Ghost

The "Ghost" malware, first discovered in 2020, is a sophisticated and successful malicious software that has been discreetly distributed via a network of GitHub accounts known as the Stargazers Ghost Network. This network utilizes open-source and legitimate software repositories to exploit trust and spread malware, demonstrating a high level of sophistication and success in its campaigns. The threat actor behind this attack has notably used the Stargazers Ghost Network to distribute a specific piece of malware known as GodLoader. Throughout September and October 2024, the Stargazers Ghost Network operated as a Distribution as a Service (DaaS), enabling the “legitimate” distribution of malware, including GodLoader, through GitHub repositories. Check Point Research identified that this network not only distributes malware or malicious links via phishing repositories but also has high infection rates, making it a significant threat. The same archive was found to be distributed by the network on multiple occasions, specifically on September 12, September 14, and September 29, 2024. The attackers behind the Ghost malware were able to exploit three critical weaknesses present across today's Software as a Service (SaaS) landscape, one of which aligns with Ghost Logins. These vulnerabilities have allowed the Stargazers Ghost Network to successfully distribute all sorts of malware, including GodLoader, marking a new and successful method for gaining initial access to systems. As such, it's crucial for organizations to remain vigilant about potential threats from seemingly legitimate sources and take appropriate cybersecurity measures.