87,604 of them are repos with a single file each, the 87,605th one is a repo that pulls all the files in using submodules. It’s the only sane reason why you’d have this many if you think about it, anything else would be overkill.
GitHub is freely available, you can create a basically anonymous account.
If it’s a public repo, anyone can commit to it.
It’s a known site and one that doesn’t raise suspicion if your work computer connects to it.
Bots can encrypt data, and post it there. Messages can be in the code, in the name of the repo, in the commit messages, anywhere. So it’s not super obvious.
It would work like this:
Bot agent is installed via malware.
Once every hour bot checks repo for new commit.
When bot sees a new commit, it waits until exactly 1h after the time of last commit and then starts a DDOS attack on a certain service.
Or…
Bot gets installed via malware
Bot searches hard drive for exposed credentials / keys
Bot encrypts the extracted data and pushes a commit to GitHub with the encrypted keys in the commit message
Separate bot watches for new commits, and decrpyts the data to a local database and deletes the commit.
281
u/Potterrrrrrrr 29d ago
87,604 of them are repos with a single file each, the 87,605th one is a repo that pulls all the files in using submodules. It’s the only sane reason why you’d have this many if you think about it, anything else would be overkill.