Overview
Arctic Wolf Internal Security Operations (SecOps) recently identified a GitHub page impersonating Arctic Wolf to target our customers and prospects.
The SecOps team immediately escalated these findings to our Threat Research team, who uncovered a complex attack chain subsequently deploying information-stealing malware.
Arctic Wolf has since removed this fake GitHub page. Upon further investigation, Threat Research found nearly 300 repositories impersonating dozens of well-known organizations and popular software.
Arctic Wolf suggests all customers be vigilant and exercise caution when interacting with suspected illicit or unofficial GitHub pages, links and “free” downloads, particularly those related to business technology, enterprise software, and games.
Details
Arctic Wolf’s Internal Security Operations (SecOps) team identified a GitHub page “hxxps://github[.]com/Arctic-Wolf-Security” impersonating Arctic Wolf to target our customers and the general public. (Our real GitHub page can be found at https://github.com/rtkwlf.)
The SecOps team diligently investigated this malicious activity and escalated it to our Threat Research team for further investigation. The fake GitHub page appeared to be crafted specifically to lend credibility to the impersonation by referencing legitimate Arctic Wolf services, offerings, and operational requirements relevant to our customer base.
Although the GitHub page itself hosted non-malicious content, a link disguised as an ‘Official Page’ led unsuspecting victims to download a ZIP archive containing several malicious executables. Within was an unofficial file named “Arctic-Wolf-3.9.7.exe”. Running this trojanized executable runs another file disguised as the dynamic-link library “libcurl.dll”. This is side-loaded and leveraged to launch the encrypted payload within.
Arctic Wolf Threat Research continued to investigate the attack chain, leading us to discover that it attempts to deploy a complex information-stealing “BoryptGrab Stealer” malware on victims’ systems.
Arctic Wolf has since taken down the malicious GitHub page. In addition, our Threat Research team found similar instances through OSINT where the same suspected threat actor has used the same tactics to deploy malware under the guise of software from other popular cybersecurity vendors such as Malwarebytes, Bitdefender, and 360 Total Security. As of writing, we have uncovered nearly 300 repositories with similar redirect links, where the threat actor is using SEO keywords to attract victims.
Figure 1: Fake Arctic Wolf page on GitHub at hxxps://github[.]com/Arctic-Wolf-Security, linked to a malicious download purporting to be free software. (This page has since been removed.)
How Arctic Wolf Protects Its Customers
Arctic Wolf is committed to ending cyber risk, and when active campaigns are identified, we move quickly to protect our customers. We have leveraged threat intelligence around this threat activity to enhance detections in the Aurora® Superintelligence Platform, subject to customer environment and available telemetry. As this campaign develops, Arctic Wolf may refine detections for additional indicators of compromise and techniques leveraged by this threat.
Recommendations
- Be highly vigilant of links and downloads associated with GitHub pages or unofficial links to software and tooling, even though pages may look official.
- Be wary of free downloads, trials, “beta versions” or “cracked” versions of typically paid software.
- Always verify the legitimacy of software downloads obtained, especially from unofficial sources.
Indicators of Compromise (IOCs)
NOTE: This report contains sensitive technical indicators intended for defensive use. Do not use these indicators or techniques for offensive purposes.
| Type | Value | Context |
| Domain | hxxps://github[.]com/ antivirus-free-bitdefender |
Fake Bitdefender GitHub download page |
| Domain | hxxps://github[.]com/ malwarebytes-protection |
Fake Malwarebytes GitHub download page |
| Domain | hxxps://github[.]com/ Arctic-Wolf-Security |
Fake Arctic Wolf GitHub download page, which has now been taken down at our request |
| Domain | hxxps://bentleyvazquezpvey[.]github[.]io/ .github/ Arctic-Wolf |
Redirect link that downloads a malicious package after a user clicks the “Official Page” button |
| File | fd01262bd56510088b9ddfe58ca101ab b98575f3c0259b480a31b917aa73bc56 |
Malicious “libcurl.dll” delivered as part of the fake repository and used for DLL sideloading |
Arctic Wolf Response
Our Threat Research and Detection Engineering teams continuously monitor the evolving threat landscape, public code repositories, and adversary infrastructure for emerging threats targeting Arctic Wolf customers. This includes tracking attempts by threat actors to misuse or impersonate Arctic Wolf Networks branding in an effort to gain credibility and distribute malicious content. As new intelligence is identified, Arctic Wolf will continue to enhance and update its detection and prevention capabilities to help protect customer environments from evolving threats.
Threat actors are increasingly creating convincing GitHub pages that impersonate trusted software vendors, security companies, developers, and open-source projects to distribute malware. Arctic Wolf highly recommends that customers exercise caution when accessing GitHub repositories, particularly when arriving via search engines, social media links, advertisements, or unsolicited communications.
