Stargazer Goblin
Stargazer Goblin is the name used by Check Point for the threat actor operating the Stargazers Ghost Network, a large organization of GitHub accounts used to distribute malware through repositories themed around gaming cheats and malware. Reported activity associated or potentially associated with this actor includes use of GitHub repositories, promotion of cracked software, password-protected archives, and social-media or developer-platform amplification including TikTok and Facebook. Supporting reporting also notes overlap with campaigns delivering Lumma Stealer and other malware through GitHub-hosted lures and backdoored repositories, but attribution in those cases remains inconclusive. Sophos assessed that some 2023–2025 GitHub malware distribution activity may be linked to a Distribution-as-a-Service ecosystem such as Stargazer Goblin, a closely related operation, or another actor using a similar model. Based on the provided content, Stargazer Goblin is best characterized as a malware distribution actor tied to the Stargazers Ghost Network and GitHub-based malware delivery; no high-confidence nation-state attribution is stated in the source material.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
49 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Distribution-as-a-Service operation using GitHub accounts and repositories themed around gaming cheats and malware to distribute infostealers, with overlap noted against the backdoored repository campaign discussed in the article.
Operates or is associated with the ‘Stargazers Ghost Network,’ a Distribution-as-a-Service operation using GitHub repositories themed as gaming cheats and malware to distribute infostealers. The article assesses the current ischhfd83-linked campaign may be a new customer of this operation, a closely linked variant, or a rival/standalone actor using similar methods.
Potentially linked by similarity to a LummaStealer distribution campaign that promotes cracked software via GitHub repositories, cracked forums, Facebook groups, Devpost, TikTok, and Chromium issues, using password-protected archives and MEGA-hosted payload delivery.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.