---
title: "Discussion on \"Following the GitLab Dead Drop: Configuration Changes and C2 History\" | Hashnode"
description: "Discussion on \"Following the GitLab Dead Drop: Configuration Changes and C2 History\". How a GitLab-hosted configuration file let the UNK_DeadDrop operators change servers without new payloads, and what\nits revision history reveals."
url: "https://hashnode.com/posts/gitlab-dead-drop-infrastructure/6ae856129023a1bb138a08a5"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Following the GitLab Dead Drop: Configuration Changes and C2 History](https://unk-deaddrop.hashnode.dev/gitlab-dead-drop-infrastructure?utm_source=hashnode&utm_medium=feed)

How a GitLab-hosted configuration file let the UNK\_DeadDrop operators change servers without new payloads, and what its revision history reveals.

Nov 2 · 7 min read · unk-deaddrop.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#malware](https://hashnode.com/tag/malware)
-   [#gitlab](https://hashnode.com/tag/gitlab)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)

## Written by

[Ilja Krasnjanski](https://hashnode.com/@iljakrasnjanski)

@iljakrasnjanski · Berlin

  
[View profile](https://hashnode.com/@iljakrasnjanski)

Independent security researcher and systems engineer based in Berlin. Author of UNK\_DeadDrop and unk-scanner. I write about static AST analysis, software supply-chain security, and low-level runtime internals. Currently open to full-time roles in security research, static analysis tooling, or systems engineering.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.