167. Adversaries Use Weaponized GitHub Repositories to Deliver Malware
Hello everyone! Trend Micro has uncovered a new threat actor dubbed Water Curse . The adversary uses weaponized GitHub repositories to deliver multistage malware. Researchers already identified at least 76 GitHub accounts related to this campaign. So, the project files contain a snippet of malicious batch file code inside of the <PreBuildEvent> tag, which would be triggered while the code is compiling. MSBuild.exe spawns cmd.exe , which drops a malicious .vbs file, for example, C:\Users\[redacted]\AppData\Local\Temp\ohQ13W\XHa0aaUw9.vbs . And yes, we can use this behavior for hunting: event_type: "filecreatewin" AND proc_p_file_path: "msbuild.exe" AND proc_file_path: "cmd.exe" AND file_path: "vbs" See you tomorrow!