News

Rubrik Extends Protection for GitHub, Wracked by Cybersecurity Attacks

• By David Ramel
• 03/13/2025

Rubrik announced a raft of new cybersecurity features, including protection for GitHub, which has become a prime target for threat actors.

The company's announcement last week featured the protection for the Microsoft-owned GitHub platform as just one small part of a bevy of new features and functionalities, but it's even more significant in the wake of an increase in cybersecurity attacks noted by Microsoft after Rubrik's announcement.

A new attack vector was detailed by Microsoft in the company's March 6 post, "Malvertising campaign leads to info stealers hosted on GitHub."

"In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information," Microsoft said. "The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms. The campaign impacted a wide range of organizations and industries, including both consumer and enterprise devices, highlighting the indiscriminate nature of the attack."

Coincidentally, a recent report from Wiz noted that GitHub repositories have emerged as a prime target for threat actors, detailed in the company's "2025 State of Code Security: Key Trends and Risks" report published last month.

"GitHub's popularity makes it a central hub for developers -- but also for attackers," said Wiz. "Alarmingly, 35% of GitHub repositories are public, providing malicious actors with easy access to exploits if developers make critical mistakes, such as accidentally committing sensitive credentials. This reinforces the need for stricter permissions and better repository management practices."

GitGuardian detailed further GitHub vulnerabilities in its "The State of Secrets Sprawl 2025" report, which stated: "In 2024, we found 23,770,171 new hardcoded secrets added to public GitHub repositories. This figure represents a 25% surge in the total number of secrets from the previous year. This marks a substantial increase in the number of secrets found and continues the disturbing trend: secrets sprawl is steadily worsening over time."

While not addressing any specific threats or vulnerabilities such as secrets sprawl, last week's Rubrik announcement detailed the new Azure DevOps and GitHub Backup functionality.

"For organizations using continuous integration and continuous development to accelerate innovation, Rubrik now protects Azure DevOps and GitHub with cyber resilient automated backups, granular recovery, extended retention, and robust compliance coverage for critical data stores," the company said.

As noted, that was just one part of many new features and functionality announced by Rubrik ahead of its March 5 Cyber Resilience Summit, which is now available for on-demand viewing.

Here's a summary of those new features and functionality designed to enhance protection for cloud, Software-as-a-Service (SaaS), and on-premises environments:

• Rubrik Cloud Vault (RCV) for Amazon Web Services (AWS): RCV simplifies the management of secure off-site archival locations with flexible policies and regions. It offers immutable, isolated, logically air-gapped off-site backups combined with role-based access controls, advanced encryption, and retention locks.
• Support for Red Hat OpenShift Virtualization: Rubrik now provides comprehensive, automated, and immutable backups for organizations modernizing and migrating virtual machines to cloud-native infrastructure using Red Hat OpenShift Virtualization.
• Enhanced Security and Resilience for Microsoft Dynamics 365: Rubrik enhances protection for Microsoft Dynamics 365, aiming to secure critical operational and customer data within a unified platform.
• Sandbox Seeding for Salesforce: Rubrik introduces an intuitive user experience for selecting objects and records based on specific criteria, preventing seeding errors by analyzing data selection size versus destination size availability before moving data to the sandbox environment.
• Identity Recovery: Rubrik introduces Identity Recovery, delivering an automated and secure solution for protecting hybrid identity environments across Entra ID and Active Directory (AD). This includes orchestrated Active Directory Forest Recovery to rapidly and cleanly restore entire identity environments.

"The innovations aim to provide customers with even more ability to anticipate breaches, detect potential threats, and recover with speed and efficiency no matter where their data lives," Rubrik said.