Malware leveraging public infrastructure like GitHub on the rise

The use of public services as command-and-control (C2) infrastructure isn’t a revolutionary technique for malicious actors. ReversingLabs has observed such behavior in several malware campaigns throughout the last few years.

Malware authors occasionally place their samples in services like Dropbox, Google Drive, OneDrive and Discord to host second stage malware and sidestep detection tools. However, the ReversingLabs threat research team has recently observed the increasing use of the GitHub open source development platform for hosting malware. 

Here are two novel …

authors campaigns command control discord drive dropbox github google google drive host infrastructure isn malicious malicious actors malware onedrive public public services reversinglabs services stage threat research