Tuesday , April 1 2025
Github

Recorded Future Report
Security Experts Urge IT to Lock Down GitHub Services

Recorded Future, a threat intelligence firm, has cautioned that malicious actors are using GitHub services more to carry out secret cyber-attacks and has advised IT teams to act.

Its new report, Flying Under the Radar: Abusing GitHub for Malicious Infrastructure, revealed the most popular GitHub services for threat actors.

CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw

Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
CVE-2025-1268  Patch urgently! Canon Fixes Critical Printer Driver Flaw

Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

Australian fintech database exposed in 27000 records

Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
Australian fintech database exposed in 27000 records

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
Over 200 Million Info Leaked Online Allegedly Belonging to X

FBI investigating cyberattack at Oracle, Bloomberg News reports

The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
FBI investigating cyberattack at Oracle, Bloomberg News reports

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

CIRT alert Situational Awareness for Eid Holidays

As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
CIRT alert Situational Awareness for Eid Holidays

Cyberattack on Malaysian airports: PM rejected $10 million ransom

Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
Cyberattack on Malaysian airports: PM rejected $10 million ransom

Micropatches released for Windows zero-day leaking NTLM hashes

Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Micropatches released for Windows zero-day leaking NTLM hashes

Between March and November 2023, GitHub Raw, GitHub Objects, and GitHub Pages were the most commonly used in attacks, according to an analysis of threat intelligence samples.

GitHub has nearly 100 million developers. This means it could be a big problem if it is misused.

Recorded Future stated that threat actors use it to hide malicious activity by blending in with benign network traffic. GitHub services are often unblocked in organizations and have high uptime. Additionally, they require minimal new account verification and offer limited detection possibilities for service providers.

The report said that it is a popular, inexpensive, and very effective platform for controlling malware and transferring data secretly.

Organizations need to consider GitHub in their threat modelling, Recorded Future argued.

“In the near term, defenders should pursue a service-based strategy by flagging or even blocking specific GitHub services that are not normally used in their environment and are known to be used maliciously,” the report noted.

“This should be paired with a context-based strategy based on the principle that only specific parts of a corporate environment necessitate interaction with particular GitHub services. In the longer term, organizations should allocate resources to better understand how GitHub and other code repositories are abused.”

It concluded with eight recommendations:

*Enhance visibility into GitHub with granular monitoring of all web and cloud traffic and context-aware policies enforced at the instance level
* Maintain an up-to-date asset inventory listing all users authorized to access GitHub
* Adapt detection strategies to align with the organization’s particular environment
* Deploy adaptive security policies, potentially alongside application allow-listing
* Protect GitHub accounts to prevent hijacking by threat actors to steal code or use as C&C infrastructure
* Continually assess effectiveness of threat detection capabilities by integrating scenarios of GitHub abuse into attack simulations
* Collaborate with GitHub to help it fight back against known malicious activity on the platform
* Perform proactive threat hunting to fight unknown instances of GitHub abuse

Check Also

CheckPoint

Cybercriminals Exploit Checkpoint’s Driver in a BYOVD Attack

Threat actors are exploiting a component of CheckPoint’s ZoneAlarm antivirus to bypass Windows security measures. …

Leave a Reply

Your email address will not be published. Required fields are marked *