Threat Actors May Abuse VS Code Extensions to Deploy Ransomware and Use GitHub as C2 Server

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Deployment via VS Code Extensions and GitHub C2 Exploited Threat actors are exploiting vulnerabilities in Visual Studio Code (VS Code) extensions to deploy ransomware, using GitHub as a command and control (C2) server. This tactic poses risks to developers and organizations utilizing these extensions, potentially leading to significant data breaches and financial losses. 2 sources 47