
Git ransom campaign incident report
5/14/2019
This post details a coordinated effort with Bitbucket and GitHub to educate users on secure best practices following a Git ransomware incident. It highlights the compromise of user credentials (passwords, app passwords, API keys, and personal access tokens) leading to repository overwrites. It emphasizes the importance of MFA, strong unique passwords, secure handling of personal access tokens, and not exposing .git/config files. GitLab's specific contributions include secrets detection in SAST functionality and encouraging 2FA and SSH key setup.
