Ankura CTIX FLASH Update - April 23, 2024

Ransomware/Malware Activity

GitHub and GitLab CDN Flaw Abused to Push Malware via Legitimate Repo URLs

A flaw in GitHub's CDN (Content Delivery Network) enables attackers to upload malware into comments on GitHub repositories. The flaw was discovered after researchers noted that a new LUA malware loader was being distributed through URLs to Microsoft's GitHub repository for vcpkg and the STL library. However, references to the malware were not actually found on Microsoft's live repository, leading Bleeping Computer to discover that the GitHub URL hosting the malware must have been generated by exploiting a flaw in GitHub's CDN design. The flaw in the design is that GitHub automatically generates a download link after a file is added to a comment on a repository, which is then available via Github's CDN. Even when the comment is not posted, or deleted after posting, the files are not deleted from the CDN and the download URLs continue to be accessible. This