Exposed Git tokens and secrets are being hoovered up by hacker scans

• GreyNoise saw a significant increase in scanning activity
• IPs from Singapore are looking for exposed Git config files, also in Singapore
• The files could contain sensitive information such as login credentials and access tokens

Singaporean threat actors are on the hunt for organizations in the country that can be broken into and exploited, according to cybersecurity researchers GreyNoise, who recently observed a significant spike in reconnaissance activity.

In a new analysis, published earlier this week, GreyNoise said that on April 20-21, it witnessed a significant increase in IP addresses scanning for exposed Git configuration files. In that timeframe, it saw 4,800 unique IP addresses doing the scanning, which is a “substantial increase compared to typical levels”.

Most of the IPs originated in Singapore, although some were in the US, Germany, UK, and the Netherlands. They were mostly scanning through IPs in Singapore, as well, but also ...