Exploiting Trusted Platforms: Banking Malware via GitHub and FileZilla

 Source: Hackers Exploited GitHub and FileZilla to Deliver Banking Malware (cybersecuritynews.com)

According to the Inskit Group at Recorded Future, activities by Russian-speaking threat actors originating from the Commonwealth of Independent States (CIS) have been uncovered as the primary source behind the spread of sophisticated banking malware through GitHub and FileZilla. Despite being known as relatively secure collaboration platforms, their exploitation to spread sophisticated malware and malicious payloads throughout the internet poses a significant threat to both personal and business security. 

The methodology used by the attackers revolved around creating fake Github accounts and repositories that mimicked legitimate software offerings such as Bartender 5 and Pixelmator Pro. Subsequently, they opted to instead populate their spoofed repositories with malicious software such as Atomic MacOS Stealer (AMOS) and Vidar, which were designed to steal sensitive information from unsuspecting users who downloaded the software, thinking that it was legitimate. Populating such repositories with malicious software guaranteed the attackers some degree of success, mainly based on users who visited the site intending to access the legitimate software that the attackers falsely advertised there. 

Subsequently, upon user download, the malware could perform several illegitimate actions, including remote access to victim computers, data exfiltration, and establishing connections with command-and-control (C2) servers. Furthermore, the research conducted by the Inskit Group indicated that a degree of collaboration and coordination was uncovered between the malware variants pushed by the Russian-speaking hackers. This was due primarily to them sharing the same C2 infrastructure, which supports the theory of a coordinated and well-funded operation behind the recent attacks, potentially emanating from an organized cybercrime group or even a state-funded APT. 

In addition to GitHub, the attackers also used FileZilla, a popular site commonly used as an FTP file transfer client. Similarly to their use of the former platform, FileZilla was used to distribute their malicious payloads to unsuspecting users across the internet. Consequently, their dual exploitation of distinct trusted services across the internet to target end users underlines the sophistication and modularity of this threat group's attack mechanisms. 

In terms of mitigation and protection strategies against such threats, organizations are encouraged to implement stringent security measures, which include but are not limited to code review and automated scanning processes. The latter option can be conducted via automated scanning tools such as GitGuardian, Checkmarx, or GitHub Advanced Security. Furthermore, collaboration and awareness are crucial in the fight against attacks such as these, as security is greatly enhanced by more alert, aware, and skeptical end users. 

For a broader and more holistic overview on the attack, feel free to check out the original article on Cybersecurity News.