Rapuncel: Fake GitHub Repositories Disable EDR with a Signed Kernel Driver

1. Basic Information

• Original Title: Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign
• Source: LastPass TIME / Delphos Labs
• Published Date: 2026-09-17
• Updated Date: None
• Severity: High
• Basis for Severity: An active distribution infrastructure impersonating over 40 companies uses a kernel driver with a Microsoft compatibility signature to terminate processes matching 145 built-in AV and EDR-related process names, while stealing credentials from browsers and cryptocurrency wallets.
• Original Article: Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign
• Related Source: BleepingComputer Coverage
• Related Entities: Rapuncel, Alinubx.sys, Cruciferra PUROSANGUE, BoryptGrab, GitHub Pages, Windows

2. Executive Summary

This attack distributes large ZIP files through high-ranking fake GitHub repositories, uses DLL side-loading, and escalates privileges to SYSTEM. A signed kernel driver then terminates processes matching 145 built-in AV and EDR-related process names, after which Rapuncel steals credentials and other sensitive data.

3. Attack Flow

From Search Results to Credential Theft

1. Users search for legitimate software and follow SEO-optimized links to fake GitHub repositories.
2. Users download a ZIP file padded to 127–148 MB via GitHub Pages 404 handling and dynamic redirects hosted behind Cloudflare.
3. A fake installer loads a malicious vsdbg.dll into the legitimate vsdbg.exe and obtains SYSTEM privileges through multiple UAC elevation techniques.
4. Alinubx.sys, deployed as nvfsflt64.sys, terminates processes matching 145 built-in AV and EDR-related process names from kernel mode.
5. Rapuncel collects data from browsers, cryptocurrency wallets, Discord, Steam, Telegram, and Windows Credential Manager, then sends it to 2.26.126[.]50.
6. Persistence is established via a Windows service to continue stopping defense products and stealing data after reboot.

4. Attacker Location and Execution Environment

• Attackers manipulate search visibility and externally operate fake GitHub repositories, GitHub Pages content, Cloudflare-hosted redirects, and payload servers.
• After initial execution, the user-mode loader and Rapuncel, along with the kernel-mode Alinubx.sys, run on the victim Windows endpoint.

5. Victim and Administrator Perspective

• Victim: Appears as a legitimate brand GitHub page, displays fake VirusTotal approval, and acts as a normal installer.
• Administrator: Leaves traces such as an unknown DLL in the same directory as vsdbg.exe, the NvFsFilter service, C:\Windows\System32\drivers\nvfsflt64.sys, and numerous security process terminations.

6. Success and Failure Conditions

Success Conditions

• The user downloads and executes the ZIP from the fake repository, and grants or successfully achieves privilege escalation.
• Driver deployment and service registration are permitted, and are not blocked by application control or driver blocks.

Failure Conditions

• Software distribution is restricted to official websites and managed stores, and unofficial distributions on GitHub are not executed.
• The hash, signature family, device name, and service creation of Alinubx.sys are blocked, preventing unauthorized drivers.

7. What Happens Upon Success

• Defense products are stopped, and saved credentials are decrypted by bypassing browser App-Bound Encryption.
• Cryptocurrency wallets, session tokens, documents, screenshots, and system information are stolen.

8. Observable Logs

• Email: No email distribution observed.
• Proxy / SWG / DNS: Communication to fake GitHub Pages, dynamic redirects, payload servers, and 2.26.126[.]50 is observed.
• Endpoint / EDR: Check for vsdbg.exe loading an unexpected vsdbg.dll, DLL side-loading, driver deployment, creation of the NvFsFilter service, and termination requests targeting numerous AV and EDR-related processes.
• Identity / IdP: Usage of stolen browser, Discord, Steam, and Telegram sessions is observed.
• SaaS / Cloud: Access to fake organizations and pages on GitHub cannot be confirmed via internal GitHub audit logs, so it is supplemented by Proxy/SWG or browser history.
• Network: Transmission to 2.26.126[.]50 via HTTP format over raw TCP is observed.

9. Attack Success Determination

Confirmed via Public Information

• Malware Execution or Authentication Success Confirmed: LastPass and Delphos Labs analyzed the acquired samples and confirmed the operation of Rapuncel, Alinubx.sys, and browser injection DLLs. The number of affected endpoints has not been publicly disclosed.

Internal Organization Criteria

• User Action Confirmed: Evidence of downloading and extracting the ZIP from the fake repository is confirmed.
• Initial Execution Confirmed: Malicious DLL loading by vsdbg.exe, SYSTEM privilege escalation, and driver service registration are substantiated.
• Information Theft or Session Compromise Confirmed: Generation of collected files, C2 transmission, and usage of stolen sessions are confirmed.

10. Investigation Playbook

• Trigger: Triggered by fake brand GitHub URLs, NvFsFilter creation, or simultaneous termination of security products.
• Initial Verification: Confirm ZIP download source, executing user, file hash, signature, and service registration time.
• Endpoint: Preserve and remove drivers and persistence in Safe Mode or an external recovery environment.
• Authentication & Cloud: From a known-clean endpoint, reset credentials stored in the affected browser and revoke all affected sessions and tokens.
• Subsequent Actions: Track cryptocurrency transfers and unauthorized access to GitHub, email, and chat services.
• Containment: Isolate the endpoint, block IOCs, block drivers, and update credentials.
• Judgment Categories: Differentiate download, execution, driver operation, theft, and malicious use of stolen information.

11. Defense and Detection Ideas

• Single Event: Detect nvfsflt64.sys deployment, the NvFsFilter service, and creation of the \\.\Alinubx device with high priority.
• Time-Series Correlation: Correlate browser searches with large ZIP downloads, vsdbg.exe startup, UAC escalation, EDR termination, and external transmission.
• Hunting: Search for PEs with abnormally large .reloc, DLLs adjacent to vsdbg.exe, and renamed drivers with identical signature families.
• Log Gaps: Assuming EDR will be terminated, immediately forward DNS, Proxy, and Windows events off the endpoint.
• Priority Mitigations: Enforce official distribution sources, apply application controls such as WDAC, and implement vulnerable driver mitigations.

12. Facts / Inference / Hypothesis

Facts

• Researchers identified the same distribution kit impersonating at least 40 companies.
• Alinubx.sys carries a Microsoft Windows Hardware Compatibility Publisher signature and contains 145 built-in AV and EDR-related process names.
• Rapuncel targets over 25 browsers and 30 cryptocurrency wallets.

Inference

• Combining signature families, services, IOCTLs, and parent-child processes provides better resilience against repackaging than relying solely on file names or hashes.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

• T1036 Masquerading (Confidence: High): Masquerades as legitimate brands, Visual Studio debugger, and NVIDIA-style driver names.
• T1574.002 DLL Side-Loading (Confidence: High): Loads malicious vsdbg.dll into vsdbg.exe.
• T1562.001 Impair Defenses (Confidence: High): Terminates AV and EDR using a kernel driver.
• T1555 Credentials from Password Stores (Confidence: High): Retrieves credentials from browsers and Windows Credential Manager.

14. Unknowns and Additional Investigation

• Actual number of infections, affected regions, and scale of unauthorized usage after theft.
• Timeline and target hashes for inclusion in Microsoft's driver block list.
• Whether unused features present in Alinubx.sys were activated in other campaigns.

15. Impact on SOCs and Organizations

Relying solely on GitHub hosting or Microsoft signatures as trust indicators can lead to missed detections. In environments where developers or administrators obtain tools through search engines, organizations should enforce official distribution sources and correlate signature issuers, expected file purposes, driver installation, and subsequent defense termination.

16. Summary by Role

• SOC: Review vsdbg.exe, NvFsFilter, signed drivers, EDR termination, and C2 transmission chronologically.
• Administrators: Restrict unofficial GitHub distributions, and implement WDAC, driver blocking, and external log forwarding.
• Users: Obtain software from product official websites or official stores rather than GitHub pages found via search results.