Post

It started when a suspicious GitHub repository, disguised as a harmless Proof of Concept (PoC) for a Nuclei template, was flagged.

Recognising critical anomalies in the code and its malicious imports, the YesWeHack team joined forces with Sekoia’s threat intelligence experts to run a deep-dive investigation. The outcome of this collective defence effort:

- Infrastructure Uncovered: We mapped out a cluster of malicious GitHub repositories and backdoored Python (PyPI) specifically crafted to target the security community.