Ankura CTIX FLASH Update - July 26, 2024

Malware Activity

Stargazer Goblin uses GitHub for Malware Distribution-as-a-Service

Researchers at Check Point have identified a threat actor named Stargazer Goblin that has been creating and leveraging Github accounts to distribute malware since at least July 2023. Stargazer Goblin's Distribution-as-a-Service (DaaS) network is called "Stargazers Ghost Network", and it uses GitHub repositories to distribute malware to unsuspecting victims. Researchers at Check Point calculate that more than 3,000 active Ghost accounts comprise the DaaS network. An advertisement for the DaaS network was identified on a dark web forum first published July 8, 2023. The majority of malware seen distributed by this network are infostealers, including RedLine, Lumma Stealer, and Atlantida Stealer. The GitHub repositories hosting the malware either promote an archived file that is password protected (to evade scanning by antiviruses) or contain a link to a compromised WordPress site