Operation STANDOFF Hides Command-and-Control Traffic Behind GitHub Redirects

Operation STANDOFF is a Russian-speaking cybercrime campaign that turns a single infection into a wider compromise.

Its installer delivers information stealers, loaders, a cryptocurrency miner, and botnet components, while operators can later focus on selected victims for direct network intrusion.

The campaign also uses gaming-themed content and automated outreach to draw people toward its malware delivery ecosystem.

The operation relies on a pay-per-install model that bundles several malware families into one package.

The observed sample installed RedLine, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig, allowing the attackers to steal credentials, mine cryptocurrency, and retain access to infected systems.

Researchers at VMRay identified the activity after linking behavior that initially appeared unrelated, including dropped files, unusual network requests, and shared server infrastructure. 

VMRay said in a report shared with Cyber Security News (CSN) that the campaign combines mass malware delivery, a proxy botnet, targeted intrusion tooling, and AI-assisted influence operations.

The impact extends beyond data theft. Compromised devices can become relay points for attacker traffic, while stolen passwords, browser data, session cookies, and Active Directory credentials may support deeper access to corporate networks.

The use of multiple payloads also makes containment harder, as security teams may face several persistence methods and malicious processes at once.

Operation STANDOFF

Operation STANDOFF’s most notable infrastructure trick involves servers that answer unsolicited requests with an HTTP 301 redirect to GitHub.

This can make a suspicious host look like an ordinary redirector during a quick scan, helping its command-and-control infrastructure blend into traffic patterns associated with a trusted service. GitHub itself was not compromised or involved in the campaign.

The proxy-list server at 212.193.30.45 supplied proxies.txt to infected machines, then redirected generic requests to GitHub.

Analysts linked this behavior to a wider cluster of campaign infrastructure, while a separate host, 212.193.30.29, served the STANDOFF COORD operator console.

This distinction matters because the console host performed a normal HTTP-to-HTTPS redirect rather than the GitHub redirect technique.

The campaign’s layered design resembles other cases where threat actors abuse familiar online services, such as this report on GitHub command control abuse, but STANDOFF uses GitHub primarily as a misleading redirect destination.

Malware, Proxies, and Intrusions

The initial loader dropped dozens of executables into a user-writable staging folder and used hidden command activity to launch them.

It also attempted to weaken Microsoft Defender, checked for security tools and virtual machines, and created persistence through registry entries, scheduled tasks, services, and startup items.

Those actions give the malware more time to steal data and keep infected machines available to the operators.

One component collected browser credentials, wallet-related information, and screenshots, while others enabled botnet control or cryptocurrency mining.

The proxy function is especially concerning because it can turn victims into unwitting traffic relays, a risk also seen in proxy botnet abuse cases. RedLine’s presence adds further risk because the stealer is built to capture sensitive user data and can support follow-on attacks.

The STANDOFF COORD console indicates that the group may coordinate human operators against enterprise environments.

It tracked systems by internal, external, and DMZ network segments, stored credentials and Kerberos tickets, and included shared notes, tasks, and scoring features.

Organizations should block the listed indicators, investigate suspicious outbound requests, protect privileged accounts, and use the guidance in this Active Directory attack checklist to reduce credential-theft and lateral-movement risks.

Security teams should also watch for unsigned executables launched from user-writable folders, unexpected Defender configuration changes, suspicious scheduled tasks, and malformed WinHTTP user-agent values.

Reviewing non-browser connections to the listed addresses and isolating affected hosts quickly can limit the chance that a single infection becomes a wider network incident.

Defenders should treat redirects to trusted domains as one signal among many, then validate the server, certificate, network ownership, requested resource, and process that initiated the connection before deciding whether the activity is benign.

Indocators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.