TL; DR
Umshicileli omnye we-npm, deadcode09284814, uqhube iphulo lokuchwetheza amagama ngokuchasene ne-official axios kwaye chalk-template iipakeji ukusukela phakathi kuMeyi 2026.
Iphulo laqala njengomphangi weziqinisekiso zemveli kunye nomenzi wemali, ekhupha idatha kwi Umjelo we-Serveo HTTPS.
On 2026-05-17, ne axois-utils:1.0.9, umqhubi utshintshe umthwalo ngokupheleleyo: i-scaffold efanayo ye-triple install-hook, umshicileli ofanayo, igama elifanayo lephakheji.
Kodwa iskripthi sokufaka ngoku sisixhobo sokuqokelela ii-botnet ze-DDoS ezisebenzisa amaqonga amaninzi.
Umthwalo uthetha nomntu localhost.run i-tunnel kwaye yamkela imiyalelo yezikhukula, iguqula iindawo ezinentsholongwane zibe yinxalenye ye-botnet enamandla e-DDoS.
Umqhubi wade wathumela Iseva ye-C2 enamacala amabini ngaphakathi kwi-tarball, ebonisa ukunyuka okucacileyo ukusuka ekubiweni kweziqinisekiso ukuya kwiziseko ze-botnet ezisebenzayo.
Iipakeji ezimbini, iinguqulelo ezine ezisasebenza kwirejistri, kunye nomsebenzisi omnye ngoku osebenzisa zombini iimodyuli ngaxeshanye.
Ubunzima: phezulu.
Uhlaselo: Indlela Olusebenza Ngayo
Eli phulo lakhiwe phezu kwesiseko sokuhambisa esikruqulayo ngabom: amagama amabini eepakeji zokubhala, ileta enye ephuma kwiipakeji kunye namakhulu ezigidi zokukhuphela ngeveki (axios, itemplate yetshokhwe), kunye nokufakelwa kathathu hooks esi siqinisekiso sokuphunyezwa. Okunomdla kukuba yintoni i-scaffold ethwele — kunye nenyaniso yokuba umqhubi utshintshe umthwalo ngaphandle kokutshintsha nantoni na enye.
I-scaffold ekwabelwana ngayo
Zonke iinguqulelo ezipapashiweyo zeepakeji zombini zivakalisa umjikelo wobomi ofanayo omithathu hooks in iphakheji.json:
"scripts": { "preinstall": "node <payload>.js", "install": "node <payload>.js", "postinstall": "node <payload>.js" } Ukubeka umthwalo phantsi kwazo zontathu hooks kugqithisile — postinstall yodwa ingasebenza ngokungagqibekanga npm ukufakaUkhetho lubalulekile: ukufaka i-npm -ukungazi-izikripthi itsiba izikripthi, kodwa iindlela ezininzi zokusebenza eziqhelekileyo (i-CI cache ibuyisela loo nkqubo yokuphinda isebenze ubomi hooks ngokukhetha, okanye abaphuhlisi abahlola kuphela postinstall) yenza isibhengezo esiphindwe kathathu sokuba yeyona ndlela ikhuselekileyo yomhlaseli.
itshokhwe-tempalte yongeza indlela yesibini: ivakalisa izixhobo ze-axois:^1.0.7 njengexesha lokusebenza ukuxhomekekaUkufaka i-typosquatted itemplate yetshokhwe ngoko ke itsala nohlobo lwe-typosquat yomntakwabo, kwaye zombini iipayloads ziyasebenza. Ezi package zimbini zidibeneyo, azikho kuluhlu oluzimeleyo.
Isigaba A — isiqinisekiso / umntu othatha imali kwi-wallet (2026-05-15 → ngoku)
Isigaba A ngumthwalo wokuqala. Umlayishi umfutshane i-postinstall.js oko kukhomba kwi-Serveo HTTPS reverse-tunnel:
// chalk-tempalte/postinstall.js:11-13 const C2_HOST = "f04a273bd84c0622-80-200-28-28.serveousercontent.com"; const C2_PORT = 443; const C2_PATH = '/collect'; I-Serveo subdomain ifaka ikhowudi ye-IP yendawo ekuyiwa kuyo (80.200.28.28) ngqo kwigama lomenzi — yindlela eyaziwayo yaloo nkonzo. Umsebenzisi ujikelezisa isimaphambili se-subdomain esingacwangciswanga phakathi kweenguqulelo ukuze aphephe uluhlu lwee-blocklists ze-domain ezingaqhelekanga, kodwa i-IP engaphantsi ayishukumi. (i-chalk-temalte:1.0.14 ezisetyenzisiweyo 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 ukusetyenziswa f04a273bd84c0622-….)
i-postinstall.js izandla ziye ku i-phantom.js, imodyuli "yomqokeleli" enemigca eyi-7,667 ehlanganisiweyo. i-phantom.js uhamba nomninimzi ukuze:
Izitshixo zabucala ze-SSH (~/.ssh/*) |
.npmrc umxholo kunye naluphi na npm_* iithokheni ze-env |
| Iifayile zeziqinisekiso ze-AWS, GCP, kunye ne-Azure |
I-GitHub personal-access-token regex (ghp_*, gho_*, ghu_*, ghs_*) |
| Izinto ezenziwe nge-Crypto-wallet zeBitcoin, i-Exodus, i-Electrum, i-Monero, i-Litecoin, i-Dogecoin, i-Zcash, i-Dash |
Ukuphindaphinda .env* hamba ngapha ~/projects, ~/dev, ~/code, ~/workspace, kunye ne-install cwd |
Iimbali zeShell kunye nembali epheleleyo process.env |
Iphakheji ithunyelwa kwi-tunnel yaseServeo apha /qokelelaAkukho ngxaki, akukho logic ichasene ne-VM, akukho staging — ukubheja komqhubi kuxhomekeke kwivolumu kunye nesantya.
Isigaba B — I-PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 kuphela)
Isigaba B sithatha indawo ye-phantom.js + postinstall.js ngefayile enye ebizwa ngokuba yi-distrube.js (uhlobo lokubhala luhlobo lomqhubi). I-scaffold ye-triple-hook kwi-package.json ayitshintshanga; iphakheji igcina igama elifanayo, i-scope, kunye nephethini ye-version-bump. Ukusuka ngaphandle, i-axois-utils:1.0.9 ijongeka ngathi ngumntwana olandela i-1.0.6. Ngaphakathi, lusapho olwahlukileyo lwe-malware.
distrube.js ivula ngebhloko yoqwalaselo echaza uphawu lomqhubi:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Izimvo zibhekiswe kumqhubi wexesha elizayo osebenzisa ikhithi ("Sebenzisa i-URL yakho ye-localhost.run HTTPS"). Oko, kunye noko kuthunyelwa ecaleni kweklayenti ye-bot, kukubona ukuba oku akusiyo nje umthwalo wexhoba - yikhithi.
Ukuhamba:
- Ukunyamezela isebenza kuqala. Iskripthi sizifakela ngeendlela ezintathu ezahlukeneyo kwi-OS nganye (irejista) Run + Ifolda yokuqalisa + schsasks kwiWindows; crontab + inkonzo ye-phantom-bot iyunithi yenkqubo + .ukuku/.zshrc faka + /etc/rc.local kwiLinux; I-LaunchAgent com.phantom.bot.plist kwi-macOS). Igama lenkonzo yokuphikelela kunye nelebhile yeLaunchAgent zombini i-phantom-bot / com.phantom.bot, apho ke livela khona igama lephulo.
- Ulwazi lwenkqubo olugqithisiweyo isebenza kube kanye — iminwe efakwe umfanekiso omnye POST ukuya kwi-b94b6bcfa27554.lhr.life:443/collect ephethe igama lomnxibelelanisi, iqonga, i-arch, igama lomsebenzisi, i-CPU/RAM, i-network interfaces, i-process.env, i-cwd, i-homedir, inguqulelo ye-node, kunye ne-IP kawonkewonke. Oku akunabundlongondlongo kangako kuneSigaba A: akukho SSH, akukho wallets, akukho .env recursion. Umsebenzi we-bot kukubhalisa, hayi ukuba.
- I-loop ye-heartbeat Ivula i-HTTPS POST rhoqo emva kwemizuzwana engama-30 ukuya kwi-b94b6bcfa27554.lhr.life:443/. I-User-Agent yi-PhantomBot/1.0. Ukuqinisekiswa kwe-TLS kukhutshaziwe ngokucacileyo (rejectUnauthorized: false). Impendulo ye-C2 ihluzwa njenge-JSON yefom {type, target, port, duration, threads, method} kwaye ithunyelwe.
- Izixhobo zezixhobo zikaMkhukula ixhunywe kwimiyalelo emithandathu:
| Uhlobo lomyalelo | mnqongo | amaNqaku |
|---|---|---|
| ping | Impendulo ye-Liveness | I-Bot izichaza ngokwayo |
| http | Isikhukula seHTTP | Isicelo seLayer-7 |
| https | Isikhukula se-HTTPS | Kufana ne-http, i-TLS-wripped |
| tcp | Ukhukula lwe-TCP | I-spam ye-65 KB engacwangciswanga yokulayisha |
| udp | Isikhukula se-UDP | Iipakethi ze-UDP ezingama-65,507-byte |
| ngokukhawuleza | I-DoS yokuseta kwakhona ngokukhawuleza ye-HTTP/2 | Indlela ye-2023 CVE-2023-44487 |
Zonke iimodyuli ezintlanu zezikhukhula zithatha joliswe kuyo, izibuko, Ixesha, yaye intambo ingxoxo — i-bot yi-flooder eqhelekileyo yokuqesha, ayijoliswanga nakweyiphi na ixhoba elithile. Uluhlu lwamaxhoba omqhubi luhlala kwi-C2, kungekhona kwiphakheji.
Yintoni Entsha Apha — i-C2 binary ethunyelweyo
Isigaba A sisimo esiqhelekileyo: ubusela beziqinisekiso, i-install hook, i-C2 efakwe kumthengisi. Isigaba B si ngokunjalo imo eqhelekileyo — ii-botnets ze-DDoS bezisoloko ziyinxalenye yeepakethe ze-npm ezinobungozi kangangeminyaka. Okungaqhelekanga kukuba umqhubi uthumele icala lomncedisi yekhithi engaphakathi kwi-npm tarball:
- c2 — i-Go ELF binary ehlanganisiweyo eyi-4-megabyte
- c2.go — umthombo we-426-line Go waloo binary
Akukho fayile ibizwayo yi-install hook. Ayiyonxalenye yomthwalo wexhoba. Ihleli kwi-package directory ngendlela efanayo nefayile yoxwebhu ebinokwenza ngayo. Eyona nto inokwenzeka kukuba umqhubi utyhale umthi wakhe wophuhliso ukuya kwi-npm ngaphandle kokukhetha uluhlu lweefayile - i-OpSec slip yokwenyani - kwaye into ethunyelwayo yi-kit epheleleyo enamacala amabini: umthengi uqhutywa lixhoba, kwaye umqhubi uqhutywa liseva.
Le yinxalenye yebali ethethelela ukwakheka kwe "turnkey botnet kit". Nabani na okhuphele izixhobo ze-axois: 1.0.9 Ngaphambi kokuba i-takedown ibe nesampulu yexhoba kuphela - baneseva ye-C2 esebenzayo.
I-pivot, kwisivakalisi esinye
Umpapashi ofanayo, amagama eepakeji afanayo, isicabha esifanayo esineentambo ezintathu, uphawu olufanayo "lwephantom" — kodwa umthwalo womvuzo utshintshe imodeli yokwenza imali ngobusuku obunye: ukusuka “kwiimfihlo zokuvuna endingazithengisa kwakhona” ukuya “kumthamo wokuqeshisa izikhukhula endinokuziqeshisa”. Ii-TTPs zexesha lokufaka ekufuneka abakhuseli bazibukele ziyafana kuzo zombini izigaba; ukhuselo olusekelwe kwisiginitsha oluxhomekeke kwimitya yendlela yesipaji yeSigaba A okanye ukuya i-phantom.jsUmqokeleli wemigca eyi-7,667 ebengayi kuphoswa yiSigaba B ngokupheleleyo.
| Umhla (UTC) | umcimbi |
|---|---|
| 2026-05-15 | Impapasho yokuqala: axois-utils:1.0.4 (Ulwakhiwo lovavanyo lwe-LAN, isixhobo sophuhliso kwi 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 ipapashwe — Isigaba A C2 sitshintshelwe kwi 80.200.28.28 nge-Serveo tunnel; uluvo lomthombo // Change to '80.200.28.28' for public iqinisekisa ukutshintshwa kwe-dev→prod |
| 2026-05-16 | chalk-tempalte:1.0.14 kwaye 1.0.16 ipapashiwe — ibhengeza umlayishi onamatyathanga axois-utils:^1.0.7 njengokuxhomekeka kwexesha lokusebenza; i-Serveo subdomain ijikelezisiwe |
| 2026-05-16 | Iphulo leSigaba A lifunyenwe ngexesha lokuskena kwe-npm rhoqo; kusetyenziswe izigwebo eziqinisekisiweyo nezingalunganga |
| 2026-05-17 | axois-utils:1.0.9 ipapashiwe — i-payload pivot: I-PhantomBot DDoS iqesha nge-localhost.run tunnel; icala lomqhubi c2 yokubini kunye c2.go umthombo uthunyelwe kwi-tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 kwaye 1.0.20 ipapashwe — iseseSigaba A (isela); umqhubi ngoku usebenzisa zombini iimodyuli ngaxeshanye |
| 2026-05-17 | Ukufunyanwa kweSigaba B ngexesha lokuskena okuqhelekileyo; izigqibo zisetyenziswa kuyo yonke into 2026-05-17 iinguqulelo |
| (Iyaqhubeka) | Iingxelo zokususa zilindile; zonke iipakeji ezine ezipapashiweyo zisafumaneka kwirejistri ngexesha lokubhalwa kwale ncwadi |
Iimpawu zokuvumelana
Iipakethi
| Ecosystems | ipakethe | iinguqulelo |
|---|---|---|
| npm | axois-utils (i-typosquat ye-axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (i-typosquat ye-chalk-template) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Ubuwena bombhali
| intsimi | ixabiso |
|---|---|
| umshicileli we-npm | deadcode09284814 |
| I-imeyile yomshicileli | phantomdeadcode@tutamail.com |
| SCM ukuqinisekiswa | nanye |
Umyalelo-nolawulo
| Isigaba | Endpoint | Transport |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Umjelo we-Serveo HTTPS |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Umjelo we-Serveo HTTPS (uhlobo lwangaphambili) |
| A | 80.200.28.28:443/collect | Isiphelo seVPS esisisiseko |
| B | b94b6bcfa27554.lhr.life:443/ | i-localhost.run i-HTTPS reverse-tunnel |
Iifayile ezicociweyo (SHA-256)
| ifayile | SHA-256 | amaNqaku |
|---|---|---|
c2 (Yiya kwi-ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Iseva ye-C2 esecaleni komqhubi, ithunyelwe ngaphakathi axois-utils:1.0.9 |
c2.go (Imigca engama-426) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Yiya kumthombo we-C2 binary |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Iklayenti ye-bot yeSigaba B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Isigaba A sokuqinisekisa / umqokeleli wesikhwama |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Umqokeleli weSigaba A (uhlobo lwe-1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Isilayishi seSigaba A, esifana ne-byte kuzo zombini iinguqulelo |
Imfanelo kunye neNkuthazo
Silandela eli phulo njenge PhantomBot, ethatha uphawu lomqhubi kwi Iarhente Yomsebenzisi: PhantomBot/1.0 intloko yentliziyo, inkonzo ye-phantom-bot iyunithi yenkqubo, i com.phantom.bot ilebhile ye-LaunchAgent, kunye i-phantomdeadcode@ isiphatho se-imeyile. Umsebenzisi uhlala ethetha ngeli gama ubuncinane kwizinto ezine ezisetyenzisiweyo.
Ikhathalogu yeempawu
- Umshicileli - ikhowudi emiselweyo09284814 kwi-npm. Iakhawunti yesandla esinye, i-imeyile yeTutamail engasetyenziswayo, akukho SCM ukuqinisekiswa. Akukho ngxelo yangaphambili yokupapashwa ngaphaya kweli phulo.
- Ukusetyenziswa kwakhona kwebhrendi — “iphantom” ivela kwi-imeyile yomshicileli, kwifayile yefayile yomqokeleli weSigaba A (i-phantom.js), kwigama lenkonzo yokuzingisa yeSigaba B (inkonzo ye-phantom-bot), kwileyibhile yeLaunchAgent (com.phantom.bot), nakwi-bot User-Agent (I-PhantomBot/1.0).
- Izibonelelo - I-VPS enye kwi 80.200.28.28 iifronts Isigaba A ngokusebenzisa ujikelezo lwe-subdomain yaseServeo; Isigaba B sifudukela kwi-a i-localhost.run itonela ebuyela umva (b94b6bcfa27554.lhr.lifeZombini iinkonzo zabathengisi zisimahla kwaye zifuna kuphela i-SSH ephumayo kwicala lomqhubi, ngokuhambelana nokuseta kwe-OpSec enebhajethi ephantsi, ephantsi.
- Isimbo sekhowudi — IJavaScript ecacileyo kuyo yonke indawo; akukho ngxaki, akukho khowudi yentambo, akukho kuhlolwa kwe-anti-VM. Amagama aguquguqukayo achaza (ulwazi lweSystemInfo, phumezaUmyalelo, httpUmkhukula). Izimvo kwi distrube.js thetha ngqo nomsebenzisi wexesha elizayo ("Sebenzisa i-URL yakho ye-localhost.run HTTPS"), nto leyo ebonisa ukuba le fayile yayijoliswe ekubeni isasazwe kwakhona njengekhithi, ingasetyenziswa ngumhlaseli omnye.
- Islip ye-OpSec — I-tarball yeSigaba B ithumela zombini iklayenti ye-bot kunye neseva ye-C2 esecaleni komqhubi (c2 ELF + c2.go umthombo). Oku kuhambelana nomsebenzisi otyhale umthi wakhe osebenzayo ukuya kwi-npm ngaphandle kokuphonononga uluhlu lweefayile. Nokuba umqhubi akanamava, okanye ikhithi ayisebenzi. kuthetha iza kusasazwa esidlangalaleni kwaye i-C2 binary yinxalenye yemveliso.
- Ukuziqinisekisa - izixhobo ze-axois: 1.0.4 iqulethe uluvo lomthombo // Tshintshela ku-'80.200.28.28' kuluntu kumgca we-12, eqinisekisa inkqubela phambili yophuhliso/yokucwangcisa/yemveliso edla ngokukhanyelwa ngabaqhubi.
Isizathu
Umthwalo weSigaba A ulula ngokuba yimali: iziqinisekiso, izitshixo zelifu, ii-GitHub token, kunye nee-crypto wallets zonke zinemarike zokuthengisa kwakhona. ISigaba B sikwayimali, kodwa singathanga ngqo: Iinkonzo ze-DDoS-for-rent (“booter”) ziqesha umthamo wokukhukula ngomzuzu, kwaye ii-bots ezifana nale ithunyelwa apha zizinto ezisetyenziswa kuzo ezo nkonzo. Ukubetha kwentliziyo kwemizuzwana engama-30, okuqhelekileyo. joliswe kuyo/izibuko/Ixesha iskimu yomyalelo, kunye nesixhobo sokulwa izikhukula esineenkqubo ezintlanu zeprotocol standard imveliso yomqhubi we-booter.
Ukusebenzisa zombini iimodyuli ngaxeshanye — i-chalk-temalte:1.0.19 kwaye 1.0.20 qhubeka nokuthumela isela ngelixa izixhobo ze-axois: 1.0.9 ithumela i-bot - ibonisa ukuba umqhubi ukhusela imithombo yengeniso endaweni yokushiya iSigaba A. I-pivot yi- Ukongeza, hayi ukutshintshwa.
Oko singakubangiyo
Asikwazanga ukuqinisekisa ubuwena bokwenyani obungasemva ikhowudi emiselweyo09284814 isiphatho, kwaye asiyibaleli le phulo kuye nawuphi na umdlali wezoyikiso odumileyo, iqela, okanye ilizwe. Uphawu "lwephantom" luhambelana ngokwaneleyo kuzo zonke izinto zakudala ukuze kucetyiswe umsebenzisi omnye, kodwa ukuthunyelwa kwe-kit-style ye-C2 binary kushiya ithuba lokuba iipakeji zexesha elizayo ezivela kwiziphatho ezingadibaniyo ziya kuphinda zisebenzise ikhowudi efanayo.
Impembelelo, Iindlela Ezisetyenziswayo kunye Nezinto Ekufuneka Zenziwe Ngabakhuseli
igalelo
Iithagethi ze-squat ezisemthethweni axios kwaye itemplate yetshokhwe zixhomekeke kakhulu kwinkqubo yeJavaScript; axios I-alone iphakathi kweephakheji ezingamashumi amathathu eziphambili ze-npm ezikhutshelwe kakhulu. Amagama e-typosquat akude kakhulu kunalawo okwenyani (i-axois ↔ axios, i-temalte ↔ template), kwaye zombini ziimpazamo zopelo ezinokwenzeka ngokweelwimi.
Asikwazanga ukufumana izibalo zokukhuphela ezithembekileyo zeenguqulelo ezinobungozi ngaphambi kokususwa kwe-intanethi — i-npm ayigcini inani lokukhuphela ngoguqulelo ngalunye emva kokuba iphakheji ingashicilelwanga, kwaye npms.ioIiproksi zesitayile se--zinomsindo ngolu hlobo. Nawuphi na umbutho onefayile yokutshixa egqibezela iphakheji ebizwa ngokuba yi izixhobo ze-axois or itshokhwe-tempalte evela kumshicileli ikhowudi emiselweyo09284814 kufuneka iphathwe njengengenamsebenzi: jikelezisa zonke iinkcukacha ezikhoyo inkqubo.env kwi-host echaphazelekayo, jonga ii-vectors zokunyamezela ngokwe-OS nganye (jonga "Oko abakhuseli bafanele bakwenze" ngezantsi), kwaye ususe ukuxhomekeka.
Iipateni ezivelayo
Eli phulo libonisa utshintsho esilubonileyo kwiziganeko ezininzi zamva nje ze-npm: isikhonkwane sokufaka i-hook sisixhobo esihlala ixesha elideumthwalo womvuzo ungatshintshwaUmshicileli ofanayo, iphakheji efanayo, iyafana faka ngaphambili / fakela / postinstall kathathu, kwanenguqulelo efanayo-i-bump cadence — into ekuphela kwayo eyatshintsha phakathi izixhobo ze-axois: 1.0.6 kwaye izixhobo ze-axois: 1.0.9 yayiyifayile leyo hooks run. Ukuchonga okusekelwe kwisiginitsha kuxhomekeke kwiSigaba A somthwalo wokuhlawula (iintambo zendlela yesipaji, i-phantom.jsUmqokeleli we-Serveo C2 (oyi-7,667-line collector), ngewayephawule iinguqulelo ezintathu zokuqala waza waphoswa yiPhase B ngokupheleleyo.
Le ndlela ifanayo ibonakala nakwezinye iiphulo zika-2026 esizilandeleleyo: umqhubi omnye onesiseko esizinzileyo, otshintshana phakathi kokwebiwa kweziqinisekiso, abathengi abakhohlisayo kwiimviwo, i-Telegram-bot exfil, kwaye ngoku kuqeshwa i-DDoS. Abakhuseli abaxhomekeke kwiisignitsha zomthwalo baya kuqhubeka belahlekelwa ngumjikelo wesibini wephulo ngalinye.
Isiphumo kukuba Ii-TTPs zexesha lokufaka zezona zilungileyo. Izibhengezo ezintathu ze-install-hook, faka izikripthi ezingenisa https or umntwana_inkqubo, faka izikripthi ezibhalela iifolda eziqala umsebenzisi, kwaye ufake izikripthi ezisombulula amagama ee-hostname kwiinkonzo zasimahla ze-reverse-tunnel (Serveo, i-localhost.run, ngrok, cloudflared) zonke azifumaneki lula kwiiphakheji ezisemthethweni kwaye zixhaphakile kwezo zinobungozi.
Oko abakhuseli bafanele bakwenze
- Uphicotho lwefayile yokutshixa. Khangela yonke iphakheji-lock.json / isitshixo sentambo / i-pnpm-lock.yaml kumbutho wakho ukuze ufumane imitya echanekileyo izixhobo ze-axois kwaye itshokhwe-tempaltePhatha nawuphi na umdlalo njengesivumelwano.
- Jikelezisa iimfihlo kwiindwendwe ezichaphazelekayo. Isigaba A siqulethe iziqinisekiso ze-SSH, ilifu, iGitHub, i-npm, kunye ne-wallet ezivunwe ngobuninzi. Cinga ngazo zonke iziqinisekiso ezikhoyo inkqubo.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~/.config, okanye nayiphi na .env* ifayile kwi-host echaphazelekayo iyavezwa.
- Susa ukunyamezela (Isigaba B). KwiWindows, cima HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, susa %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, yaye imisebenzi ye-schtasks /cima /tn SystemUpdate /fKwiLinux, i-crontab -e kwaye ususe @reboot node…, inkquboctl – umsebenzisi ukhubaza –ngoku phantom-bot.service emva koko cima ~/.config/systemd/user/phantom-bot.service, khuhla .ukuku / .zshrc / /etc/rc.localKwi-macOS, launchctl layisha ~/Library/LaunchAgents/com.phantom.bot.plist uze ucime uluhlu.
- Vimba ii-host ze-C2. Yongeza ii-endpoints ezine ze-C2 kwitheyibhile ye-IOC kuluhlu lwakho lokuvimba ukuphuma. *.serveousercontent.com kwaye *.lhr.life ingavalwa ngobuninzi ukuba indawo okuyo ayinalo ilungelo lokusebenzisa iinkonzo ze-reverse tunnel.
- Zingela ngexesha lokufaka i-TTP, hayi umthwalo. Iifayile zokutshixa ezifakwe kwi-inventory iphakheji.json wathi faka ngaphambili, fakela, yaye postinstall Zonke zikhomba kwiskripthi esifanayo. Jonga ngokuthelekisa ubudala bephakheji kunye nesimo sokuqinisekiswa komshicileli. Le patheni ayifumaneki kwiiphakheji ezisemthethweni kwaye lolona phawu luthembekileyo olusetyenziswa yiPhantomBot.
- Uhlolo lwe-C2 binary. Nabani na okhuphele izixhobo ze-axois: 1.0.9 ineseva ye-C2 yomqhubi (c2 ELF, sha256 165fa92d…) kwidiski. Ii-cache ze-Scan kunye neendawo zokugcina izinto ze-CI. I-binary ayisebenzi yodwa, kodwa ubukho bayo kwindawo yokusebenza bubungqina obucacileyo bokuba iphakheji ifakiwe.
Umgca wokuvala
Umsebenzisi ofanayo, iphakheji efanayo, kunye ne-install hook efanayo zinokuzisa izoyikiso ezahlukeneyo ngokupheleleyo kwiiyure ezingama-48. Jonga i-scaffold, hayi umthwalo.
