InfoSecBulletin Cybersecurity for mankind
Recorded Future’s Insikt Group has discovered a major cyber threat campaign carried out by Russian-speaking hackers, possibly located in the Commonwealth of Independent States (CIS).
This campaign misuses GitHub, a platform for software development, to spread different malware. The report explains how attackers pretend to be popular software like 1Password, Bartender 5, and Pixelmator Pro to infect victims with malware that steals information like AMOS, Vidar, Lumma, and Octo. The malware variants have a shared command-and-control infrastructure, indicating a well-coordinated attack strategy to cause the most damage on different platforms.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Hackers make GitHub profiles to share infected versions of popular software. When users download these apps, their devices get malware that can steal data and do harmful actions. This shows the hackers are adaptable and use shared command-and-control systems, suggesting a well-organized cyber attack.
Insikt Group’s analysis uncovered various malware families in this campaign, such as:
Atomic macOS Stealer (AMOS): Targets macOS users by impersonating commonly used applications.
Vidar and Lumma: Information stealers that target Windows devices.
Octo: A banking trojan specifically targeting Android devices.
Attackers effectively use GitHub to manage their malicious tools and target various operating systems with different types of malware.
The campaign uses complex tactics such as domain spoofing. This means that users are redirected from harmless websites to harmful GitHub repositories. The malware tricks users by pretending to be a necessary software update or additional software, making them unknowingly download it.
Insikt Group also uncovered the backend infrastructure used in this campaign, including multiple C2 servers and the use of public file-sharing services like Dropbox and Pixeldrain to spread additional payloads. The usage of FileZilla servers for managing and disseminating malware variants highlights the campaign’s sophistication.
Insikt Group recommends several mitigation strategies, including:
*Verify the authenticity of the download sources and maintain updated antivirus and anti-malware solutions.
* Employ tools like GitGuardian and GitHub Advanced Security to scan for potentially malicious code.
* Implement an organization-wide code review process for any externally obtained code before its integration into production environments.
