The attacker, Stargazer Goblin, created a network of counterfeit GitHub accounts to distribute various malware. The scheme, which has generated $100,000 in illicit profits over the past year, includes more than 3,000 accounts used to host malicious links and software.
The fraudulent “Stargazers Ghost Network,” named by Check Point, encompasses thousands of repositories hosting malware such as Atlantida Stealer, Rhadamanthys, RisePro, Lumma Stealer, and RedLine. These accounts are also involved in various activities on the platform to give them the appearance of legitimacy.
The network's activities were detected in August 2022, but ads for the scheme appeared on the Dark Net only in early July 2023. According to experts, the network not only spreads malware but also performs other tasks to make these fake accounts look like regular users.
To protect against being taken off the platform, Stargazer Goblin uses different categories of accounts for different aspects of the scheme. Some accounts create phishing repository templates, others host images for these templates, and still others add malware in the form of password-protected archives disguised as cracked software and game cheats.
As GitHub accounts are detected and blocked, Stargazer Goblin updates links to new active malware releases, ensuring minimal disruption to operations. Some accounts in the network were previously compromised, and their credentials were likely obtained by ransomware.
The Stargazer Ghost Network shows a high level of organization and adaptability, which allows attackers to minimize losses and quickly recover from GitHub's actions. Using different accounts for different tasks makes their infrastructure resistant to detection and removal from the platform.
This case highlights the importance of international law enforcement cooperation in the fight against cybercrime and demonstrates how even the most influential dark web markets can be stopped.
Comments 0