GitHub

A network named Stargazer Goblin manipulated GitHub to promote malware and phishing links, impacting the platform's integrity by boosting malicious repositories' popularity using ghost accounts. These activities aimed to deceive users seeking free software into downloading ransomware and info-stealer malware, compromising user data and potentially causing financial and reputational harm to both GitHub and its users. GitHub’s response was to disable accounts in violation of their policies and continue efforts to detect and remove harmful content.

Source: https://www.wired.com/story/github-malware-spreading-network-stargazer-goblin/

TPRM report: https://scoringcyber.rankiteo.com/company/github

"id": "git001072724",
"linkid": "github",
"type": "Breach",
"date": "7/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': 'GitHub Users',
                        'industry': 'Software Development',
                        'name': 'GitHub',
                        'type': 'Platform'}],
 'attack_vector': 'Social Engineering, Malicious Links',
 'data_breach': {'type_of_data_compromised': 'User Data'},
 'description': 'A network named Stargazer Goblin manipulated GitHub to '
                "promote malware and phishing links, impacting the platform's "
                "integrity by boosting malicious repositories' popularity "
                'using ghost accounts. These activities aimed to deceive users '
                'seeking free software into downloading ransomware and '
                'info-stealer malware, compromising user data and potentially '
                'causing financial and reputational harm to both GitHub and '
                "its users. GitHub's response was to disable accounts in "
                'violation of their policies and continue efforts to detect '
                'and remove harmful content.',
 'impact': {'brand_reputation_impact': 'High',
            'data_compromised': 'User Data',
            'identity_theft_risk': 'High',
            'systems_affected': 'GitHub Platform'},
 'initial_access_broker': {'entry_point': 'Ghost Accounts',
                           'high_value_targets': 'GitHub Users'},
 'motivation': 'Financial Gain, Data Theft',
 'post_incident_analysis': {'corrective_actions': 'Disable Ghost Accounts, '
                                                  'Continuous Detection and '
                                                  'Removal',
                            'root_causes': 'Trust in Popular Repositories'},
 'response': {'containment_measures': 'Disabled Ghost Accounts',
              'remediation_measures': 'Continued Detection and Removal of '
                                      'Harmful Content'},
 'threat_actor': 'Stargazer Goblin Network',
 'title': 'Stargazer Goblin Network Manipulates GitHub to Promote Malware',
 'type': 'Malware Distribution and Phishing',
 'vulnerability_exploited': 'User Trust in Popular Repositories'}