Back Ground.News

Russian Hackers Hijack GitHub, Mirror Sites in Supply Chain Attack

Ground.News • February 12, 2026

In January 2026, cybersecurity experts identified a sophisticated supply chain attack campaign dubbed RU-APT-ChainReaver-L.

RU-APT-ChainReaver-L hits Windows, macOS, iOS via compromised mirrors, signed malware, and cloud-hosted supply chain attacks.

A newly exposed advanced persistent threat (APT) campaign, tracked as RU-APT-ChainReaver-L, is hijacking trusted file-hosting sites and long-standing GitHub accounts.

Recent attacks, including GitVenom and Lumma Stealer, underscore the threat of Attackers using GitHub repositories as malware staging mechanisms.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RU-APT-ChainReaver-L Targets Trusted Websites and GitHub Repositories The RU-APT-ChainReaver-L campaign has launched a sophisticated supply chain attack, compromising trusted mirror websites and GitHub repositories. This attack affects users on Windows, macOS, and iOS platforms, utilizing advanced techniques such as code signing with valid certificates and deceptive redirect chains. 4 sources 37

Extracted Entities

Russian Hackers Hijack GitHub, Mirror Sites in Supply Chain Attack

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (4)