https://www.secureworks.com/blog/drokbk-malware-uses-github-as-dead-drop-resolver