about a wave of attacks aimed at encrypting Git repositories on services like GitHub, GitLab, and Bitbucket. Attackers wipe the repository and leave a message asking to send 0.1 BTC (approximately $700) to recover data from a backup (in reality, only the commit headers are damaged, and the information may be ). Similar incidents have already occurred on GitHub 371 repositories affected.
Some attack victims admit they used weak passwords or forgot to remove access tokens from old applications. Some believe (though this is still just speculation and the hypothesis has not been confirmed) that the leak of credentials was due to the compromise of the , which provides a GUI for working with Git from macOS and Windows. In March, several were discovered in SourceTree, enabling remote code execution when interacting with repositories controlled by attackers.
To restore the repository after an attack, it is enough to execute 'git checkout origin/master', after which
you can find out the SHA hash of your last commit through 'git reflog' and reset the changes made by the attackers using the command 'git reset {SHA}'. If you have a local copy, the problem can be resolved by executing 'git push origin HEAD:master --force'.
Source: opennet.ru
