Threat video1:00
AsyncRAT via Fake GitHub Security Tools: Detection & IOCs
Fake GitHub security tools deliver AsyncRAT and an infostealer; 9 detection rules, 52 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for AsyncRAT via Fake GitHub Security Tools: Detection & IOCs →
Chapters
- 0:00The hookFake GitHub tools infected about ~2,000 systems.
- 0:04The storyFor two years, trojans hid in GitHub tools.
- 0:10Attack pathBuilding the project triggered malware.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise47 indicators to hunt: 2 IPs, 4 domains and 11 URLs, and more.
- 0:38MITRE ATT&CK techniques25 ATT&CK techniques, from resource development to impact.
- 0:43Remediation5 steps now: Hunt for and block the published Dr[.]Web IOCs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake GitHub tools infected about ~2,000 systems.
0:05For two years, trojans hid in GitHub tools.
0:11Building the project triggered malware. PowerShell downloaded the loader from Pastebin.
0:16The loader patched security APIs and disabled antivirus.
0:20Remote access, clipper, stealer exfiltrated via Telegram.
0:27No threat actor is attributed. Confidence: low.
0:3147 indicators to hunt: 2 IPs, 4 domains and 11 URLs, and more.
0:3925 ATT&CK techniques, from resource development to impact.
0:445 steps now: Hunt for and block the published Dr[.]Web IOCs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.