Flying Under the Radar: Abusing GitHub for Malicious Infrastructure

New Insikt Group research discusses the frequent abuse of GitHub's services by cybercriminals and advanced persistent threats (APTs) for various malicious infrastructure schemes. These include payload delivery, dead drop resolving (DDR), full command-and-control (C2), and exfiltration. GitHub's popularity among threat actors lies in its ability to allow them to blend in with legitimate network traffic, making detection and attribution challenging for defenders.

The "living-off-trusted-sites" (LOTS) approach is highlighted as a growing trend among APTs, with less-sophisticated groups expected to follow …

abuse abusing advanced advanced persistent threats apts command control cybercriminals ddr dead delivery exfiltration github infrastructure insikt group lies malicious malware analysis payload persistent persistent threats radar research services threat threat actors threats under under the radar