New Ransomware - Cybercriminals target Git Repos

Developers have reported since May 3 that hackers are targeting Git and BitBucket source code repositories, wiping them and replacing them with a ransom demand to pay a given amount to a Bitcoin wallet. Although reportedly hundreds of accounts were affected, the Bitcoin wallet of the hackers has still only received 0.00052525 BTC ($2.99 USD) as of May 6. This campaign has affected not only Github and Gitlab repositories, but also BitBucket repositories.

Recommendations

• If affected by this attack, use the git reflog command to retrieve the latest commit hash, as well as reset your passwords
• Use SSH instead of HTTP Basic Authentication for your deploys with Git repos
• Monitor your Bitbucket, Gitlab or Github instances using ZeroFOX for similar ransomware attacks. If you do not have these data sources, reach out to your account manager

Details

The source of the attack appears to be related to deployments of git repositories that did not properly scrub the .git/config directory. Over 100 of the affected repos contained remote URLs with username:password strings and basic HTTP Authentication. There are 289 repos on Github that contain the ransom note, which is listed below:

To recover your lost code and avoid leaking it: 
Send us 0.1 Bitcoin (BTC) to our Bitcoin address 1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA 
and contact us by Email at [email protected] with your 
Git login and a Proof of Payment. 
If you are unsure if we have your data, contact us and we will send you a proof. 
Your code is downloaded and backed up on our servers. 
If we dont receive your payment in the next 10 Days, we will make your code public or use them otherwise.

BleepingComputer posted updates from Atlassian, Github and GitLab with their responses, which all confirmed that these attacks stem from a client-side misconfiguration issue. As of 08 May 2019, the Bitcoin address only received 0.00052525 BTC.