TechOfficeTwo Distinct GitHub Projects Spark Interest from Separate Contacts Yesterday
Emerging GitHub Malware Campaign Utilizing StealC: A Detailed Analysis
Recent communications from two distinct individuals regarding different projects on GitHub have unveiled an alarming trend. The first, identified as "Tito," reached out via direct message concerning a comment on GitHub about a supposed patch for "synara." The second, referred to as "Robert Z," sent an email about a similar situation involving another project on the platform. These reports led to a deeper investigation which revealed a pervasive malware campaign leveraging GitHub comments in a disturbingly innovative way.
Malicious Activity Overview
Upon investigation, it became evident that multiple files linked to malware have been circulating online under various names, including:
- hb_patch_v1112
- registry_patch_v0.1.7
- rep_fix_v1.zip
- sodium_fix_v1
- log_fix_patch
These patches have become a vector for malware distribution as attackers create accounts on GitHub, post comments on open issues, and convince unsuspecting developers that they have discovered a genuine fix. This behavior appears to be automated, leading to rapid dissemination of the malicious links.
| File Name | Description |
|---|---|
| hb_patch_v1112 | Malware sample claiming to fix issues in projects |
| registry_patch_v0.1.7 | Alleged registry fix with malicious payload |
| rep_fix_v1.zip | Zipped file containing harmful executable |
| sodium_fix_v1 | Pseudonym for another malware variant |
| log_fix_patch | Claims to fix logs but embeds malware |
Attack Lifecycle
This specific campaign is believed to have initiated on July 7. The method involves a program written in Go that, once executed, queries a remote host. In this case, the targeted host resolves to a Telegram channel. The description of this Telegram channel refers to a website, which serves as the endpoint where the malware payload exfiltrates sensitive code and information.
One of the strategic advantages of this approach is the ability for the attackers to swiftly modify the Telegram channel's description. Should the designated website be taken down, they can easily point to a new one without significant disruption to their operations. Essentially, they have created an informal DNS resolver mechanism utilizing Telegram as a relay point.
Identification and Characteristics
Security analysts have identified this malware as StealC based on YARA identifiers. This suggests that it is likely an evolution of existing malware technologies, with potentially new variations introduced to evade detection effectively. The creative coupling of GitHub spam and the use of a bootleg DNS resolver on Telegram showcases advanced tactics aimed at undermining developer resources.
As Telegram does not traditionally respond rapidly to takedown requests, this channel serves as an ideal communication vector for malicious actors, allowing them extended operational timeframes before being disrupted.
Conclusion
The revelation of this malware campaign highlights an emerging trend in cyber threats that exploit well-established platforms such as GitHub. Developers must remain vigilant against unsolicited patches and examine the origins of any files they download. As the landscape of cyber threats evolves, it is crucial for the tech community to collaborate in identifying and mitigating these risks effectively.
This situation is a wake-up call, reminding us that vigilance and proactive defense mechanisms are paramount in the ongoing battle against cybercrime.
Yesterday two different people contacted me about two different projects on GitHub. "Tito" DMd me about someone making a comment on GitHub claiming to have a patch for "synara" (Image 1) "Robert Z" emailed about something similar on a different GitHub project (image 2). Interesting. Upon further investigation it turns out this exact file has been discovered online named: - hb_patch_v1112 - registry_patch_v0.1.7 - rep_fix_v1.zip - sodium_fix_v1 - log_fix_patch blah blah blah (image 3) Basically, someone is creating accounts on GitHub, going to open issues, and leaving a comment saying they've found a patch (it's likely automated, but whatever). The patch is malware. It appears this campaign began around July 7th (yesterday) and is making its rounds pretty quickly. When you look inside (hehe silly reference) it's a program written in Go. When the binary detonates it queries a remote host which resolves to ... Telegram. The Telegram channel description specifies a website. The website in the Telegram description is where the payload exfiltrates code too. They're doing it this way because they can quickly change the Telegram channel description if the website they specify is taken down. It's basically a bootleg DNS resolver (image 4). Anyway, this is StealC (based on YARA identifiers). This is (probably) a new malware campaign by someone using StealC. I like it. Very cool usage of GitHub spam combined with a bootleg ass DNS resolver on Telegram. It probably helps because I doubt Telegram is quick to take action with takedown requests. Yesterday two different people contacted me about two different projects on GitHub. "Tito" DMd me about someone making a comment on GitHub claiming to have a patch for "synara" (Image 1) "Robert Z" emailed about something similar on a different GitHub project (image 2). Interesting. Upon further investigation it turns out this exact file has been discovered online named: - hb_patch_v1112 - registry_patch_v0.1.7 - rep_fix_v1.zip - sodium_fix_v1 - log_fix_patch blah blah blah (image 3) Basically, someone is creating accounts on GitHub, going to open issues, and leaving a comment saying they've found a patch (it's likely automated, but whatever). The patch is malware. It appears this campaign began around July 7th (yesterday) and is making its rounds pretty quickly. When you look inside (hehe silly reference) it's a program written in Go. When the binary detonates it queries a remote host which resolves to ... Telegram. The Telegram channel description specifies a website. The website in the Telegram description is where the payload exfiltrates code too. They're doing it this way because they can quickly change the Telegram channel description if the website they specify is taken down. It's basically a bootleg DNS resolver (image 4). Anyway, this is StealC (based on YARA identifiers). This is (probably) a new malware campaign by someone using StealC. I like it. Very cool usage of GitHub spam combined with a bootleg ass DNS resolver on Telegram. It probably helps because I doubt Telegram is quick to take action with takedown requests.
