HACKERAI Malware: GitHub Gists Used for Covert C2

Acronis research describes a newly identified malware framework named HACKERAI that uses legitimate GitHub Gists as a covert C2 channel to receive commands and exfiltrate data; the campaign reportedly targeted telecom, government, defense, energy and critical infrastructure organizations in South Asia and is assessed with moderate confidence as linked to APT36 (Transparent Tribe). The report outlines capabilities (system-info collection, remote command execution, persistence via browser shortcut changes), defensive recommendations, and notes the absence of machine-readable IoCs in the published summary.