GitLocker Breach

Overview

In June 2024, GitHub users fell victim to an extortion campaign targeting their repositories. The threat actor gained unauthorized access to GitHub accounts using stolen credentials that seemed to be acquired from previous breaches. The attacker deleted the repository contents and replaced them with a README file. Inside the file there are instructions directing the victims to contact the threat actor through Telegram to get their deleted data in exchange for a ransom.

Incident Analysis

Root Causes

Credential Mismanagement

Many users used weak passwords or reused credentials across different platforms, making them more vulnerable to attacks.

Lack of Layered Security

Many compromised GitHub accounts did not have MFA enabled, making it easy for the attacker to access the account by using the password only.

Lack of Monitoring and Detection

Insufficient monitoring of repository activity logs and accounts permissions delayed the detection process of the attack.

Attack Techniques

Initial Access

• The attackers used stolen GitHub credentials obtained from previous data breaches or phishing campaigns.

• The attackers used Malicious OAuth apps to bypass security defences, exploiting users’ trust in third party integrations.

Repository Manipulation

Once the attackers gain access to the users’ repositories, they:

• Deleted all repository contents.

• Renamed the repositories.

• Repository contents were backed up by the attackers to use them for extortion.

Extortion

The attackers replaced the repos with a README file holding a message stating that the data has been backed up and providing instructions to contact the attackers on Telegram and the victims must pay a ransom to get their data back.

Motivations Behind the Attack

The main motive behind this attack is financial gain through extortion. By deleting repositories content, the attacker caused operational problems and forced the organizations to pay the ransom to get the data back.

Impact of the Attack

Financial Loss

Victims must deal with ransom demands with no guarantee of data recovery even if payment is made.

Workflow Disruption

The deleted repositories will disrupt workflows and could expose organizations to significant delays.

Reputational Damage

The affected organizations may lose the confidence of their customers and partners if the sensitive data is leaked.

Supply Chain Attack Risks

If the affected repositories include dependencies or shared libraries used by other projects or third parties, this could lead to supply chain attacks.

Recommendations

Enable Multi-Factor Authentication (MFA)

All users should enable MFA to add an extra layer of security.

Continuous Monitoring

Regularly monitor and review account activity logs for any unauthorized access or changes.

Secrets Management

Regularly rotate secrets and use strong, unique passwords for each account.

Review Authorized Apps

Review and audit all OAuth apps and revoke access to any suspicious ones.

Affected GitHub Repos - Source: BleepingComputer