TL; DR
Otu onye mbipụta npm, deadcode09284814, emeela mkpọsa maka njehie mkpụrụedemede ederede megide iwu kwadoro axios na chalk-template ngwugwu kemgbe etiti Mee 2026.
Mgbasa ozi ahụ malitere dị ka akwụkwọ ikike nkịtị na onye na-ezu ohi obere akpa, na-ewepụta data gaa na Ọwara HTTPS nke Serveo.
On 2026-05-17, na axois-utils:1.0.9, onye ọrụ gbanwere ibu ọrụ ahụ kpamkpam: otu ihe mkpuchi ntinye atọ ahụ, otu onye mbipụta ahụ, otu aha ngwugwu ahụ.
Mana edemede nrụnye ahụ bụ ugbu a onye na-eweghachi botnet DDoS.
Ibu ọrụ ahụ na-agwa a okwu localhost.run ọwara ma nabata iwu idei mmiri, na-eme ka gburugburu ebe ndị butere ọrịa bụrụ akụkụ nke botnet nwere ike DDoS.
Onye ọrụ ahụ zipụrụ ọbụna C2 sava binary n'ime tarball, na-egosi mmụba doro anya site na ohi asambodo gaa na akụrụngwa botnet na-arụ ọrụ.
Ngwugwu abụọ, ụdị anọ ka na-arụ ọrụ na ndekọ ahụ, na otu onye ọrụ ugbu a na-agba modulu abụọ ahụ n'otu oge.
Oke ike: dị elu.
Mwakpo ahụ: Otu O Si Arụ Ọrụ
A na-ewulite mkpọsa a n'elu ihe eji ebufe ihe na-agwụ ike: aha ngwugwu abụọ e ji typosquat mee, otu mkpụrụedemede dị na ngwugwu nwere ọtụtụ narị nde nbudata kwa izu (axios, ihe ndebiri nzu), na ntinye atọ hooks nke ahụ na-ekwe nkwa mmezu ya. Ihe na-adọrọ mmasị bụ ihe ihe owuwu ahụ bụ na-eburu — na eziokwu ahụ bụ na onye na-arụ ọrụ gbanwere ibu ahụ n'agbanweghị ihe ọ bụla ọzọ.
Ebe a na-ekerịta ihe owuwu
Ụdị ọ bụla ebipụtara nke ngwugwu abụọ ahụ na-ekwupụta otu usoro ndụ atọ ahụ hooks in ngwugwu.json:
Depụta ibu ọrụ dị n'okpuru atọ niile hooks dị oke egwu — nrụnye mgbe etinyere naanị ya ga-agba ọsọ na ndabara npm tinyeNhọrọ ahụ dị mkpa: npm wụnye –ignore-scripts na-amafe edemede, mana ọtụtụ usoro ọrụ a na-ahụkarị (CI cache na-eweghachi usoro ndụ ahụ ọzọ hooks nhọrọ, ma ọ bụ ndị mmepe na-enyocha naanị nyocha, nrụnye mgbe etinyere) mee nkwupụta ugboro atọ nke na-adịghị oke nchebe maka onye na-awakpo ahụ.
nzu-tempalte na-agbakwụnye usoro nke abụọ: ọ na-ekwupụta utilities axois:^1.0.7 dị ka oge ọrụ adabereỊwụnye ihe ndị e dere n'ụdị ederede ihe ndebiri nzu Ya mere, ọ na-adọtakwa okwu mkparị nwanne, ibu ọrụ abụọ ahụ na-agbakwa ọsọ. Ngwugwu abụọ ahụ bụ ụzọ abụọ a haziri ahazi, ọ bụghị ndepụta ndị nọọrọ onwe ha.
Nkebi A — onye na-ezu ohi akwụkwọ ikike / onye na-ezu obere akpa (2026-05-15 → ugbu a)
Nkebi A bụ ibu mbụ a na-ebu. Ihe na-ebu ibu bụ obere postinstall.js nke ahụ na-ezo aka na ọwara ntụgharị nke Serveo HTTPS:
Ngalaba Serveo na-akọwapụta adreesị IP ebe a na-aga (80.200.28.28) kpọmkwem na aha nnabata — nkwekọrịta a na-amata maka ọrụ ahụ. Onye ọrụ ahụ na-atụgharị prefix subdomain na-enweghị usoro n'etiti nsụgharị iji zere ndepụta ngọngọ ngalaba na-enweghị isi, mana IP dị n'okpuru anaghị agagharị.tempalte nzu:1.0.14 -ABỤ 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 ojiji f04a273bd84c0622-….)
postinstall.js aka pụọ na phantom.js, modulu "onye nchịkọta" nke nwere ahịrị 7,667. phantom.js na-agakwuru onye ọbịa maka:
Igodo nkeonwe SSH (~/.ssh/*) |
.npmrc ihe dị n'ime na ihe ọ bụla npm_* akara env |
| Faịlụ nzere AWS, GCP, na Azure |
Regex nke ihe nrịbama ohere nkeonwe nke GitHub (ghp_*, gho_*, ghu_*, ghs_*) |
| Ihe ndị e ji akpa ego Crypto mee maka Bitcoin, Ọpụpụ, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
Ihe na-emegharị ugboro ugboro .env* gafere ~/projects, ~/dev, ~/code, ~/workspace, na nrụnye cwd |
Akụkọ Shell na ihe niile gbasara Shell process.env |
E tinyere ngwugwu ahụ n'ọwara Serveo na /kpokọtaEnweghị ihe mgbochi, enweghị usoro mgbochi VM, enweghị usoro ihe omume — ihe onye ọrụ ga-eme bụ olu na ọsọ.
Nkeji B — PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 naanị)
Usoro B na-eji otu faịlụ aha ya bụ distrube.js dochie phantom.js + postinstall.js (ụdị njehie ahụ bụ nke onye ọrụ). Nhazi triple-hook dị na package.json agbanweghị agbanwe; ngwugwu ahụ na-edobe otu aha, scope, na ụdị-bump. Site na mpụga, axois-utils:1.0.9 dị ka obere ihe na-esochi 1.0.6. N'ime ya, ọ bụ ezinụlọ malware dị iche.
distrube.js na-emepe na ngọngọ nhazi nke na-akpọ aha akara nke onye ọrụ ahụ:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
A na-agwa ndị a okwu ndị a nye onye ọrụ ga-arụ ọrụ n'ọdịnihu nke na-agba ngwa ahụ ("Jiri URL HTTPS gị nke localhost.run"). Nke ahụ, tinyere ihe na-abịa n'akụkụ onye ahịa bot, bụ ihe na-egosi na nke a abụghị naanị ibu ọrụ onye ihe metụtara - ọ bụ ngwa ahụ.
Usoro ahụ:
- Iguzosi ike Ọ na-ebu ụzọ na-agba ọsọ. Ederede ahụ na-etinye onwe ya n'ụzọ atọ dị iche iche kwa OS (ndebanye aha) Run + folda mmalite + schtasks na Windows; crontab + ọrụ phantom-bot.service sistemụ sistemụ + .bashrc/.nke itinye + /etc/rc.local na Linux; LaunchAgent com.phantom.bot.plist na macOS). Aha ọrụ nkwụsi ike na akara LaunchAgent bụ abụọ. phantom-bot / com.phantom.bot, nke bụkwa ebe aha mkpọsa ahụ si bịa.
- Exfil ozi sistemụ na-agba ọsọ otu ugboro — otu mkpịsị aka POST na b94b6bcfa27554.lhr.life:443/collect na-ebu aha nnabata, ikpo okwu, arch, aha njirimara, CPU/RAM, njikọ netwọk, process.env, cwd, homedir, ụdị node, na IP ọha. Nke a adịghị ike karịa Nkebi A: enweghị SSH, enweghị obere akpa ego, enweghị recursion .env. Ọrụ bot bụ ịdebanye aha, ọ bụghị izu ohi.
- Mgbatị obi Na-emepe HTTPS POST kwa sekọnd iri atọ ruo b94b6bcfa27554.lhr.life:443/. Onye nnọchite anya onye ọrụ bụ PhantomBot/1.0. A gbanyụrụ nkwenye TLS nke ọma (rejectUnauthorized: false). A na-akọwa nzaghachi C2 dị ka JSON nke ụdị {ụdị, ihe mgbaru ọsọ, ọdụ ụgbọ mmiri, oge, eriri, usoro} wee ziga ya.
- Ngwa agha idei mmiri a na-ejikọ ya na iwu isii:
| Ụdị iwu | modul | Notes |
|---|---|---|
| ping | Azịza ndụ | Bot na-achọpụta onwe ya |
| http | Idei mmiri HTTP | Idei mmiri arịrịọ nke oyi akwa-7 |
| https | Iju mmiri HTTPS | Dị ka http, TLS-wrapped |
| tcp | Idei mmiri TCP | 65 KB spam na-enweghị usoro |
| udp | Idei mmiri UDP | Ngwugwu UDP 65,507-byte |
| ngwa ngwa | Tọgharịa ngwa ngwa HTTP/2 DoS | Usoro 2023 CVE-2023-44487 |
Modulu ise niile nke idei mmiri na-ewere lekwasịrị, n'ọdụ ụgbọ mmiri, Na oge, na eri arụmụka — bot ahụ bụ ihe a na-akpọ ide mmiri nkịtị, ọ bụghị maka onye ọ bụla metụtara. Ndepụta onye ọrụ ahụ metụtara dị na C2, ọ bụghị na ngwugwu ahụ.
Ihe Dị Ọhụrụ Ebe a — ọnụọgụ abụọ C2 e zigara
Usoro A bụ ụdị a maara nke ọma: izu ohi nzere, nko nrụnye, C2 nke onye na-ere ahịa na-akụ. Usoro B bụ na- ụdị a maara nke ọma — botnet DDoS abụrụla ihe eji eme ngwugwu npm ọjọọ ruo ọtụtụ afọ. Ihe na-adịghị ahụkebe bụ na onye ọrụ zigara ya akụkụ nkesa nke ngwa dị n'ime bọọlụ npm:
- c2 — ihe dịka 4-megabyte nke Go ELF binary chịkọtara
- c2.go — isi iyi Go nke ahịrị 426 maka ọnụọgụ abụọ ahụ
Ọ dịghị faịlụ ọ bụla a na-akpọ site na njikọ nrụnye ọ bụla. Ha abụghị akụkụ nke ibu ọrụ onye ahụ metụtara. Ha nọ n'ime akwụkwọ ndekọ ngwugwu ahụ otu ụzọ faịlụ akwụkwọ ga-esi. Ihe kacha mma ịgụ bụ na onye ọrụ ahụ kpaliri osisi ọrụ mmepe ha gaa na npm na-enweghị ịhazi ndepụta faịlụ - ezigbo OpSec slip - na ihe e zigara bụ ngwa zuru oke nwere akụkụ abụọ: onye ahịa ahụ na-agba ọsọ, onye ọrụ ahụ na-agbakwa sava.
Nke a bụ akụkụ nke akụkọ ahụ nke kwadoro usoro "ngwa botnet turnkey". Onye ọ bụla budatara ya utilities axois:1.0.9 tupu nbudata ihe ahụ, ọ bụghị naanị ihe nlele onye ihe metụtara ga-eme — ha nwere sava C2 na-arụ ọrụ.
Okwu ahụ, n'otu ahịrịokwu
Otu onye mbipụta ahụ, otu aha ngwugwu ahụ, otu ihe mkpuchi atọ ahụ, otu akara "phantom" ahụ — mana ibu ọrụ gbanwere ụdị ego a na-enweta n'otu abalị: site na "ihe nzuzo owuwe ihe ubi m nwere ike ire ọzọ" ruo "ịgbazite ikike idei mmiri m nwere ike ịgbazite". Oge ntinye TTP nke ndị nche kwesịrị ilele fọrọ nke nta ka ọ bụrụ otu ihe ahụ n'ofe usoro abụọ ahụ; ihe nchebe dabere na mbinye aka nke ejiri eriri akpa ego nke Phase A ma ọ bụ iji phantom.jsNdị na-anakọta ahịrị 7,667 gaara echefu Phase B kpamkpam.
| Ụbọchị (UTC) | omume |
|---|---|
| 2026-05-15 | Mbipụta mbụ: axois-utils:1.0.4 (Nrụpụta ule LAN, nrụpụta mmepụta na 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 ebipụtara — E gbanwere usoro A C2 ka ọ bụrụ 80.200.28.28 site na ọwara Serveo; okwu mmalite // Change to '80.200.28.28' for public na-akwado mgbanwe dev→prod |
| 2026-05-16 | chalk-tempalte:1.0.14 na 1.0.16 ebipụtara - onye na-ebu ibu agbụ ígwè na-ekwupụta axois-utils:^1.0.7 dị ka ndabere oge ọsọ; ngalaba Serveo tụgharịrị |
| 2026-05-16 | Achọpụtara mkpọsa nkebi A n'oge nyocha npm nkịtị; etinyere mkpebi ọjọọ nke akwadoro |
| 2026-05-17 | axois-utils:1.0.9 ebipụtara — payload pivot: PhantomBot DDoS recruit site na localhost.run ọwara; onye ọrụ-akụkụ c2 ọnụọgụ abụọ na c2.go E zigara isi mmalite ya na bọọlụ tarbọl |
| 2026-05-17 | chalk-tempalte:1.0.19 na 1.0.20 ebipụtara — ka bụ Usoro A (ohi); onye ọrụ na-agbazi modulu abụọ ahụ ugbu a n'otu oge |
| 2026-05-17 | Nchọpụta nke Usoro B n'oge nyocha nkịtị; etinyere mkpebi n'ofe niile 2026-05-17 nsụgharị |
| (na-aga n'ihu) | A na-echere akụkọ mwepụta; ngwugwu anọ niile ebipụtara ka dị na ndekọ ahụ n'oge edere ya. |
Ihe Ndị Na-egosi Nkwekọrịta
nchịkọta
| Ngwurugwu | ngwugwu | Versions |
|---|---|---|
| npm | axois-utils (ụdị axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (ụdị ihe osise chalk) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Njirimara onye dere ya
| ubi | uru |
|---|---|
| onye mbipụta npm | deadcode09284814 |
| Ozi email onye mbipụta | phantomdeadcode@tutamail.com |
| SCM nkwenye | ọ dịghị onye |
Iwu-na njikwa
| adọ | Njedebe | Transport |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Ọwara HTTPS nke Serveo |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Ọwara HTTPS nke Serveo (ụdị mbụ) |
| A | 80.200.28.28:443/collect | Isi njedebe VPS dị n'okpuru |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS ọwara azụ |
Nchịkọta faịlụ (SHA-256)
| File | SHA-256 | Notes |
|---|---|---|
c2 (Gaa ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Sava C2 nke onye ọrụ, ezitere n'ime axois-utils:1.0.9 |
c2.go (ahịrị 426) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Gaa isi iyi maka C2 binary |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Onye ahịa bot nke usoro B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Asambodo nke Oge A/onye na-anakọta obere akpa |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Onye nchịkọta nkebi A (ụdị 1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Ihe na-ebuga Phase A, nke yiri byte n'ofe ụdị abụọ ahụ |
Njirimara na Mkpali
Anyị na-esochi mkpọsa a dịka PhantomBot, na-ewere akara ngosi nke onye ọrụ ahụ site na Onye nnọchite anya onye ọrụ: PhantomBot/1.0 isi obi, ọrụ phantom-bot.service sistemụ, nke bụ otu com.phantom.bot akara LaunchAgent na akara ngosi, koodu onye nwụrụ anwụ @ Aka email. Onye ọrụ ahụ na-agbaso otu ihe ahụ ma ọ dịkarịa ala ihe anọ.
Katalọgụ akara
- nkwusa - koodu ọnwụ09284814 na npm. Akaụntụ otu aka, ozi email a na-atụfu nke Tutamail, mba SCM nkwenye. Enweghị akụkọ ihe mere eme nke mbipụta gara aga karịa mkpọsa a.
- Imegharị aha maka akara ọzọ — “Phantom” pụtara na ozi email onye mbipụta, na aha faịlụ onye nchịkọta Phase A (phantom.js), na aha ọrụ nkwụsi ike nke Phase B (ọrụ phantom-bot.service), na akara LaunchAgent (com.phantom.bot), na na bot User-Agent (PhantomBot/1.0).
- Infrastructure - Otu VPS na 80.200.28.28 n'ihu Nkebi A site na ntụgharị subdomain nke Serveo; Nkebi B na-aga na a localhost.run ọwara azụ (b94b6bcfa27554.lhr.ndụỌrụ ndị na-ere ahịa abụọ a bụ n'efu ma chọọ naanị SSH na-apụ apụ n'akụkụ onye ọrụ, dịka ntọala OpSec dị obere ma dị obere.
- Ụdị koodu — Javascript dị mfe n'ofe ya; enweghị ihe mgbochi, enweghị koodu eriri, enweghị nyocha mgbochi VM. Aha mgbanwe dị iche iche na-akọwa (stealInfoSystemInfo, mezuoIwu, httpIdei mmiri). Okwu ndị dị na distrube.js gwa onye ọrụ ga-arụ ọrụ n'ọdịnihu okwu ozugbo ("Jiri URL HTTPS gị nke localhost.run"), na-atụ aro na e bu n'obi ka e kesaa faịlụ ahụ ọzọ dị ka ngwa, ọ bụghị otu onye mwakpo ji ya.
- Mbelata OpSec — Egwuregwu tarball nke Phase B na-ebufe ma onye ahịa bot na sava C2 nke onye ọrụ (c2 ELF + c2.go isi mmalite). Nke a kwekọrọ na onye ọrụ nke kpaliri osisi ọrụ ha gaa na npm na-enyochaghị ndepụta faịlụ ahụ. Ma onye ọrụ ahụ enweghị ahụmịhe, ma ọ bụ ngwa ahụ bụ pụtara a ga-ekesa ya n'ihu ọha na C2 binary bụ akụkụ nke ngwaahịa ahụ.
- Nkwenye onwe onye - utilities axois:1.0.4 nwere okwu mmalite // Gbanwee gaa na '80.200.28.28' maka ọha n'ahịrị nke 12, na-akwado ọganihu mmepe / nhazi / mmepụta nke ndị ọrụ na-agọnarịkarị.
Mkpali
Ibu ọrụ nke Phase A bụ ohi ego dị mfe: nzere, igodo igwe ojii, ihe nrịbama GitHub, na obere akpa ego crypto niile nwere ahịa ire ere mmiri mmiri. Phase B bụkwa ego, mana ọ bụghị kpọmkwem: ọrụ DDoS-for-hire ("booter") na-agbaze ikike idei mmiri site na nkeji, na bots dị ka nke e zigara ebe a bụ ngwa ahịa ọrụ ndị ahụ na-arụ ọrụ. Obi ike nke sekọnd 30, nke bụ ụdị nkịtị. lekwasịrị/n'ọdụ ụgbọ mmiri/Na oge atụmatụ iwu, na ngwa agha idei mmiri ise ahụ bụ standard ngwaahịa nke onye na-arụ ọrụ buuter.
Na-agba ọsọ modulu abụọ ahụ n'otu oge — tempalte nzu:1.0.19 na 1.0.20 gaa n'ihu na-ebuga onye ohi ahụ mgbe utilities axois:1.0.9 na-ebuga bot ahụ — na-atụ aro na onye ọrụ ahụ na-egbochi mmiri ịnweta ego kama ịhapụ Phase A. Pivot ahụ bụ mgbakwunye, ọ bụghị onye nnọchi anya.
Ihe anyị na-ekwughị
Anyị enwebeghị ike ịkwado njirimara ụwa n'ezie dị n'azụ ya koodu ọnwụ09284814 aka, anyị anaghịkwa ekwu na mkpọsa a sitere n'aka onye ọ bụla a kpọrọ onye na-eme ihe iyi egwu, otu, ma ọ bụ obodo. Akara "phantom" ahụ kwekọrọ n'ihe ochie niile iji gosi na otu onye ọrụ na-arụ ọrụ, mana mbupu ụdị ngwa nke C2 binary na-eme ka o kwe omume na ngwugwu ndị ga-abịa n'ọdịnihu site na aka ndị na-enweghị njikọ ga-eji otu koodu ahụ mee ihe ọzọ.
Mmetụta, Usoro na Ihe Ndị Na-agbachitere Kwesịrị Ime
Mmetụta
Ebumnuche squat ziri ezi axios na ihe ndebiri nzu dabere na gburugburu ebe obibi JavaScript nke ukwuu; axios Naanị ya dị n'etiti ngwugwu npm iri atọ kachasị ebudatara. Aha typosquat bụ otu igodo dị iche na nke ezigbo ya (aksois ↔ axios, tempalte ↔ template), ha abụọ bụkwa okwu ndị na-ezighi ezi n'asụsụ.
Anyị enweghị ike ịnweta ọnụọgụ nbudata a pụrụ ịdabere na ya maka ụdị ọjọọ ahụ tupu ewepụ ya — npm anaghị ejide ọnụọgụ nbudata kwa ụdị mgbe ebipụtaghị ngwugwu ahụ, nakwa npms.io-ụdị proxies na-eme mkpọtụ n'ọkwa a. Òtù ọ bụla nke faịlụ mkpọchi ya na-agbanwe gaa na ngwugwu aha ya axois-utils or nzu-tempalte site n'aka onye mbipụta koodu ọnwụ09284814 a ga-emeso ya dị ka ihe e mebiri emebi: tụgharịa asambodo ọ bụla dị na ya usoro.env na onye ọbịa ahụ metụtara, nyocha vektọ nnọgidesi ike kwa OS (lee "Ihe ndị nchebe kwesịrị ime" n'okpuru), ma wepụ ntụkwasị obi ahụ.
Ụkpụrụ na-apụta
Mgbasa ozi a na-egosi mgbanwe anyị hụrụ n'ọtụtụ ihe omume npm n'oge na-adịbeghị anya: ihe mkpuchi ntinye-nko bụ ihe onwunwe siri ike; a na-agbanwe ibu ọrụ ahụOnye mbipụta ahụ, otu ngwugwu ahụ, otu wụnye tupu oge eruo / tinye / nrụnye mgbe etinyere atọ, na ọbụna otu ụdị ahụ - mbelata ụda — naanị ihe gbanwere n'etiti utilities axois:1.0.6 na utilities axois:1.0.9 bụ faịlụ ahụ hooks ọsọ. Nchọpụta dabere na mbinye aka nke etinyere na ibu ọrụ nke Phase A (eriri ụzọ obere akpa, phantom.jsonye nchịkọta ahịrị 7,667 nke Serveo C2, onye na-ahazi Serveo C2) gaara egosi ụdị atọ mbụ ahụ ma ghara ikweta Phase B kpamkpam.
Otu ihe a na-ahụ n'ọtụtụ mkpọsa ndị ọzọ anyị lere anya na 2026: otu onye ọrụ nwere ihe eji arụ ọrụ kwụsiri ike, na-agbanwe n'etiti izu ohi asambodo, ndị ahịa na-aghọ aghụghọ ule, Telegram-bot exfil, na ugbu a ndị ọrụ DDoS. Ndị na-agbachitere ndị dabere na mbinye aka ụgwọ ọrụ ga-anọgide na-efunahụ agba nke abụọ nke mkpọsa ọ bụla.
Ihe na-akpata ya bụ na TTPs oge nrụnye bụ akara ngosi ka mmaNkwupụta ntinye atọ, tinye edemede ndị na-ebubata https or usoro nwa, tinye edemede ndị na-ede na folda mmalite onye ọrụ, ma wụnye edemede ndị na-edozi aha nnabata na ọrụ ntụgharị-ọwara n'efu (Serveo, localhost.run, ngrok, cloudflared) niile dị ụkọ na ngwugwu ziri ezi ma dịkwa na ngwugwu ọjọọ.
Ihe ndị na-agbachitere kwesịrị ime
- Nyocha faịlụ mkpọchi. Chọọ nke ọ bụla ngwugwu-mkpọchi.json / mkpọchi eriri. / mkpọchi pnpm.yaml na nzukọ gị maka kpọmkwem eriri ndị ahụ axois-utils na nzu-tempalteWere onye ọ bụla ga-alụ ọgụ dị ka nkwekọrịta.
- Gbanwee ihe nzuzo na ndị ọbịa metụtara. Usoro A nke a na-enweta n'ọtụtụ ebe site na SSH, ígwé ojii, GitHub, npm, na obere akpa ego. Were ya na asambodo ọ bụla dị na ya. usoro.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~ / .nhazi, ma ọ bụ ihe ọ bụla .env* A na-ekpughe faịlụ dị na onye ọbịa ahụ metụtara.
- Wepụ ntachi obi (Nkebi nke B). Na Windows, hichapụ HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, wepu %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, na schtasks /hichapụ /tn Sistemụ Mmelite /fNa Linux, crontab -e ma wepu @reboot node …, gbanyụọ systemctl –user –now phantom-bot.service wee hichapụ ~/.config/systemd/user/phantom-bot.service, sipu .bashrc / .nke / /etc/rc.localNa macOS, nbudata launchctl ~/Library/LaunchAgents/com.phantom.bot.plist wee hichapụ plist ahụ.
- Gbochie ndị ọbịa C2. Tinye isi njedebe anọ nke C2 na tebụl IOC na ndepụta mkpọchi ọpụpụ gị. *.servousercontent.com na *.lhr.ndụ enwere ike igbochi ya n'ozuzu ma ọ bụrụ na gburugburu ebe obibi gị enweghị ojiji ziri ezi maka ọrụ ntụgharị azụ.
- Ịchọgharị site na TTP oge nrụnye, ọ bụghị ibu arọ. Ntinye faịlụ mkpọchi ngwa ahịa nke ngwugwu.json ekwu wụnye tupu oge eruo, tinye, na nrụnye mgbe etinyere Ha niile na-atụ aka n'otu edemede ahụ. Nyochaa afọ ngwugwu na ọnọdụ nkwenye onye mbipụta. Usoro a adịghị adịkarị na ngwugwu ziri ezi ma ọ bụ otu ihe mgbaàmà kachasị ntụkwasị obi nke PhantomBot na-eji eme ihe.
- Nyocha maka ọnụọgụ abụọ nke C2. Onye ọ bụla ebudatara utilities axois:1.0.9 nwere ihe nkesa C2 nke onye ọrụ (c2 ELF, sha256 165fa92d…) na diski. Nyochaa cache na ụlọ ahịa ihe ochie CI. Binary ahụ na-ehi ụra n'onwe ya, mana ọnụnọ ya na ebe ọrụ bụ ihe akaebe doro anya na etinyere ngwugwu ahụ.
Ahịrị mmechi
Otu onye ọrụ ahụ, otu ngwugwu ahụ, na otu njikọ nrụnye ahụ nwere ike ibute ihe iyi egwu dị iche iche kpamkpam n'ime awa 48. Lelee ihe mkpuchi ahụ, ọ bụghị ibu ọrụ ahụ.
