Void Dokkaebi - Malicious Git Repository Clone & Execute (T1195.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•9

Detects developers cloning a repository (mimicking a coding interview test) and immediately executing an anomalous binary or script hidden within the project structure. This behavior is indicative of the Void Dokkaebi threat actor's tactics.