North Korean operatives spoof GitHub commit dates to disguise malicious repos as established projects

DPRK-linked threat actors are manipulating git commit timestamps to make freshly created GitHub repositories appear years old and trustworthy, hiding obfuscated malware loaders inside commonly trusted configuration files. At least one flagged repo had accumulated over 100 stars before detection. The technique is part of Pyongyang's broader developer-targeting playbook — which has increasingly zeroed in on crypto and web3 engineers through fake open-source packages, fraudulent job interviews, and supply chain compromise.

TLDR by @Benthic

More coverage

• North Korean IT Workers Exploiting GitHub to Target Organizations ... (rewterz.com)
• North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker ... (thehackernews.com)
• North Korea Cyber Espionage: GitHub Enterprise Server Attacked ... (rescana.com)
• DPRK IT Fraud Network Uses GitHub to Target Global Companies (nisos.com)
• Espionage Exposed: Inside a North Korean Remote Worker Network (kelacyber.com)

Explore the topic

• North Korea