Atrás 
Netskope Threat Research Labs has discovered an attack that hosts its payload Remote Access Trojan (RAT) on GitHub. The hosting of the malicious code behind cloud apps is becoming popular among attackers. In December 2017, we discovered TelegramRAT which used Dropbox to host its malicious payload. Of course, GitHub can be used as a resilient malware payload host because of its designed high availability. Another central benefit the attacker has in hosting the payload on a cloud App, such as GitHub, is that it is often allow listed from security scanners. This means that the RAT will get a pass until, perhaps, when it is detonated, at which time, it is often too late.
Generally, this allow listing of cloud apps is done to reduce the performance issues introduced by blind scanners which evaluate the entire cloud app space equivalently. It is for this reason that we recommend deployment of cloud app aware security scanners which can differentiate between sanctioned instances of the app, like those used by internal developers, and those that are unsanctioned, like those used by attackers.
In this case, the attacker used GitHub’s native branching to hide the malware from casual passers-by. The attacker behind this tailored the hosting of files in GitHub to hide their malware files behind different branches rather than a master branch so that it’s not directly visible to users. We worked with the GitHub security team, and the malicious account is now taken down at the time writing this blog.
Threat Detection & Protection
The fact that many organizations use Github for source control and to support the ease of use, the organizations typically allow list all the traffic to and from Github.com. In this case, it is Github.com; but the allow listing can also apply to other cloud apps, which leads to a new attack surface. Only Netskope has the capability of performing an in-depth inspection at the instance level of a cloud app, which ultimately provides the best solution for scenarios such as the ones described in this blog. For example, Netskope Active Platform customers can use the Netskope Context Engine to enable cloud app instance-level policies to block downloads from unsanctioned cloud storage applications. There were a couple of binaries hosted on the GitHub account which dropped CyberGate RAT, and Netskope Threat Protection detects these threats as “Trojan.GenericKD.6190562”, “Trojan.Agent.CPZE”, “Trojan.Autoit.Agent.PT” and the dropped RAT binary as “Trojan.Agent.AROC”.
Recommendations
Netskope recommends the following to combat such threats:
- Detect and remediate cloud threats using a threat-aware CASB solution like Netskope and enforce policy on usage of unsanctioned services as well as unsanctioned instances of sanctioned cloud services
- Sample policies to enforce:
- Scan all uploads from unmanaged devices to sanctioned cloud applications for malware
- Scan all uploads from remote devices to sanctioned cloud applications for malware
- Scan all downloads from unsanctioned cloud applications for malware
- Scan all downloads from unsanctioned instances of sanctioned cloud applications for malware
- Enforce quarantine/block actions on malware detection to reduce user impact
- Block unsanctioned instances of sanctioned or well-known cloud apps to prevent attackers from exploiting user trust in the cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via the cloud.
- Enforce DLP policies to control files and data en route to or from your corporate environment
- Regularly backup and turn on versioning for critical content in cloud services
- Enable the “View known file extensions” option on Windows machines
- Warn users to avoid executing unsigned macros and macros from an untrusted source, unless they are confident they are safe
- Warn users to avoid executing a file unless they confident that the files are harmless
- Warn users against opening untrusted attachments, regardless of their extensions or filenames
- Keep systems and antivirus updated with the latest releases and patches
Peering into the malicious GitHub account
The GitHub user account hosting malicious codes is as shown in Figure 1.
Figure 1: GitHub account hosting malicious repositories.
As shown in Figure 1, the attacker created four repositories in November 2017 that were still active at the time of writing this blog. Every repository hides malicious files in different branches with similar functionality of infection. Let’s have a close look at one of the repositories, “fisf” as shown in Figure 2.
