Wouldn’t have been that hard to write a rule that matches the repositories being created by this malware. It literally does the same thing to every victim.