TL; DR
Umshicileli oyedwa we-npm, deadcode09284814, uqhube umkhankaso wokubhala amagama ngokumelene ne-official axios futhi chalk-template amaphakheji kusukela maphakathi noMeyi 2026.
Lo mkhankaso waqala njengomuntu ojwayelekile osebenzisa iziqinisekiso kanye nomeba wesikhwama semali, ekhipha idatha ku- Umhubhe we-Serveo HTTPS.
On 2026-05-17, Nge axois-utils:1.0.9, umqhubi ushintshe umthwalo wokukhokha ngokuphelele: i-scaffold efanayo yokufaka i-triple-hook, umshicileli ofanayo, igama elifanayo lephakheji.
Kodwa iskripthi sokufaka manje sesiyi-botnet recruit ye-DDoS ehlanganisa amapulatifomu amaningi.
Umthwalo okhokhelwayo ukhuluma no- localhost.run i-tunnel futhi yamukela imiyalo yezikhukhula, iguqula izindawo ezithelelekile zibe yingxenye ye-botnet enamandla e-DDoS.
Umqhubi waze wathumela Iseva ye-C2 enambambili ngaphakathi kwe-tarball, okubonisa ukwanda okucacile kusukela ekwebiweni kweziqinisekiso kuya engqalasizinda ye-botnet esebenzayo.
Amaphakheji amabili, izinguqulo ezine ezisasebenza kurejista, kanye nomqhubi oyedwa manje osebenzisa womabili amamojula ngokufana.
Ubunzima: phezulu.
Ukuhlasela: Indlela Okusebenza Ngayo
Lo mkhankaso wakhelwe phezu kwesisekelo sokulethwa esiyisicefe ngamabomu: amagama amabili ephakheji yokubhala, incwadi eyodwa ephuma emaphaketheni kanye nokulandwa kwamasonto onke okungamakhulu ezigidi (axios, ithempulethi yetshoko), kanye nokufakwa kathathu hooks lokho kuqinisekisa ukwenziwa. Okuthakazelisayo ukuthi yini i-scaffold ethwele — kanye neqiniso lokuthi umqhubi ushintshe umthwalo ngaphandle kokushintsha noma yini enye.
I-scaffold ehlanganyelwe
Yonke inguqulo eshicilelwe yamaphakheji womabili imemezela umjikelezo wokuphila ofanayo wezintathu hooks in iphakethe.json:
Ukufaka umthwalo okhokhelwayo ngaphansi kwazo zonke ezintathu hooks kungaphezu kwamandla — faka okuthunyelwe eyedwa izosebenza ngokuzenzakalelayo ukufaka i-npmUkukhetha kubalulekile: ukufaka i-npm -ukungazi-izikripthi yeqa izikripthi, kodwa imisebenzi eminingana evamile (i-CI cache ibuyisela leyo nqubo yokuqalisa kabusha umjikelezo wokuphila hooks ngokukhetha, noma onjiniyela abahlola kuphela faka okuthunyelwe) yenza isimemezelo esiphindwe kathathu sokubheja okuphephile kakhulu kumhlaseli.
i-chalk-temalte ingeza indlela yesibili: imemezela i-axois-utils:^1.0.7 njengesikhathi sokusebenza ukuncikaUkufaka umbhalo obhalwe phansi ithempulethi yetshoko ngakho-ke kudonsa nokubhala amagama omndeni, futhi womabili ama-payload ayasebenza. Amaphakheji amabili ayimbhangqwana ohlanganisiwe, hhayi uhlu oluzimele.
Isigaba A — iziqinisekiso / umphangi wesikhwama (2026-05-15 → okwamanje)
Isigaba A yisisindo sokuqala somthwalo. Isilayishi sifushane i-postinstall.js lokho kukhomba ku-Serveo HTTPS reverse-tunnel:
Isizinda esincane se-Serveo sifaka ikhodi ye-IP yendawo oya kuyo (80.200.28.28) ngqo kugama lomethuleli — inqubo eyaziwayo yaleyo nsizakalo. Umsebenzisi ujikeleza isiqalo sesizinda esingahleliwe phakathi kwezinguqulo ukuze agweme uhlu lokuvimba lwesizinda olungenalwazi, kodwa i-IP eyisisekelo ayilokothi inyakaze. (i-chalk-temalte:1.0.14 esetshenziswa 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 ukusetshenziswa f04a273bd84c0622-….)
i-postinstall.js izandla zivulekile ku i-phantom.js, imojula “yomqoqi” enemigqa engu-7,667 ehlanganisiwe. i-phantom.js uhamba nombungazi ukuze:
Okhiye abayimfihlo be-SSH (~/.ssh/*) |
.npmrc okuqukethwe nanoma yikuphi npm_* amathokheni e-env |
| Amafayela eziqinisekiso ze-AWS, GCP, kanye ne-Azure |
I-regex ye-GitHub yomuntu siqu yokufinyelela (ghp_*, gho_*, ghu_*, ghs_*) |
| Izinto zobuciko ze-Crypto-wallet ze-Bitcoin, i-Exodus, i-Electrum, i-Monero, i-Litecoin, i-Dogecoin, i-Zcash, i-Dash |
Ukuphindaphinda .env* dabula phakathi ~/projects, ~/dev, ~/code, ~/workspace, kanye ne-cwd yokufaka |
Imlando yeShell kanye ne-full process.env |
Inqwaba ithunyelwe emhubheni we-Serveo ku- /qoqaAkukho ukufiphaza, akukho logic yokulwa ne-VM, akukho staging — ukubheja komqhubi kusevolumu kanye nesivinini.
Isigaba B — I-PhantomBot DDoS recruit (2026-05-17, axois-utils:1.0.9 kuphela)
Isigaba B sithatha indawo ye-phantom.js + postinstall.js ngefayela elilodwa elibizwa ngokuthi i-distrube.js (uhlobo lokubhala lungolwabasebenzisi). I-scaffold enezikhonkwane ezintathu ku-package.json ayishintshiwe; iphakheji igcina igama elifanayo, i-scope, kanye nephethini ye-version-bump. Uma ubheka ngaphandle, i-axois-utils:1.0.9 ibukeka njengokulandela okuncane ku-1.0.6. Ngaphakathi, umndeni ohlukile we-malware.
i-distrube.js ivula ngebhulokhi yokucushwa eqamba igama lomkhiqizo womqhubi:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Amazwana aqondiswe ku-opharetha wesikhathi esizayo osebenzisa ikhithi ("Sebenzisa i-URL yakho ye-HTTPS ye-localhost.run"). Lokho, kanye nalokho okuthunyelwa eduze kweklayenti le-bot, kuwukubonisa ukuthi lokhu akuyona nje umthwalo womthwalo wesisulu - yikhithi.
Ukugeleza:
- ukuphikelela isebenza kuqala. Iskripthi sizifaka ngezindlela ezintathu ezahlukene nge-OS ngayinye (irejistri) Qalisa + Ifolda yokuqalisa + imvusex ku-Windows; i-crontab + isevisi ye-phantom-bot iyunithi yesistimu + .bashrc/.zshrc faka + /etc/rc.local ku-Linux; I-LaunchAgent com.phantom.bot.plist ku-macOS). Igama lesevisi yokuphikelela kanye nelebula le-LaunchAgent zombili i-phantom-bot / com.phantom.bot, okuyilapho futhi igama lomkhankaso livela khona.
- Ulwazi lwesistimu oluthunyelwe isebenza kanye — umunwe othathwe kanye kuphela THUMELA ku-b94b6bcfa27554.lhr.life:443/collect ephethe igama lomsingathi, ipulatifomu, i-arch, igama lomsebenzisi, i-CPU/RAM, i-network interfaces, i-process.env, i-cwd, i-homedir, inguqulo ye-node, kanye ne-IP yomphakathi. Lokhu akunamandla kakhulu kuneSigaba A: akukho SSH, akukho wallets, akukho .env recursion. Umsebenzi we-bot ukubhalisa, hhayi ukweba.
- I-loop yokushaya kwenhliziyo Ivula i-HTTPS POST njalo ngemizuzwana engama-30 ku-b94b6bcfa27554.lhr.life:443/. I-User-Agent yi-PhantomBot/1.0. Ukuqinisekiswa kwe-TLS kukhutshaziwe ngokusobala (rejectUnauthorized: false). Impendulo ye-C2 ihlungwa njenge-JSON yefomu {type, target, port, duration, threads, method} bese ithunyelwa.
- Izikhali zezikhukhula ixhunywe emiyalweni eyisithupha:
| Uhlobo lomyalo | I-module | amanothi |
|---|---|---|
| ping | Impendulo ye-Liveness | I-Bot iziveza yona |
| http | Isikhukhula se-HTTP | Isicelo se-Layer-7 |
| https | Isikhukhula se-HTTPS | Kufana ne-http, i-TLS-wripped |
| tcp | Isikhukhula se-TCP | ugaxekile wokulayisha okungahleliwe ongu-65 KB |
| udp | Isikhukhula se-UDP | Amaphakethe e-UDP angu-65,507-byte |
| ngokushesha | I-DoS yokusetha kabusha okusheshayo ye-HTTP/2 | Indlela ye-2023 CVE-2023-44487 |
Zonke izimojuli ezinhlanu zezikhukhula zithatha umgomo, Imbobo, isikhathi, Futhi izindikimba impikiswano — i-bot iyi-flooder ejwayelekile yokuqasha, engahloselwe noma yisiphi isisulu esithile. Uhlu lwezisulu zomsebenzi luhlala ku-C2, hhayi ephaketheni.
Yini Entsha Lapha — i-C2 binary ethunyelwe
Isigaba A siyindlela ejwayelekile: ukwebiwa kweziqinisekiso, ukufaka i-hook, i-C2 exhunywe kumthengisi. Isigaba B siyindlela ejwayelekile. futhi isimo esijwayelekile — Ama-botnet e-DDoS abelokhu eyingxenye yamaphakheji e-npm anonya iminyaka eminingi. Okungavamile ukuthi umqhubi uthumele uhlangothi lweseva kwekhithi ngaphakathi kwe-npm tarball:
- c2 — i-Go ELF binary ehlanganisiwe engu-4-megabyte
- c2.go — umthombo we-Go wemigqa engu-426 walowo mbhalo wesibili
Awekho amafayela abizwa yinoma iyiphi i-install hook. Awekho ingxenye yomthwalo womthwalo wesisulu. Ahleli kufolda yephakheji ngendlela efanayo nefayela lemibhalo elingenza ngayo. Ukufundwa okunokwenzeka kakhulu ukuthi umqhubi ucindezele umuthi wakhe wokusebenza wokuthuthukisa ku-npm ngaphandle kokukhetha uhlu lwamafayela - isiliphu sangempela se-OpSec - futhi okuthunyelwayo yikhithi ephelele enezinhlangothi ezimbili: iklayenti eliqhutshwa yisisulu, kanye neseva eqhutshwa umqhubi.
Lena yingxenye yendaba eqinisekisa ukwakheka kwe-"turnkey botnet kit". Noma ubani olande i-axois-utils:1.0.9 Ngaphambi kokuthi i-takedown ibe nesampula yesisulu kuphela - baneseva ye-C2 esebenzayo.
I-pivot, ngomusho owodwa
Umshicileli ofanayo, amagama afanayo ephakheji, isikafu esifanayo esinezikhonkwane ezintathu, uphawu olufanayo "lwe-phantom" — kodwa umthwalo okhokhelwayo ushintshe imodeli yokwenza imali ngobusuku obubodwa: kusukela “ezimfihlo zokuvuna engingazithengisa kabusha” kuya “kumthamo wezikhukhula engingaziqasha”. Ama-TTP esikhathi sokufaka okufanele abavikeli bawabukele acishe afane kuzo zombili izigaba; ukuzivikela okusekelwe esiginesha okugxile ezintanjeni zendlela yesikhwama seSigaba A noma ku i-phantom.jsUmqoqi wemigqa engu-7,667 ubengeke aphuthelwe yiSigaba B nhlobo.
| Usuku (UTC) | Indawo |
|---|---|
| 2026-05-15 | Ukushicilelwa kokuqala: axois-utils:1.0.4 (Ukwakhiwa kokuhlolwa kwe-LAN, i-dev rig ku- 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 kushicilelwe — Isigaba A C2 sishintshelwe ku 80.200.28.28 ngomhubhe we-Serveo; ukuphawula komthombo // Change to '80.200.28.28' for public kuqinisekisa ukushintshaniswa kwe-dev→prod |
| 2026-05-16 | chalk-tempalte:1.0.14 futhi 1.0.16 kushicilelwe — isilayishi esiboshwe ngeketanga simemezela axois-utils:^1.0.7 njengokuxhomekeka kwesikhathi sokusebenza; isizinda esincane se-Serveo sijikelezisiwe |
| 2026-05-16 | Umkhankaso weSigaba A utholakale ngesikhathi sokuskena okuvamile kwe-npm; kusetshenziswe izinqumo eziqinisekisiwe nezinonya |
| 2026-05-17 | axois-utils:1.0.9 kushicilelwe — i-pivot yokulayisha umthwalo: I-PhantomBot DDoS iqasha nge-localhost.run tunnel; uhlangothi lwe-opharetha c2 okubili kanye c2.go umthombo uthunyelwe ku-tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 futhi 1.0.20 kushicilelwe — kuseyisigaba A (isela); umqhubi manje usebenzisa womabili amamojula ngasikhathi sinye |
| 2026-05-17 | Ukutholwa kweSigaba B ngesikhathi sokuskena okuvamile; izinqumo zisetshenziswa kuzo zonke 2026-05-17 izinguqulo |
| (kuyaqhubeka) | Imibiko yokususa ilindile; wonke amaphakheji amane ashicilelwe asatholakala kurejista ngesikhathi sokubhala |
Izinkomba Zokuyekethisa
Packages
| Ecosystem | Iphakheji | Izilinganiso |
|---|---|---|
| npm | axois-utils (i-typosquat ye-axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (i-typosquat yethempulethi ye-chalk) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Ubunikazi bombhali
| Inkambu | Value |
|---|---|
| umshicileli we-npm | deadcode09284814 |
| I-imeyili yomshicileli | phantomdeadcode@tutamail.com |
| SCM yokuqinisekisa | none |
Umyalo-nokulawula
| Isigaba | Isiphetho | Ezokuthutha |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | Umhubhe we-Serveo HTTPS |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | Umhubhe we-Serveo HTTPS (inguqulo yangaphambilini) |
| A | 80.200.28.28:443/collect | Iphuzu lokugcina le-VPS eliyisisekelo |
| B | b94b6bcfa27554.lhr.life:443/ | i-localhost.run i-HTTPS reverse-tunnel |
Ukufakwa kwamafayela (SHA-256)
| Ifayela | I-SHA-256 | amanothi |
|---|---|---|
c2 (Go ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Iseva ye-C2 eseceleni komqhubi, ithunyelwe ngaphakathi axois-utils:1.0.9 |
c2.go (Imigqa engu-426) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | Iya kumthombo we-C2 binary |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Iklayenti le-bot le-Phase B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | Isigaba A sokuqinisekisa / umqoqi wesikhwama |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | Umqoqi weSigaba A (uhlobo lwe-1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Isilayishi sesigaba A, sifana nge-byte kuzo zombili izinguqulo |
Ukufaneleka kanye Nokugqugquzelwa
Silandelela lo mkhankaso njengo PhantomBot, ethatha uphawu lomqhubi uqobo ku- I-ejenti yomsebenzisi: PhantomBot/1.0 ikhanda lenhliziyo, isevisi ye-phantom-bot iyunithi yesistimu, com.phantom.bot ilebula le-LaunchAgent, kanye ne- i-phantomdeadcode@ isibambo se-imeyili. Umsebenzisi uvumelana naleli gama okungenani ezintweni ezine ezisetshenzisiwe.
Ikhathalogi yezimpawu
- Umshicileli - i-deadcode09284814 ku-npm. I-akhawunti yesibambo esisodwa, i-imeyili engasetshenziswa ye-Tutamail, ayikho SCM ukuqinisekiswa. Akukho mlando wokushicilelwa wangaphambilini ngaphandle kwalo mkhankaso.
- Ukusetshenziswa kabusha kwebhrendi — “i-phantom” ivela ku-imeyili yomshicileli, egameni lefayela lomqoqi weSigaba A (i-phantom.js), egameni lesevisi yokuphikelela yeSigaba B (isevisi ye-phantom-bot), kulebula ye-LaunchAgent (com.phantom.bot), kanye naku-bot User-Agent (I-PhantomBot/1.0).
- Ingqalasizinda - I-VPS eyodwa ku- 80.200.28.28 imingcele Isigaba A ngokusebenzisa ukuzungeza kwesizinda esincane se-Serveo; Isigaba B sithuthela ku-a i-localhost.run umhubhe obuyela emuva (b94b6bcfa27554.lhr.lifeZombili izinsizakalo zabathengisi zimahhala futhi zidinga i-SSH ephumayo kuphela ohlangothini lomqhubi, okuhambisana nokusethwa kwe-OpSec okunesabelomali esincane, okuphansi.
- isitayela sekhodi — I-JavaScript ecacile kuyo yonke indawo; akukho ukufiphaza, akukho ukufaka ikhodi kwezinhlamvu, akukho ukuhlolwa kwe-anti-VM. Amagama aguquguqukayo ayachaza (ulwazi lwe-stealSystem, executeCommand, httpUzamcolo). Amazwana ku- i-distrube.js khuluma ngqo nomqhubi wesikhathi esizayo ("Sebenzisa i-URL yakho ye-localhost.run HTTPS"), okuphakamisa ukuthi ifayela lalihloselwe ukusatshalaliswa kabusha njengekhithi, hhayi umhlaseli oyedwa.
- Isiliphu se-OpSec — I-tarball ye-Phase B ithumela kokubili iklayenti le-bot kanye neseva ye-C2 eseceleni komqhubi (c2 I-ELF + c2.go umthombo). Lokhu kuhambisana nomsebenzisi osunduzele umuthi wakhe osebenzayo ku-npm ngaphandle kokuhlola uhlu lwamafayela. Noma ngabe umsebenzisi akanalwazi, noma ikhithi ayilona kusho izosatshalaliswa esidlangalaleni futhi i-C2 binary iyingxenye yomkhiqizo.
- Ukuziqinisekisa - i-axois-utils:1.0.4 iqukethe ukuphawula komthombo // Shintsha uye ku-'80.200.28.28' emphakathini kumugqa 12, okuqinisekisa inqubekela phambili yokuthuthukiswa/ukuhlelwa/ukukhiqiza okwenziwa ngabaqhubi ngokuvamile.
Motivation
Umthwalo we-Phase A uwukweba kwezezimali okulula: iziqinisekiso, okhiye bamafu, amathokheni e-GitHub, kanye nama-wallet e-crypto konke kunezimakethe zokuthengisa kabusha okuketshezi. I-Phase B nayo iyimali, kodwa engaqondile: Izinsizakalo ze-DDoS-for-rent (“booter”) ziqasha amandla okukhukhula ngomzuzu, kanti ama-bot afana nalawa athunyelwa lapha ayimpahla lezo zinsizakalo ezisebenza kuyo. Ukushaya kwenhliziyo kwemizuzwana engama-30, okujwayelekile umgomo/Imbobo/isikhathi uhlelo lomyalo, kanye ne-arsenal yezikhukhula yephrothokholi emihlanu yizona standard umkhiqizo womqhubi we-booter.
Ukusebenzisa amamojula womabili ngesikhathi esifanayo — i-chalk-temalte:1.0.19 futhi 1.0.20 qhubeka nokuthumela isela ngenkathi i-axois-utils:1.0.9 ithumela i-bot - iphakamisa ukuthi umqhubi uvikela imithombo yemali engenayo kunokuba ashiye iSigaba A. I-pivot iyi- Ngaphezu, hhayi esikhundleni.
Lokho esingakufuni
Asikwazanga ukuqinisekisa ukuthi ungubani ngempela ngemuva kwe- i-deadcode09284814 isibambo, futhi asisho ukuthi lo mkhankaso uvela kunoma yimuphi umlingisi osongelayo oqanjwe ngegama, iqembu, noma izwe. Umkhiqizo "we-phantom" uhambisana ngokwanele kuzo zonke izinto zobuciko ukuze uphakamise umqhubi oyedwa, kodwa ukuthunyelwa kwesitayela sekhithi se-C2 binary kushiya ithuba lokuthi amaphakheji esikhathi esizayo avela kuzibambo ezingahlobene azosebenzisa kabusha ikhodi efanayo.
Umthelela, Izitayela kanye Nalokho Okufanele Kwenziwe Abavikeli
Impact
Ama-squat target asemthethweni axios futhi ithempulethi yetshoko zincike kakhulu kuhlelo lwe-JavaScript; axios I-alone iphakathi kwamaphakheji angamashumi amathathu aphezulu e-npm alandiwe kakhulu. Amagama okubhala ahlukile kancane kunalawo angempela (i-axois ↔ axios, i-temalte ↔ ithempulethi), futhi zombili ziyizipelingi ezingalungile ngokwezilimi.
Asikwazanga ukuthola izibalo zokulanda ezinokwethenjelwa zezinguqulo ezinonya ngaphambi kokususwa — i-npm ayigcini inani lokulanda ngenguqulo ngayinye ngemva kokuthi iphakheji ingashicilelwanga, futhi npms.ioAma-proxies esitayela anomsindo ngale ndlela. Noma iyiphi inhlangano enefayela lokukhiya elizimisele ukusebenzisa iphakheji ebizwa ngokuthi ama-axois-utils or i-chalk-temalte kusuka kumshicileli i-deadcode09284814 kufanele kuphathwe njengokungafaneleki: shintshanisa yonke imininingwane ekhona ku inqubo.env kumphathi othintekile, hlola amavektha okuphikelela ngokwe-OS ngayinye (bheka "Okufanele kwenziwe abavikeli" ngezansi), bese ususa ukuncika.
Amaphethini akhulayo
Lo mkhankaso uyisibonelo soshintsho esilubonile ezigamekweni eziningana zakamuva ze-npm: isikafulo se-install-hook siyimpahla eqinile; umthwalo okhokhelwayo ungashintshwaUmshicileli ofanayo, iphakheji efanayo, efanayo faka kusengaphambili / Faka / faka okuthunyelwe kathathu, ngisho nenguqulo efanayo-i-bump cadence — okuwukuphela kwento eyashintsha phakathi i-axois-utils:1.0.6 futhi i-axois-utils:1.0.9 kwakuyifayela hooks run. Ukutholwa okusekelwe esiginesha kukhiyelwe kumthwalo wokukhokha weSigaba A (izintambo zendlela yesikhwama, i-phantom.jsUmqoqi we-Serveo C2 (ongu-7,667-line collector), ngabe ubhale phansi izinguqulo ezintathu zokuqala futhi waphuthelwa yiSigaba B ngokuphelele.
Iphethini efanayo ibonakala kweminye imikhankaso ka-2026 esiyilandelele: umqhubi oyedwa one-scaffold ezinzile, oshintshana phakathi kokwebiwa kweziqinisekiso, amaklayenti akhohlisa izivivinyo, i-exfil ye-Telegram-bot, kanye nokuqashwa kwe-DDoS manje. Abavikeli abathembele kumasignesha omthwalo bazoqhubeka nokulahlekelwa umzuliswano wesibili womkhankaso ngamunye.
Umphumela uwukuthi Ama-TTP esikhathi sokufaka ayisignali engcono. Izimemezelo zokufaka ezintathu, ukufaka izikripthi ezingenisa https or inqubo_yengane, faka izikripthi ezibhalela amafolda abasebenzisi abaqalayo, bese ufaka izikripthi ezixazulula amagama abathumeli kumasevisi wamahhala we-reverse-tunnel (Serveo, i-localhost.run, ngrok, cloudflared) konke akuvamile kumaphakheji asemthethweni futhi avamile kuwo wonke ama-malware.
Okufanele kwenziwe ngabavikeli
- Ukuhlolwa kwe-Lockfile. Sesha yonke package-lock.json / i-yarn.lock / i-pnpm-lock.yaml enhlanganweni yakho ukuze uthole izintambo eziqondile ama-axois-utils futhi i-chalk-temaltePhatha noma yikuphi ukufana njengokuvumelana.
- Zungezisa izimfihlo kubabungazi abathintekile. Isigaba A siqukethe iziqinisekiso ze-SSH, ifu, i-GitHub, i-npm, kanye ne-wallet ezivunwe ngobuningi. Cabanga ngazo zonke iziqinisekiso ezikhona ku inqubo.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~ / .config, noma yikuphi .env* ifayela eliku-host ethintekile liyadalulwa.
- Susa ukuphikelela (Isigaba B). Ku-Windows, susa I-HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, susa %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, Futhi imisebenzi ye-schtasks /delete /tn SystemUpdate /fKu-Linux, i-crontab-e bese ususa @reboot node …, i-systemctl – umsebenzisi ukhubaza – manje i-phantom-bot.service bese ususa ~/.config/systemd/user/phantom-bot.service, ukukhuhla .bashrc / .zshrc / /etc/rc.localKu-macOS, launchctl layisha ~/Library/LaunchAgents/com.phantom.bot.plist bese ususa uhlu.
- Vimba ababungazi be-C2. Engeza ama-endpoint amane e-C2 kuthebula le-IOC ohlwini lwakho lokuvimba ukuphuma. *.serveousercontent.com futhi *.lhr.life ingavinjelwa ngobuningi uma indawo yakho ingenalo ukusetshenziswa okusemthethweni kwezinsizakalo ze-reverse-tunnel.
- Ukuzingela ngesikhathi sokufaka i-TTP, hhayi umthwalo okhokhelwayo. okufakiwe kwefayela lokukhiya eliyimpahla okungobani iphakethe.json limenyezelwe faka kusengaphambili, Faka, Futhi faka okuthunyelwe konke kukhomba kuskripthi esifanayo. Hlola ngokuqhathanisa nobudala bephakheji nesimo sokuqinisekiswa komshicileli. Le phethini ayivamile kumaphakheji asemthethweni futhi iyisignali eyodwa ethembekile kakhulu iPhantomBot eyisebenzisa kabusha.
- Hlola i-binary ye-C2. Noma ubani olandile i-axois-utils:1.0.9 ineseva ye-C2 yomqhubi (c2 ELF, sha256 165fa92d…) kudiski. Ama-cache okuskena kanye nezitolo zezinto zobuciko ze-CI. I-binary ayisebenzi yodwa, kodwa ukuba khona kwayo endaweni yokusebenza kuwubufakazi obucacile bokuthi iphakheji ifakiwe.
Umugqa wokuvala
Umqhubi ofanayo, iphakheji efanayo, kanye ne-install hook efanayo kungaletha izinsongo ezihluke ngokuphelele emahoreni angu-48. Qaphela i-scaffold, hhayi umthwalo okhokhelwayo.
