A recent investigation uncovered over 100 backdoored GitHub repositories masquerading as malware and gaming cheats, with infection chains leading to multiple RATs and infostealers. The campaign primarily targets cheating gamers and inexperienced cybercriminals but poses risks to anyone compiling unverified code. #SakuraRAT #ischhfd83 #SearchFilter
Keypoints
- 141 GitHub repositories linked to the ischhfd83 email address were found, 133 of which contained backdoors embedded in various languages including Visual Basic PreBuild events, Python, screensaver (.scr), and JavaScript files.
- The primary infection chain involves a multi-stage process starting from a PreBuild event script that downloads and executes a malicious 7z archive named SearchFilter.7z hosted on GitHub.
- The final payload comprises complex malware including Electron-based apps, infostealers such as Lumma Stealer, and RATs including AsyncRAT and Remcos, communicating with the threat actor via Telegram bots.
- The threat actor employs automated GitHub Actions workflows to simulate repository activity through frequent commits, aiming to make repositories appear actively maintained and attract victims.
- Backdoored repositories mainly target gaming cheats (58%), with others posing as malware tools (24%), bot software, cryptocurrency tools, and miscellaneous utilities.
- The campaign shows links to a Distribution-as-a-Service operation active since at least 2022, with signs of ongoing evolution and possible connections to previously reported campaigns like Stargazers Ghost Network and GitVenom.
- Indicators of compromised infrastructure include malicious URLs (e.g., rlim[.]com, popcorn-soft.glitch[.]me), Telegram bot communications, and deceptive domains such as arturshi[.]ru redirecting to fraudulent financial sites.
MITRE Techniques
- [T1070.004] Indicator Removal on Host: File Deletion – The malware deletes shadow copies to obstruct data recovery (‘functions included deleting shadow copies’).
- [T1059] Command and Scripting Interpreter – Use of PowerShell, VBS, Python, and JavaScript scripts to execute malicious payloads during infection (‘The PreBuild event contained commands designed to silently download malware’).
- [T1566.001] Phishing: Spearphishing Attachment – Malicious code embedded in GitHub repositories acting as lure for inexperienced threat actors and gamers (‘repositories purported to be malware and gaming cheats but contained backdoors’).
- [T1204] User Execution – Infection requires users to compile or run unverified code (‘compiling code from an open-source repository is no different than running an unverified executable’).
- [T1497] Virtualization/Sandbox Evasion – Malware checks CPU cores as a crude anti-VM measure (‘malware executes PowerShell command to obtain number of CPU cores’).
- [T1083] File and Directory Discovery – Malware collects host system information including username, hostname, OS version, and network interfaces (‘collects basic infection info about infected device’).
- [T1105] Ingress Tool Transfer – Payloads and scripts downloaded from multiple URLs and Pastebin-like services (‘downloads 7z archive and other payloads from URLs such as hxxps://rlim[.]com’).
- [T1027] Obfuscated Files or Information – Heavy obfuscation and encoding used in scripts and payloads (‘payloads were heavily obfuscated’; use of Base64 encoding and encryption with Fernet library).
- [T1071.001] Application Layer Protocol: Web Protocols – Communication with attacker via Telegram bots and interaction with web servers for payload delivery (‘malware sending data via Telegram bot’).
Indicators of Compromise
- [Domains] Malicious download and command-and-control domains – rlim[.]com, popcorn-soft.glitch[.]me, pastebin[.]com, pastejustit[.]com, arturshi[.]ru, octofin[.]co
- [File Hashes] Malicious files linked to backdoors and payloads (e.g., SearchFilter.7z archive and .scr files) – first seen in December 2023 on VirusTotal (specific hashes available on GitHub repository).
- [Email Addresses] Associated with repositories and contributors – ischhfd83[at]rambler[.]ru, dfghtjyfdyhu567[at]outlook[.]com, Ali888Z (Pastebin user).
- [File Names] Malicious build files and payloads – SearchFilter.exe, app.asar (Electron archive), Paypal Payment Resou[U+202E]nls..scr (with right-to-left override), app.py (Python backdoor script).
- [URLs] Payload and script hosting links – hxxps://github[.]com/unheard44/fluid_bean/releases/download/releases/SearchFilter.7z, hxxps://img[.]guildedcdn[.]com (no longer serving files), multiple Pastebin and Pastejustit raw links.
Views: 25