Poisoned Pipeline / Incidents / AS24
Self-hosted GitHub Actions runners (Praetorian Gato)
Praetorian's 2022–2023 red-team work, released as Gato (GitHub Attack
Toolkit) at ShmooCon 2023, showed that non-ephemeral self-hosted Actions
runners are a supply-chain persistence and lateral-movement platform.
A job on the runner executes on the underlying host, on the internal
network, and can schedule follow-on workflows. GitHub's own docs warn
against using self-hosted runners on public repos. T0148 was identified
from this class of operations, not from one public victim advisory.
Mapped techniques
- T0148 Scheduled tasks on self hosted runner
- T0132 Overprivileged CI/CD Runners
- T0166 Trigger pipeline execution
supply-chain Self-hosted runner
Self-hosted runners persist the environment between jobs; a malicious
workflow can leave scheduled tasks or extra runner registrations.
The runner host sits inside the org network and holds deployment
credentials the public GitHub-hosted runner never sees.
Gato's attack module pushes a workflow or opens a fork PR that
executes on the self-hosted runner.
Framework gaps noted
- Public named-victim write-ups for this pattern exist in later Actions worms; this story records the research identification of T0148.