A sharp rise in malicious scanning for exposed Git configuration files has been detected, raising serious concerns about potential codebase theft and credential leaks for organizations worldwide.
According to security analysts at GreyNoise Intelligence, there was a record surge in Git config file probing, with around 4,800 unique IP addresses involved in daily scanning between April 20 and 21, 2025.
Crawling Activity Reaches Unprecedented Levels
This recent surge marks the most significant of four distinct spikes recorded since September 2024.
Earlier surges generally involved approximately 3,000 unique IP addresses, making the current campaign notably larger in scale.
“GreyNoise can confirm that 95% of all IPs exhibiting this behavior over the past 90 days are classified as malicious,” the firm stated in its latest analysis.
The activity is being monitored under the GreyNoise Git Config Crawler tag, which tracks IP addresses scanning for exposed Git configuration files.
Global Surge in Git Configuration Scanning Activity
Although the scanning activity spans the globe, Singapore has emerged as both the leading source and destination for these attacks, followed closely by the United States and Germany.
Notably, much of the malicious traffic originates from legitimate cloud infrastructure, with numerous IP addresses tied to providers such as Cloudflare, Amazon, and DigitalOcean.
Geographic Breakdown of Activity
Top Source Countries
- Singapore: 4,933 unique IPs
- United States: 3,807 unique IPs
- Germany: 473 unique IPs
Top Destination Countries
- Singapore: 8,265 unique IPs
- United States: 5,143 unique IPs
- Germany: 4,138 unique IPs
Technical Impact and Security Risks
The attackers are specifically targeting .git/config files, which contain sensitive repository metadata. When exposed, these files can reveal:
- Remote repository URLs (e.g., GitHub, GitLab)
- Branch names and structures
- Internal development metadata
More critically, if an attacker gains access to the entire .git directory, they may be able to reconstruct full codebases, including commit histories that could expose credentials, proprietary logic, and sensitive business information.
A similar incident in 2024 led to the leak of 15,000 credentials and the unauthorized cloning of 10,000 private repositories.
This current campaign appears linked to CVE-2021-23263, a known vulnerability published in December 2021. Its continued exploitation indicates that many systems remain unpatched, leaving them vulnerable to attack.
Recommendations for Mitigation
Security professionals advise taking the following immediate actions:
- Restrict access to
.git/directories via public web servers - Configure web servers to deny access to hidden files and folders
- Monitor logs for suspicious or repeated requests to
.git/configpaths - Rotate credentials that may have been stored in exposed version control histories
The scale and sophistication of this ongoing campaign highlight the urgent need for organizations to secure their source code management environments and proactively guard against targeted scanning and exploitation efforts.
