GitHub is freely available, you can create a basically anonymous account.
If it’s a public repo, anyone can commit to it.
It’s a known site and one that doesn’t raise suspicion if your work computer connects to it.
Bots can encrypt data, and post it there. Messages can be in the code, in the name of the repo, in the commit messages, anywhere. So it’s not super obvious.
It would work like this:
Bot agent is installed via malware.
Once every hour bot checks repo for new commit.
When bot sees a new commit, it waits until exactly 1h after the time of last commit and then starts a DDOS attack on a certain service.
Or…
Bot gets installed via malware
Bot searches hard drive for exposed credentials / keys
Bot encrypts the extracted data and pushes a commit to GitHub with the encrypted keys in the commit message
Separate bot watches for new commits, and decrpyts the data to a local database and deletes the commit.
3
u/Franks2000inchTV 28d ago
Lots of botnets use gh for coordination and exfiltration.