Summary:
The use of public services as command-and-control (C2) infrastructure by malicious actors is not a new phenomenon, with Dropbox, Google Drive, OneDrive, and Discord being commonly observed platforms. However, a recent trend detected by researchers highlights an increasing reliance on the GitHub open-source development platform for hosting malware. In this evolving landscape, two novel techniques have been identified the abuse of GitHub Gists and the issuance of commands through git commit messages. Malware authors are leveraging these techniques to host second-stage malware, sidestepping detection tools, and exploiting the familiarity of developer traffic with such platforms.[/subscribe_to_unlock_form]
Summary:
The use of public services as command-and-control (C2) infrastructure by malicious actors is not a new phenomenon, with Dropbox, Google Drive, OneDrive, and Discord being commonly observed platforms. However, a recent trend detected by researchers highlights an increasing reliance on the GitHub open-source development platform for hosting malware. In this evolving landscape, two novel techniques have been identified the abuse of GitHub Gists and the issuance of commands through git commit messages. Malware authors are leveraging these techniques to host second-stage malware, sidestepping detection tools, and exploiting the familiarity of developer traffic with such platforms.[emaillocker id="1283"]
The first technique involves the use of GitHub Gists, a feature designed for sharing code snippets. Malicious actors utilize secret Gists, which do not appear in public searches or on the user's profile page, making them a discreet means of hosting two-stage malicious payloads. In a specific case, PyPI packages masquerading as network proxying libraries contained Base64-encoded strings that, when decoded, revealed URLs pointing to secret Gists. These Gists, belonging to throwaway accounts, contained Base64-encoded Python commands, demonstrating an unusual method of command delivery.
The second technique involves malware embedded in PyPI packages which abuses version control system features. After installation, the malware clones a specific GitHub repository and checks for commit messages beginning with a predefined string. If found, the malware decodes the Base64-encoded commit message, executing it as a Python command in a new process. An interesting aspect is the use of an original method for command delivery through git commit messages, though the identified malware samples were not observed executing malicious functionality.
While the use of GitHub as C2 infrastructure is not new, the abuse of features like Git Gists and commit messages for command delivery represents novel tactics by malicious actors. Researchers speculates that a common malware author may be behind both campaigns, given the identical execution technique and impersonation of similar networking utilities. Despite the removal of these malicious packages from PyPI, the persistence of the malware author in publishing new samples suggests that more GitHub-centric attack methods may emerge. Developers and application security teams are urged to remain vigilant within the open-source ecosystem, employing modern tooling for comprehensive software supply chain security to discern between malicious and legitimate packages.
Threat Profile:
References:
The following reports contain further technical details:
https://thehackernews.com/2023/12/hackers-abusing-github-to-evade.html
[/emaillocker]