Datadog Security Labs Sounds Alarm Over GitHub Targeting Campaigns
Datadog Security Labs has issued a warning regarding “several overlapping campaigns” that are methodically exploiting the GitHub API to enumerate corporate organizations, repositories, and user accounts. This alarming activity appears to rely heavily on automated scraping tools equipped with custom or benign-sounding user agents. According to Julie Agnes Sparks, a senior security engineer at Datadog, the attackers utilize ‘ghost’ accounts that have been dormant for years, along with compromised OAuth tokens and personal access tokens (PATs) belonging to legitimate users.
While most of the observed activity primarily focuses on public data, there are concerning instances where attackers have successfully cloned private repositories. The campaigns strategically employ a blend of automated scanning tools and over 50 dormant accounts, in addition to multiple legitimate accounts whose PATs have either been unintentionally exposed or compromised through other means.
What stands out about these ‘ghost’ accounts is their age; many were created two to five years ago and deliberately kept inactive until activated for malicious API traffic across multiple organizations. This approach is designed to evade detection, providing attackers with the ability to masquerade their scraping activities as legitimate usage instead of creating new accounts for immediate exploitation.
Significantly, a substantial portion of GitHub’s API remains accessible without authentication, allowing attackers to blend their enumeration queries with ordinary API operations. Common activities include listing an organization’s public repositories, exploring a user’s follower and following lists, profiling gists and starred repositories, and conducting GraphQL queries against public objects.
These collected data points can serve as a valuable resource for threat actors, enabling them to perform reconnaissance and construct a detailed map of an organization’s GitHub activities. This includes insights into public repositories, member interactions, and project modifications.
Several cases have confirmed unauthorized access, with attackers taking steps to clone private repositories from some organizations. According to Datadog, while individual requests may appear mundane, the aggregate behavior raises significant red flags. The coordinated efforts of a group of accounts synchronized across various organizations with tailored tooling can lead to serious security incidents, especially if attackers transition from enumeration to cloning operations.
This sophisticated campaign highlights a growing concern in the realm of cybersecurity as attackers leverage long-abandoned accounts to infiltrate GitHub organizations. Business owners should remain vigilant, reinforcing their security frameworks, especially in accessing external services, to mitigate the risks associated with such security breaches. Techniques potentially aligned with MITRE ATT&CK frameworks, including initial access through compromised accounts, persistence via dormant profiles, and reconnaissance tactics by mapping organizational activities, underline the multifaceted methods employed in these attacks.
As the landscape of cyber threats continues to evolve, organizations must prioritize proactive measures to safeguard their digital assets and remain alert to new vulnerabilities in the ever-expanding online ecosystem.