TL; DR
Iphakheji ye-PyPI eqanjwe ukulawula i-gcli ithumele ithuluzi eliphelele lokufinyelela kude le-Windows: ukuqopha ngokucindezela inkinobho, ukuthwebula i-webcam nemakrofoni, ukuqapha ibhodi lokunamathisela, ukufinyelela kwe-browser-credential, ukulawula isikrini, ukuphikelela, ukuphakama kwamalungelo, kanye "nemiyalo engaphezu kuka-140" ezikhangisiwe. Ayizange ifihle ukuthi yayiyini: isifinyezo se-PyPI sephakheji siyichaze njengethuluzi lokufinyelela kude nge npoint.io".
Imininingwane efanele ukuhlaba ikhefu yileyo nkulumo "nge-npoint.io." Esikhundleni sokubiza iseva ezinikele, kusetshenziswa i-implant i-npoint[.]io (isevisi yamahhala, esemthethweni yokusingatha amadokhumenti amancane e-JSON) njengokudluliselwa kwayo komyalo nokulawula. Umsebenzisi ubhala imiyalo ebhokisini le-JSON; ukuhlola okufakwayo okuvimba, okusebenzisa, nokubhala imiphumela emuva. Akukho sizinda esiphethwe ngumhlaseli okufanele sivinjwe, akukho IP entsha okufanele iphawulwe: ithrafikhi iya kusevisi esetshenziswa onjiniyela nsuku zonke.
Izinguqulo eziyisithupha zanyatheliswa cishe emahoreni ayishumi nantathu nesigamu, ngayinye inamandla kakhulu kuneyokugcina. Zonke zazo zathola amaphuzu. ml_okubikezelwe_kuphephile ngumhleli wezinhlelo ozenzakalelayo ngaphambi kokubuyekezwa mathupha, umndeni wahlelwa kabusha njengononya.
Ukwakheka komzimba kokuhlasela
ukulawula i-gcli ifaka iphakheji yokungenisa i-gcli, i-Python codebase enamamojula angu-35. Azikho izikhathi zokufaka hooks — akukho lutho oluhambayo ngesikhathi pip ukufaka. Ikhono lihlala kumamojula ngokwawo, libizwa uma ithuluzi selisebenza, futhi ukwakheka kwemojula kufundeka njengeshidi lemininingwane yomkhiqizo:
Isiteshi somyalo siyingxenye ethakazelisayo. Amathuluzi amaningi okufinyelela kude afinyelela kuseva elawulwa yi-opharetha — i-IP, isizinda, umhlinzeki we-hosting ongabikwa futhi akhishwe ku-inthanethi. ukulawula i-gcli esikhundleni salokho uphatha insizakalo yamahhala ye-JSON-bin njenge-dead-drop. The iphuzu eliyinhloko imojuli ifunda futhi ibhale amadokhumenti amancane e-JSON ku- i-npoint[.]io ngaphezu kwe-HTTPS evamile; i crypto/ukubethela Amamojula asonga imithwalo yokukhokha eshintshiwe ukuze okuqukethwe yibhini kungabi yimiyalo ecacile. Umphumela uwukudluliselwa okuhlanganisiwe, okubethelwe:
- Umsebenzisi uphonsa umyalelo (obethelwe) ebhinini le-JSON.
- I-implant, esebenza kumphathi wesisulu, ihlola ukuthi i-bin, i-decrypt, ikhiphe omunye wabaphathi bayo bemiyalo, bese ibhala umphumela (obhalwe ngemfihlo).
- Kumqaphi wenethiwekhi, isisulu simane sikhuluma no i-npoint[.]io — isevisi enesizathu esizwakalayo sokuvela kuthrafikhi yonjiniyela.
Akukho ukulanda kwesigaba sesibili futhi akukho loader efihliwe lapha: ikhono lithunyelwa liphelele, ku-Python efundekayo, futhi okuwukuphela "kokufihla" ukukhetha i-relay kanye nokubethela kwemithwalo yokukhokha edluliselwe.
Kungani i-JSON-bin dead-drop ikhanga ngendlela ephumelelayo kufanelekile ukuyichaza, ngoba ichaza ukuthi kungani silindele ukubona iphethini futhi:
- Ayikho indawo yokugcina ephethwe ngumsebenzisi. Akukho sizinda se-C2 okufanele sibhaliswe, akukho VPS okufanele iqashwe, futhi akukho lutho olufanele umvikeli noma umbhalisi. Iphakheji ayithinti isiteshi; ukususwa kwe- isiteshi kusho ukucela i-SaaS ejwayelekile ukuthi iqaphe idokhumenti eyodwa phakathi kwezigidi.
- Ukuhlanza idumela. I-HTTPS ephumayo eya kusevisi yonjiniyela eyaziwayo ayinazo izijeziso zodumo ezingase zivele kusizinda esisha noma i-IP eluhlaza. Amasethingi amaningi okuhlunga ukuphuma akuvumela ngokungaqondile.
- Ukungavumelani kanye nokuphikwa. Imodeli yokuvota — i-implant ilanda idokhumenti ngesikhawu kunokubamba isokhethi evulekile — ikhiqiza ithrafikhi ebukeka njengokuvota kwe-API okuvamile, hhayi iseshini yokusebenzisana. Ukubethela okuqukethwe kwedokhumenti kusho ukuthi ngisho nomhlaziyi othola ibhini ubona umbhalo oyimfihlo, hhayi uhlu lwemiyalo.
- Ukujikeleza okuncaneUkuthuthela kwenye i-bin, noma isevisi ehlukile yenothi/ukunamathisela, kuyinguquko yokucushwa komugqa owodwa kumqhubi. Noma yiluphi uhlu lokuvimba olufakwe ku-relay ethile luphelelwa yisikhathi ngesikhathi luthunyelwa.
Ukushintshana okwenziwa ngumsebenzisi yi-throughput kanye ne-latency: i-dead-drop relay ihamba kancane futhi iphansi kune-direct connection. Ku-implant yokuqapha nokulawula ekhipha imiyalo emifushane futhi iqoqe imiphumela ngokuhamba kwesikhathi, kulula ukwenza lokho kuhweba.
esibekelwe
Umndeni wanda ngokushesha. Izitembu zesikhathi zokudala amathikithi ezinguqulo ezimakiwe zibeka yonke i-arc ebonwe ngaphakathi kwamahora ayishumi nantathu nesigamu, futhi inani lobufakazi besithwebuli landa kanye nekhodi - kusukela kumasayithi ambalwa amakiwe enguqulweni yokuqala kuya kwayishumi nane yakamuva.
Izinombolo zenguqulo azishicilelwanga ngokulandelana okuqinile, kodwa isiqondiso sicacile: ukusika okuncane kokuqala, bese kuba ukuphindaphinda okusheshayo kuya ku-0.7.1 egcwele ngokugcwele. Lesi isimo sephrojekthi esathuthukiswayo esunduzelwa kubhaliso lomphakathi njengoba ikhula, hhayi ukwehla okukodwa.
Izinkomba Zokuyekethisa
Zonke izinkomba ezingezansi ziqinisekiswe ngokumelene nokuqukethwe kwephakheji eku-disk kanye nokuskenwa kwezinkomba eziqondile zenguqulo 0.7.1; azikho eziqagelayo.
Inothi lomvikeli: isignali eqinile kakhulu akuyona i-domain (i-relay host ijikeleza kancane) kodwa Ukuma: iphakheji eyodwa ehlanganisa izinto ezintathu noma ngaphezulu ezihlukile zokuqapha umgcini futhi ihambisa iluphu yomyalo/yempendulo ngesevisi yomphakathi yokusingatha okuqukethwe. i-npoint[.]io Akusebenzi ezitolo eziningi; ukuxwayisa ngenqubo engalindelekile ebamba amadivayisi okufaka futhi ikhulume nensizakalo ye-JSON-bin kuqine kakhulu.
Ukuziphatha okuqashelwe kanye nokuhlelwa
Izinto ezimbili zenza lesi sibonelo singajwayelekile, futhi zombili zingamaqiniso abonakalayo kunokuba kube yiziphetho mayelana nesisusa.
Yazikhangisa. Isifinyezo sephakheji esasakazwa ku-PyPI sibala amakhono ngolimi olulula — ukufinyelela kude, ukulawula ideskithophu, ukuphathwa komsebenzisi, i-webcam, umsindo, i-keylogger, ukuphikelela, idatha yesiphequluli, i-WiFi, irejista, “imiyalo engu-140+.” Akuzange kube nomzamo wokudlulisa ikhodi njengomsizi wokwakha, i-CLI wrapper, noma i-AI-agent utility, okuyisimo esivame kakhulu esisibonayo kubhaliso lomphakathi. Ukuthi lokho kuvuleka kubonisa ithuluzi leqembu elibomvu elishicilelwe ngaphandle kwezilawuli zokufinyelela noma okunye umbuzo okuqukethwe kwephakheji kuphela okungaxazululwa; okuqinisekile ukuthi ithuluzi lokufinyelela kude elisebenzayo nelijwayelekile kanye nokuqapha lalifakwa yinoma ubani one- PIP.
Yayithembele ekwethembeni enkonzweni engenabungozi. Ukusebenzisa i-npoint[.]io njengoba i-relay iyindlela echazayo. Kuyisibonelo sephethini ebanzi — ukuhambisa i-C2 nge-SaaS esemthethweni (amasayithi okunamathisela, ama-JSON bin, iwebhu yokuxoxahooks, amadokhumenti amafu) ukuze ithrafikhi enonya ihlangane nomsebenzi ojwayelekile wonjiniyela futhi kungabikho ndawo yokugcina ephethwe ngumsebenzisi okufanele ibanjwe. Imithwalo ekhokhelwayo ku-relay yayibethelwe, ngakho okuqukethwe yibhini ngeke kufundwe njengemiyalo kumbukeli ojwayelekile.
Izimpawu zomshicileli zincane futhi zijwayelekile. Iphakheji imemezele ukuthi Umbhali "kwabanikeli be-gcli" kanye nelayisensi ye-MIT, futhi wakhomba ikhasi layo lasekhaya kanye nezinkambu zokugcina ku github[.]com/gcli-control/gcliAkukho noyedwa kulokho okuqinisekisayo: umucu wombhali ungumbhalo wamahhala, inhloko yelayisensi ye-MIT ayibizi lutho, futhi i-URL yokugcina kumethadatha yephakheji iyisimangalo, hhayi ubufakazi bokuthi ivelaphi. Iphethini - igama elisha sha, umbhali oqoqekile, kanye ne-org/repo yokuzibhekisela eyadalwa eduze kwephakheji - yilokho iphrojekthi ebukeka khona uma imiswa ngokuqondile ukuze ithwale ikhodi, kunokuba ithuluzi elisunguliwe eliye lakhulisa isici sokulawula kude. Siphawula lokhu njengokubona; kuyahambisana, kodwa ngokwako akusunguli, ukusatshalaliswa okwakhelwe injongo.
Sichaza lokhu kuchithwa njengokunonya ngokusekelwe ekhonweni nasekulethweni: ukufakwa okuphelele, okusebenzisekayo kokufinyelela kude kanye nokufakwa kokuqapha, okusatshalaliswa ku-index yephakheji yomphakathi ene-relay eyimfihlo. Asisho ukuthi kukhona okuqondiwe noma isisusa.
Umthelela, izitayela kanye nalokho abavikeli abangakwenza
Indawo engaboni kahle yokuhlunga okugxile ekufihleni. Okhiye be-triage yephakheji ezenzakalelayo kakhulu ku zifihla izimpawu ze i-malware ejwayelekile yokubhalisa — ama-blobs afihliwe, isikhathi sokufaka hooks, ukuvuna iziqinisekiso okukodwa. Iphakheji elula ngokusobala i-RAT, enekhodi efundekayo ehlanzekile futhi engenakho ukufaka i-hook, ayivezi lutho lwalezo zibikezelo futhi ingadlula ama-heuristics alindele ukufihlwa. Izimpawu ezibamba leli klasi ngokuthembekile zisekelwe esakhiweni kunokuba zisuselwe ekufihleni: ukubalwa kwabantu kwamandla (zingaki izinto zokuqala ezihlukile zokuqapha i-host ezikhona ndawonye kuphakheji eyodwa) kanye nokuhlaziywa kwesimo se-C2 (iluphu yomyalo/impendulo eqondiswa ngesevisi yokusingatha okuqukethwe okujwayelekile). Lokho kuhlola umlilo kungakhathaliseki ukuthi kuthembekile noma kungakanani. okufihliwe ukupakishwa.
Umkhuba we-SaaS-as-C2. Ukusebenzisa kabi isevisi yokubamba esemthethweni njengento engapheli akuyona into entsha, kodwa kuyaqhubeka nokusebenza ngoba izindleko zokuzivikela zokuvimba isevisi ziphezulu futhi izindleko zokuhlasela zokushintsha izinsizakalo ziseduze no-zero. Lindela okwengeziwe. Ukuzivikela kwenethiwekhi okugxile ezizindeni ezithile ezimbi kuyaguga ngokushesha; imithetho yokuziphatha ("le nqubo ifunda ibhodi lokunamathisela kanye nekhamera yewebhu bese ikhuluma ne-API yokubamba amanothi") ayikwenzi lokho.
Umdwebo wokuthola izinto eziqinile. Umthetho oqinile awusho igama i-npoint[.]io nhlobo. Ihlanganisa ukubonwa okubili okuvamile kodwa okungajwayelekile ngokuhlanganyela kunjiniyela ojwayelekile noma kumphathi we-CI:
xwayisa lapho inqubo eyodwa, ngaphakathi kweseshini eyodwa, kokubili:
(A) ifinyelela idivayisi yokufaka ye-host-surveillance primitive — (ikhibhodi/igundane), ikhamera, imakrofoni, ukuthwebula isikrini, i-clipboard read-loop, noma isitolo seziqinisekiso zesiphequluli ("Login Idatha" / "Isifundazwe Sendawo" / i-DPAPI); FUTHI
(B) yenza izicelo eziphumayo kusevisi yomphakathi yokusingatha okuqukethwe / ukunamathisela / i-JSON-bin / i-chat-webhook bese iphakamisa ukuze ibuyekezwe, kungakhathaliseki ukuthi iyiphi isevisi ethile ku-(B).
Akekho noyedwa ongasolisayo: izithombe-skrini eziningi zamathuluzi asemthethweni, kanye ne-JSON eningi ethunyelwa ku-API yokubamba. Ukuhlangana ngaphakathi kwenqubo eyodwa yesikhashana kuyisignali, futhi iyasinda kunoma yikuphi ukujikeleza kokudlulisela.
Izinyathelo ezisebenzayo zamaqembu:
- Phatha ukufakwa kwamaphakheji omphakathi kubathuthukisi kanye nababungazi be-CI njengomngcele wokusebenza, hhayi ukulula - i-RAT ku-ejenti yokwakha iyi-RAT enezimfihlo zakho.
- Khetha izibuko zangaphakathi ezifakwe ohlwini oluvunyelwe; iphakheji eqanjwe ngokoqobo ngesilawuli kude futhi echaza i-keylogger akufanele ixazululwe ku-index yenkampani.
- Isexwayiso ku- Inhlanganisela — idivayisi yokufaka noma ukuthwebula isikrini kanye nethrafikhi ephumayo eya kusevisi yokuqukethwe/ukunamathisela/i-JSON-bin — kunokuba kunoma iyiphi i-primitive eyodwa, enokusetshenziswa okungenangozi kokuhlukaniswa.
- Ungathembeli kumaphuzu “aphephile” azenzakalelayo njengesinqumo sokugcina samaphakheji anekhono elibanzi lokufinyelela kumphathi; waqondise ekubuyekezweni komuntu.
Umndeni wephakheji uhlukaniswe nge-enonya futhi uthunyelwe ekususweni kwerejistri. Ngenxa yokuthi i-C2 esekelwe ku-relay ayishiyi lutho oluphethwe yi-opharetha emgodini ongaphansi komhlaba, inani lokuzivikela elihlala isikhathi eside lisezigxivizweni zokuziphatha ezingenhla, hhayi kunoma yikuphi ukufakwa okukodwa kohlu lokuvimba.
