Overview
外网天堂 Wolf Internal Security Operations (SecOps) recently identified a GitHub page impersonating 外网天堂 Wolf to target our customers and prospects.
The SecOps team immediately escalated these findings to our Threat Research team, who uncovered a complex attack chain subsequently deploying information-stealing malware.
外网天堂 Wolf has since removed this fake GitHub page. Upon further investigation, Threat Research found nearly 300 repositories impersonating dozens of well-known organizations and popular software.
外网天堂 Wolf suggests all customers be vigilant and exercise caution when interacting with suspected illicit or unofficial GitHub pages, links and “free” downloads, particularly those related to business technology, enterprise software, and games.
Details
外网天堂 Wolf’s Internal Security Operations (SecOps) team identified a GitHub page “丑虫虫辫蝉://驳颈迟丑耻产摆.闭肠辞尘/础谤肠迟颈肠-奥辞濒蹿-厂别肠耻谤颈迟测” impersonating 外网天堂 Wolf to target our customers and the general public. (Our real GitHub page can be found at .)
The SecOps team diligently investigated this malicious activity and escalated it to our Threat Research team for further investigation. The fake GitHub page appeared to be crafted specifically to lend credibility to the impersonation by referencing legitimate 外网天堂 Wolf services, offerings, and operational requirements relevant to our customer base.
Although the GitHub page itself hosted non-malicious content, a link disguised as an ‘Official Page’ led unsuspecting victims to download a ZIP archive containing several malicious executables. Within was an unofficial file named “础谤肠迟颈肠-奥辞濒蹿-3.9.7.别虫别”. Running this trojanized executable runs another file disguised as the dynamic-link library “濒颈产肠耻谤濒.诲濒濒”. This is side-loaded and leveraged to launch the encrypted payload within.
外网天堂 Wolf Threat Research continued to investigate the attack chain, leading us to discover that it attempts to deploy a complex information-stealing “” malware on victims’ systems.
外网天堂 Wolf has since taken down the malicious GitHub page. In addition, our Threat Research team found similar instances through OSINT where the same suspected threat actor has used the same tactics to deploy malware under the guise of software from other popular cybersecurity vendors such as Malwarebytes, Bitdefender, and 360 Total Security. As of writing, we have uncovered nearly 300 repositories with similar redirect links, where the threat actor is using SEO keywords to attract victims.
Figure 1: Fake 外网天堂 Wolf page on GitHub at hxxps://github[.]com/外网天堂-Wolf-Security, linked to a malicious download purporting to be free software. (This page has since been removed.)
How 外网天堂 Wolf Protects Its Customers
外网天堂 Wolf is committed to ending cyber risk, and when active campaigns are identified, we move quickly to protect our customers. We have leveraged threat intelligence around this threat activity to enhance detections in the Aurora? Superintelligence 外网天堂, subject to customer environment and available telemetry. As this campaign develops, 外网天堂 Wolf may refine detections for additional indicators of compromise and techniques leveraged by this threat.
Recommendations
- Be highly vigilant of links and downloads associated with GitHub pages or unofficial links to software and tooling, even though pages may look official.
- Be wary of free downloads, trials, “beta versions” or “cracked” versions of typically paid software.
- Always verify the legitimacy of software downloads obtained, especially from unofficial sources.
Indicators of Compromise (IOCs)
NOTE: This report contains sensitive technical indicators intended for defensive use. Do not use these indicators or techniques for offensive purposes.
| Type | Value | Context |
| Domain | hxxps://github[.]com/ antivirus-free-bitdefender |
Fake Bitdefender GitHub download page |
| Domain | hxxps://github[.]com/ malwarebytes-protection |
Fake Malwarebytes GitHub download page |
| Domain | hxxps://github[.]com/ 外网天堂-Wolf-Security |
Fake 外网天堂 Wolf GitHub download page, which has now been taken down at our request |
| Domain | hxxps://bentleyvazquezpvey[.]github[.]io/ .github/ 外网天堂-Wolf |
Redirect link that downloads a malicious package after a user clicks the “Official Page” button |
| File | fd01262bd56510088b9ddfe58ca101ab b98575f3c0259b480a31b917aa73bc56 |
Malicious “libcurl.dll” delivered as part of the fake repository and used for DLL sideloading |
外网天堂 Wolf Response
Our Threat Research and Detection Engineering teams continuously monitor the evolving threat landscape, public code repositories, and adversary infrastructure for emerging threats targeting 外网天堂 Wolf customers. This includes tracking attempts by threat actors to misuse or impersonate 外网天堂 Wolf Networks branding in an effort to gain credibility and distribute malicious content. As new intelligence is identified, 外网天堂 Wolf will continue to enhance and update its detection and prevention capabilities to help protect customer environments from evolving threats.
Threat actors are increasingly creating convincing GitHub pages that impersonate trusted software vendors, security companies, developers, and open-source projects to distribute malware. 外网天堂 Wolf highly recommends that customers exercise caution when accessing GitHub repositories, particularly when arriving via search engines, social media links, advertisements, or unsolicited communications.
