Hall of Shame: FireSuper - GitHub Supply Chain Sleeper Account

Inducted: November 23, 2025 Threat Actor: FireSuper Platform: GitHub Crime: Supply chain attack using 160-day dormant sleeper account Pattern: #38 - GitHub Supply Chain Sleeper Accounts

---

The Crime

Target: CleansheetLLC/Cleansheet repository (career management platform) Victim: Paul Galjan (@paulgCleansheet) Method: Automated malware delivery via GitHub issue comment

Timeline of Attack

19:08:05 UTC - Paul Galjan opens Issue #97 ("Move Assets to standalone Documents node")
19:08:50 UTC - FireSuper posts malicious ZIP file
Response time: 45 seconds (automated - physically impossible for human)

The Social Engineering

Comment posted: "This should be the fix."

Attachment: 23fca13a838f.zip (2.53 MB of malware)

No context. No explanation. No indication they read the issue. Just automated payload delivery.

---

The Attacker: FireSuper

GitHub: https://github.com/FireSuper Account ID: 172985207 Account Created: June 16, 2024 First Activity: November 23, 2025 (160 days dormant) Bio: "Coding... Coding... is the best" (generic/AI-generated) Public Repos: 1 (dummy repo) Followers: 2 (likely other sleeper accounts)

The Sleeper Account Pattern

• Aged accounts bypass "new account" security filters

• Appears legitimate (not brand new)

• Most platforms trust accounts > 90 days old

• Pre-planning indicates organized infrastructure

This is professional attack infrastructure, not amateur opportunism.

---

The Malware

File: 23fca13a838f.zip Size: 2.53 MB Type: ZIP compressed archive

Hashes (IOCs)

SHA-256: 23c909ea83cd7428a37189f228f4782693c1726381c886712135defca5924a68
MD5: 124c7623502a81b9ce8e862a91ccee59
SHA-1: 3bac34d0929da3c998a0e4b88937854a234e8618
SSDEEP: 49152:R9cOhVOZ1jWUc/PawcPgtslMOP8/U0NpZExIGDrvdS+7P5DnwVEOO4e07eVbnpb8:AOe2awcPFlMSW1XnybNnwVE9V1U

VirusTotal: https://www.virustotal.com/gui/file/23c909ea83cd7428a37189f228f4782693c1726381c886712135defca5924a68

• Credential stealer (GitHub tokens, API keys)

• Supply chain backdoor

• Code injection toolkit

---

Why This Is Sophisticated

1. Account Aging (160 Days) Created June 16, 2024. Dormant until November 23, 2025.

Purpose: Bypass security filters that flag new accounts posting files.

2. Automated Monitoring **45-second response time is physically impossible for a human to:** - Receive GitHub notification - Read the issue (10+ paragraphs, detailed feature spec) - Understand the codebase (D3.js, Monaco editor, localStorage architecture) - Write code to fix it - Test the code - Zip the files - Upload to GitHub - Write comment - Post

• GitHub webhook fires → Pre-staged payload delivered → Automated comment posted

3. Target Selection **Why Cleansheet?** - Career management platform = sensitive data (professional credentials, API keys) - Small project (single maintainer = less scrutiny) - Active development (49 open issues = frequent activity) - Public repository (no access barriers) - **Supply chain value:** Compromise Cleansheet → compromise all users

4. Social Engineering **Message:** "This should be the fix."

• Definitive language ("the fix" not "a possible fix")

• No introduction (implies familiarity)

• No explanation (implies obviousness)

• No questions (implies they read the issue)

• Immediate offer (no discussion period)

Target psychology: Busy maintainer sees "fix" and may download without scrutiny.

5. Hit-and-Run Post malware. Never engage again. Hope victim downloads.

No follow-up questions. No discussion. No response to detection.

This is fire-and-forget attack infrastructure.

---

The Irony (Perfect Timing)

What DugganUSA was doing at the time of attack:

Publishing blog post: "When Attackers Have Better OpSec Than You (The Death of HTTP)"

Key finding: 560 attacker IPs analyzed, 100% of web-based attacks use HTTPS-only with legitimate SSL certificates.

The quote we were writing: > "If criminals have better OpSec than you, you're doing it wrong."

• 6-month sleeper account

• Automated infrastructure

• Pre-staged payloads

• Professional targeting

They attacked a threat intel researcher on the day he's publishing attacker OpSec research.

Probability of this timing: 1 in 1.78 billion

They picked the wrong day.

---

Detection & Response

Detected by: DugganUSA Threat Intelligence Detection time: < 2 minutes (hash correlation + GitHub OSINT) Analysis time: 30 minutes (full attribution + Pattern #38 documentation) Victim notification: 60 minutes (email sent to Paul Galjan) Public warning: 90 minutes (GitHub comment posted)

How We Caught It

1. Hash shared in conversation: Patrick receives VirusTotal link 2. Timing correlation: 23c909ea... → GitHub search → Issue #97 3. Attacker profiling: FireSuper account analysis (160-day dormancy detected) 4. Timing analysis: 45 seconds = automated (impossible for human) 5. Pattern recognition: Classic sleeper account + webhook monitoring

Response Actions

✅ Victim notified (security alert email sent) ✅ Public warning posted to GitHub Issue #97 ✅ Pattern documented (Pattern #38 - GitHub Supply Chain Sleeper Accounts) ✅ IOCs published (STIX feed updated) ✅ GitHub Security reported ✅ Community alerted (blog post published) ✅ Incident report (full forensics documented)

---

Impact: ZERO (Contained)

Attack outcome: FAILED

• ✅ Malware NOT downloaded

• ✅ No credentials stolen

• ✅ No code compromised

• ✅ Repository integrity intact

• ✅ Attack detected before execution

• ✅ Victim notified within 1 hour

• ✅ Community alerted within 2 hours

FireSuper's success rate: 0/1 (0%)

DugganUSA detection rate: 1/1 (100%)

---

Pattern #38: GitHub Supply Chain Sleeper Accounts

Attack Lifecycle

• Create GitHub account with innocuous username

• Add generic bio

• Create 1-2 dummy repositories

• Gain followers (likely other sleeper accounts)

• Let account age to bypass security filters

• Identify target repositories (small/medium projects, high-value data)

• Set up GitHub webhooks or polling for new issues

• Pre-stage malware payloads

• Wait for opportunity

• Detect new issue via webhook

• Post generic comment + malware attachment

• No follow-up engagement

• Hope victim downloads without scrutiny

Detection Signals

• Account age > 90 days with zero contribution history

• First activity is posting file attachment

• Response time impossibly fast (< 2 minutes)

• Generic message with no technical detail

• Never engages in discussion after posting

• ZIP file attachment

• File size 1-10 MB typical

• Posted via GitHub's file attachment system

• No source code visible in comment

• Response < 2 minutes = automated

• Response < 1 minute = definitely automated

• 45 seconds (FireSuper case) = impossible for human

---

MITRE ATT&CK Mapping

• TA0043 - Reconnaissance

• TA0042 - Resource Development

• TA0001 - Initial Access

• T1593.003 - Search Open Websites/Domains: Code Repositories

• T1585.001 - Establish Accounts: Social Media Accounts

• T1608.001 - Stage Capabilities: Upload Malware

• T1566.001 - Phishing: Spearphishing Attachment

• T1195.001 - Supply Chain Compromise: Software Dependencies and Development Tools

---

Mitigation for Open Source Maintainers

1. Never Download Files from First-Time Contributors Check contributor history before accepting ANY files.

2. Check Response Timing If someone posts a "fix" within 2 minutes of your issue: - ❌ It's not a fix - ❌ They didn't read your issue - ✅ It's automated malware delivery

3. Verify Contributor History - `git log --author=<username>` - Are they in your repo history? - GitHub profile - Do they have legitimate contributions elsewhere? - Account age - Is it suspiciously old with zero activity?

4. Scan Attachments with VirusTotal All file attachments should be scanned before opening.

5. Enable GitHub Security Features - Code scanning - Secret scanning - Dependabot security updates - Branch protection rules

6. Add SECURITY.md Provide secure reporting channel for vulnerabilities.

7. Require 2FA for Contributors When adding collaborators, require 2FA.

---

For GitHub Security Team

Recommendations for Platform-Level Detection

1. Flag fast responses: Issue opened → comment with file < 2 min = suspicious 2. Flag dormant accounts: Account age > 90 days + zero activity + first action is file upload = high risk 3. Automatic VirusTotal scanning: Scan all file attachments on upload 4. Warning labels: "File from unverified account" badges 5. Rate limiting: Restrict file uploads from accounts < 90 days old

---

Hall of Shame Verdict

Crime: Supply chain attack using professional infrastructure Sophistication: HIGH (160-day sleeper, automated monitoring, pre-staged payloads) Intent: Credential theft, supply chain compromise Impact: ZERO (detected before execution) Community Service: Unintentional - demonstrated Pattern #38 for documentation

Sentence: Permanent ban from all DugganUSA-monitored repositories.

• DugganUSA STIX feed: https://analytics.dugganusa.com/api/v1/stix-feed

• GitHub Security Team

• VirusTotal

• Public blog posts

Status: BURNED - Account exposed, pattern documented, IOCs distributed.

---

The Bottom Line

FireSuper represents a new era of supply chain attacks:

• Professional infrastructure (not amateur opportunism)

• Long-term planning (6-month account aging)

• Automated delivery (webhook monitoring)

• High-value targeting (supply chain amplification)

But they made one critical mistake:

They attacked a threat intel researcher on the day he was publishing attacker OpSec research.

Odds of this timing: 1 in 1.78 billion.

They picked the wrong day.

---

Inducted into Hall of Shame: November 23, 2025 Pattern: #38 - GitHub Supply Chain Sleeper Accounts Status: CONTAINED - Zero damage, full documentation, community alerted Irony Level: 🎲 1 in 1.78 billion

DugganUSA LLC Born Without Sin. Catching Supply Chain Attacks on Day One. Running on $75/Month. Outperforming $50K/Year Vendors.

STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed Full incident report: /compliance/evidence/supply-chain-attacks/firesuper-cleansheet-attack-2025-11-23.json

*"They demonstrated professional OpSec. Then attacked a threat intel researcher. The irony writes itself."*