to maintain access.
Technically, the attack involves registering a self-hosted runner to an attacker-controlled GitLab project. The runner polls GitLab via outbound HTTPS (port 443), fetches job scripts defined in `.gitlab-ci.yml`, and executes them locally using the shell executor. This model bypasses traditional EDR detections because the binary is trusted and the network behavior mimics authorized DevOps workflows. Persistence is achieved by installing the runner as a Windows service, often under high-privilege accounts like `LocalSystem`.
This threat is significant for organizations using GitLab or GitHub, as it turns a standard development tool into a stealthy exfiltration and execution platform. The use of legitimate binaries and encrypted outbound-only traffic makes identification difficult without specific behavioral monitoring for anomalous CI/CD runner activity on non-build servers.