TL; DR
He kaiwhakaputa npm kotahi, deadcode09284814, kua whakahaere i tētahi kaupapa whakahē i te hunga tika axios a chalk-template ngā mōkihi mai i waenganui o Mei 2026.
I tīmata te kaupapa hei tahae tohu me te pēke moni tuku iho, e tuku raraunga ana ki tētahi Kauhanga HTTPS Serveo.
On 2026-05-17, me axois-utils:1.0.9, i whakawhiti katoa te kaiwhakahaere i te kawenga: te tūāpapa tāuta-toru kotahi, te kaiwhakaputa kotahi, te ingoa mōkihi kotahi.
Engari ko te tuhinga tāuta he taputapu whakauru whatunga DDoS whakawhiti-pūhara inaianei.
Ka kōrero te uta ki tētahi localhost.run kauhanga, ā, ka whakaae ki ngā whakahau waipuke, ka huri i ngā taiao kua pangia hei wāhanga o tētahi whatunga karetao e taea ana e te DDoS.
I tukuna atu anō e te kaiwhakahaere te Pūrua tūmau C2 i roto i te tarball, e whakaatu ana i te pikinga mārama mai i te tahae tohu ki te hanganga botnet hohe.
E rua ngā mōkihi, e whā ngā putanga kei te rēhita tonu, ā, kotahi te kaiwhakahaere e whakahaere ana i ngā kōwae e rua i te wā kotahi.
Te kaha: teitei.
Te Whakaeke: Te Āhua o tana Mahi
Kua hangaia te kaupapa i runga i tētahi tūāpapa tuku hoha: e rua ngā ingoa mōkihi typosquat, kotahi te reta e wehe ana i ngā mōkihi me ngā rau miriona tango ia wiki (axios, tauira-toka), me te tāutanga takitoru hooks e whakamana ana i te whakatinanatanga. Ko te mea whakamere ko te aha te tūāpapa kawe — me te mea i whakarerekē te kaiwhakahaere i te utanga me te kore e whakarerekē i tetahi atu mea.
Te tūāpapa tiritahi
Ko ia putanga kua whakaputaina o ngā mōkihi e rua e kī ana i te huringa ora e toru hooks in mōkihi.json:
"scripts": { "preinstall": "node <payload>.js", "install": "node <payload>.js", "postinstall": "node <payload>.js" } Te whakarārangi i te kawenga i raro i ngā mea e toru hooks he nui rawa te mahi - i muri i te tāutanga ka rere noa iho i roto i te taunoa npm tāutaHe mea nui te kōwhiringa: tāuta npm –whakakore-hōtuhi ka pekehia ngā tuhinga, engari he maha ngā rerengamahi noa (ka whakahokia mai e te CI cache taua huringa ora whakahaere anō hooks whiriwhiri, ngā kaiwhakawhanake rānei e arotake ana i ngā mea anake i muri i te tāutanga) me kī ko te whakapuakitanga toru-tāpiri te peti haumaru rawa atu mō te kaiwhakaeke.
templete-kōhatu tāpirihia he tikanga tuarua: ka whakapuakina axois-utils:^1.0.7 hei wā whakahaere te whakawhirinakiTe tāuta i te typosquatted tauira-toka nō reira ka kukume mai i te typosquat tuakana-teina, ā, ka oma ngā kawenga e rua. He takirua taunga ngā mōkihi e rua, ehara i te rārangi motuhake.
Wāhanga A — tahae tohu / pēke moni (2026-05-15 → ināianei)
Ko te Wāhanga A te kawenga taketake. He poto te kawenga postinstall.js e tohu ana ki te kauhanga whakamuri Serveo HTTPS:
// chalk-tempalte/postinstall.js:11-13 const C2_HOST = "f04a273bd84c0622-80-200-28-28.serveousercontent.com"; const C2_PORT = 443; const C2_PATH = '/collect'; Ka whakakōwaea e te roherohe Serveo te IP ūnga (80.200.28.28) tika tonu i roto i te ingoa manaaki — he tikanga e mōhiotia ana mō taua ratonga. Ka hurihia e te kaiwhakahaere te kupumatua rohe-iti matapōkere i waenga i ngā putanga hei karo i ngā rārangi poraka rohe koretake, engari kāore te IP o raro e neke. (templete-taipitopito:1.0.14 whakamahia 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 whakamahinga f04a273bd84c0622-….)
postinstall.js ringa atu ki phantom.js, he kōwae "kaikohi" e 7,667 ngā rārangi. phantom.js ka hikoi te kaihautū mō:
Ngā kī tūmataiti SSH (~/.ssh/*) |
.npmrc ngā ihirangi me tetahi npm_* tohu taiao |
| Ngā kōnae tohu AWS, GCP, me Azure |
Regex tohu-uru-whaiaro GitHub (ghp_*, gho_*, ghu_*, ghs_*) |
| Ngā taonga tuku iho o te putea matihiko mō Bitcoin, Exodus, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
He whakahāngaitanga .env* hikoi ~/projects, ~/dev, ~/code, ~/workspace, me te tāuta cwd |
Ngā hītori anga me te katoa process.env |
Ka TUKUna te paihere ki te kauhanga Serveo i /kohikohiKāore he whakapoauau, kāore he arorau anti-VM, kāore he whakaritenga — ko te peti a te kaiwhakahaere kei runga i te nui me te tere.
Wāhanga B — Te kimi DDoS a PhantomBot (2026-05-17, axois-utils:1.0.9 anake)
Ka whakakapia e te Wāhanga B a phantom.js + postinstall.js ki tētahi kōnae kotahi ko distrube.js te ingoa (nā te kaiwhakahaere te hapa tā). Kāore te tūāpapa matau-toru i roto i te package.json i whakarerekētia; ka mau tonu te ingoa, te whānuitanga, me te tauira putanga-pump o te mōkihi. Mai i waho, ko te axois-utils:1.0.9 te āhua he whai ake iti ki te 1.0.6. I roto, he whānau pūmanawa kino rerekē.
distrube.js ka tuwhera me te poraka whirihoranga e whakaingoa ana i te waitohu ake a te kaiwhakahaere:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Ka tukuna ngā kōrero ki tētahi kaiwhakahaere ā muri ake nei e whakahaere ana i te kete ("Whakamahia tō URL HTTPS localhost.run"). Koinā, me ngā mea e tukuna ana i te taha o te kiritaki karetao, te tohu ehara tēnei i te kawenga patunga noa iho — engari ko te kete.
Te rere:
- Te manawanui Ka oma tuatahi. E toru ngā huarahi e tāuta ai te tuhinga i a ia anō mō ia pūnaha whakahaere (rēhita Whakahaere + Kōpaki Whakaoho + Tuhinga i runga i te Windows; crontab + ratonga phantom-bot wae pūnaha + .bashrc/.zshrc tāpiri + /etc/rc.local i runga i te Linux; LaunchAgent com.phantom.bot.plist i runga i te macOS). Ko te ingoa ratonga pumau me te tapanga LaunchAgent e rua karetao-pēhanga / com.phantom.bot, koinei anō te pūtake o te ingoa o te kaupapa whakatairanga.
- Ngā mōhiohio pūnaha exfil Ka oma kotahi — he tohu tapumati kotahi te POST ki b94b6bcfa27554.lhr.life:443/collect e mau ana i te ingoa manaaki, te tūāpapa, te arch, te ingoa kaiwhakamahi, te CPU/RAM, ngā atanga whatunga, te process.env, te cwd, te homedir, te putanga pūnga, me te IP tūmatanui. He iti ake te kaha o tēnei i te Wāhanga A: kāore he SSH, kāore he pēke moni, kāore he .env recursion. Ko te mahi a te karetao he rēhita, ehara i te tahae.
- Porowhita o te manawa Ka whakatuwherahia he HTTPS POST i ia 30 hēkona ki b94b6bcfa27554.lhr.life:443/. Ko te Kaiwhakamahi-Kaihoko ko PhantomBot/1.0. Kua monoa te manatoko TLS (rejectUnauthorized: false). Ka wetewetehia te urupare C2 hei JSON o te puka {type, target, port, duration, threads, method} kātahi ka tukuna.
- Ngā patu waipuke kua honoa ki ngā whakahau e ono:
| Momo whakahau | kōwae | Notes |
|---|---|---|
| ping | Whakautu ora | Ka tautuhia e te karetao ia ia anō |
| http | Waipuke HTTP | Waipuke tono Papa-7 |
| https | waipuke HTTPS | He rite tonu ki te http, kua takaihia ki te TLS |
| Tcp | Waipuke TCP | 65 KB pāme uta-matapōkere |
| udp | Waipuke UDP | Ngā mōkihi UDP 65,507-paita |
| tere | Tautuhi-tere o te HTTP/2 DoS | Te tikanga 2023 CVE-2023-44487 |
E rima ngā waeine waipuke e tango ana i tētahi ūnga, tauranga, roa, a aho tautohe — he pūnaha waipuke utu-ā-ringa whānui te karetao, kāore i te aro ki tētahi patunga motuhake. Kei te C2 te rārangi patunga a te kaiwhakahaere, kāore i roto i te mōkihi.
He aha ngā mea hou i konei — te pūnaha rua C2 kua tukuna
He āhua mōhio te Wāhanga A: te tahae tohu, te matau tāuta, te C2 kei roto i te rua kaihoko. Ko te Wāhanga B hoki he āhua mōhiotia — kua roa ngā whatunga karetao DDoS e noho ana hei wāhanga o ngā mōkihi npm kino. Ko te mea rerekē ko te tuku a te kaiwhakahaere i te taha tūmau o te kete i roto i te tarball npm:
- c2 — he pūnaha rua Go ELF kua whakahiatohia he 4-megabyte
- c2.go — te pūtake Go rārangi-426 mō taua pūrua
Kāore tētahi o ngā kōnae e karangatia ana e tētahi matau tāuta. Ehara rātou i te wāhanga o te kawenga patunga. Kei roto rātou i te whaiaronga mōkihi, pērā i te kōnae tuhinga. Ko te pānui tino whaitake ko te pana a te kaiwhakahaere i tā rātou rākau mahi whanaketanga ki te npm me te kore e whakarite i te rārangi kōnae — he pepa OpSec tūturu — ā, ko te mea i tukuna ko te kete taha-rua katoa: ko te kiritaki e whakahaerehia ana e te patunga, me te tūmau e whakahaerehia ana e te kaiwhakahaere.
Koinei te wāhanga o te kōrero e whakamārama ana i te hanganga o te "kete whatunga karetao kua oti te whakarite". Ko te hunga katoa i tango mai axois-utils:1.0.9 i mua i te tangohanga, ehara i te mea he tauira patunga anake tā rātou — he tūmau C2 kei te mahi tonu.
Te porowhita, i roto i te rerenga kotahi
Kaiwhakaputa kotahi, ingoa mōkihi kotahi, turanga matau-toru kotahi, waitohu "plantom" kotahi - engari i huri te kawenga i te tauira whakangao moni i te pō kotahimai i ngā "mea ngaro o te kotinga ka taea e au te hoko anō" ki te "kaha waipuke reti ka taea e au te riihi". Ko ngā TTP wā-tāuta me mātaki e ngā kaiwawao he tata rite tonu puta noa i ngā wāhanga e rua; ko ngā parepare e hangai ana ki te waitohu e hono ana ki ngā aho ara-pēke a te Wāhanga A, ki phantom.jsKua ngaro katoa i te kaikohi raina 7,667 a te kamupene i te Wāhanga B.
| Te Rā (UTC) | takahanga |
|---|---|
| 2026-05-15 | Te whakaputanga tuatahi: axois-utils:1.0.4 (Hanganga whakamātautau LAN, taputapu whakawhanake i 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 whakaputaina — Kua whakawhitia te Wāhanga A C2 ki 80.200.28.28 mā te kauhanga Serveo; te kōrero pūtake // Change to '80.200.28.28' for public whakaū i te whakawhiti dev→prod |
| 2026-05-16 | chalk-tempalte:1.0.14 a 1.0.16 whakaputaina — te whakapuakitanga a te kaiwhakaeke mekameka axois-utils:^1.0.7 hei whakawhirinakitanga wā-oma; kua hurihia te roheroto Serveo |
| 2026-05-16 | I kitea te pakanga Wāhanga A i te wā o te matawai npm auau; i whakamahia ngā whakataunga kino kua whakaūtia |
| 2026-05-17 | axois-utils:1.0.9 whakaputaina — pivot utanga: PhantomBot DDoS kimi mā te kauhanga localhost.run; taha-kaiwhakahaere c2 rua me te c2.go pūtake i tukuna ki te tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 a 1.0.20 kua whakaputaina — kei te Wāhanga A tonu (tahae); kei te whakahaerehia ngā kōwae e rua e te kaiwhakahaere i te wā kotahi |
| 2026-05-17 | Te kitenga o te Wāhanga B i te wā o te matawai auau; ngā whakataunga i whakamahia puta noa i ngā 2026-05-17 putanga |
| (kei te haere tonu) | Kei te tatari tonu ngā pūrongo tango; kei te wātea tonu ngā mōkihi e whā kua whakaputaina i runga i te rēhita i te wā e tuhia ana tēnei. |
Ngā Tohu o te Whakaaetanga
Kete
| Te haukori | mōkī | Tuhinga |
|---|---|---|
| npm | axois-utils (pāpāho o axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (pāpāho o te tauira-toka) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Tuakiri kaituhi
| Field | uara |
|---|---|
| kaiwhakaputa npm | deadcode09284814 |
| Īmēra a te kaiwhakaputa | phantomdeadcode@tutamail.com |
| SCM whakaū | kahore |
Whakahau-a-whakahaere
| Waahi | Aronga | Transport |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Kauhanga HTTPS Serveo |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Kauhanga HTTPS Serveo (putanga o mua) |
| A | 80.200.28.28:443/collect | Te pūwāhi VPS matua |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS kauhanga-whakamuri |
Ngā Whakarāpopototanga Kōnae (SHA-256)
| kōnae | SHA-256 | Notes |
|---|---|---|
c2 (Haere ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Tūmau C2 taha-kaiwhakahaere, tukuna ki roto axois-utils:1.0.9 |
c2.go (426 ngā rārangi) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Haere ki te pūtake mō te rua C2 |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Kiritaki karetao Wāhanga B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Kaikohi tohu / pēke moni Wāhanga A |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Kaikohi Wāhanga A (momo 1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Utaina Wāhanga A, he rite tonu te paita puta noa i ngā putanga e rua |
Te Whakawhiwhinga me te Hihiri
Ka aroturukihia e mātou tēnei kaupapa hei PhantomBot, te tango i te waitohu a te kaiwhakahaere ake mai i te Kaihoko-Kaiwhakamahi: PhantomBot/1.0 pane o te manawa, te ratonga phantom-bot wae pūnaha, te com.phantom.bot Tapanga LaunchAgent, me te waeherematemate@ kakau īmēra. He rite tonu te kaiwhakahaere mō tēnei ingoa puta noa i te iti rawa e whā ngā taonga.
Putumōhio tohu
- kaiwhakaputa - waehere mate09284814 i runga i te npm. Pūkete kotahi-kāri, īmēra Tutamail whakakorekore, kāore SCM manatoko. Kāore he hītori whakaputanga o mua i tua atu i tēnei kaupapa.
- Te whakamahinga anō o te waitohu — ka puta te kupu “phantom” i roto i te īmēra a te kaiwhakaputa, i roto i te ingoa kōnae o te kaikohi Wāhanga A (phantom.js), i roto i te ingoa ratonga pumau Wāhanga B (ratonga phantom-bot), i roto i te tapanga LaunchAgent (com.phantom.bot), ā, i roto i te karetao Kaiwhakamahi-Kaihoko (PhantomBot/1.0).
- hanganga — Kotahi te VPS i 80.200.28.28 ngā mua o te Wāhanga A mā te hurihanga rohe-rohe Serveo; ka neke te Wāhanga B ki tētahi localhost.run kauhanga-whakamuri (b94b6bcfa27554.lhr.lifeHe kore utu ngā ratonga a te kaihoko e rua, ā, me whakamahi noa i te SSH puta noa i te taha o te kaiwhakahaere, e rite ana ki ngā tatūnga iti-pūtea, iti-OpSec.
- Kāhua waehere — He JavaScript noa puta noa; kāore he whakapōrearea, kāore he waehere aho, kāore he tirotiro anti-VM. He whakaahua ngā ingoa taurangi (tahaePūnahaMōhiohio, whakahaereWhakahau, httpWaipukeNgā kōrero i roto i distrube.js wāhitau tika ki tētahi kaiwhakahaere ā muri ake nei (“Whakamahia tō URL HTTPS localhost.run”), e kī ana i hangaia te kōnae kia tohatohahia anō hei kete, kaua e whakamahia e tētahi kaiwhakaeke kotahi.
- Paheketanga OpSec — Ka tukuna e te tarball Wāhanga B te kiritaki karetao me te tūmau C2 taha-kaiwhakahaere (c2 ELF + c2.go pūtake). He rite tēnei ki tētahi kaiwhakahaere i pana i tā rātou rākau mahi ki te npm me te kore e arotake i te rārangi kōnae. Kāore i te wheako te kaiwhakahaere, kāore rānei te kete i te te tikanga kia tohatohahia ki te marea, ā, ko te pūnaha rua C2 he wāhanga o te hua.
- Te whakaū i a koe anō - axois-utils:1.0.4 kei roto te kōrero pūtake // Hurihia ki '80.200.28.28' mō te marea kei te rārangi 12, e whakaū ana i te ahunga whakamua o te whakawhanaketanga / te whakaaturanga / te whakaputanga e whakakahoretia ana e ngā kaiwhakahaere.
Te whakatenatena
He tahae pūtea noa iho te kawenga Wāhanga A: he mākete hoko anō wai ngā tohu tuakiri, ngā kī kapua, ngā tohu GitHub, me ngā pēke moni matihiko. He pūtea anō hoki te Wāhanga B, engari he kore ā-tikanga: ka utua e ngā ratonga DDoS-mō-te-utu ("booter") te kaha waipuke i ia meneti, ā, ko ngā karetao pēnei i te mea e tukuna ana ki konei ko ngā taonga e whakahaerehia ana e aua ratonga. Ko te ngakau 30-hekona, ko te whānui ūnga/tauranga/roa te kaupapa whakahau, ā, ko te patu waipuke e rima-tikanga te standard hua o tētahi kaiwhakahaere pūtu.
Te whakahaere i ngā kōwae e rua i te wā kotahi — templete-taipitopito:1.0.19 a 1.0.20 haere tonu ki te tuku i te tahae i a ia e axois-utils:1.0.9 ka tukuna te karetao — e kī ana kei te ārai te kaiwhakahaere i ngā awa moni whiwhi kaua ki te whakarērea te Wāhanga A. Ko te pivot he tua, ehara i te whakakapi.
Ngā mea kāore mātou e kī ana
Kāore anō kia taea e mātou te whakaū i tētahi tuakiri o te ao tūturu kei muri i te waehere mate09284814 te mana whakahaere, ā, kāore mātou e tuku i tēnei pakanga ki tētahi kaiwhakaari riri kua whakaingoatia, rōpū, whenua rānei. He rite tonu te waitohu "plantom" puta noa i ngā taonga tuku iho hei tohu i tētahi kaiwhakahaere kotahi, engari ko te tuku momo kete o te rua C2 e waiho ana i te tūponotanga ka whakamahi anō ngā mōkihi ā muri ake nei mai i ngā mana whakahaere kāore e pā ana ki te waehere kotahi.
Pānga, Ngā Auahatanga me Ngā Mea e Tika Ana kia Mahihia e Ngā Kaiwawao
pānga
Ngā whāinga tūpono tika axios a tauira-toka e whakawhirinakihia whānuitia ana i roto i te pūnaha JavaScript; axios kei roto i ngā mōkihi npm e toru tekau kua tino tikiakehia. Kotahi te pēhi o ngā ingoa typosquat mai i ngā ingoa tūturu (ākio ↔ axios, tempalte ↔ tātauira), ā, he hē te tuhi kupu e rua e tika ana kia kitea i te taha reo.
Kāore i taea e mātou te tiki i ngā tatauranga tango pono mō ngā putanga kino i mua i te tangohanga — kāore a npm e pupuri i ngā tatau tango mō ia putanga i muri i te whakakorenga o te mōkihi, ā npms.ioHe haruru ngā proxies momo--i tēnei tauine. Ko tētahi whakahaere e whakatau ana i tana kōnae maukati ki tētahi mōkihi e huaina ana ngā taputapu-axois or templete-kōhatu mai i te kaiwhakaputa waehere mate09284814 me whakaaro kua takahia: hurihia ngā tohu katoa kei roto tukanga.env i runga i te kaihautū e pāngia ana, arotakehia ngā whārite pumau mō ia OS (tirohia "Ngā mahi a ngā kaiwawao" i raro nei), ka tango i te whakawhirinakitanga.
Ngā tauira e puta ake ana
He tauira tēnei kaupapa i tētahi panonitanga kua kitea e tātou i roto i ētahi aituā npm tata nei: Ko te turanga matau tāuta te rawa pakari; ka taea te whakawhiti i te kawenga. Ko te kaiwhakaputa kotahi, ko te mōkihi kotahi, ko te mea kotahi tāutanga i mua / tāuta / i muri i te tāutanga takitoru, ā, tae noa ki te auau putanga-puku kotahi - ko te mea anake i rerekē i waenganui axois-utils:1.0.6 a axois-utils:1.0.9 ko te kōnae te hooks oma. Te kimi i runga i te waitohu e pā ana ki te kawenga Wāhanga A (ngā aho ara-pēke, phantom.js(te kaikohi rārangi 7,667 a 's, te kaihautū Serveo C2) kua tohu i ngā putanga tuatahi e toru, ā, kāore i kitea te Wāhanga B.
E kitea ana te tauira kotahi puta noa i ētahi atu pakanga o te tau 2026 kua aroturukihia e mātou: he kaiwhakahaere kotahi me te tūāpapa pumau, e whakawhiti ana i waenga i te tahae tohu, ngā kiritaki tinihanga whakamātautau, te Telegram-bot exfil, ā, ināianei ko te kimi kaimahi DDoS. Ka hinga tonu ngā kaiwawao e whakawhirinaki ana ki ngā waitohu kawenga i te rauna tuarua o ia pakanga.
Ko te hua o tera Ko ngā TTP wā tāuta te tohu pai ake. Ngā whakapuakitanga matau tāuta-toru, ngā tuhinga tāuta e kawemai ana https or tukanga_tamaiti, tāutahia ngā hōtuhi e tuhi ana ki ngā kōpaki whakaoho-kaiwhakamahi, me te tāuta i ngā hōtuhi e whakatau ana i ngā ingoa manaaki i runga i ngā ratonga kauhanga-whakamuri kore utu (Serveo, localhost.run, ngrok, cloudflared) he onge katoa i roto i ngā mōkihi tika, ā, he mea noa i roto i ngā mōkihi kino.
Ngā mea me mahi e ngā kaiwawao
- Arotake kōnae maukati. Rapua ia package-lock.json / miro.raka / pnpm-lock.yaml i roto i tō whakahaere mō ngā aho tika ngā taputapu-axois a templete-kōhatuWhakaarohia tētahi whakataetae hei whakaaetanga.
- Hurihia ngā mea ngaro ki ngā kaihautū e pāngia ana. Wāhanga A - Ngā tohu SSH, kapua, GitHub, npm, me te putea kua kohia i te nuinga. Whakaarohia kei roto i ia tohu katoa tukanga.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~/.config, tetahi atu ranei .env* ka hurahia te kōnae kei runga i te kaihautū e pāngia ana.
- Tangohia te u tonu (Wāhanga B). I runga i te Windows, mukua HKCU\Pūmanawa\Microsoft\Windows\Putanga o Nāianei\Whakahaere\Whakahōu Pūnaha, tango %APPDATA%\Microsoft\Windows\Tīmata Tahua\Ngā Papatono\Whakaoho\whakahōu-pūnaha.bat, a schtasks /muku /tn Whakahōu Pūnaha /fI runga i te Linux, crontab -e ka tango @reboot pūnga …, systemctl –whakakorehia te kaiwhakamahi –ināianei phantom-bot.service ka muku ~/.config/systemd/user/phantom-bot.service, horoi .bashrc / .zshrc / /etc/rc.localI runga i te macOS, launchctl wetewete ~/Library/LaunchAgents/com.phantom.bot.plist kātahi ka muku i te plist.
- Āraia ngā kaihautū C2. Tāpirihia ngā pito mutunga C2 e whā i roto i te ripanga IOC ki tō rārangi aukati putanga. *.serveousercontent.com a *.lhr.ora ka taea te aukati whānui mēnā kāore he whakamahinga tika o tō taiao mō ngā ratonga kauhanga whakamuri.
- Te rapu mā te TTP wā-tāuta, ehara i te kawenga. Ngā tāurunga kōnae maukati rarangi taonga mōkihi.json puaki tāutanga i mua, tāuta, a i muri i te tāutanga e tohu ana te katoa ki te tuhinga kotahi. Tirohia te pakeke o te mōkihi me te mana manatoko a te kaiwhakaputa. He onge tēnei tauira i roto i ngā mōkihi tika, ā, koinei te tohu pono kotahi e whakamahia anōtia ana e PhantomBot.
- Arotake mō te pūnaha rua C2. Te hunga katoa i tango mai axois-utils:1.0.9 kei a ia te tūmau C2 a te kaiwhakahaere (c2 ELF, sha256 165fa92d…) i runga i te kōpae. Matawaihia ngā keteroki me ngā toa taonga CI. Kei te moe te pūnaha rua i a ia anō, engari ko tōna aroaro i runga i te teihana mahi he tohu mārama kua tāutahia te mōkihi.
Rārangi kati
Ka taea e te kaiwhakahaere kotahi, te mōkihi kotahi, me te matau tāuta kotahi te tuku i ngā tūmomo riri rerekē i roto i ngā hāora 48. Kia tūpato ki te tūāpapa, kaua ki te kawenga.
