AnalysisPublished 3 Aug 2022

Github Repo Compromise Domain MyJino RU

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

This report concerns a compromise involving a GitHub repository associated with the domain MyJino RU. The incident is related to software supply chain compromise activities, as indicated by the MITRE ATT&CK pattern T1195.002. No specific technical details, affected software versions, or exploit code are provided.

Impact

The compromise of a GitHub repository can potentially lead to the distribution of malicious code or unauthorized changes in software supply chains, posing risks to downstream users who rely on the affected repository. Specific impacts are not detailed in the provided information.

Defensive guidance

Since this is a supply chain compromise, users should verify the integrity of software obtained from the affected repository and monitor for official communications or updates from repository maintainers. Follow best practices for supply chain security and validate code provenance.

Indicators of compromise

Domains 2

ovz1.j19544519.pr46m.vps.myjino.ruC2 domain
myjino.ruResult from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru

Text 13

195.161.41.221Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru
ovz1.j19544519.pr46m.vps.myjino.ru.Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru
AResult from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru
all
MAL_Github_Repo_Compromise_MyJino_Ru_Aug22
dns
network
Github Repo Compromise Domain MyJino RU
dns
network

Counter 1

Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru

Datetime 2

Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru

2022-07-28T11:22:53+00:00
2022-08-03T06:19:30+00:00

Yara 1

rule MAL_Github_Repo_Compromise_MyJino_Ru_Aug22 { meta: description = "Detects URL mentioned in report on compromised Github repositories in August 2022" author = "Florian Roth" reference = "https://twitter.com/stephenlacy/status/1554697077430505473" date = "2022-08-03" score = 90 strings: $x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide $x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide condition: 1 of them }

Comment 1

Detects connections to the host used in a big repository compromise discovered in August 2022

Link 2

https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/windows/network_connection/net_connection_win_github_myjino_ru.yml
https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/linux/network_connection/net_connection_github_myjino_ru.yml

Sigma 3

title: Github Repo Compromise Domain MyJino RU id: 3a9f4c77-8e2e-45eb-abc1-4754f670d3a9 status: test description: Detects connections to the host used in a big repository compromise discovered in August 2022 references: - https://twitter.com/stephenlacy/status/1554697077430505473 date: 2022/08/03 author: Florian Roth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname: 'ovz1.j19544519.pr46m.vps.myjino.ru' condition: selection falsepositives: - Users looking up that domain after reading the report (unlikely) level: high
title: Github Repo Compromise Domain MyJino RU id: 242e0911-294a-44ea-a54e-7eea97aa2622 status: test description: Detects connections to the host used in a big repository compromise discovered in August 2022 references: - https://twitter.com/stephenlacy/status/1554697077430505473 date: 2022/08/03 author: Florian Roth logsource: product: linux category: network_connection detection: selection: DestinationHostname: 'ovz1.j19544519.pr46m.vps.myjino.ru' condition: selection falsepositives: - Users looking up that domain after reading the report (unlikely) level: high
title: DNS Lookup Github Repo Compromise Domain MyJino RU id: 6b0dd2e4-13ff-4eff-b79b-4444fad43644 status: test description: Detects connections to the host used in a big repository compromise discovered in August 2022 references: - https://twitter.com/stephenlacy/status/1554697077430505473 date: 2022/08/03 author: Florian Roth logsource: category: dns detection: selection: query: 'ovz1.j19544519.pr46m.vps.myjino.ru' condition: selection falsepositives: - Users looking up that domain after reading the report (unlikely) - Web proxy or other security device DNS lookups of the domain level: high

Community reviews

Loading reviews…