TL; DR
Wofalitsa m'modzi wa npm, deadcode09284814, wachita kampeni yolemba zolakwika motsutsana ndi zovomerezeka axios ndi chalk-template ma phukusi kuyambira pakati pa Meyi 2026.
Kampeniyi inayamba ngati munthu wamba amene amaba ziphaso za anthu komanso amene amaba chikwama, n’kutulutsa deta ku Serveo HTTPS ngalande.
On 2026-05-17, ndi axois-utils:1.0.9, wogwiritsa ntchitoyo anasintha katundu wonse: scaffold yomweyi ya triple install-hook, wofalitsa yemweyo, dzina lomweli la phukusi.
Koma script yokhazikitsa tsopano ndi gulu la ma botnet a DDoS omwe amagwiritsidwa ntchito pa nsanja zosiyanasiyana.
Katundu wolipira amalankhula ndi localhost.run mumsewu ndipo amavomereza malamulo osefukira kwa madzi, zomwe zimapangitsa malo omwe ali ndi kachilombo kukhala gawo la botnet yokhoza DDoS.
Wogwira ntchitoyo anatumizanso Seva ya C2 ya binary mkati mwa tarball, kusonyeza kukwera koonekeratu kuchokera ku kuba ziphaso kupita ku zomangamanga za botnet zomwe zikugwira ntchito.
Ma phukusi awiri, mitundu inayi ikugwirabe ntchito pa registry, ndipo wogwiritsa ntchito m'modzi tsopano akuyendetsa ma module onse awiri motsatizana.
Kuopsa: kwakukulu.
Kuukira: Momwe Kumagwirira Ntchito
Kampeniyi yamangidwa pa malo operekera zinthu osasangalatsa: mayina awiri a maphukusi a zilembo, kalata imodzi yochotsera maphukusi ndi kutsitsa mazana mamiliyoni sabata iliyonse (axios, template ya choko), ndi kukhazikitsa katatu hooks chitsimikizo chomwe chimatsimikizira kuti chikuchitika. Chosangalatsa ndi chomwe chimayikidwa padenga amanyamula — ndi mfundo yakuti woyendetsa katunduyo anasintha katunduyo popanda kusintha china chilichonse.
Chipinda chogawana
Mtundu uliwonse wofalitsidwa wa ma phukusi onse awiri umalengeza za moyo womwewo wa magawo atatu hooks in phukusi.json:
Kulemba katundu wolipidwa pansi pa zonse zitatu hooks ndi woopsa kwambiri — atakhazikitsa yokha ingagwire ntchito mwachisawawa npm kukhazikitsaKusankha n'kofunika: npm kukhazikitsa -ignore-scripts imadumpha zolemba, koma njira zingapo zodziwika bwino (CI cache imabwezeretsa moyo womwewo hooks mwasankha, kapena opanga mapulogalamu omwe amangoyang'ana atakhazikitsa) lengezani katatu kuti ndiye njira yotetezeka kwambiri kwa wowukirayo.
choko-temalte imawonjezera njira yachiwiri: imalengeza zida za axois:^1.0.7 ngati nthawi yogwirira ntchito kudaliraKukhazikitsa zilembo zolembedwa template ya choko Chifukwa chake zimakopanso mtundu wa typosquat wa abale, ndipo zonse ziwiri zimayendetsedwa. Ma phukusi awiriwa ndi awiri ogwirizana, osati mndandanda wodziyimira pawokha.
Gawo A — chiphaso / woba chikwama (2026-05-15 → apano)
Gawo A ndiye katundu woyambirira. Chojambuliracho ndi chachifupi pambuyo pokhazikitsa.js zomwe zimasonyeza pa Serveo HTTPS reverse-tunnel:
Subdomain ya Serveo imalemba IP yopitako (80.200.28.28) mwachindunji mu dzina la hostname — mwambo wodziwika bwino wa utumiki umenewo. Wogwiritsa ntchitoyo amasinthasintha mawu oyamba a subdomain pakati pa mitundu kuti apewe mndandanda wa domain blocklists, koma IP yomwe ili pansi pake sisuntha. (choko-temalte:1.0.14 ntchito 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 ntchito f04a273bd84c0622-….)
pambuyo pokhazikitsa.js manja agwireni phantom.js, gawo la "chosonkhanitsa" la mizere 7,667. phantom.js amayenda ndi wolandila alendo kuti:
Makiyi achinsinsi a SSH (~/.ssh/*) |
.npmrc zomwe zili mkati ndi chilichonse npm_* zizindikiro za env |
| Mafayilo a AWS, GCP, ndi Azure |
GitHub personal-access-token regex (ghp_*, gho_*, ghu_*, ghs_*) |
| Zinthu zakale za Crypto-wallet za Bitcoin, Exodus, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
Kubwerezabwereza .env* kudutsa ~/projects, ~/dev, ~/code, ~/workspace, ndi kukhazikitsa cwd |
Mbiri ya Shell ndi zonse process.env |
Phukusili latumizidwa ku ngalande ya Serveo pa /sonkhanitsaniPalibe kubisa, palibe anti-VM logic, palibe staging — bet ya wogwiritsa ntchito ndi voliyumu ndi liwiro.
Gawo B — PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 yokha)
Gawo B limalowa m'malo mwa phantom.js + postinstall.js ndi fayilo imodzi yotchedwa distrube.js (cholakwika ndi cha wogwiritsa ntchito). Chikwatu cha katatu chomwe chili mu package.json sichinasinthe; phukusili limasunga dzina lomwelo, scope, ndi mtundu womwewo. Kuchokera kunja, axois-utils:1.0.9 imawoneka ngati yotsatira yaying'ono ya 1.0.6. Mkati, ndi banja lina la pulogalamu yaumbanda.
distrube.js imatsegulidwa ndi block yosinthira yomwe imatchula dzina la kampani ya wogwiritsa ntchitoyo:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Ndemangazo zimatumizidwa kwa wogwiritsa ntchito mtsogolo amene akuyendetsa zida ("Gwiritsani ntchito localhost.run HTTPS URL yanu"). Izi, kuphatikiza zomwe zimatumizidwa pafupi ndi kasitomala wa bot, ndi umboni wakuti izi si katundu wongowonongeka - ndi zida zomwe zilipo.
Kuyenda:
- Kulimbikira imayamba kugwira ntchito. Chikalatacho chimadziyika chokha m'njira zitatu zosiyanasiyana pa OS iliyonse (registry) Thamangani + Chikwatu choyambira + Zolemba pa Windows; crontab + phantom-bot.service gawo la systemd + .bashrc/.zshrc onjezerani + /etc/rc.local pa Linux; LaunchAgent com.phantom.bot.plist pa macOS). Dzina la ntchito yolimbikira ndi chizindikiro cha LaunchAgent zonse ndi phantom-bot / com.phantom.bot, komwenso ndi komwe dzina la kampeni limachokera.
- Chidziwitso cha dongosolo imagwira ntchito kamodzi — chala chaching'ono chimayikidwa pa b94b6bcfa27554.lhr.life:443/collect chonyamula dzina la hostname, platform, arch, username, CPU/RAM, network interfaces, process.env, cwd, homedir, node version, ndi public IP. Izi sizowopsa kwambiri kuposa Phase A: palibe SSH, palibe wallets, palibe .env recursion. Ntchito ya bot ndi kulembetsa, osati kuba.
- Chizunguliro cha kugunda kwa mtima imatsegula HTTPS POST masekondi 30 aliwonse kuti b94b6bcfa27554.lhr.life:443/. Wogwiritsa Ntchito ndi PhantomBot/1.0. Kutsimikizira kwa TLS kwaletsedwa (rejectUnauthorized: false). Yankho la C2 limagawidwa ngati JSON ya mawonekedwe {mtundu, cholinga, doko, nthawi, ulusi, njira} ndikutumizidwa.
- Zida zankhondo za kusefukira kwa madzi yalumikizidwa ku malamulo asanu ndi limodzi:
| Mtundu wa lamulo | gawo | zolemba |
|---|---|---|
| ya ping | Yankho la Liveness | Bot imadzizindikiritsa yokha |
| http | Kusefukira kwa HTTP | Kusefukira kwa pempho la Gawo-7 |
| https | Kusefukira kwa HTTPS | Mofanana ndi http, TLS-written |
| tcp | Kusefukira kwa TCP | Sipamu yolipira mwachisawawa ya 65 KB |
| udp | Chigumula cha UDP | Mapaketi a UDP a 65,507-byte |
| mofulumira | HTTP/2 yobwezeretsa mwachangu DoS | Njira ya 2023 CVE-2023-44487 |
Ma module onse asanu a kusefukira kwa madzi amatenga cholinga, doko, nthawindipo Magawo mkangano — bot ndi chida chodziwika bwino chogwiritsidwa ntchito pobowola madzi, chomwe sichikuyang'ana munthu aliyense wovulala. Mndandanda wa ozunzidwa wa wogwiritsa ntchitoyo uli pa C2, osati mu phukusi.
Chatsopano Pano — C2 binary yotumizidwa
Gawo A ndi lodziwika bwino: kuba ziphaso, mbedza yoyika, C2 yolumikizidwa ndi wogulitsa. Gawo B ndi komanso mawonekedwe odziwika bwino — Mabotolo a DDoS akhala akupangidwa ndi ma phukusi oipa a npm kwa zaka zambiri. Chodabwitsa ndichakuti woyendetsa adatumiza mbali ya seva za zida zomwe zili mkati mwa npm tarball:
- c2 — Go ELF binary yopangidwa ndi 4-megabyte
- c2.go — gwero la Go la mizere 426 la binary imeneyo
Palibe fayilo yomwe imayitanidwa ndi mbedza iliyonse yokhazikitsa. Si gawo la malipiro a ozunzidwa. Ali mu chikwatu cha phukusi monga momwe fayilo yolembera ingachitire. Kuwerenga koyenera kwambiri ndikuti wogwiritsa ntchitoyo adakankhira mtengo wawo wogwirira ntchito ku npm popanda kusunga mndandanda wa mafayilo - slip yeniyeni ya OpSec - ndipo chomwe chimatumizidwa ndi zida zonse ziwiri: kasitomala wozunzidwayo amayendetsa, ndi seva yomwe wogwiritsa ntchitoyo amayendetsa.
Iyi ndi gawo la nkhaniyi lomwe limatsimikizira kuti "turnkey botnet kit" ndi yolondola. Aliyense amene adatsitsa zida za axois:1.0.9 Asanayambe kuchotsa deta, palibe chitsanzo cha wozunzidwa chokha - ali ndi seva ya C2 yogwira ntchito.
Pivot, mu chiganizo chimodzi
Wofalitsa yemweyo, mayina omwewo a phukusi, chikwanje chomwecho cha zingwe zitatu, chizindikiro chomwecho cha "phantom" — koma malipiro adasintha njira yopezera ndalama usiku wonse: kuyambira pa “zinsinsi zokolola zomwe ndingathe kugulitsanso” mpaka “kubwereka mphamvu ya kusefukira kwa madzi komwe ndingathe kubwereka”. Ma TTP a nthawi yokhazikitsa omwe oteteza ayenera kuyang'anira ndi ofanana kwambiri m'magawo onse awiri; chitetezo chozikidwa pa siginecha chomwe chimalumikizidwa ndi zingwe za njira ya chikwama cha Gawo A kapena ku phantom.jsWosonkhanitsa mizere 7,667 wa m'gululi akanaphonya Gawo B konse.
| Tsiku (UTC) | chochitika |
|---|---|
| 2026-05-15 | Kufalitsa koyamba: axois-utils:1.0.4 (Kumanga mayeso a LAN, dev rig pa 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 lofalitsidwa — Gawo A C2 lasinthidwa kukhala 80.200.28.28 kudzera mu ngalande ya Serveo; ndemanga yochokera ku gwero // Change to '80.200.28.28' for public imatsimikizira kusintha kwa dev→ prod |
| 2026-05-16 | chalk-tempalte:1.0.14 ndi 1.0.16 yofalitsidwa — chojambulira cholumikizidwa ndi unyolo chikulengeza axois-utils:^1.0.7 monga kudalira nthawi yogwiritsira ntchito; Serveo subdomain yazunguliridwa |
| 2026-05-16 | Kampeni ya Gawo A yapezeka panthawi yofufuza ya npm; zigamulo zotsimikizika zagwiritsidwa ntchito |
| 2026-05-17 | axois-utils:1.0.9 yofalitsidwa — pivot yolipira: PhantomBot DDoS imagwiritsa ntchito njira yopezera anthu kudzera mu ngalande ya localhost.run; mbali ya opareta c2 awiri ndi c2.go gwero latumizidwa mu tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 ndi 1.0.20 yofalitsidwa — akadali Gawo A (woba); wogwiritsa ntchito tsopano akuyendetsa ma module onse awiri motsatizana |
| 2026-05-17 | Kupezeka kwa Gawo B panthawi yowunikira nthawi zonse; zigamulo zimagwiritsidwa ntchito m'magawo onse 2026-05-17 Mabaibulo |
| (kupitilira) | Malipoti ochotsa zinthu akudikira; ma phukusi onse anayi ofalitsidwa akadalipobe pa registry panthawi yolemba |
Zizindikiro za Kugwirizana
phukusi
| Makhalidwe | phukusi | Versions |
|---|---|---|
| npm | axois-utils (typosquat of axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (typosquat ya choko-template) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Kudziwika kwa wolemba
| Field | mtengo |
|---|---|
| wofalitsa wa npm | deadcode09284814 |
| Imelo ya wofalitsa | phantomdeadcode@tutamail.com |
| SCM kutsimikizira | palibe |
Lamulo-ndi-kulamulira
| Phase | Mapeto | Transport |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS ngalande |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS ngalande (mtundu wakale) |
| A | 80.200.28.28:443/collect | Mapeto a VPS oyambira |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS reverse-tunnel |
Ma digest a mafayilo (SHA-256)
| file | SHA-256 | zolemba |
|---|---|---|
c2 (Go ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Seva ya C2 yogwira ntchito, yatumizidwa mkati axois-utils:1.0.9 |
c2.go (Mizere 426) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Pitani ku gwero la C2 binary |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Kasitomala wa bot wa Gawo B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Gawo A la ziphaso / wosonkhanitsa chikwama |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Wosonkhanitsa Gawo A (mtundu wa 1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Gawo A loader, lofanana ndi byte m'mitundu yonse iwiri |
Udindo ndi Chilimbikitso
Tikutsata kampeni iyi ngati PhantomBot, kutenga dzina la kampani ya wogwiritsa ntchitoyo kuchokera ku Wogwiritsa Ntchito: PhantomBot/1.0 mutu wa mtima, phantom-bot.service gawo la systemd, com.phantom.bot Label ya LaunchAgent, ndi phantomdeadcode@ chogwirira cha imelo. Wogwiritsa ntchitoyo amatsatira dzinali m'zinthu zosachepera zinayi.
Kabukhu ka zizindikiro
- wofalitsa - deadcode09284814 pa npm. Akaunti ya chogwirira chimodzi, imelo ya Tutamail yogwiritsidwa ntchito nthawi imodzi, palibe SCM kutsimikizira. Palibe mbiri yakale yofalitsa nkhani kupitirira kampeni iyi.
- Kugwiritsanso ntchito chizindikiro — “phantom” imawonekera mu imelo ya wofalitsa, mu dzina la fayilo la Phase A collector (phantom.js), m'dzina la ntchito yolimbikira ya Gawo B (phantom-bot.service), mu chizindikiro cha LaunchAgent (com.phantom.bot), komanso mu bot User-Agent (PhantomBot/1.0).
- zomangamanga - VPS imodzi pa 80.200.28.28 Ma fronts Gawo A kudzera mu Serveo subdomain rotation; Gawo B limapita ku a localhost.run ngalande yobwerera m'mbuyo (b94b6bcfa27554.lhr.life). Mautumiki onse awiri ogulitsa ndi aulere ndipo amafunikira SSH yotuluka yokha kumbali ya wogwiritsa ntchito, mogwirizana ndi makonzedwe a OpSec otsika mtengo komanso otsika mtengo.
- Kodi style — JavaScript yosavuta; palibe kubisa, palibe kulemba zilembo, palibe macheke otsutsana ndi VM. Mayina osinthika ndi ofotokozera (kuba Zambiri zaSystem, executeCommand, httpChigumulaNdemanga mu distrube.js lankhulani mwachindunji ndi wogwiritsa ntchito mtsogolo ("Gwiritsani ntchito localhost.run HTTPS URL yanu"), zomwe zikusonyeza kuti fayiloyo idapangidwa kuti igawidwenso ngati zida, osati kugwiritsidwa ntchito ndi wowukira m'modzi.
- Chikwangwani cha OpSec — Phase B tarball imatumiza kasitomala wa bot komanso seva ya C2 yogwira ntchito (c2 ELF + c2.go source). Izi zikugwirizana ndi wogwiritsa ntchito amene anakankhira mtengo wawo wogwirira ntchito ku npm popanda kuyang'ana mndandanda wa mafayilo. Kaya wogwiritsa ntchitoyo alibe chidziwitso, kapena zida zake ndi amatanthauza kuti igawidwe poyera ndipo C2 binary ndi gawo la malonda.
- Kudzitsimikizira - zida za axois:1.0.4 lili ndi ndemanga yochokera // Sinthani kukhala '80.200.28.28' kuti anthu onse azitha pa mzere 12, kutsimikizira kupita patsogolo kwa chitukuko / kupanga / kupanga komwe ogwiritsa ntchito nthawi zambiri amakana.
Chilimbikitso
Gawo A ndi kuba ndalama mosavuta: ziphaso, makiyi a cloud, ma token a GitHub, ndi ma crypto wallets onse ali ndi misika yogulitsanso madzi. Gawo B ndi la ndalama, koma losalunjika: Ntchito za DDoS-for-rent (“booter”) zimabwereka mphamvu yodzaza madzi mphindi iliyonse, ndipo ma bot ngati omwe amatumizidwa pano ndi omwe ntchitozo zimayendetsedwa. Kugunda kwa mtima kwa masekondi 30, komwe ndi generic. cholinga/doko/nthawi dongosolo la lamulo, ndi zida zisanu zankhondo za kusefukira kwa madzi ndizomwe standard chopangidwa ndi woyendetsa booter.
Kuyendetsa ma module onse awiri nthawi imodzi — choko-temalte:1.0.19 ndi 1.0.20 pitirizani kutumiza wobayo pamene zida za axois:1.0.9 imatumiza bot - ikusonyeza kuti wogwiritsa ntchitoyo akuteteza njira zopezera ndalama m'malo mosiya Gawo A. Pivot ndi Kuwonjezera, osati choloŵa m’malo.
Zimene sitikunena
Sitinathe kutsimikizira kuti ndi ndani kwenikweni amene ali kumbuyo kwa deadcode09284814 chogwirira, ndipo sitikunena kuti kampeniyi ndi ya munthu aliyense wodziwika kuti ndi wowopseza, gulu, kapena dziko. Chizindikiro cha "phantom" chimagwirizana mokwanira pazinthu zakale kuti chisonyeze wogwiritsa ntchito m'modzi, koma kutumiza kwa C2 binary monga kit kumatsegula mwayi woti ma phukusi amtsogolo ochokera kuzinthu zosagwirizana adzagwiritsanso ntchito code yomweyo.
Zotsatira, Zochitika & Zimene Oteteza Ayenera Kuchita
Zotsatira
Zolinga zovomerezeka za squat axios ndi template ya choko zimadalira kwambiri mu dongosolo la JavaScript; axios yokha ndi imodzi mwa maphukusi makumi atatu apamwamba kwambiri a npm omwe adatsitsidwa kwambiri. Mayina a zilembo zolembedwa ali kutali ndi makiyi enieni (axois ↔ axios, tempalte ↔ Chinsinsi), ndipo zonsezi ndi zolakwika pa kalembedwe ka chilankhulo.
Sitinathe kupeza ziwerengero zodalirika zotsitsa za mitundu yoyipa tisanachotsedwe — npm sisunga kuchuluka kwa kutsitsa pa mtundu uliwonse phukusi litachotsedwa, ndipo npms.ioMa proxies a -style ndi okwera phokoso pamlingo uwu. Bungwe lililonse lomwe fayilo yake yotsekeredwa imasankha phukusi lotchedwa zida za axois or choko-temalte kuchokera kwa wofalitsa deadcode09284814 ziyenera kuonedwa ngati zosokoneza: sinthani chiphaso chilichonse chomwe chilipo process.env pa wolandila wokhudzidwayo, fufuzani ma vector opitilira pa OS iliyonse (onani "Zomwe oteteza ayenera kuchita" pansipa), ndikuchotsa kudalira.
Mapangidwe atsopano
Kampeni iyi ikuwonetsa kusintha komwe taona pazochitika zingapo zaposachedwa za npm: Chipinda chokhazikitsira ndi cholimba; katundu wolipidwa akhoza kusinthidwaWofalitsa yemweyo, phukusi lomwelo, lomwelo kukhazikitsa pasadakhale / kukhazikitsa / atakhazikitsa katatu, komanso ngakhale mtundu womwewo wa bump cadence — chinthu chokhacho chomwe chinasintha pakati zida za axois:1.0.6 ndi zida za axois:1.0.9 fayiloyo inali hooks run. Kuzindikira pogwiritsa ntchito siginecha komwe kumayikidwa pa Phase A payload (zingwe za njira ya chikwama, phantom.jsWosonkhanitsa wa mizere 7,667, Serveo C2 host) akanalemba mayina a mitundu itatu yoyamba ndipo anaphonya Phase B kwathunthu.
Momwemonso zikuwonekeranso m'makampeni ena a 2026 omwe tawatsata: woyendetsa mmodzi wokhala ndi malo okhazikika, kusinthana pakati pa kuba ziphaso, makasitomala onyenga mayeso, kutumiza mauthenga a Telegram-bot, ndipo tsopano kulemba anthu ntchito ku DDoS. Oteteza omwe amadalira ma signature a payload adzapitiliza kutayika gawo lachiwiri la kampeni iliyonse.
Zotsatira zake ndi izi Ma TTP a nthawi yokhazikitsa ndiye chizindikiro chabwino kwambiri. Kulengeza katatu kokhazikitsa, kuyika zolemba zomwe zimalowetsa https or njira_yachibwana, ikani zolemba zomwe zimalembera mafoda oyambira ogwiritsa ntchito, ndikuyika zolemba zomwe zimathetsa mayina a hostname pa ntchito zaulere zosinthira njira (Serveo, localhost.run, ngrok, cloudflared) zonse sizipezeka kawirikawiri m'maphukusi ovomerezeka ndipo zimapezekanso m'maphukusi oipa.
Zimene oteteza ayenera kuchita
- Kuwunika kwa ma Lockfile. Sakani chilichonse phukusi-lock.json / yarn.lock / pnpm-lock.yaml mu bungwe lanu kuti mudziwe bwino zomwe zikuchitika zida za axois ndi choko-temalteChitani chilichonse chogwirizana ngati mgwirizano.
- Sinthirani zinsinsi pa eni ake omwe akhudzidwa. Gawo A la SSH, mtambo, GitHub, npm, ndi ziphaso za chikwama zomwe zathetsedwa. Ganizirani kuti ziphaso zonse zomwe zilipo mu process.env, ~/.ssh, ~/.aws, ~/.npmrc, ~/.config, kapena chilichonse .env* Fayilo pa wolandila wokhudzidwayo yawonekera.
- Chotsani kupirira (Gawo B). Pa Windows, chotsani HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, chotsani %APPDATA%\Microsoft\Windows\Start Menyu\Mapulogalamu\Startup\system-update.batndipo schtasks /delete /tn SystemUpdate /fPa Linux, crontab -e ndi kuchotsa @reboot node …, systemctl -user disable -now phantom-bot.service ndiye chotsani ~/.config/systemd/user/phantom-bot.service, kutsuka .bashrc / .zshrc / /etc/rc.localPa macOS, tsegulani launchctl ~/Laibulale/LaunchAgents/com.phantom.bot.plist kenako chotsani mndandanda.
- Letsani ma host a C2. Onjezani ma endpoint anayi a C2 mu tebulo la IOC ku mndandanda wanu wa blocklist wa egress. *.serveousercontent.com ndi *.lhr.life Zitha kutsekedwa ndi anthu ambiri ngati malo anu sagwiritsidwa ntchito moyenera pa ntchito zosinthira njira.
- Kusaka potengera nthawi yokhazikitsa TTP, osati katundu wolemera. Zolemba za fayilo yotseka zomwe zili phukusi.json analengeza kukhazikitsa pasadakhale, kukhazikitsandipo atakhazikitsa Zonse zikuloza pa script imodzi. Onaninso zaka za phukusi ndi momwe wofalitsa akutsimikizira. Kachitidwe aka sikapezeka kawirikawiri m'maphukusi ovomerezeka ndipo ndi chizindikiro chodalirika kwambiri chomwe PhantomBot imagwiritsanso ntchito.
- Kufufuza kwa C2 binary. Aliyense amene watsitsa zida za axois:1.0.9 ili ndi seva ya C2 ya woyendetsa (c2 ELF, sha256 165fa92d…) pa diski. Ma cache ojambulira ndi malo osungira zinthu zakale za CI. Binary sigwira ntchito yokha, koma kupezeka kwake pa workstation ndi umboni wosatsutsika wakuti phukusili linayikidwa.
Mzere wotsekera
Wogwiritsa ntchito yemweyo, phukusi lomwelo, ndi mbedza yokhazikitsa yomweyo zimatha kupereka zoopsa zosiyana mkati mwa maola 48. Yang'anirani denga, osati katundu wolipidwa.
