Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
How to Investigate a GitHub Repo's Real History
Malware Families
Excerpt
How to Investigate a GitHub Repo's Real History | OpenSourceMalware BLOG How to Investigate a GitHub Repo's Real History Learn to reconstruct what actually happened to a compromised repo using timestamps and logs that the person doing the manipulation doesn't control. By cb482791-4ef1-4762-96ad-b0ca4bdd538e · 2026-10-06T22:00:00.000Z Threat actors commonly manipulate git history to make a GitHub author or repo look more credible, or to hide malicious activity.…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 187c20dc2b421fc95b0be0bab561fa5c6fb2627f | Medium | Score 53/100 | First seen |
| SHA1 | 2fac30d5be730de6e4a339e8ae4a7ba9cb896f0d | Medium | Score 53/100 | First seen |
| SHA1 | 1622ff5a8f96f81e3fd192bf727f6fa078199a92 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-48384 | Medium | Score 42/100 | First seen |
| SHA1 | f7791d612bc4af16dd5891d6cabe17e0a3e69ac5 | Medium | Score 53/100 | First seen |
| SHA1 | 5bdb04df0b5c92568f7b862529d5dfe946e18868 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…