TL; DR
Ib tus tshaj tawm npm nkaus xwb, deadcode09284814, tau khiav ib qho kev sib tw tawm tsam typosquat tawm tsam cov neeg raug cai axios thiab chalk-template cov pob khoom txij li nruab nrab lub Tsib Hlis 2026.
Lub phiaj xwm tau pib ua ib qho kev nyiag daim ntawv pov thawj thiab lub hnab nyiaj, rho tawm cov ntaub ntawv mus rau ib qho Serveo HTTPS tunnel.
On 2026-05-17, nrog axois-utils:1.0.9, tus neeg teb xov tooj tau hloov pauv tag nrho cov payload: tib lub triple install-hook scaffold, tib lub publisher, tib lub npe pob.
Tab sis cov ntawv teeb tsa tam sim no yog ib qho kev sib tw hla-platform DDoS botnet recruit.
Lub payload hais lus rau ib tug localhost.run qhov av thiab lees txais cov lus txib dej nyab, hloov cov chaw muaj kab mob mus ua ib feem ntawm DDoS-muaj peev xwm botnet.
Tus neeg teb xov tooj txawm xa cov C2 server binary sab hauv lub tarball, qhia txog kev nce qib meej meej los ntawm kev nyiag daim ntawv pov thawj mus rau cov khoom siv botnet uas siv tau.
Ob lub pob khoom, plaub lub version tseem ua haujlwm ntawm lub registry, thiab ib tus neeg teb xov tooj tam sim no khiav ob lub modules ua ke.
Qhov hnyav: siab.
Kev Tawm Tsam: Nws Ua Haujlwm Li Cas
Daim phiaj xwm no yog tsim los ntawm kev xa khoom tsis zoo: ob lub npe pob khoom typosquat, ib tsab ntawv tawm ntawm cov pob khoom nrog ntau pua lab daus las ntawm kev rub tawm txhua lub lim tiam (axios, daim qauv chalk), thiab peb zaug teeb tsa hooks uas lav qhov kev ua tiav. Qhov nthuav yog dab tsi lub scaffold nqa — thiab qhov tseeb tias tus neeg teb xov tooj tau hloov cov khoom thauj yam tsis tau hloov lwm yam dab tsi.
Lub scaffold sib koom ua ke
Txhua qhov version uas tau luam tawm ntawm ob lub pob khoom tshaj tawm tib lub sijhawm peb lub voj voog ntawm lub neej hooks in pob.json:
Sau cov payload rau hauv tag nrho peb hooks yog overkill - tom qab kev teeb tsa ib leeg yuav khiav hauv qhov tsis tau teeb tsa npm nruabQhov kev xaiv tseem ceeb: npm nruab - tsis quav ntsej-scripts hla cov ntawv sau, tab sis ntau txoj haujlwm ua ke (CI cache rov qab kho qhov rov ua haujlwm lub voj voog) hooks xaiv, lossis cov neeg tsim khoom uas tsuas yog tshuaj xyuas tom qab kev teeb tsa) ua ib daim ntawv tshaj tawm triple-redundant uas yog qhov kev twv txiaj zoo tshaj plaws rau tus neeg tawm tsam.
chalk-tempalte ntxiv ib txoj kev thib ob: nws tshaj tawm axois-utils:^1.0.7 ua ib lub sijhawm ua haujlwm vam khom. Kev teeb tsa tus lej cim daim qauv chalk yog li ntawd rub cov kwv tij typosquat thiab, thiab ob qho payloads khiav. Ob lub pob khoom yog ib khub sib koom ua ke, tsis yog cov npe ywj pheej.
Theem A — daim ntawv pov thawj / tus neeg nyiag hnab nyiaj (2026-05-15 → tam sim no)
Theem A yog thawj qhov payload. Lub loader yog luv luv postinstall.js uas taw tes rau Serveo HTTPS reverse-tunnel:
Lub Serveo subdomain encodes lub chaw nyob IP (80.200.28.28) ncaj qha rau hauv lub npe hostname - ib qho kev cai uas paub tau rau qhov kev pabcuam ntawd. Tus neeg teb xov tooj tig lub subdomain prefix random ntawm cov versions kom zam dhau cov npe naïve domain blocklists, tab sis qhov IP hauv qab yeej tsis txav mus. (chalk-tempalte:1.0.14 siv 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 siv f04a273bd84c0622-….)
postinstall.js tes tawm mus phantom.js, ib qho 7,667-kab bundled "collector" module. phantom.js tus tswv tsev taug kev rau:
Cov yuam sij ntiag tug SSH (~/.ssh/*) |
.npmrc cov ntsiab lus thiab txhua yam npm_* env tokens |
| Cov ntaub ntawv pov thawj ntawm AWS, GCP, thiab Azure |
GitHub tus kheej-nkag-token regex (ghp_*, gho_*, ghu_*, ghs_*) |
| Cov khoom siv crypto-wallet rau Bitcoin, Exodus, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
Ib qho rov ua dua .env* taug kev ~/projects, ~/dev, ~/code, ~/workspace, thiab qhov kev teeb tsa cwd |
Cov keeb kwm ntawm Shell thiab tag nrho cov ntaub ntawv process.env |
Lub pob khoom raug POSTed rau Serveo qhov av ntawm /sauTsis muaj kev ua kom pom tsis meej, tsis muaj kev xav tiv thaiv VM, tsis muaj kev npaj ua ntej - tus neeg teb xov tooj qhov kev twv yog nyob ntawm qhov ntim thiab qhov ceev.
Theem B — PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 xwb)
Theem B hloov phantom.js + postinstall.js nrog ib daim ntawv hu ua distrube.js (tus typo yog tus neeg teb xov tooj). Lub triple-hook scaffold hauv package.json tsis hloov pauv; lub pob khoom khaws tib lub npe, qhov ntau thiab tsawg, thiab cov qauv version-bump. Los ntawm sab nraud, axois-utils: 1.0.9 zoo li me me ua raws li 1.0.6. Sab hauv, nws yog tsev neeg malware sib txawv.
distrube.js qhib nrog ib lub thaiv teeb tsa uas muab lub npe rau tus neeg teb xov tooj lub npe:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Cov lus tawm tswv yim yog xa mus rau tus neeg teb xov tooj yav tom ntej uas khiav cov khoom siv ("Siv koj lub localhost.run HTTPS URL"). Qhov ntawd, ntxiv rau qhov xa mus rau tus neeg siv bot, yog qhov qhia tias qhov no tsis yog tsuas yog tus neeg raug tsim txom payload - nws yog cov khoom siv.
Cov dej ntws:
- Persistence khiav ua ntej. Cov ntawv sau nruab nws tus kheej hauv peb txoj kev sib txawv rau txhua OS (registry) khiav + Cov ntaub ntawv pib + cov haujlwm ntawm Windows; crontab + phantom-bot.kev pabcuam systemd unit + .bashrc/.zshrc ntxiv + /etc/rc.local ntawm Linux; LaunchAgent com.phantom.bot.plist ntawm macOS). Lub npe kev pabcuam persistence thiab daim ntawv lo LaunchAgent yog ob qho tib si. tus neeg hlau phantom / com.phantom.bot, uas kuj yog qhov chaw uas lub npe phiaj xwm los ntawm.
- Cov ntaub ntawv qhia txog qhov system khiav ib zaug - ib qho kev txhaj tshuaj ntiv tes POST rau b94b6bcfa27554.lhr.life:443/collect nqa hostname, platform, arch, username, CPU/RAM, network interfaces, process.env, cwd, homedir, node version, thiab pej xeem IP. Qhov no tsis tshua muaj kev nruj dua li Theem A: tsis muaj SSH, tsis muaj hnab nyiaj, tsis muaj .env recursion. Tus bot txoj haujlwm yog sau npe, tsis yog nyiag.
- Lub plawv dhia voj voog qhib ib qho HTTPS POST txhua 30 vib nas this rau b94b6bcfa27554.lhr.life:443/. Tus Neeg Sawv Cev Tus Neeg Siv yog PhantomBot/1.0. Kev txheeb xyuas TLS raug kaw meej meej (rejectUnauthorized: cuav). Cov lus teb C2 raug txheeb xyuas ua JSON ntawm daim ntawv {hom, lub hom phiaj, chaw nres nkoj, lub sijhawm, xov, txoj kev} thiab xa tawm.
- Cov khoom siv dej nyab yog txuas rau rau cov lus txib:
| Hom lus txib | module | Sau ntawv |
|---|---|---|
| ping | Cov lus teb txog kev muaj sia nyob | Bot txheeb xyuas nws tus kheej |
| Http | HTTP dej nyab | Txheej-7 thov dej nyab |
| https | HTTPS dej nyab | Ib yam li http, TLS-qhwv |
| tcp | TCP dej nyab | 65 KB random-payload spam |
| udp | dej nyab UDP | 65,507-byte UDP pob ntawv |
| ceev ceev | HTTP/2 DoS rov pib dua sai sai | Cov txheej txheem 2023 CVE-2023-44487 |
Tag nrho tsib lub modules dej nyab siv ib qho lub hom phiaj, qhov chaw nres nkoj, ntev, Thiab threads kev sib cav - tus neeg hlau yog ib qho kev siv rau kev ntiav neeg ua haujlwm, tsis yog lub hom phiaj rau ib tus neeg raug tsim txom tshwj xeeb. Daim ntawv teev cov neeg raug tsim txom ntawm tus neeg teb xov tooj nyob ntawm C2, tsis yog nyob rau hauv pob khoom.
Muaj Dab Tsi Tshiab Ntawm No — lub C2 binary uas tau xa tuaj
Theem A yog ib daim duab uas paub zoo: kev nyiag daim ntawv pov thawj, kev teeb tsa hook, tus muag khoom-tunneled C2. Theem B yog kuj ib daim duab uas paub zoo - DDoS botnets tau yog ib qho khoom siv ntawm cov pob khoom npm phem tau ntau xyoo. Qhov txawv txav yog tias tus neeg teb xov tooj xa cov sab server ntawm cov khoom siv sab hauv npm tarball:
- c2 — ib daim 4-megabyte Go ELF binary uas tau muab tso ua ke
- c2.go — qhov chaw Go 426-kab rau qhov binary ntawd
Ob daim ntawv tsis raug hu los ntawm ib qho install hook. Lawv tsis yog ib feem ntawm tus neeg raug tsim txom payload. Lawv zaum hauv daim nplaub tshev pob khoom ib yam li cov ntaub ntawv sau cia. Qhov nyeem tau zoo tshaj plaws yog tias tus neeg teb xov tooj thawb lawv tsob ntoo ua haujlwm tsim kho mus rau npm yam tsis tau sau cov npe ntaub ntawv - daim ntawv thov OpSec tiag tiag - thiab qhov xa mus yog cov khoom siv ob sab: tus neeg siv khoom uas tus neeg raug tsim txom khiav, thiab lub server uas tus neeg teb xov tooj khiav.
Qhov no yog ib feem ntawm zaj dab neeg uas piav qhia txog qhov "turnkey botnet kit". Txhua tus neeg uas tau rub tawm axois-utils:1.0.9 ua ntej kev tshem tawm tsis yog tsuas yog muaj tus qauv raug tsim txom xwb - lawv muaj lub server C2 ua haujlwm.
Lub pivot, hauv ib kab lus
Tib lub tuam txhab luam tawm, tib lub npe pob khoom, tib lub triple-hook scaffold, tib lub "phantom" branding - tab sis lub payload tau hloov pauv tus qauv kev khwv nyiaj thaum hmo ntuj: los ntawm "cov lus zais sau qoob loo uas kuv tuaj yeem muag dua" mus rau "qhov muaj peev xwm xauj dej nyab uas kuv tuaj yeem xauj". Lub sijhawm teeb tsa TTP uas cov neeg tiv thaiv yuav tsum tau saib xyuas yuav luag zoo ib yam thoob plaws ob theem; kev tiv thaiv raws li kos npe keyed rau Theem A cov hlua hnab nyiaj-txoj kev lossis rau phantom.jstus neeg sau kab 7,667 yuav plam theem B kiag li.
| Hnub Tim (UTC) | Cov kev tshwm sim |
|---|---|
| 2026-05-15 | Thawj tsab ntawv tshaj tawm: axois-utils:1.0.4 (LAN sim tsim, dev rig ntawm 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 luam tawm — Theem A C2 hloov mus rau 80.200.28.28 ntawm Serveo qhov av; cov lus tawm tswv yim los ntawm qhov chaw // Change to '80.200.28.28' for public lees paub qhov kev hloov pauv dev → prod |
| 2026-05-16 | chalk-tempalte:1.0.14 thiab 1.0.16 luam tawm — chained loader tshaj tawm axois-utils:^1.0.7 ua ib qho kev vam khom thaum lub sijhawm khiav; Serveo subdomain tig mus |
| 2026-05-16 | Kev sib tw theem A tau pom thaum lub sijhawm luam theej npm niaj hnub; tau lees paub tias muaj kev txiav txim siab phem |
| 2026-05-17 | axois-utils:1.0.9 luam tawm - payload pivot: PhantomBot DDoS nrhiav neeg los ntawm localhost.run tunnel; operator-side c2 binary thiab c2.go qhov chaw xa khoom hauv tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 thiab 1.0.20 luam tawm - tseem yog Theem A (stealer); tus neeg teb xov tooj tam sim no khiav ob lub modules ua ke |
| 2026-05-17 | Kev tshawb pom ntawm Theem B thaum lub sijhawm luam theej duab niaj hnub; cov lus txiav txim siv rau txhua qhov 2026-05-17 versions |
| (txuas ntxiv) | Cov ntawv ceeb toom txog kev tshem tawm tseem tab tom tos; tag nrho plaub pob khoom uas tau tshaj tawm tseem muaj nyob rau ntawm daim ntawv teev npe thaum lub sijhawm sau ntawv |
Cov Cim Qhia Txog Kev Sib Tw
Tej pob khoom
| ecosystem | pob | versions |
|---|---|---|
| npm | axois-utils (typosquat ntawm axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (typosquat ntawm chalk-template) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Tus sau ntawv lub npe
| teb | Tus nqi |
|---|---|
| npm publisher | deadcode09284814 |
| Tus tshaj tawm email | phantomdeadcode@tutamail.com |
| SCM pov thawj | tsis muaj leej twg |
Hais-thiab-tswj
| Sij hawm | Endpoint | Thauj |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS tunnel |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS qhov av (qhov ua ntej) |
| A | 80.200.28.28:443/collect | Qhov kawg ntawm VPS hauv qab |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS reverse-tunnel |
Cov ntaub ntawv faib tawm (SHA-256)
| cov ntaub ntawv | SHA-256 | Sau ntawv |
|---|---|---|
c2 (Mus ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Tus neeg teb xov tooj C2 server, xa mus rau sab hauv axois-utils:1.0.9 |
c2.go (426 kab) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Mus rau qhov chaw rau C2 binary |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Theem B bot client |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Theem A daim ntawv pov thawj / tus neeg sau nyiaj |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Tus neeg sau Theem A (1.0.20 variant) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Theem A loader, byte-zoo ib yam thoob plaws ob qho versions |
Kev Ua Tus Thawj Coj & Kev Txhawb Siab
Peb taug qab qhov kev sib tw no raws li PhantomBot, coj tus neeg teb xov tooj lub npe los ntawm Tus Neeg Sawv Cev: PhantomBot/1.0 lub plawv dhia header, lub phantom-bot.kev pabcuam unit systemd, lub com.phantom.bot Daim ntawv lo rau LaunchAgent, thiab phantomdeadcode@ email kov. Tus neeg teb xov tooj yeej ib txwm hais txog lub npe no thoob plaws tsawg kawg plaub yam khoom cuav.
Cov ntawv teev cov cim qhia
- Publisher - tus lej tuag09284814 ntawm npm. Ib tus account uas siv tau ib zaug xwb, Tutamail email uas siv pov tseg tau, tsis muaj SCM kev txheeb xyuas. Tsis muaj keeb kwm tshaj tawm ua ntej dhau ntawm qhov kev sib tw no.
- Kev siv dua lub npe lag luam — "phantom" tshwm sim hauv email ntawm tus tshaj tawm, hauv lub npe ntawm cov ntaub ntawv sau Theem A (phantom.js), nyob rau hauv lub npe kev pabcuam Theem B (phantom-bot.kev pabcuam), nyob rau hauv daim ntawv lo LaunchAgent (com.phantom.bot), thiab nyob rau hauv bot User-Agent (PhantomBot/1.0).
- infrastructure — Ib qho VPS ntawm 80.200.28.28 pem hauv ntej Theem A ntawm Serveo subdomain rotation; Theem B txav mus rau a localhost.khiav qhov av rov qab (b94b6bcfa27554.lhr.lub neej). Ob qho kev pabcuam ntawm tus muag khoom yog pub dawb thiab tsuas yog xav tau SSH sab nraud ntawm sab ntawm tus neeg teb xov tooj xwb, sib xws nrog cov peev nyiaj tsawg, cov teeb tsa OpSec qis.
- code style — JavaScript yooj yim thoob plaws; tsis muaj kev ua kom pom tsis meej, tsis muaj kev encoding string, tsis muaj kev kuaj xyuas anti-VM. Cov npe hloov pauv yog piav qhia (nyiagSystemInfo, executeCommand, httpFlood). Cov lus tawm tswv yim hauv distrube.js ncaj qha mus rau tus neeg teb xov tooj yav tom ntej ("Siv koj lub localhost.run HTTPS URL"), qhia tias cov ntaub ntawv no tau npaj siab yuav muab faib ua ib pob khoom, tsis yog siv los ntawm ib tus neeg tawm tsam.
- Daim ntawv pov thawj OpSec — Lub tarball theem B xa ob qho tib si bot client thiab tus neeg teb xov tooj C2 server (c2 ELF + c2.go qhov chaw). Qhov no yog sib xws nrog tus neeg teb xov tooj uas thawb lawv tsob ntoo ua haujlwm mus rau npm yam tsis tau tshuaj xyuas cov npe ntawm cov ntaub ntawv. Tus neeg teb xov tooj tsis muaj kev paub dhau los, lossis cov khoom siv yog txhais tau tias kom muab faib rau pej xeem thiab C2 binary yog ib feem ntawm cov khoom.
- Kev lees paub tus kheej - axois-utils:1.0.4 muaj cov lus tawm tswv yim los ntawm qhov chaw // Hloov mus rau '80.200.28.28' rau pej xeem ntawm kab 12, lees paub qhov kev nce qib ntawm dev / staging / kev tsim khoom uas cov neeg ua haujlwm feem ntau tsis lees paub.
Sab
Lub sijhawm A payload yog kev nyiag nyiaj txiag yooj yim: cov ntaub ntawv pov thawj, cov yuam sij huab, GitHub tokens, thiab crypto hnab nyiaj txhua tus muaj cov lag luam muag khoom rov qab. Lub sijhawm B kuj yog nyiaj txiag, tab sis tsis ncaj qha: DDoS-rau-ntiav ("booter") cov kev pabcuam xauj tsev muaj peev xwm los ntawm feeb, thiab cov bots zoo li qhov xa tuaj ntawm no yog cov khoom muag uas cov kev pabcuam khiav. Lub plawv dhia 30-thib ob, cov generic lub hom phiaj/qhov chaw nres nkoj/ntev cov lus txib schema, thiab tsib-protocol dej nyab arsenal yog cov standard cov khoom ntawm tus neeg teb xov tooj booter.
Khiav ob lub modules ua ke - chalk-tempalte:1.0.19 thiab 1.0.20 txuas ntxiv xa tus neeg nyiag khoom thaum axois-utils:1.0.9 xa cov neeg hlau - qhia tias tus neeg teb xov tooj tab tom tiv thaiv cov nyiaj tau los es tsis txhob tso tseg Theem A. Lub pivot yog ib qho Ntxiv rau, tsis yog hloov.
Qhov peb tsis thov
Peb tsis tau lees paub qhov tseeb ntawm lub ntiaj teb tom qab qhov no tus lej tuag09284814 kov, thiab peb tsis muab qhov kev sib tw no rau ib tus neeg ua phem, pawg, lossis lub tebchaws. Lub npe "phantom" yog sib xws txaus thoob plaws cov khoom siv los qhia ib tus neeg teb xov tooj, tab sis kev xa khoom ntawm C2 binary qhib qhov ua tau tias cov pob khoom yav tom ntej los ntawm cov tes tsis sib xws yuav rov siv tib cov lej.
Kev Cuam Tshuam, Cov Qauv & Cov Neeg Tiv Thaiv Yuav Tsum Ua Li Cas
Qhov cuam tshuam
Lub hom phiaj squat raug cai axios thiab daim qauv chalk nyob ntawm ntau yam hauv JavaScript ecosystem; axios nyob ib leeg nyob ntawm peb caug pob npm uas rub tawm ntau tshaj plaws. Cov npe typosquat yog ib qho kev nias ntawm cov npe tiag tiag (axois ↔ axios, tempalte ↔ template), thiab ob qho tib si yog cov lus sau tsis raug.
Peb tsis tau txais cov ntaub ntawv rub tawm txhim khu kev qha rau cov qauv phem ua ntej tshem tawm - npm tsis khaws cov lej rub tawm ib-version tom qab pob khoom tsis tau tshaj tawm, thiab npms.io-style proxies muaj suab nrov ntawm qhov ntsuas no. Txhua lub koom haum uas lawv cov ntaub ntawv xauv daws teeb meem rau pob khoom hu ua axois-utils or chalk-tempalte los ntawm tus tshaj tawm tus lej tuag09284814 yuav tsum raug kho raws li kev puas tsuaj: tig txhua daim ntawv pov thawj uas muaj nyob hauv txheej txheem.env ntawm tus tswv tsev uas raug cuam tshuam, tshuaj xyuas cov vectors persistence ib OS (saib "Cov neeg tiv thaiv yuav tsum ua li cas" hauv qab no), thiab tshem tawm qhov kev vam khom.
Cov qauv tshiab
Daim phiaj xwm no ua piv txwv txog kev hloov pauv uas peb tau pom hauv ntau qhov xwm txheej npm tsis ntev los no: lub scaffold install-hook yog cov khoom siv ruaj khov; qhov payload yog swappable. Tus tshaj tawm tib yam, tib pob khoom, tib yam ua ntej nruab / nruab / tom qab kev teeb tsa peb npaug, thiab txawm tias tib qho version-bump cadence - tib yam uas hloov pauv ntawm axois-utils:1.0.6 thiab axois-utils:1.0.9 yog cov ntaub ntawv hooks khiav. Kev tshawb nrhiav raws li kos npe uas tau muab tso rau hauv Phase A payload (wallet-path strings, phantom.js's 7,667-kab tus neeg sau, tus tswv tsev Serveo C2) yuav tau cim thawj peb qhov versions thiab plam Theem B kiag li.
Tus qauv zoo sib xws no pom tau thoob plaws lwm cov phiaj xwm xyoo 2026 uas peb tau taug qab: ib tus neeg ua haujlwm nrog lub scaffold ruaj khov, pauv ntawm kev nyiag daim ntawv pov thawj, cov neeg siv khoom dag ntxias xeem, Telegram-bot exfil, thiab tam sim no DDoS recruitment. Cov neeg tiv thaiv uas vam khom cov kos npe payload yuav pheej poob qhov thib ob ntawm txhua qhov phiaj xwm.
Qhov xaus yog tias TTPs thaum lub sijhawm teeb tsa yog lub cim zoo dua. Triple install-hook declarations, install scripts uas import https or tus menyuam_txheej txheem, nruab cov ntawv sau uas sau rau cov nplaub tshev pib siv, thiab nruab cov ntawv sau uas daws cov npe hostnames ntawm cov kev pabcuam reverse-tunnel dawb (Serveo, localhost.khiav, ngrok, cloudflared) tsis tshua muaj nyob rau hauv cov pob khoom raug cai thiab feem ntau pom ntawm cov phem.
Cov neeg tiv thaiv yuav tsum ua li cas
- Kev tshuaj xyuas cov ntaub ntawv xauv. Tshawb nrhiav txhua pob-lock.json / xov paj.xauv / pnpm-xauv.yaml hauv koj lub koom haum rau cov hlua tseeb axois-utils thiab chalk-tempalteXav txog txhua qhov kev sib tw ua ib qho kev sib haum xeeb.
- Tig cov lus zais rau cov tswv tsev uas raug kev cuam tshuam. Theem A cov ntaub ntawv pov thawj SSH, huab, GitHub, npm, thiab hnab nyiaj uas tau sau ua ntau daim. Xav tias txhua daim ntawv pov thawj uas tau muaj nyob hauv txheej txheem.env, ~/.ssh, ~/.aws, ~/.npmrc, ~/.config, lossis ib qho .env* cov ntaub ntawv ntawm tus tswv tsev cuam tshuam raug nthuav tawm.
- Tshem tawm qhov kev ua siab ntev (Theem B). Hauv Windows, rho tawm HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, tshem tawm %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, Thiab schtasks / rho tawm /tn SystemUpdate /fNyob rau hauv Linux, crontab -e thiab tshem tawm @reboot node …, systemctl –user lov tes taw –now phantom-bot.service ces muab lwv tawm ~/.config/systemd/user/phantom-bot.service, txhuam .bashrc / .zshrc / /etc/rc.localNyob rau hauv macOS, launchctl unload ~/Library/LaunchAgents/com.phantom.bot.plist ces rho tawm cov plist.
- Thaiv cov C2 hosts. Ntxiv plaub qhov kawg ntawm C2 hauv lub rooj IOC rau koj daim ntawv teev kev thaiv kev tawm mus. *.serveousercontent.com thiab *.lhr.lub neej tuaj yeem raug thaiv lag luam wholesale yog tias koj qhov chaw ib puag ncig tsis muaj kev siv raug cai rau cov kev pabcuam rov qab-qhov av.
- Nrhiav los ntawm lub sijhawm teeb tsa TTP, tsis yog qhov hnyav. Cov ntaub ntawv xauv khoom uas lawv muaj pob.json tshaj tawm hais tias ua ntej nruab, nruab, Thiab tom qab kev teeb tsa txhua tus taw tes rau tib tsab ntawv. Tshawb xyuas nrog lub hnub nyoog ntawm pob khoom thiab qhov xwm txheej txheeb xyuas tus tshaj tawm. Tus qauv no tsis tshua muaj nyob rau hauv cov pob khoom raug cai thiab yog tib qho cim txhim khu kev qha uas PhantomBot rov siv dua.
- Kev tshuaj xyuas rau C2 binary. Txhua tus neeg uas tau downloaded axois-utils:1.0.9 muaj tus neeg teb xov tooj lub C2 server (c2 ELF, sha256 165fa92d…) ntawm disk. Luam theej duab caches thiab CI artifact stores. Lub binary yog dormant los ntawm nws tus kheej, tab sis nws muaj nyob rau ntawm lub workstation yog pov thawj tseeb tias pob khoom tau raug ntsia.
Kab kaw
Tus neeg teb xov tooj tib yam, tib pob khoom, thiab tib lub cuab yeej teeb tsa tuaj yeem xa cov kev hem thawj sib txawv kiag li hauv 48 teev. Saib xyuas lub scaffold, tsis yog lub payload.
