The subgroup of an Iranian nation-state group known asΒ Nemesis KittenΒ has been attributed as behind a previously undocumented custom malware dubbed Drokbk that uses GitHub as a dead drop resolver to exfiltrate data from an infected computer, or to receive commands.
"The use of GitHub as a virtual dead drop helps the malware blend in," Secureworks principal researcher Rafe PillingΒ said. "All the