Angreifer gehackt andere Benutzer Git-Repositories und erfordern Geld für die Datenrettung

ZDNet Journalisten zeigten die Aufmerksamkeit auf ungewöhnliches Problem der Git-Repositories, einschließlich GitHub, Bitbucket und Gitlab Benutzer.

Last week unknown attacker or a group of attackers started hacking other people’s repository, löschen Sie alle anfänglichen Codes und Kommentare, und später erfordern Buyout für die Datenrettung.

Nachricht mit Buy-out-Anforderung, die oben dargestellt ist, also says that prior to deleting information attacker thoughtfully saved it on his server, and victim has 10 days on payment transition. Otherwise attacker threatens to delete data forever.

To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA and contact us by Email at with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us and we will send you a proof. Your code is downloaded and backed up on our servers. If we don’t receive your payment in the next 10 Tage, we will make your code public or use them otherwise, , — says blackmailer’s message.

Currently on Bitcoin-wallet that is mentioned in the message was not received any transactions, though journalists inform about 392 victims of the blackmail campaign on GitHub only while Atlassian company experts say about at least 1000 involved users.

Gemäß Bad Packets company specialists, the most likeable is that this attack was planned, and hackers scanned network, searching for /.git/config and files with Git configuration, and later used found accounts for penetration repositories. In the interview to ZDNet, GitLab specialists confirmed that this expert’s theory is trustworth, and in the case that investigated GitLlab, issue was hidden in compromised accounts that were stored in the open search.

It is worth noting that StackExchanges users consider that attackers does not delete information from their repositories, but just changes Git commits headlines. If this is true, data can be restored without buyout payments. On StackExchange have already prepared instruction for this case.

In Ergänzung, security specialists actively call victims not to pay to the blackmailer and instead to turn in GitHub, GitLab and Bitbucket support that can allegedly help them.

Security specialists actively call victims not to pay to the blackmailer


Über Trojan Mörder

Tragen Sie Trojan Killer-Portable auf Ihrem Memory-Stick. Achten Sie darauf, dass Sie in der Lage sind, Ihr PC keine Cyber-Bedrohungen widerstehen zu helfen, wo immer Sie sind.

überprüfen Sie auch

MageCart auf der Heroku Cloud Platform

Die Forscher fanden mehrere MageCart Web Skimmer Auf Heroku Cloud Platform

Forscher an Malwarebytes berichteten über mehr MageCart Web-Skimmer auf der Heroku Cloud-Plattform zu finden, …

Android Spyware CallerSpy

CallerSpy Spyware Masken als Android-Chat-Anwendung

Trend Micro Experten entdeckt die Malware CallerSpy, die Masken als Android-Chat-Anwendung, und, …

Hinterlasse eine Antwort