Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Banana Squad, a threat actor first identified in 2023, has launched a new campaign targeting GitHub repositories. The group has created over 60 trojanized repositories masquerading as hacking tools written in Python. These malicious repositories contain hundreds of trojanized Python files that utilize encoding and encryption techniques to hide backdoor code. The campaign primarily uses the domain dieserbenni[.]ru, with a new domain 1312services[.]ru detected recently. The trojanized repositories exploit GitHub's UI feature where long lines of code don't wrap, allowing attackers to hide malicious code off-screen. This sophisticated technique makes visual detection challenging, highlighting the increasing stealth of supply chain attacks on open-source platforms.

The threat actor known as Banana Squad, first identified in 2023, has initiated a new campaign targeting GitHub repositories by creating over 60 trojanized repositories disguised as hacking tools written in Python. These repositories contain hundreds of malicious Python files that employ encoding and encryption techniques to conceal backdoor code. The campaign leverages GitHub's user interface behavior where long lines of code do not wrap, allowing attackers to hide malicious payloads off-screen and evade visual detection by reviewers. The malicious repositories primarily communicate with command and control (C2) infrastructure hosted on domains such as dieserbenni[.]ru and the recently observed 1312services[.]ru. This approach exemplifies a sophisticated supply chain attack on open-source platforms, exploiting trust in publicly available code and the collaborative nature of GitHub. The use of encoding and encryption complicates static analysis and detection by automated tools. The campaign's tactics align with multiple MITRE ATT&CK techniques including T1132.001 (Data Encoding), T1204.002 (User Execution: Malicious File), T1553.002 (Subvert Trust Controls), T1140 (Deobfuscate/Decode Files or Information), T1608.001 (Stage Capabilities), T1027 variants (Obfuscated Files or Information), T1588.001 (Obtain Capabilities), T1078 (Valid Accounts), T1102.002 (Web Service), and T1059.006 (Command and Scripting Interpreter: Python). Although no known exploits in the wild have been reported yet, the campaign's stealth and supply chain nature pose significant risks to organizations relying on open-source Python tools from GitHub.

Detailed information about Threat actor Banana Squad exploits GitHub repos in new campaign. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'trojanized repositories'

Filter Threats

Threats Tagged 'trojanized repositories'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility