TL; DR
Mohatisi a le mong oa npm, deadcode09284814, e tsamaisitse letšolo la ho ngola ka mongolo o fosahetseng khahlanong le molao o amohelehang axios 'me chalk-template liphutheloana ho tloha bohareng ba Mots'eanong 2026.
Letšolo lena le qalile e le mokhoa oa setso oa ho utsoa mangolo le ho utsoa sepache, ho ntša lintlha ho Kotopo ea HTTPS ea Serveo.
On 2026-05-17, le axois-utils:1.0.9, mosebedisi o fetotse mojaro o lefelletsweng ka botlalo: scaffold e tshwanang ya ho kenya dihoko tse tharo, mohatisi ya tshwanang, lebitso le tshwanang la sephutheloana.
Empa sengoloa sa ho kenya jwale ke k'hamphani ya botnet ya DDoS e sebedisang di-platform tse fapaneng.
Moroalo o bua le localhost.run kotopo mme e amohela ditaelo tsa dikgohola, e fetola dibaka tse tshwaeditsweng karolo ya botnet e nang le bokgoni ba DDoS.
Motsamaisi o bile a romela Seva ea C2 ea binary ka hare ho tarball, e bonts'ang keketseho e hlakileng ho tloha bosholung ba mangolo ho ea ho meralo ea motheo e sebetsang ea botnet.
Liphutheloana tse peli, mefuta e mene e ntseng e sebetsa ho ngoliso, le opereishene e le 'ngoe hona joale e tsamaisa li-module ka bobeli ka nako e le 'ngoe.
Bohloko: bo phahameng.
Tlhaselo: Kamoo e Sebetsang Kateng
Letšolo lena le hahiloe holim'a sethala sa ho fana ka thepa se tenang ka boomo: mabitso a mabeli a liphutheloana tsa mongolo, lengolo le le leng le sa tsoa liphutheloana ka li-download tse makholo a limilione beke le beke (axios, template ea tjhoko), le ho kenya hararo hooks tiisetso eo e phethahatswang. Se kgahlehang ke hore na scaffold ke eng e jara — le taba ea hore motsamaisi o fetotse thepa ntle le ho fetola letho le leng.
Sekala se arolelanoang
Phetolelo e 'ngoe le e 'ngoe e hatisitsoeng ea liphutheloana tsena ka bobeli e phatlalatsa potoloho e tšoanang ea bophelo ba tse tharo hooks in sejana.json:
"scripts": { "preinstall": "node <payload>.js", "install": "node <payload>.js", "postinstall": "node <payload>.js" } Ho thathamisa mojaro o lefelloang tlas'a tsohle tse tharo hooks e feteletsa lintho — kamora ho kenya e le 'ngoe e ne e tla sebetsa ka mokhoa oa kamehla npm kenyaKhetho ea bohlokoa: npm kenya –ignore-scripts e tlola dingolwa, empa mesebetsi e mengata e tloaelehileng (cache ea CI e tsosolosa potoloho eo ea bophelo hape hooks ka ho khetha, kapa bahlahisi ba hlahlobang feela kamora ho kenya) etsa phatlalatso e sa hlokeng ho fetisoa hararo e le phephetso e sireletsehileng ka ho fetisisa bakeng sa mohlaseli.
tjhoko-tempalte e eketsa mokhoa oa bobeli: e phatlalatsa lisebelisoa tsa axois:^1.0.7 e le nako ea ho matha ho itshetlehaHo kenya mongolo o ngotsoeng ka mongolo o sa fellang template ea tjhoko ka hona e hohela le mongolo wa bana ba motho, mme meputso ka bobedi e a sebetsa. Diphutheloana tsena tse pedi ke para e hokahaneng, ha se lenane le ikemetseng.
Mokhahlelo oa A — mangolo a bopaki / mosholu oa sepache (2026-05-15 → hona joale)
Mokhahlelo oa A ke mojaro oa pele oa moputso. Mojaro o mokhutšoanyane kamora ho kenya.js e supang ho Serveo HTTPS reverse-tunnel:
// chalk-tempalte/postinstall.js:11-13 const C2_HOST = "f04a273bd84c0622-80-200-28-28.serveousercontent.com"; const C2_PORT = 443; const C2_PATH = '/collect'; Subdomain ea Serveo e kenyelletsa IP ea moo u eang teng (80.200.28.28) ka ho toba lebitsong la moamoheli — mokhoa o tsebahalang bakeng sa tšebeletso eo. Mosebelisi o potoloha sehlohlolo sa subdomain se sa reroang pakeng tsa liphetolelo ho qoba manane a thibelo a domain a sa tsebeng letho, empa IP e ka tlase ha e sisinyehe. (tjhoko-template:1.0.14 sebelisetsoa 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 tšebeliso f04a273bd84c0622-….)
kamora ho kenya.js matsoho ho phantom.js, mojule oa "moqokeleli" o kopantsoeng ka mela e 7,667. phantom.js o tsamaea le moamoheli bakeng sa:
Linotlolo tsa poraefete tsa SSH (~/.ssh/*) |
.npmrc dikahare le efe kapa efe npm_* li-tokens tsa env |
| Lifaele tsa boitsebiso ba AWS, GCP, le Azure |
regex ea GitHub ea phihlello ea motho ka mong (ghp_*, gho_*, ghu_*, ghs_*) |
| Mesebetsi ea matsoho ea sepache sa Crypto bakeng sa Bitcoin, Exodus, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
E ipheta-phetang .env* tsamaea ka ~/projects, ~/dev, ~/code, ~/workspace, le ho kenya cwd |
Nalane ea Shell le kakaretso ea eona process.env |
Sephutheloana se POSOA kotopong ea Serveo ho /kgoboketsaHa ho na ho se tsitse, ha ho na mokhoa o khahlanong le VM, ha ho na sethala — bethe ea opereishene e holim'a bophahamo le lebelo.
Mokhahlelo oa B — PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 feela)
Mokhahlelo wa B o nkela phantom.js + postinstall.js sebaka ka faele e le 'ngoe e bitsoang distrube.js (mokhoa oa ho ngola ke oa opereishene). Sekhahla sa li-triple-hook ho package.json ha sea fetoha; sephutheloana se boloka lebitso le tšoanang, scope, le paterone ea version-bump. Ho tloha ka ntle, axois-utils:1.0.9 e shebahala joaloka tatellano e nyane ho 1.0.6. Ka hare, ke lelapa le fapaneng la malware.
distrube.js e buloa ka boloko ba tlhophiso bo rehellang lebitso la moetsi oa khoebo:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Maikutlo a lebisitsoe ho opereishene ea ka moso ea tsamaisang kit ("Sebelisa URL ea hau ea HTTPS ea localhost.run"). Seo, hammoho le seo se romeloang haufi le moreki oa bot, ke pontšo ea hore ena ha se feela mojaro oa motho ea hlasetsoeng - ke kit.
Phallo:
- Mamello e qala pele. Sengolwa se itlhoma ka ditsela tse tharo tse fapaneng ka OS (registry) Matha + Foldara ea ho qala + li-schtasks ho Windows; crontab + phantom-bot.tšebeletso yuniti ea tsamaiso + .bashrc/.zshrc eketsa + /etc/rc.local ho Linux; LaunchAgent com.phantom.bot.plist ho macOS). Lebitso la tshebeletso ya ho phehella le leibole la LaunchAgent ka bobedi ke phantom-bot / com.phantom.bot, e leng moo lebitso la letšolo le tswang teng.
- Tlhaloso ea tlhahisoleseling ea sistimi e sebetsa hang feela — monwana o le mong o POST ho b94b6bcfa27554.lhr.life:443/collect e jereng lebitso la moamoheli, sethala, arch, lebitso la mosebelisi, CPU/RAM, li-network interfaces, process.env, cwd, homedir, mofuta oa node, le IP ea sechaba. Sena ha se mabifi haholo ho feta Phase A: ha ho na SSH, ha ho na li-wallet, ha ho na .env recursion. Mosebetsi oa bot ke ho ngolisa, eseng ho utsoa.
- Sekotwana sa ho otla ha pelo e bula HTTPS POST metsotsoana e meng le e meng e 30 ho b94b6bcfa27554.lhr.life:443/. Moemeli oa Mosebelisi ke PhantomBot/1.0. Netefatso ea TLS e emisitsoe ka ho hlaka (rejectUnauthorized: false). Karabo ea C2 e arotsoe e le JSON ea foromo {type, target, port, duration, threads, method} 'me e rometsoe.
- pokello ea thepa ea moroallo e hokahantsoe le litaelo tse tšeletseng:
| Mofuta oa taelo | mojuleng | Notes |
|---|---|---|
| bi | Karabo ea bophelo bo botle | Bot e itsebahatsa |
| -http | Moroallo oa HTTP | Kopo ea moroallo ea Layer-7 |
| https | Moroallo oa HTTPS | E tšoanang le http, e phuthetsoe ka TLS |
| tcp | Moroallo oa TCP | Spam ea 65 KB ea ho lefa ka mokhoa o sa reroang |
| udp | Moroallo oa UDP | Lipakete tsa UDP tsa li-byte tse 65,507 |
| ka potlako | DoS ea ho seta bocha ka potlako ea HTTP/2 | Mokhoa oa 2023 CVE-2023-44487 |
Li-module tsohle tse hlano tsa moroallo li nka sepheo, kepe boo, nako, 'me dikgwele ngangisano — bot ke sesebelisoa se tloaelehileng sa ho hira, se sa reretsoeng motho ea hlokofalitsoeng. Lethathamo la bahlaseluoa ba mosebelisi le lula ho C2, eseng ka har'a sephutheloana.
Se Secha Mona — C2 binary e rometsoeng
Mokhahlelo A ke sebopeho se tsebahalang: bosholu ba mangolo, ho kenya sehokelo, ho kenya kotopo C2 e nang le morekisi. Mokhahlelo B ke e boetse e sebopeho se tsebahalang — Dibotnete tsa DDoS e bile karolo ya diphutheloana tse kotsi tsa npm ka dilemo tse ngata. Se sa tlwaelehang ke hore mosebedisi o rometse lehlakore la seva ea kit ka hare ho npm tarball:
- c2 — binary e kopantsoeng ea 4-megabyte Go ELF
- c2.go — mohloli oa 426-line Go bakeng sa binary eo
Ha ho faele e bitswang ke hook efe kapa efe ya ho kenya. Ha se karolo ya mojaro wa moputso wa motho ya hlasetsweng. Ba dutse bukeng ya diphuthelwana ka tsela e tshwanang le eo faele ya ditokomane e neng e ka etsa ka yona. Palo e utlwahalang ka ho fetisisa ke hore motho ya sebetsang o sutumelletse sefate sa hae sa ntshetsopele ho npm ntle le ho hlophisa lenane la difaele - slip ya nnete ya OpSec - mme se rometsweng ke kit e felletseng e mahlakore a mabedi: moreki eo motho ya hlasetsweng o mo tsamaisa, mme seva eo motho ya sebetsang o mo tsamaisa.
Ena ke karolo ea pale e lokafatsang ho foreimi ea "turnkey botnet kit". Mang kapa mang ea jarollotseng lisebelisoa tsa axois:1.0.9 Pele ho takedown ho se na sampole ya motho ya hlasetsweng feela — ba na le seva ya C2 e sebetsang.
Pivot, ka polelo e le 'ngoe
Mohatisi a le mong, mabitso a tšoanang a liphutheloana, scaffold e tšoanang ea lihokelo tse tharo, lets'oao le tšoanang la "phantom" - empa mojaro o fetotse mohlala oa ho etsa chelete ka bosiu bo le bong: ho tloha ho "liphiri tsa kotulo tseo nka li rekisang hape" ho ea ho "bokhoni ba ho hira likhohola tseo nka li hirisang". Li-TTP tsa nako ea ho kenya tseo basireletsi ba lokelang ho li shebella li batla li tšoana ho pholletsa le mekhahlelo ka bobeli; litšireletso tse thehiloeng ho matšoao tse kenelletseng lithapong tsa tsela ea sepache sa Mokhahlelo oa A kapa ho phantom.jsMoqokeleli oa mela e 7,667 o ne a tla be a fositse Mokhahlelo oa B ka ho feletseng.
| Letsatsi (UTC) | Event |
|---|---|
| 2026-05-15 | Khatiso ea pele: axois-utils:1.0.4 (Kaho ea teko ea LAN, rig ea nts'etsopele ho 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 e phatlalalitsoe — Mokhahlelo oa A C2 o fetotsoe ho 80.200.28.28 ka kotopo ea Serveo; maikutlo a mohloli // Change to '80.200.28.28' for public e tiisa phetoho ea dev→ prod |
| 2026-05-16 | chalk-tempalte:1.0.14 'me 1.0.16 e phatlalalitsoe — ho phatlalatsa hore mojaro o kentsweng ka ketane axois-utils:^1.0.7 e le ho itšetleha ka nako ea ho sebetsa; Serveo subdomain e potolohile |
| 2026-05-16 | Letšolo la Mokhahlelo oa A le fumanoe nakong ea tlhahlobo ea kamehla ea npm; ho sebelisitsoe liqeto tse tiisitsoeng tse mpe |
| 2026-05-17 | axois-utils:1.0.9 e phatlalalitsoe — pivot ea mojaro oa moputso: PhantomBot DDoS e hira ka kotopo ea localhost.run; lehlakore la operator c2 binary le c2.go mohloli o rometsoe ka har'a tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 'me 1.0.20 e phatlalalitsoe — e ntse e le Mokhahlelo oa A (mosholu); opereishene joale e sebelisa li-module ka bobeli ka nako e le 'ngoe |
| 2026-05-17 | Ho sibolloa ha Mokhahlelo oa B nakong ea ho skena ka mokhoa o tloaelehileng; liqeto li sebelisitsoe ho pholletsa le tsohle 2026-05-17 version |
| (e ntse e tsoela pele) | Litlaleho tsa ho tlosa li ntse li emetse; liphutheloana tsohle tse 'ne tse phatlalalitsoeng li ntse li fumaneha ho ngoliso nakong ea ho ngola |
Matšoao a ho Sekisetsa
Packages
| Ts'ebetso | sephutheloana | Litemana |
|---|---|---|
| npm | axois-utils (typosquat ea axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (typosquat ea tjhoko-template) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Boitsebiso ba mongoli
| Tšimo | latela boleng ba |
|---|---|
| mohatisi oa npm | deadcode09284814 |
| Imeile ea mohatisi | phantomdeadcode@tutamail.com |
| SCM netefadiwe | ea mong |
Taelo-le-taolo
| Phase | Qetellong | Transport |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Kotopo ea HTTPS ea Serveo |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Serveo HTTPS kotopo (mofuta oa pejana) |
| A | 80.200.28.28:443/collect | Qetello ea VPS e ka tlase |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS reverse-tunnel |
Meqolo ea lifaele (SHA-256)
| faele | SHA-256 | Notes |
|---|---|---|
c2 (Eya ho ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Seva ea C2 e lehlakoreng la opereishene, e rometsoe kahare axois-utils:1.0.9 |
c2.go (Mela e 426) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Eya mohloling bakeng sa binary ea C2 |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Moreki oa bot ea Mokhahlelo oa B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Mokhahlelo oa A oa mangolo a thuto / pokello ea sepache |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Moqokeleli oa Mokhahlelo oa A (mofuta oa 1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Mochini oa ho kenya oa Mokhahlelo oa A, o ts'oanang ka byte ho pholletsa le mefuta ka bobeli |
Tšusumetso le Tšusumetso
Re latela letšolo lena e le PhantomBot, ho nka lebitso la moetsi oa khoebo ho tsoa ho Moemeli oa Mosebelisi: PhantomBot/1.0 hlooho ea pelo, phantom-bot.tšebeletso yuniti ea tsamaiso, com.phantom.bot Leiboleng la LaunchAgent, le phantomdeadcode@ Lebitso la imeile. Mosebelisi o lumellana ka lebitso lena bonyane mesebetsing e mene ea khale.
Khataloganyo ea matšoao
- mohoeletsi - khoutu ea dead09284814 ho npm. Ak'haonte ea mohala o le mong, imeile ea Tutamail e lahloang, ha ho na SCM netefatso. Ha ho na nalane ea phatlalatso ea pele ho feta letšolo lena.
- Ho sebelisa hape letšoao la khoebo — “phantom” e hlaha lengolo-tsoibila la mohatisi, lebitsong la moqokeleli la Mokhahlelo wa A (phantom.js), lebitsong la tšebeletso ea ho phehella ea Mokhahlelo oa B (phantom-bot.tšebeletso), ho leiboleng la LaunchAgent (com.phantom.bot), le ho roboto ya Moemeli wa Mosebedisi (PhantomBot/1.0).
- Infrastructure - VPS e le 'ngoe ho 80.200.28.28 Mokhahlelo wa A ka potoloho ya Serveo subdomain; Mokhahlelo wa B o fetela ho localhost.run kotopo e khutlelang morao (b94b6bcfa27554.lhr.life). Litšebeletso ka bobeli tsa barekisi li mahala 'me li hloka feela SSH e tsoang ka lehlakoreng la opereishene, e tsamaellanang le litlhophiso tsa OpSec tse nang le tekanyetso e tlase le tse nang le tekanyetso e tlase.
- Mokhoa oa khoutu — JavaScript e se nang letho ho pholletsa le yona; ha ho na ho patisana, ha ho na ho kenya khoutu ya dikhoele, ha ho na diteko tse kgahlanong le VM. Mabitso a feto-fetohang a hlalosa (Tlhahisoleseling ea Sisteme, phethaCommand, httpMoroalloMaikutlo ho distrube.js bua ka kotloloho le opareitara ya nakong e tlang ("Sebelisa URL ya hao ya HTTPS ya localhost.run"), e leng se bontshang hore faele e ne e reretswe ho abuwa botjha e le kit, e seng ho sebediswa ke mohlasedi a le mong.
- Setlankana sa OpSec — Tarball ea Phase B e romela moreki oa bot le seva ea C2 e lehlakoreng la opereishene (c2 ELF + c2.go Mohloli). Sena se tsamaellana le mosebedisi ya ileng a sutumelletsa sefate sa hae se sebetsang ho npm ntle le ho hlahloba lenane la difaele. Mosebetsi ha a na boiphihlelo, kapa kit ke e bolelang e tla ajoa phatlalatsa mme binary ya C2 ke karolo ya sehlahiswa.
- Ho itlhalosa - lisebelisoa tsa axois:1.0.4 e na le maikutlo a mohloli // Fetolela ho '80.200.28.28' bakeng sa sechaba moleng oa 12, ho netefatsa tsoelo-pele ea nts'etsopele / ea ho beha / ea tlhahiso eo hangata basebetsi ba e hanang.
Tšusumetso
Moroalo oa Phase A ke bosholu ba lichelete bo totobetseng: mangolo a tumello, linotlolo tsa leru, li-tokens tsa GitHub, le li-wallet tsa crypto kaofela li na le limmaraka tsa thekiso ea metsi hape. Phase B le eona ke ea lichelete, empa e sa tobang: Litšebeletso tsa DDoS-for-hire (“booter”) li hira bokhoni ba moroallo ka motsotso, 'me li-bot tse kang tse rometsoeng mona ke lethathamo la lits'ebeletso tseo li sebetsang ho tsona. Ho otla ha pelo ha metsotsoana e 30, e tloaelehileng sepheo/kepe boo/nako morero oa taelo, le pokello ea lihlomo tsa likhohola tse hlano ke tsona standard sehlahisoa sa mokhanni oa booter.
Ho tsamaisa di-module ka bobedi ka nako e le nngwe — tjhoko-template:1.0.19 'me 1.0.20 tsoela pele ho romela mosholu ha a ntse a lisebelisoa tsa axois:1.0.9 e romela roboto - e fana ka maikutlo a hore mosebedisi o sireletsa mehloli ea chelete ho e-na le ho tlohela Mokhahlelo oa A. Pivot ke Ho phaella moo, eseng ho nkela sebaka.
Seo re sa se tsekeng
Ha re so khone ho netefatsa boitsebiso ba 'nete bo ka morao ho khoutu ea dead09284814 sebetsana, 'me ha re amahanye letšolo lena le entsoeng ke sebapali sefe kapa sefe se reriloeng sa tšokelo, sehlopha, kapa naha. Letšoao la "phantom" le tsitsitse ka ho lekaneng ho pholletsa le lintho tsa khale ho fana ka maikutlo a hore ho na le opereishene e le 'ngoe, empa ho romelloa ha C2 binary ka mokhoa oa kit ho siea monyetla oa hore liphutheloana tsa nakong e tlang tse tsoang ho li-handle tse sa amaneng li tla sebelisa khoutu e tšoanang hape.
Tšusumetso, Mekhoa le Seo Basireletsi ba Lokelang ho se Etsa
tshusumetso
Lipheo tse molaong tsa squat axios 'me template ea tjhoko li itšetlehile haholo ka tikoloho ea JavaScript; axios alone e har'a liphutheloana tse mashome a mararo tse holimo tse jarollotsoeng ka ho fetisisa tsa npm. Mabitso a mongolo a ho ngola a hole le a 'nete (axois ↔ axios, tempalte ↔ thempleite), 'me ka bobeli ke mantsoe a fosahetseng a ka utloisisoang puong.
Re hlolehile ho fumana lipalo-palo tse tšepahalang tsa download bakeng sa mefuta e kotsi pele ho taolwa — npm ha e boloke lipalo tsa download tsa phetolelo ka 'ngoe ka mor'a hore sephutheloana se se ke sa hatisoa, 'me npms.ioLi-proxie tsa setaele li lerata ka tekanyo ena. Mokhatlo ofe kapa ofe oo faele ea oona ea senotlolo e ikemiselitseng ho latela sephutheloana se bitsoang lisebelisoa tsa axois or tjhoko-tempalte ho tsoa ho mohatisi khoutu ea dead09284814 e lokela ho nkoa e le e senyehileng: fetola lengolo le leng le le leng la boitsebiso le teng ho process.env ho moamoheli ea amehileng, hlahloba li-vector tsa ho phehella ka OS (sheba "Seo basireletsi ba lokelang ho se etsa" ka tlase), 'me u tlose ho itšetleha.
Mekhoa e hlahang
Letšolo lena le bontša phetoho eo re e boneng liketsahalong tse 'maloa tsa morao tjena tsa npm: sekala sa ho kenya sehokelo ke letlotlo le tšoarellang; mojaro o ka fetoloaMohatisi a le mong, sephutheloana se tšoanang, se tšoanang preinstall / kenya / kamora ho kenya triple, esita le mofuta o tšoanang oa bump cadence — ntho feela e ileng ea fetoha pakeng tsa lisebelisoa tsa axois:1.0.6 'me lisebelisoa tsa axois:1.0.9 e ne e le faele ea hooks e sebetsa. Temoho e thehilweng ho tshaeno e kentsweng ho Mokgahlelo wa A wa ho lefa (dithapo tsa tsela ya sepache, phantom.js'Mokelli oa mela e 7,667, moamoheli oa Serveo C2) a ka be a ile a tšoaea mefuta e meraro ea pele 'me a fosa Phase B ka ho feletseng.
Mokhoa o tšoanang o bonahala matšolong a mang a 2026 ao re a latetseng: mosebelisi a le mong ea nang le sethala se tsitsitseng, ea fapanyetsanang pakeng tsa bosholu ba mangolo, bareki ba qhekellang litlhahlobo, exfil ea Telegram-bot, le hona joale ho hiroa DDoS. Basireletsi ba itšetlehileng ka lipontšo tsa meputso ba tla lula ba lahleheloa ke potoloho ea bobeli ea letšolo le leng le le leng.
Sephetho ke hore Li-TTP tsa nako ea ho kenya ke lets'oao le betere. Lipolelo tse tharo tsa ho kenya, ho kenya dingolwa tse kenyang https or ts'ebetso_ea ngoana, kenya dingolwa tse ngollang difoldareng tsa basebedisi ba qalang, mme o kenye dingolwa tse rarollang mabitso a baeti ditshebeletsong tsa mahala tsa reverse-tunnel (Serveo, localhost.run, ngrok, cloudflared) kaofela ha di fumanehe ka bongata diphuthelong tse molaong mme di atile hara tse kotsi.
Seo basireletsi ba lokelang ho se etsa
- Tlhahlobo ea lifaele tsa senotlolo. Batla e 'ngoe le e 'ngoe package-lock.json / khoele.notlolo / pnpm-lock.yaml mokhatlong oa hau bakeng sa likhoele tse nepahetseng lisebelisoa tsa axois 'me tjhoko-tempalteTšoara papali efe kapa efe e le tumellano.
- Phetoho ea liphiri ho beng ba matlo ba amehileng. Mokhahlelo oa A oa SSH, leru, GitHub, npm, le mangolo a sepache a kotutsoeng ka bongata. Nka hore mangolo a sepache a mang le a mang a teng ho process.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~/.config, kapa efe kapa efe .env* Faele e ho moamoheli ya amehileng e pepesitsoe.
- Tlosa ho phehella (Mokhahlelo oa B). Ho Windows, hlakola HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, tlosa %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, 'me mesebetsi ea schtasks /hlakola /tn SystemUpdate /fHo Linux, crontab -e le tlosa @reboot node …, systemctl –mosebelisi o tima –hona joale phantom-bot.service ka nako eo hlakola ~/.config/systemd/user/phantom-bot.service, hohla .bashrc / .zshrc / /etc/rc.localHo macOS, launchctl jarolla ~/Laeborari/LaunchAgents/com.phantom.bot.plist ebe o hlakola lenane.
- Thibela mabotho a C2. Kenya lintlha tse 'ne tsa C2 tafoleng ea IOC lenaneng la hau la ho thibela ho tsoa. *.serveousercontent.com 'me *.lhr.bophelo e ka thibeloa ka bongata haeba tikoloho ea hau e se na tšebeliso e molaong bakeng sa lits'ebeletso tsa reverse-tunnel.
- Batla ka nako ea ho kenya TTP, eseng mojaro o boima. Lingoliloeng tsa faele ea polokelo tseo sejana.json o ile a re preinstall, kenya, 'me kamora ho kenya kaofela li supa mongolo o le mong. Hlahloba lilemo tsa sephutheloana le boemo ba netefatso ea mohatisi. Mokhoa ona ha o fumanehe hangata liphuthelong tse nepahetseng 'me ke lets'oao le tšepahalang ka ho fetisisa leo PhantomBot e le sebelisang hape.
- Tlhahlobo ea binary ea C2. Mang kapa mang ea jarollotseng lisebelisoa tsa axois:1.0.9 e na le seva ea C2 ea opareitara (c2 ELF, sha256 165fa92d…) ho disk. Skena li-cache le mabenkele a lintho tsa khale tsa CI. Binary e robetse ka boeona, empa boteng ba eona setsing sa mosebetsi ke bopaki bo hlakileng ba hore sephutheloana se kentsoe.
Mola o koalang
Mosebelisi ea tšoanang, sephutheloana se tšoanang, le sehokelo se tšoanang sa ho kenya li ka fana ka litšokelo tse fapaneng ka ho feletseng ka hare ho lihora tse 48. Shebella sethala, eseng mojaro o boima.
