{"id":892,"date":"2022-11-05T01:20:26","date_gmt":"2022-11-04T17:20:26","guid":{"rendered":"http:\/\/www.aqwu.net\/wp\/?p=892"},"modified":"2022-11-05T01:20:26","modified_gmt":"2022-11-04T17:20:26","slug":"2022-%e5%b9%b4%e7%ac%ac%e4%b8%89%e5%ad%a3%e5%ba%a6-apt-%e8%b6%8b%e5%8a%bf%e6%8a%a5%e5%91%8a","status":"publish","type":"post","link":"https:\/\/www.aqwu.net\/wp\/?p=892","title":{"rendered":"2022 \u5e74\u7b2c\u4e09\u5b63\u5ea6 APT \u8d8b\u52bf\u62a5\u544a"},"content":{"rendered":"\n

\u4e94\u5e74\u591a\u6765\uff0c\u5361\u5df4\u65af\u57fa\u7684\u5168\u7403\u7814\u7a76\u4e0e\u5206\u6790\u56e2\u961f \uff08GReAT\uff09 \u4e00\u76f4\u5728\u53d1\u5e03\u9ad8\u7ea7\u6301\u7eed\u6027\u5a01\u80c1 \uff08APT\uff09 \u6d3b\u52a8\u7684\u5b63\u5ea6\u6458\u8981\u3002\u8fd9\u4e9b\u6458\u8981\u57fa\u4e8e\u6211\u4eec\u7684\u5a01\u80c1\u60c5\u62a5\u7814\u7a76;\u5b83\u4eec\u63d0\u4f9b\u4e86\u6211\u4eec\u5728\u79c1\u4ebaAPT\u62a5\u544a\u4e2d\u66f4\u8be6\u7ec6\u5730\u53d1\u5e03\u548c\u8ba8\u8bba\u7684\u5185\u5bb9\u7684\u4ee3\u8868\u6027\u5feb\u7167\u3002\u5b83\u4eec\u65e8\u5728\u7a81\u51fa\u6211\u4eec\u8ba4\u4e3a\u4eba\u4eec\u5e94\u8be5\u6ce8\u610f\u7684\u91cd\u5927\u4e8b\u4ef6\u548c\u53d1\u73b0\u3002<\/p>\n\n\n\n

\u8fd9\u662f\u6211\u4eec\u7684\u6700\u65b0\u4e00\u671f\uff0c\u91cd\u70b9\u5173\u6ce8\u6211\u4eec\u5728 2022 \u5e74\u7b2c\u4e09\u5b63\u5ea6\u89c2\u5bdf\u5230\u7684\u6d3b\u52a8\u3002<\/p>\n\n\n\n

\u539f\u6587\u94fe\u63a5\uff1ahttps:\/\/securelist.com\/apt-trends-report-q3-2022\/107787\/<\/a><\/p>\n\n\n\n

\u5e0c\u671b\u4e86\u89e3\u6709\u5173\u6211\u4eec\u7684\u60c5\u62a5\u62a5\u544a\u7684\u66f4\u591a\u4fe1\u606f\u6216\u8981\u6c42\u6709\u5173\u7279\u5b9a\u62a5\u544a\u7684\u66f4\u591a\u4fe1\u606f\u7684\u8bfb\u8005\uff0c\u8bf7\u8054\u7cfbintelreports@kaspersky.com<\/a>.<\/p>\n\n\n\n

<\/figure>\n\n\n\n

\u6700\u663e\u8457\u7684\u53d1\u73b0<\/h2>\n\n\n\n

7\u67087\u65e5\uff0cCISA\u53d1\u51fa\u8b66\u62a5\uff0c\u201d\u671d\u9c9c\u56fd\u5bb6\u8d44\u52a9\u7684\u7f51\u7edc\u884c\u4e3a\u8005\u5229\u7528\u6bdb\u4f0a\u5c9b\u52d2\u7d22\u8f6f\u4ef6\u653b\u51fb\u533b\u7597\u4fdd\u5065\u548c\u516c\u5171\u536b\u751f\u90e8\u95e8<\/a>\u201c\uff0c\u57fa\u4e8e\u697c\u68af\u95f4\u5173\u4e8e\u6bdb\u4f0a\u5c9b\u52d2\u7d22\u8f6f\u4ef6\u7684\u62a5\u544a\u3002\u6211\u4eec\u53ef\u4ee5\u5728 2022 \u5e74\u786e\u8ba4\u6bdb\u4f0a\u5c9b\u52d2\u7d22\u8f6f\u4ef6\u4e8b\u4ef6\uff0c\u4f46\u6211\u4eec\u4f1a\u5c06\u5176\u201c\u9996\u6b21\u51fa\u73b0\u201d\u65e5\u671f\u4ece\u62a5\u544a\u7684 2021 \u5e74 5 \u6708\u6269\u5c55\u5230 2021 \u5e74 4 \u6708 15 \u65e5\uff0c\u5e76\u5c06\u76ee\u6807\u7684\u5730\u7406\u4f4d\u7f6e\u6269\u5c55\u5230\u65e5\u672c\u548c\u5370\u5ea6\u3002\u7531\u4e8e\u6b64\u4e8b\u4ef6\u4e2d\u7684\u6076\u610f\u8f6f\u4ef6\u662f\u5728 2021 \u5e74 4 \u6708 15 \u65e5\u7f16\u8bd1\u7684\uff0c\u5e76\u4e14\u6240\u6709\u5df2\u77e5\u6837\u672c\u7684\u7f16\u8bd1\u65e5\u671f\u90fd\u76f8\u540c\uff0c\u56e0\u6b64\u6b64\u4e8b\u4ef6\u53ef\u80fd\u662f\u7b2c\u4e00\u4e2a\u6d89\u53ca Maui \u52d2\u7d22\u8f6f\u4ef6\u7684\u4e8b\u4ef6\u3002CISA \u62a5\u544a\u4e2d\u6ca1\u6709\u63d0\u4f9b\u5c06\u52d2\u7d22\u8f6f\u4ef6\u5f52\u56e0\u4e8e\u671d\u9c9c\u884c\u4e3a\u8005\u7684\u6709\u7528\u4fe1\u606f\uff0c\u4f46\u6211\u4eec\u53d1\u73b0\uff0c\u5728\u5c06 Maui \u90e8\u7f72\u5230\u7cfb\u7edf\u524d\u5927\u7ea6 10 \u5c0f\u65f6\uff0c\u8be5\u7ec4\u7ec7\u8fd8\u5728\u7cfb\u7edf\u4e2d\u90e8\u7f72\u4e86 DTrack \u7684\u53d8\u4f53\u3002\u8fd9\u4e2a\u548c\u5176\u4ed6\u6570\u636e\u70b9\u5e94\u8be5\u6709\u52a9\u4e8e\u4ee5\u4f4e\u5230\u4e2d\u7b49\u7684\u7f6e\u4fe1\u5ea6\u5de9\u56fa\u5bf9\u97e9\u8bedAPT Andariel\uff08\u53c8\u540dSilent Chollima\u548cStonefly\uff09\u7684\u5f52\u56e0\u3002\u60a8\u53ef\u4ee5\u9605\u8bfb\u6211\u4eec\u5173\u4e8e Andariel \u4f7f\u7528 DTrack \u548c Maui \u7684\u516c\u5f00\u62a5\u544a\u8fd9\u91cc<\/a>.<\/p>\n\n\n\n

DTrack\u662fLazarus\u7ec4\u5b50\u96c6\u4f7f\u7528\u7684\u540e\u95e8\u3002\u540e\u95e8\u5df2\u88ab\u7528\u4e8e\u5404\u79cd\u653b\u51fb\uff0c\u5305\u62ec\u52d2\u7d22\u8f6f\u4ef6\u653b\u51fb\u548c\u95f4\u8c0d\u6d3b\u52a8\u3002\u6211\u4eec\u8fc7\u53bb\u548c\u6700\u8fd1\u4e5f\u591a\u6b21\u62a5\u544a\u8fc7\u5b83\uff0c\u56e0\u4e3a\u5b83\u5728\u62c9\u6492\u8def\u7684\u6d3b\u52a8\u4e2d\u8d77\u7740\u91cd\u8981\u4f5c\u7528\u3002\u5728 3 \u6708\u4efd\uff0c\u6211\u4eec\u68c0\u6d4b\u5230\u65b0\u7684 DTrack \u6837\u672c\u4ee5\u4e0d\u540c\u7684\u65b9\u5f0f\u6253\u5305\uff0c\u5e76\u4e14\u4ee3\u7801\u53d8\u5316\u76f8\u5bf9\u8f83\u5c11\u3002\u5728\u5c06\u4e8e 11 \u6708\u53d1\u5e03\u7684\u62a5\u544a\u4e2d\uff0c\u6211\u4eec\u5c06\u8be6\u7ec6\u5206\u6790\u8fd9\u7ec4\u6700\u65b0\u7684\u6837\u672c\uff0c\u63cf\u8ff0\u53d8\u5316\u548c\u5305\u88c5\u673a\u5236\u3002\u6211\u4eec\u8fd8\u5c06\u91cd\u70b9\u4ecb\u7ecd\u65b0\u7684\u53d7\u5bb3\u8005\u5b66\uff0c\u5305\u62ec\u6b27\u6d32\u5404\u5730\u7684\u5404\u79cd\u76ee\u6807\u3002<\/p>\n\n\n\n

\u4fc4\u8bed\u6d3b\u52a8<\/h2>\n\n\n\n

\u6211\u4eec\u5728 2021 \u5e74\u9996\u6b21\u5c06\u5a01\u80c1\u884c\u4e3a\u8005 HotCousin \u8bb0\u5f55\u4e3a\u5229\u7528 EnvyScout \u690d\u5165\u7269\u7684\u6076\u610f\u6d3b\u52a8\u96c6\u7fa4\uff0c\u5fae\u8f6f\u516c\u5f00\u5c06\u5176\u5f52\u56e0\u4e8e\u9ed1\u6697\u5149\u73af \uff08NOBELIUM\uff09\u3002\u6211\u4eec\u6700\u8fd1\u7684\u8c03\u67e5\u663e\u793a\uff0c\u4eca\u5e74\u81f3\u5c11\u4ece2\u6708\u4efd\u5f00\u59cb\uff0cHotCousin\u8bd5\u56fe\u7834\u574f\u6b27\u6d32\uff0c\u4e9a\u6d32\uff0c\u975e\u6d32\u548c\u5357\u7f8e\u6d32\u7684\u5916\u4ea4\u90e8\u3002\u8be5\u5c0f\u7ec4\u7684TTP\u4e0e\u6211\u4eec\u4e4b\u524d\u63cf\u8ff0\u7684\u4e00\u81f4\u3002\u53d7\u5bb3\u8005\u6210\u4e3a\u9c7c\u53c9\u5f0f\u7f51\u7edc\u9493\u9c7c\u7535\u5b50\u90ae\u4ef6\u7684\u76ee\u6807\uff0c\u8bf1\u4f7f\u4ed6\u4eec\u6302\u8f7d\u6076\u610f ISO \u6587\u4ef6\u5e76\u53cc\u51fb LNK\uff0c\u4ece\u800c\u542f\u52a8\u611f\u67d3\u94fe\u3002\u7b2c\u4e00\u6b21\u611f\u67d3\u901a\u5e38\u65e8\u5728\u5b89\u88c5\u4e0b\u8f7d\u5668\uff0c\u8be5\u4e0b\u8f7d\u7a0b\u5e8f\u8bd5\u56fe\u4ece\u5408\u6cd5\u7684Web\u670d\u52a1\u4e0b\u8f7d\u5176\u4ed6\u6076\u610f\u690d\u5165\u7269\u3002\u6700\u7ec8\u7684\u6709\u6548\u8f7d\u8377\u901a\u5e38\u662f\u5e02\u552e\u7684\u690d\u5165\u7269\uff0c\u4f8b\u5982Cobalt Strike\u3002\u5176\u4ed6\u4f9b\u5e94\u5546\u4e5f\u89c2\u5bdf\u5230\u5176\u4e2d\u4e00\u4e9b\u6d3b\u52a8\uff0c\u7279\u522b\u662f\u5bf9\u4eceDropbox\uff0cGoogle Drive\u548cTrello\u7b49\u5916\u90e8\u670d\u52a1\u83b7\u5f97\u989d\u5916\u690d\u5165\u7269\u7684\u4e0b\u8f7d\u5668\u7684\u63cf\u8ff0\u3002\u5728\u5927\u591a\u6570\u60c5\u51b5\u4e0b\uff0c\u76ee\u6807\u4f3c\u4e4e\u662f\u6b27\u6d32\u7684\u5916\u4ea4\u548c\u653f\u5e9c\u7ec4\u7ec7\u3002\u6211\u4eec\u4ecd\u7136\u65e0\u6cd5\u786e\u5b9aHotCousin\u4e0eDark Halo\/NOBELIUM\u6216The Dukes\/APT29\u4e4b\u95f4\u7684\u4efb\u4f55\u91cd\u8981\u8054\u7cfb;\u4f46\u76ee\u6807\u3001\u6280\u672f\u548c\u4ea4\u6613\u6280\u5de7\u90fd\u4e0e\u516c\u5f00\u63cf\u8ff0\u4e3a APT29 \u7684\u6d3b\u52a8\u76f8\u543b\u5408\u3002<\/p>\n\n\n\n

\u4e2d\u6587\u6d3b\u52a8<\/h2>\n\n\n\n

2021 \u5e74\u521d\uff0c\u5361\u5df4\u65af\u57fa\u53d1\u5e03\u4e86\u4e00\u4efd\u5173\u4e8e A41APT \u6d3b\u52a8\u7684\u79c1\u4eba\u62a5\u544a\u3002\u8be5\u62a5\u544a\u5305\u62ec\u8be5\u6d3b\u52a8\u4e2d\u4f7f\u7528\u7684\u6076\u610f\u8f6f\u4ef6\u7684\u6280\u672f\u7ec6\u8282\uff0c\u4f8b\u5982Ecipekac\uff0cSodaMaster\uff0cP8RAT\uff0cFYAnti\u548cQuasarRAT\u3002\u6211\u4eec\u4e0e\u7814\u7a76\u5408\u4f5c\u4f19\u4f34\u4e00\u8d77\u89c2\u5bdf\u4e86 A41APT \u6d3b\u52a8\u5728\u6574\u4e2a 2021 \u5e74\u7684\u6d3b\u52a8\uff0c\u5e76\u5728 2022 \u5e74\u65e5\u672c\u5b89\u5168\u5206\u6790\u5e08\u4f1a\u8bae\u4e0a\u4ecb\u7ecd\u4e86\u8fd9\u9879\u7814\u7a76\uff08\u201c\u6211\u4eec\u80fd\u505a\u4e9b\u4ec0\u4e48\u6765\u5e94\u5bf9\u6df7\u4e71\u7684 A41APT \u6d3b\u52a8\u201d\uff09\u30022021 \u5e74 12 \u6708\uff0c\u8d8b\u52bf\u79d1\u6280\u8fd8\u53d1\u8868\u4e86\u4e00\u7bc7\u5173\u4e8e\u4ed6\u4eec\u5bf9 A41APT \u6d3b\u52a8\u80cc\u540e\u7684\u5a01\u80c1\u884c\u4e3a\u8005\u6700\u65b0\u6d3b\u52a8\u7684\u8c03\u67e5\u7684\u535a\u5ba2\u6587\u7ae0\uff0c\u4ed6\u4eec\u5c06\u5176\u547d\u540d\u4e3a Earth Tengshe\u3002\u8d8b\u52bf\u79d1\u6280\u8ba4\u4e3a\uff0c\u6b64\u6d3b\u52a8\u4e0e APT10 \u5a01\u80c1\u53c2\u4e0e\u8005\u6709\u5bc6\u5207\u8054\u7cfb\u3002\u4ed6\u4eec\u7684\u535a\u5ba2\u6587\u7ae0\u8fd8\u5f15\u5165\u4e86\u65b0\u7684\u6076\u610f\u8f6f\u4ef6\uff0c\u79f0\u4e3aJackpot – \u4ee5\u524d\u672a\u77e5\u7684\u9488\u5bf9IIS\u670d\u52a1\u5668\u7684\u65e0\u6587\u4ef6\u6076\u610f\u8f6f\u4ef6\u3002\u6211\u4eec\u7684\u7814\u7a76\u7ed3\u679c\u4e0e\u8d8b\u52bf\u79d1\u6280\u5728\u4e00\u4e9b\u65b0\u7684TTP\u4e0a\u91cd\u53e0\uff0c\u4f8b\u5982SodaMaster\u548cEcipekac\u7684\u66f4\u65b0\u7248\u672c\uff0c\u4ee5\u53ca\u4e00\u4e2a\u540d\u4e3aIISBack\u7684\u65b0\u6076\u610f\u65e0\u6587\u4ef6IIS\u6a21\u5757\u3002\u4f46\u662f\uff0c\u6211\u4eec\u8fd8\u53d1\u73b0\u4e86\u4e00\u4e2a\u65b0\u7684\u6076\u610f\u690d\u5165\u7a0b\u5e8f\uff0c\u81ea 2015 \u5e74\u4ee5\u6765\uff0c\u8be5\u53c2\u4e0e\u8005\u4e00\u76f4\u4f7f\u7528\u5b83\u6765\u90e8\u7f72 SodaMaster\uff1a\u6211\u4eec\u5c06\u6b64\u6a21\u5757\u547d\u540d\u4e3a HUI \u52a0\u8f7d\u5668\u3002\u6211\u4eec\u7684\u7814\u7a76\u8fd8\u63ed\u793a\u4e86\u8be5\u5a01\u80c1\u884c\u4e3a\u8005\u591a\u5e74\u6765\u4f7f\u7528\u7684\u4e00\u4e9b\u6076\u610f\u8f6f\u4ef6\u690d\u5165\u7269\u7684\u6f14\u53d8\uff0c\u4f8b\u5982Ecipekac\u548cSodaMaster\u3002<\/p>\n\n\n\n

\u81ea 4 \u6708\u4ee5\u6765\uff0c\u6211\u4eec\u68c0\u6d4b\u5230\u8bb8\u591a KeyPlug \u6076\u610f\u8f6f\u4ef6\u6837\u672c\u90e8\u7f72\u5728\u4e9a\u6d32\u56fd\u5bb6\u77e5\u540d\u53d7\u5bb3\u8005\u7684\u7cfb\u7edf\u4e2d\uff0c\u5176\u4e2d\u4e00\u4e9b\u75d5\u8ff9\u53ef\u4ee5\u8ffd\u6eaf\u5230 2021 \u5e74\u5e95\u3002KeyPlug\u662f\u4e00\u4e2a\u6a21\u5757\u5316\u540e\u95e8\uff0c\u80fd\u591f\u901a\u8fc7\u5176XOR\u52a0\u5bc6\u5d4c\u5165\u5f0f\u914d\u7f6e\u5757\u4e2d\u8bbe\u7f6e\u7684\u591a\u4e2a\u7f51\u7edc\u901a\u4fe1\u534f\u8bae\u4e0e\u5176\u670d\u52a1\u5668\u8fdb\u884c\u901a\u4fe1\u3002\u670d\u52a1\u5668\u57fa\u7840\u8bbe\u65bd\u4e3b\u8981\u57fa\u4e8e Cloudflare CDN\uff0c\u6211\u4eec\u6536\u96c6\u7684\u6bcf\u4e2a\u6076\u610f\u8f6f\u4ef6\u6837\u672c\u90fd\u53ea\u5305\u542b\u4e00\u4e2a\u57df\u548c\u591a\u4e2a IP \u5730\u5740\uff0c\u8fd9\u4e9b\u5730\u5740\u90fd\u6307\u5411 CDN \u7f51\u7edc\u4e0a\u7684\u540c\u4e00\u57df\u3002\u8fde\u63a5\u5230\u670d\u52a1\u5668\u540e\uff0c\u6076\u610f\u8f6f\u4ef6\u4f1a\u4e0b\u8f7d\u66f4\u591a\u6a21\u5757\u4f5c\u4e3a\u63d2\u4ef6\u5e76\u5c06\u5176\u52a0\u8f7d\u5230\u53d7\u5bb3\u8005\u7684\u8ba1\u7b97\u673a\u4e0a\u3002\u8fd9\u4e9b\u653b\u51fb\u4e2d\u4f7f\u7528\u7684\u6076\u610f\u8f6f\u4ef6\u548c\u57fa\u7840\u8bbe\u65bd\u4e0e\u4ee5\u524d\u5df2\u77e5\u7684 APT41 \u6d3b\u52a8\u6709\u76f8\u4f3c\u4e4b\u5904\u3002\u4f46\u662f\uff0c\u8fd9\u4e9b\u653b\u51fb\u53ea\u80fd\u5f52\u56e0\u4e8e\u4e2d\u7b49\u7f6e\u4fe1\u5ea6\u7684 APT41;\u800c\u4e14\u4e5f\u6709\u53ef\u80fd\u662f\u53e6\u4e00\u4e2a\u5a01\u80c1\u884c\u4e3a\u8005\u662f\u653b\u51fb\u7684\u5e55\u540e\u9ed1\u624b\u3002<\/p>\n\n\n\n

\u6211\u4eec\u6700\u8fd1\u5206\u6790\u4e86DiceyF\u4f7f\u7528GamePlayerFramework\u5bf9\u5728\u7ebf\u8d4c\u535a\u5e73\u53f0\u5f00\u53d1\u5de5\u4f5c\u5ba4\u548cIT\u62db\u8058\u7ec4\u7ec7\u7684\u76ee\u6807\u3002\u8fd9\u4e0e\u8f83\u65e7\u7684 PuppetLoader \u4ee3\u7801\u6709\u5173\uff0c\u4f46\u5df2\u7528 C# \u91cd\u65b0\u8bbe\u8ba1\u548c\u91cd\u5199\u3002DiceyF \u7a83\u53d6\u4ee3\u7801\u7b7e\u540d\u8bc1\u4e66\u4ee5\u5bf9\u6076\u610f\u8f6f\u4ef6\u8fdb\u884c\u6570\u5b57\u7b7e\u540d\uff0c\u5728\u5176\u6076\u610f\u8f6f\u4ef6\u4e2d\u5d4c\u5165\u5de5\u4ef6\u548c\u5b57\u7b26\u4e32\uff0c\u6a21\u4eff\u4f7f\u7528\u8fd9\u4e9b\u8bc1\u4e66\u7b7e\u540d\u7684\u5408\u6cd5\u8f6f\u4ef6\uff0c\u7136\u540e\u901a\u8fc7\u8f6f\u4ef6\u5206\u53d1\u670d\u52a1\u5668\u5206\u53d1\u7b7e\u540d\u7684\u6076\u610f\u8f6f\u4ef6\u3002\u5927\u591a\u6570\u76ee\u6807\u662f\u9999\u6e2f\u548c\u83f2\u5f8b\u5bbe\uff0c\u4f46\u4e5f\u6709\u4e00\u4e9b\u5728\u4e2d\u56fd\u548c\u8d8a\u5357\u3002<\/p>\n\n\n\n

\u4e09\u6708\u4efd\uff0c\u6211\u4eec\u89c2\u5bdf\u5230\u5728\u67d0\u4e9b\u653b\u51fb\u4e2d\u4f7f\u7528Microsoft Word\u6587\u4ef6\u4f5c\u4e3a\u611f\u67d3\u5a92\u4ecb\u30026\u6708\uff0c\u6211\u4eec\u53d1\u73b0\u4e86\u4e00\u4e2a\u4f7f\u7528\u5305\u542b\u65e5\u8bed\u5185\u5bb9\u7684\u8bf1\u9975\u6587\u4ef6\u7684SFX\u6587\u4ef6\u3002\u6211\u4eec\u8fd8\u53d1\u73b0\u4e86\u4e00\u4e2a\u65b0\u7684\u4e0b\u8f7d\u5668shellcode\uff0c\u6211\u4eec\u79f0\u4e4b\u4e3aDOWNIISSA\uff0c\u7528\u4e8e\u90e8\u7f72\u6d1b\u5fb7\u4fe1\u606f\u540e\u95e8<\/a>.\u867d\u7136\u76ee\u6807\u662f\u65e5\u672c\u7684\uff0c\u5e76\u4e14\u4e0eAPT10\u901a\u5e38\u7684\u53d7\u5bb3\u8005\u4e00\u81f4\uff0c\u4f46\u6211\u4eec\u4e5f\u53d1\u73b0\u4e86\u5728\u4fc4\u7f57\u65af\u548c\u9a6c\u6765\u897f\u4e9a\u53ef\u80fd\u91c7\u53d6\u884c\u52a8\u7684\u8ff9\u8c61\u3002\u6b64\u5916\uff0c\u6211\u4eec\u5206\u522b\u57283\u6708\u30014\u6708\u548c5\u6708\u7814\u7a76\u4e86\u65b0\u7248\u672c\u7684LODEINFO shellcode\uff0c\u5373v0.5.9\u3001v0.6.2\u3001v0.6.3\u548cv0.6.5\u3002\u8fd9\u4e9b\u53d1\u73b0\u8868\u660e\uff0cAPT10\u4f3c\u4e4e\u5df2\u7ecf\u6709\u4e00\u6bb5\u65f6\u95f4\u4e0d\u6d3b\u8dc3\u4e86\uff0c\u73b0\u5728\u5df2\u7ecf\u901a\u8fc7\u65b0\u7248\u672c\u7684LODEINFO\u6062\u590d\u4e86\u6d3b\u52a8\u3002<\/p>\n\n\n\n

4\u6708\uff0c\u6211\u4eec\u7684\u4ea7\u54c1\u5728\u4e9a\u592a\u5730\u533a\u7684\u4e00\u4e2a\u5916\u4ea4\u7ec4\u7ec7\u4e2d\u68c0\u6d4b\u5230CobaltStrike\u88c5\u8f7d\u673a\uff0c\u8be5\u88c5\u8f7d\u673a\u8fc7\u53bb\u66fe\u88ab\u51e0\u4e2aAPT\u53c2\u4e0e\u8005\u7784\u51c6\u3002\u52a0\u8f7d\u7a0b\u5e8f\u5f15\u8d77\u4e86\u6211\u4eec\u7684\u6ce8\u610f\uff0c\u56e0\u4e3a\u5176\u4e2d\u4e00\u4e2a\u52a0\u8f7d\u7a0b\u5e8f\u663e\u793a\u4e86\u6765\u81ea\u8f6f\u4ef6\u5f00\u53d1\u516c\u53f8\u7684\u5408\u6cd5\u6570\u5b57\u7b7e\u540d\uff0c\u6211\u4eec\u63d0\u9192\u4e86\u8be5\u516c\u53f8\u8be5\u4e8b\u4ef6\u3002\u6df1\u5165\u6316\u6398\uff0c\u6211\u4eec\u53d1\u73b0\u4e86\u51e0\u79cd\u5229\u7528HTTP\u6216\u539f\u59cbTCP\u901a\u4fe1\u534f\u8bae\u7684\u53d8\u4f53\uff0c\u5e76\u53d1\u73b0\u4e86\u4e0e\u4e4b\u76f8\u5173\u7684\u5f00\u53d1\u540e\u6d3b\u52a8\u7684\u75d5\u8ff9\uff0c\u4ee5\u53ca\u540c\u65f6\u4f7f\u7528Radmin\u548cGh0stRAT\u3002\u81ea\u7136\u8bed\u8a00\u4f2a\u5f71\u548c\u5f31TTP\u8868\u660e\uff0c\u8fd9\u6b21\u653b\u51fb\u53ef\u80fd\u5f52\u56e0\u4e8e\u8bb2\u4e2d\u6587\u7684\u653b\u51fb\u8005\uff0c\u4f46\u6211\u4eec\u65e0\u6cd5\u5c06\u6b64\u6d3b\u52a8\u4e0e\u4efb\u4f55\u73b0\u6709\u7fa4\u4f53\u8054\u7cfb\u8d77\u6765\u3002\u4e8b\u5b9e\u4e0a\uff0c\u9664\u4e86\u8fd9\u6b21\u4e8b\u4ef6\u4e4b\u5916\uff0c\u6211\u4eec\u627e\u4e0d\u5230\u62a5\u544a\u4e2d\u4ecb\u7ecd\u7684\u6ef4\u7ba1\u7684\u4efb\u4f55\u5176\u4ed6\u7528\u9014\u3002<\/p>\n\n\n\n

\u4e2d\u4e1c<\/h2>\n\n\n\n

\u6211\u4eec\u6700\u8fd1\u53d1\u73b0\u5e76\u5206\u6790\u4e86FramedGolf\uff0c\u8fd9\u662f\u4e00\u4e2a\u4ee5\u524d\u672a\u8bb0\u5f55\u7684IIS\u540e\u95e8\uff0c\u53ea\u80fd\u5728\u4f0a\u6717\u627e\u5230\uff0c\u65e8\u5728\u5728\u76ee\u6807\u7ec4\u7ec7\u4e2d\u5efa\u7acb\u6301\u4e45\u7684\u7acb\u8db3\u70b9\u3002\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0c\u5728\u6210\u529f\u5229\u7528Exchange\u670d\u52a1\u5668\u4e0a\u7684ProxyLogon\u7c7b\u578b\u6f0f\u6d1e\u540e\uff0c\u5df2\u7ecf\u90e8\u7f72\u4e86\u540e\u95e8\u3002\u8be5\u6076\u610f\u8f6f\u4ef6\u5df2\u88ab\u7528\u6765\u5371\u5bb3\u81f3\u5c11\u5341\u51e0\u4e2a\u7ec4\u7ec7\uff0c\u6700\u8fdf\u4ece 2021 \u5e74 4 \u6708\u5f00\u59cb\uff0c\u5927\u591a\u6570\u7ec4\u7ec7\u4ecd\u5728 2022 \u5e74 6 \u6708\u4e0b\u65ec\u53d7\u5230\u653b\u51fb\u3002<\/p>\n\n\n\n

SoleDragon\u662fSilentBreak\u5a01\u80c1\u7ec4\u7ec7\u4f7f\u7528\u7684\u590d\u6742\u6076\u610f\u8f6f\u4ef6\u3002\u5361\u5df4\u65af\u57fa\u4e8e 2018 \u5e74\u9996\u6b21\u53d1\u73b0\u6b64\u6076\u610f\u8f6f\u4ef6\u4ee5\u53ca CVE-2018-8453 \u6f0f\u6d1e\u30022019\u5e74\uff0cSoleDragon\u4e5f\u901a\u8fc7Skype\u90e8\u7f72\u3002\u5728\u90a3\u4e4b\u540e\uff0c\u6ca1\u6709\u5173\u4e8e SoleDragon \u7684\u4fe1\u606f\uff0c\u76f4\u5230\u6211\u4eec\u5728 2021 \u5e74\u5e95\u68c0\u6d4b\u5230\u4e24\u4e2a\u65b0\u7684\u690d\u5165\u7269\u3002\u8fd9\u4e9b\u9488\u5bf9\u4e2d\u4e1c\u7ec4\u7ec7\u7684\u690d\u5165\u7269\u4e0e\u8f83\u65e7\u7684SoleDragon\u6837\u672c\u5177\u6709\u4ee3\u7801\u76f8\u4f3c\u6027\u3002\u65b0\u53d1\u73b0\u7684\u690d\u5165\u7269\u4e4b\u4e00\u662fC++\u540e\u95e8 SoleExecutor\uff0c\u5b83\u7b49\u5f85\u6fc0\u6d3b\u6d88\u606f\uff0c\u7136\u540e\u63a5\u6536 DLL \u5e76\u542f\u52a8\u5b83;\u53e6\u4e00\u4e2a\u690d\u5165\u7269\u662f\u6211\u4eec\u79f0\u4e4b\u4e3aPowerpol\u7684\u952e\u76d8\u8bb0\u5f55\u5668\u3002<\/p>\n\n\n\n

\u516d\u6708\uff0c\u6211\u4eec\u53d1\u73b0\u4e86\u4e00\u4e2a\u4ee5\u524d\u4e0d\u4e3a\u4eba\u77e5\u7684Android\u95f4\u8c0d\u8f6f\u4ef6\u5e94\u7528\u7a0b\u5e8f\uff0c\u8be5\u5e94\u7528\u7a0b\u5e8f\u9488\u5bf9\u8bb2\u6ce2\u65af\u8bed\u7684\u4eba\u3002SandStrike\u7684\u5206\u53d1\u662f\u4e3a\u4e86\u83b7\u53d6\u5728\u4f0a\u6717\u88ab\u7981\u6b62\u7684\u6709\u5173\u5df4\u54c8\u4f0a\u5b97\u6559\u7684\u8d44\u6e90\u3002\u5b83\u4e3a\u53d7\u5bb3\u8005\u63d0\u4f9b\u4e86\u53ef\u7528\u4e8e\u6d4f\u89c8\u8fd9\u4e9b\u8d44\u6e90\u7684 VPN \u8fde\u63a5\u3002\u95f4\u8c0d\u8f6f\u4ef6\u672c\u8eab\u4ece\u53d7\u5bb3\u8005\u7684\u8bbe\u5907\u4e2d\u6536\u96c6\u5404\u79cd\u6570\u636e\uff0c\u4f8b\u5982\u901a\u8bdd\u8bb0\u5f55\u6216\u8054\u7cfb\u4eba\u5217\u8868\u3002\u5728\u6267\u884c\u8fc7\u7a0b\u4e2d\uff0c\u5b83\u8fde\u63a5\u5230 C2 \u670d\u52a1\u5668\u4ee5\u8bf7\u6c42\u547d\u4ee4\uff1a\u8fd9\u4e9b\u547d\u4ee4\u5141\u8bb8\u653b\u51fb\u8005\u5bf9\u8bbe\u5907\u6587\u4ef6\u7cfb\u7edf\u6267\u884c\u64cd\u4f5c\u3002<\/p>\n\n\n\n

DeftTorero\uff08\u53c8\u540d\u9ece\u5df4\u5ae9\u96ea\u677e\uff0c\u6325\u53d1\u96ea\u677e\uff09<\/a>\u662f\u4e00\u4e2a\u53ef\u80fd\u6765\u81ea\u4e2d\u4e1c\u7684 APT \u6f14\u5458\uff0c\u4f17\u6240\u5468\u77e5\uff0c\u4ed6\u4e13\u6ce8\u4e8e\u540c\u4e00\u5730\u533a\u7684\u53d7\u5bb3\u8005\u3002\u867d\u7136\u81ea 2012 \u5e74\u4ee5\u6765\u4e00\u76f4\u89c2\u5bdf\u5230\u5176\u6d3b\u52a8\uff0c\u4f46\u5b83\u7684\u5b58\u5728\u76f4\u5230 2015 \u5e74\u624d\u88ab\u62ab\u9732\uff08\u5361\u5df4\u65af\u57fa\u662f\u6700\u65e9\u62a5\u544a\u5b83\u7684\u4eba\u4e4b\u4e00\uff09\uff0c\u76f4\u5230 2021 \u5e74 1 \u6708\u624d\u8bb0\u5f55\u5230\u4efb\u4f55\u516c\u5f00\u6d3b\u52a8\u3002\u8fc4\u4eca\u4e3a\u6b62\u53ef\u7528\u7684\u516c\u5f00\u62a5\u544a\u516c\u5f00\u5e76\u8ba8\u8bba\u4e86\u6700\u7ec8\u7684\u6709\u6548\u8f7d\u8377 – \u7206\u70b8\u6027RAT-\u4ee5\u53ca\u521d\u59cb\u7acb\u8db3\u70b9\u4e2d\u4f7f\u7528\u7684\u7f51\u7edc\u70ae\u5f39\uff0c\u51e0\u4e4e\u6ca1\u6709TTP\u3002\u6211\u4eec\u7684\u62a5\u544a\u66f4\u4fa7\u91cd\u4e8e\u5a01\u80c1\u53c2\u4e0e\u8005\u5728 2019 \u5e74\u5e95\u81f3 2021 \u5e74\u5e74\u4e2d\u5165\u4fb5\u4e2d\u4f7f\u7528\u7684 TTP\u3002\u6839\u636e\u6211\u4eec\u7684\u9065\u6d4b\u6570\u636e\uff0c2021 \u5e74 1 \u6708\u7684\u6307\u6807\u4e0d\u4e00\u5b9a\u4ee3\u8868\u65b0\u7684\u5165\u4fb5\u6216\u65b0\u7684\u6076\u610f\u8f6f\u4ef6\u6837\u672c\uff0c\u56e0\u4e3a\u68c0\u6d4b\u76f8\u5bf9\u8f83\u65e7\uff082018 \u5e74\u81f3 2020 \u5e74\u4e4b\u95f4\uff09\uff0c\u5e76\u4e14 Explosive RAT \u6837\u672c\u4e0d\u5305\u542b\u91cd\u5927\u4fee\u6539\u3002\u5206\u6790\u4ee5\u524d\u7684\u5165\u4fb5\uff0c\u6211\u4eec\u6000\u7591\u65b0\u68c0\u6d4b\u7684\u5dee\u8ddd\u662f\u7531\u4e8e\u5a01\u80c1\u53c2\u4e0e\u8005\u66fe\u7ecf\uff08\u5e76\u4e14\u53ef\u80fd\u4ecd\u7136\uff09\u4f7f\u7528\u8bb8\u591a\u5a01\u80c1\u53c2\u4e0e\u8005\u4f7f\u7528\u7684\u65e0\u6587\u4ef6\u6280\u672f\u548c\u516c\u5171\u653b\u51fb\u5de5\u5177\uff0c\u4f8b\u5982Metasploit\uff0cMimikatz\uff0cCrackmapexec\uff0c\u5df2\u77e5\u7684Web shell\u548c\u5176\u4ed6\u5df2\u77e5\u5de5\u5177\u3002\u8fd9\u4f7f\u8fd0\u8425\u5546\u5728\u59a5\u534f\u76ee\u6807\u548c\u53d7\u5bb3\u8005\u65f6\u5177\u6709\u4e00\u5b9a\u7a0b\u5ea6\u7684\u533f\u540d\u6027\u3002<\/p>\n\n\n\n

\u4e1c\u5357\u4e9a\u548c\u671d\u9c9c\u534a\u5c9b<\/h2>\n\n\n\n

\u6211\u4eec\u89c2\u5bdf\u5230\u6700\u8fd1DeathNote\u96c6\u7fa4\u7684\u4f7f\u7528\u6709\u6240\u589e\u52a0\u3002\u4e09\u6708\u4efd\uff0c\u6211\u4eec\u770b\u5230\u62c9\u6492\u8def\u7528\u5b83\u6765\u5bf9\u4ed8\u97e9\u56fd\u7684\u53d7\u5bb3\u8005\u3002\u8be5\u884c\u4e3a\u8005\u53ef\u80fd\u4f7f\u7528\u4e86\u6218\u7565\u6027\u7684Web\u5165\u4fb5\uff0c\u91c7\u7528\u4e86\u7c7b\u4f3c\u4e8e\u6211\u4eec\u4e4b\u524d\u62a5\u544a\u7684\u611f\u67d3\u94fe\uff0c\u6ee5\u7528\u7aef\u70b9\u5b89\u5168\u7a0b\u5e8f\u3002\u4f46\u662f\uff0c\u6211\u4eec\u53d1\u73b0\u6076\u610f\u8f6f\u4ef6\u548c\u611f\u67d3\u65b9\u6848\u5df2\u66f4\u65b0\u3002\u653b\u51fb\u8005\u4f7f\u7528\u4e86\u591a\u9636\u6bb5\u611f\u67d3\uff0c\u4ece\u7403\u62cd\u4e0b\u8f7d\u5668\u5f00\u59cb\u3002\u901a\u8fc7Racket Downloader\uff0c\u8fd0\u8425\u5546\u90e8\u7f72\u4e86\u989d\u5916\u7684\u6076\u610f\u8f6f\u4ef6\uff0c\u7528\u4e8e\u8fdb\u4e00\u6b65\u7684\u5229\u7528\u540e\u6d3b\u52a8\u3002\u5728\u6b64\u9636\u6bb5\uff0c\u53c2\u4e0e\u8005\u4f7f\u7528\u4e86\u6211\u4eec\u4ee5\u524d\u4ece\u672a\u89c1\u8fc7\u7684\u6076\u610f\u8f6f\u4ef6\uff0c\u4ece C2 \u670d\u52a1\u5668\u6267\u884c\u547d\u4ee4\u7684\u529f\u80fd\u5f88\u5c11\u3002\u4f7f\u7528\u8fd9\u79cd\u690d\u5165\u7684\u540e\u95e8\uff0c\u64cd\u4f5c\u5458\u8fdb\u884c\u4e86\u8bb8\u591a\u52a8\u624b\u952e\u76d8\u6d3b\u52a8\u3002\u4ed6\u4eec\u5728\u8fd9\u4e2a\u53d7\u5bb3\u8005\u7684\u73af\u5883\u4e2d\u6f5c\u4f0f\u4e86\u4e00\u4e2a\u6708\uff0c\u5e76\u6267\u884c\u4e86\u5404\u79cd\u547d\u4ee4\u6765\u6536\u96c6\u57fa\u672c\u7684\u7cfb\u7edf\u4fe1\u606f\u3002\u6b64\u5916\uff0c\u6211\u4eec\u89c2\u5bdf\u5230\u4ed6\u4eec\u5982\u4f55\u5c1d\u8bd5\u5bfb\u627e\u5177\u6709\u9ad8\u6743\u9650\u7684\u6709\u4ef7\u503c\u7684\u4e3b\u673a\uff0c\u4f8b\u5982\u6587\u4ef6\u670d\u52a1\u5668\u6216Active Directory\u670d\u52a1\u5668\u3002Lazarus Group\u63d0\u4f9b\u4e86\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\uff0c\u4f8b\u5982\u952e\u76d8\u8bb0\u5f55\u5668\u548c\u5bc6\u7801\u8f6c\u50a8\u5de5\u5177\u6765\u6536\u96c6\u66f4\u591a\u4fe1\u606f\u3002\u6b64\u5916\uff0c\u7531\u4e8e\u4e0e KrCERT \u5bc6\u5207\u5408\u4f5c\uff0c\u6211\u4eec\u6709\u673a\u4f1a\u7814\u7a76\u5bf9\u624b\u7684 C2 \u811a\u672c\u3002\u4ed6\u4eec\u91c7\u7528\u4e86\u4e0e\u4ee5\u524d\u7c7b\u4f3c\u7684C2\u7ed3\u6784\uff0c\u7834\u574f\u4e86Web\u670d\u52a1\u5668\u5e76\u914d\u7f6e\u4e86\u591a\u9636\u6bb5C2\u670d\u52a1\u5668\uff0c\u7b2c\u4e00\u9636\u6bb5\u670d\u52a1\u5668\u5145\u5f53\u4ee3\u7406\u670d\u52a1\u5668\uff0c\u7b2c\u4e8c\u9636\u6bb5\u670d\u52a1\u5668\u7528\u4e8e\u63a7\u5236\u53d7\u5bb3\u8005\u3002<\/p>\n\n\n\n

\u6211\u4eec\u53d1\u73b0\u4e86\u4e00\u9879\u9488\u5bf9\u5357\u975e\u548c\u5df4\u897f\u56fd\u9632\u627f\u5305\u5546\u7684\u6301\u7eed\u6d3b\u52a8\u3002\u653b\u51fb\u80cc\u540e\u7684\u5a01\u80c1\u884c\u4e3a\u8005\u901a\u8fc7\u793e\u4ea4\u5a92\u4f53\u6216\u7535\u5b50\u90ae\u4ef6\u8054\u7cfb\u4e86\u6f5c\u5728\u7684\u53d7\u5bb3\u8005\uff0c\u5e76\u901a\u8fc7Skype\u53d1\u9001\u4e86\u6700\u521d\u7684\u6076\u610f\u8f6f\u4ef6\u3002\u8be5\u6076\u610f\u8f6f\u4ef6\u662f\u4e00\u4e2a\u7279\u6d1b\u4f0a\u6728\u9a6c\u5316\u7684 PDF \u5e94\u7528\u7a0b\u5e8f\uff0c\u5b83\u542f\u52a8\u591a\u9636\u6bb5\u611f\u67d3\u94fe\uff0c\u901a\u8fc7 DLL \u65c1\u52a0\u8f7d\u6280\u672f\u52a0\u8f7d\u5305\u542b C2 \u901a\u4fe1\u529f\u80fd\u7684\u5176\u4ed6\u6709\u6548\u8d1f\u8f7d\u3002\u6b64\u5916\uff0c\u5a01\u80c1\u53c2\u4e0e\u8005\u5c06\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u90e8\u7f72\u5230\u521d\u59cb\u4e3b\u673a\u4ee5\u900f\u89c6\u548c\u6267\u884c\u6a2a\u5411\u79fb\u52a8\u3002\u5728\u6b64\u8fc7\u7a0b\u4e2d\uff0c\u64cd\u4f5c\u5458\u5229\u7528\u4e86\u540d\u4e3a ServiceMove \u7684\u76f8\u5bf9\u8f83\u65b0\u7684 DLL \u65c1\u52a0\u8f7d\u6280\u672f\u3002\u6b64\u6280\u672f\u7531\u7ea2\u961f\u7814\u7a76\u4eba\u5458\u5f15\u5165\uff0c\u5e76\u6ee5\u7528 Windows \u611f\u77e5\u6a21\u62df\u670d\u52a1\u52a0\u8f7d\u4efb\u610f DLL \u6587\u4ef6\u4ee5\u7528\u4e8e\u6076\u610f\u76ee\u7684\u3002\u8fd9\u4e2a\u81ed\u540d\u662d\u8457\u7684\u5a01\u80c1\u884c\u4e3a\u8005\u64cd\u4f5c\u591a\u4e2a\u96c6\u7fa4\u5e76\u6839\u636e\u5176\u610f\u56fe\u653b\u51fb\u5404\u79cd\u76ee\u6807\u3002\u5728\u5176\u4e2d\u4e00\u540d\u53d7\u5bb3\u8005\u4e2d\uff0c\u6211\u4eec\u89c2\u5bdf\u5230\u7c7b\u4f3c\u7684\u521d\u59cb\u611f\u67d3\u5a92\u4ecb\u3002\u4f46\u662f\uff0c\u8be5\u6f14\u5458\u4f7f\u7528\u4e86\u4e0d\u540c\u7684\u6076\u610f\u8f6f\u4ef6\u3002\u62c9\u6492\u8def\u96c6\u56e2\u914d\u5907\u4e86\u5404\u79cd\u5de5\u5177\uff0c\u5e76\u5c06\u5176\u7528\u4e8e\u5404\u79cd\u611f\u67d3\u94fe\u3002\u5728\u68c0\u67e5\u672c\u4f8b\u4e2d\u7684\u6240\u6709\u6837\u672c\u65f6\uff0c\u6211\u4eec\u89c2\u5bdf\u5230\u4e86\u4e0d\u540c\u7684\u96c6\u7fa4\uff1aThreatNeedle\uff0cBookcode\u548cDeathNote\u3002<\/p>\n\n\n\n

\u5341\u591a\u5e74\u6765\uff0c\u70ed\u5e26\u9a91\u5175APT\u6f14\u5458\u4e00\u76f4\u79ef\u6781\u7784\u51c6\u4e1c\u4e9a\u548c\u4e1c\u5357\u4e9a\u7684\u53d7\u5bb3\u8005\u3002\u591a\u5e74\u6765\uff0c\u6211\u4eec\u4e00\u76f4\u5728\u8ddf\u8e2a\u6b64\u5a01\u80c1\u884c\u4e3a\u8005\uff0c\u4e4b\u524d\u53d1\u5e03\u4e86\u4e00\u4efd\u63cf\u8ff0\u5176\u6076\u610f\u64cd\u4f5c\u7684 APT \u5a01\u80c1\u62a5\u544a\u3002\u4eca\u5e74\u65e9\u4e9b\u65f6\u5019\uff0c\u8d5b\u95e8\u94c1\u514b\u53d1\u8868\u4e86\u4e00\u4efd\u62a5\u544a\uff0c\u63cf\u8ff0\u4e86\u4e00\u4e2a\u540d\u4e3aAntlion\u7684\u6d3b\u52a8\uff0c\u8be5\u6d3b\u52a8\u88ab\u89c2\u5bdf\u5230\u9488\u5bf9\u53f0\u6e7e\u7684\u91d1\u878d\u673a\u6784\u3002\u5728\u5206\u6790\u6b64\u6218\u5f79\u7684 IoC \u65f6\uff0c\u6211\u4eec\u53d1\u73b0\u4e0e\u70ed\u5e26\u9a91\u5175\u5a01\u80c1\u884c\u4e3a\u8005\u6709\u5bc6\u5207\u8054\u7cfb\uff0c\u56e0\u6b64\u6211\u4eec\u5f97\u51fa\u7ed3\u8bba\uff0c\u8be5\u7ec4\u7ec7\u662f\u8681\u72ee\u6218\u5f79\u7684\u5e55\u540e\u9ed1\u624b\u3002\u5728\u6211\u4eec\u7684\u8c03\u67e5\u4e2d\uff0c\u6211\u4eec\u53d1\u73b0\u5e76\u7814\u7a76\u4e86\u8be5\u5a01\u80c1\u884c\u4e3a\u8005\u4f7f\u7528\u8d5b\u95e8\u94c1\u514b\u535a\u5ba2\u6587\u7ae0\u4e2d\u63cf\u8ff0\u7684\u6076\u610f\u8f6f\u4ef6\u7cfb\u5217\u8fdb\u884c\u7684\u4e0d\u540c\u653b\u51fb\uff0c\u4ee5\u53ca\u6211\u4eec\u51e0\u5e74\u524d\u5728\u4e00\u4efd\u5173\u4e8e Tropic Trooper \u7684\u62a5\u544a\u4e2d\u62a5\u544a\u7684\u6076\u610f\u8f6f\u4ef6\u7684\u65b0\u7248\u672c\u3002\u6211\u4eec\u8bbe\u6cd5\u53d1\u73b0\u4e86\u8fd9\u4e9b\u653b\u51fb\u7684\u611f\u67d3\u94fe\u3001\u653b\u51fb\u57fa\u7840\u8bbe\u65bd\u3001\u6a2a\u5411\u79fb\u52a8\u548c\u8be5\u884c\u4e3a\u8005\u8fdb\u884c\u7684\u5229\u7528\u540e\u6d3b\u52a8\u3002\u9664\u91d1\u878d\u884c\u4e1a\u5916\uff0c\u5176\u4ed6\u76ee\u6807\u5782\u76f4\u884c\u4e1a\u8fd8\u5305\u62ec\u79d1\u6280\u786c\u4ef6\u548c\u534a\u5bfc\u4f53\u884c\u4e1a\uff0c\u4ee5\u53ca\u653f\u6cbb\u5b9e\u4f53\u3002\u6b64\u5916\uff0c\u6211\u4eec\u5728 2021 \u5e74 8 \u6708\u53d1\u73b0\u4e86\u4e00\u4e2a\u4ee5\u524d\u672a\u77e5\u7684\u591a\u6a21\u5757\u540e\u95e8\uff0c\u8be5\u540e\u95e8\u7a0b\u5e8f\u90e8\u7f72\u5230\u53d7\u5bb3\u673a\u5668\u4e0a\uff0c\u8be5\u540e\u95e8\u4f7f\u7528 MQTT \u534f\u8bae\u4e0e\u5176 C2 \u670d\u52a1\u5668\u8fdb\u884c\u7f51\u7edc\u901a\u4fe1\u3002\u8ffd\u8e2a\u8fd9\u4e2a\u540e\u95e8\u7684\u5386\u53f2\uff0c\u4f3c\u4e4e\u8be5\u6a21\u5757\u81f3\u5c11\u81ea 2019 \u5e74\u4ee5\u6765\u4e00\u76f4\u88ab\u8be5\u5a01\u80c1\u884c\u4e3a\u8005\u4f7f\u7528\uff0c\u5e76\u4e14\u4ec5\u9488\u5bf9\u4e00\u7ec4\u9009\u5b9a\u7684\u76ee\u6807\u3002<\/p>\n\n\n\n

Kimsuky \u662f\u4e00\u4e2a\u591a\u4ea7\u4e14\u6d3b\u8dc3\u7684\u5a01\u80c1\u884c\u4e3a\u8005\uff0c\u4e3b\u8981\u9488\u5bf9\u4e0e\u671d\u9c9c\u76f8\u5173\u7684\u5b9e\u4f53\u3002\u4e0e\u5176\u4ed6\u8001\u7ec3\u7684\u5bf9\u624b\u4e00\u6837\uff0c\u8be5\u7ec4\u7ec7\u4e5f\u7ecf\u5e38\u66f4\u65b0\u5176\u5de5\u5177\u3002\u4f46\u662f\uff0c\u6700\u8fd1\uff0c\u6211\u4eec\u6709\u673a\u4f1a\u5f7b\u5e95\u4e86\u89e3\u4e86\u4ed6\u4eec\u5982\u4f55\u914d\u7f6eC2\u670d\u52a1\u5668\u4ee5\u53ca\u4ed6\u4eec\u4f7f\u7528\u54ea\u79cd\u6280\u5de7\u6765\u786e\u8ba4\u548c\u8fdb\u4e00\u6b65\u9a8c\u8bc1\u53d7\u5bb3\u8005\u3002Kimsuky\u96c6\u56e2\u914d\u7f6e\u4e86\u591a\u7ea7C2\u670d\u52a1\u5668\uff0c\u5e76\u5728\u4e16\u754c\u5404\u5730\u63d0\u4f9b\u4e86\u5404\u79cd\u5546\u4e1a\u6258\u7ba1\u670d\u52a1\u3002\u6211\u4eec\u8ba4\u4e3a\u653b\u51fb\u5206\u51e0\u4e2a\u9636\u6bb5\u53d1\u751f\u3002\u9996\u5148\uff0c\u53c2\u4e0e\u8005\u5411\u6f5c\u5728\u53d7\u5bb3\u8005\u53d1\u9001\u9c7c\u53c9\u5f0f\u7f51\u7edc\u9493\u9c7c\u7535\u5b50\u90ae\u4ef6\uff0c\u8bf1\u9975\u4e0b\u8f7d\u5176\u4ed6\u6587\u6863\u3002\u5982\u679c\u53d7\u5bb3\u8005\u5355\u51fb\u8be5\u94fe\u63a5\uff0c\u5219\u4f1a\u5bfc\u81f4\u8fde\u63a5\u5230\u7b2c\u4e00\u9636\u6bb5 C2 \u670d\u52a1\u5668\uff0c\u5e76\u5c06\u7535\u5b50\u90ae\u4ef6\u5730\u5740\u4f5c\u4e3a\u53c2\u6570\u3002\u7b2c\u4e00\u9636\u6bb5 C2 \u670d\u52a1\u5668\u9a8c\u8bc1\u4f20\u5165\u7535\u5b50\u90ae\u4ef6\u5730\u5740\u53c2\u6570\u662f\u5426\u4e3a\u9884\u671f\u53c2\u6570\uff0c\u5e76\u5728\u6076\u610f\u6587\u6863\u4f4d\u4e8e\u76ee\u6807\u5217\u8868\u4e2d\u65f6\u4f20\u9012\u6076\u610f\u6587\u6863\u3002\u7b2c\u4e00\u9636\u6bb5\u811a\u672c\u8fd8\u5c06\u53d7\u5bb3\u8005\u7684 IP \u5730\u5740\u8f6c\u53d1\u5230\u4e0b\u4e00\u9636\u6bb5\u670d\u52a1\u5668\u3002\u6253\u5f00\u63d0\u53d6\u7684\u6587\u6863\u65f6\uff0c\u5b83\u5c06\u8fde\u63a5\u5230\u7b2c\u4e8c\u4e2a C2 \u670d\u52a1\u5668\u3002\u7b2c\u4e8c\u4e2a C2 \u670d\u52a1\u5668\u4e0a\u7684\u76f8\u5e94\u811a\u672c\u68c0\u67e5\u4ece\u7b2c\u4e00\u9636\u6bb5\u670d\u52a1\u5668\u8f6c\u53d1\u7684 IP \u5730\u5740\uff0c\u4ee5\u9a8c\u8bc1\u5b83\u662f\u5426\u662f\u6765\u81ea\u540c\u4e00\u53d7\u5bb3\u8005\u7684\u9884\u671f\u8bf7\u6c42\u3002\u4f7f\u7528\u6b64 IP \u9a8c\u8bc1\u65b9\u6848\uff0c\u53c2\u4e0e\u8005\u9a8c\u8bc1\u4f20\u5165\u7684\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u53d7\u5bb3\u8005\u3002\u6700\u91cd\u8981\u7684\u662f\uff0c\u64cd\u4f5c\u5458\u4f9d\u9760\u5176\u4ed6\u51e0\u4e2a\u8fc7\u7a0b\u6765\u4ed4\u7ec6\u4ea4\u4ed8\u4e0b\u4e00\u4e2a\u6709\u6548\u8f7d\u8377\u3002\u7b2c\u4e8c\u4e2a C2 \u670d\u52a1\u5668\u4e0a\u7684\u53e6\u4e00\u4e2a C2 \u811a\u672c\u68c0\u67e5\u64cd\u4f5c\u7cfb\u7edf\u7c7b\u578b\u548c\u9884\u5b9a\u4e49\u7684\u7528\u6237\u4ee3\u7406\u5b57\u7b26\u4e32\uff0c\u4ee5\u8fc7\u6ee4\u6389\u6765\u81ea\u5b89\u5168\u7814\u7a76\u4eba\u5458\u6216\u81ea\u52a8\u5206\u6790\u7cfb\u7edf\u7684\u8bf7\u6c42\u3002\u6211\u4eec\u7684\u7814\u7a76\u5f3a\u8c03\u4e86 Kimsuky \u5a01\u80c1\u884c\u4e3a\u8005\u5982\u4f55\u5bc6\u5207\u5173\u6ce8\u9a8c\u8bc1\u5408\u6cd5\u53d7\u5bb3\u8005\u5e76\u5411\u4ed6\u4eec\u63d0\u4f9b\u4e0b\u4e00\u9636\u6bb5\u7684\u6709\u6548\u8f7d\u8377\u3002<\/p>\n\n\n\n

\u7ee7\u53bb\u5e74\u6211\u4eec\u5bf9Drop Elephant\u6d3b\u52a8\u7684\u5206\u6790\u62a5\u544a\u4e4b\u540e\uff0c\u6211\u4eec\u7ee7\u7eed\u8ddf\u8e2a\u8be5\u5a01\u80c1\u884c\u4e3a\u8005\u7684\u6d3b\u52a8\u3002\u8be5\u7ec4\u7ec7\u5728\u8fc7\u53bb\u4e00\u5e74\u4e2d\u4e00\u76f4\u975e\u5e38\u6d3b\u8dc3\uff1a\u6211\u4eec\u8c03\u67e5\u4e86\u5df4\u57fa\u65af\u5766\u548c\u4e2d\u56fd\u9488\u5bf9\u519b\u4e8b\u3001\u5916\u4ea4\u548c\u6559\u80b2\u673a\u6784\u7684\u591a\u8d77\u88ad\u51fb\u4e8b\u4ef6\u3002\u4ece\u6211\u4eec\u6536\u96c6\u7684\u6837\u672c\u5206\u6790\u4e2d\uff0c\u5f88\u660e\u663eDrop Elephant\u5e76\u6ca1\u6709\u4e22\u5f03\u5176\u4f20\u7edf\u7684JakyllHyde RAT\uff08\u53c8\u540dBadNews\uff09\uff0c\u4f46\u5728\u6700\u8fd1\u7684\u653b\u51fb\u4e2d\uff0c\u6211\u4eec\u5df2\u7ecf\u770b\u5230\u4e86\u5411\u4f7f\u7528PubFantacy\u7684\u8f6c\u53d8\uff0c\u6211\u4eec\u751a\u81f3\u770b\u5230JakyllHyde\u7684\u4e00\u4e9b\u529f\u80fd\u88ab\u79fb\u690d\u5230PubFantacy\u3002\u540c\u65f6\uff0c\u6211\u4eec\u8fd8\u53d1\u73b0\u4e86\u4f7f\u7528Delphi\u5f00\u53d1\u7684\u65b0\u6076\u610f\u8f6f\u4ef6\u3002\u6389\u843d\u5927\u8c61\u7684\u4e3b\u8981\u653b\u51fb\u65b9\u6cd5\u4ecd\u7136\u662f\u7f51\u7edc\u9493\u9c7c\u548c\u653b\u51fb\u6613\u53d7\u653b\u51fb\u7684\u529e\u516c\u5957\u4ef6\u3002\u5728\u4ee5\u524d\u4f7f\u7528 CVE-2017-0261 \u7684\u5730\u65b9\uff0cCVE-2017-11228 \u53d6\u4ee3\u4e86\u5b83\u3002<\/p>\n\n\n\n

\u5176\u4ed6\u6709\u8da3\u7684\u53d1\u73b0<\/h2>\n\n\n\n

7\u670830\u65e5\uff0c\u4e00\u4f4d\u540d\u53ebAdastrea\u7684\u6f14\u5458\u5728\u4e24\u4e2a\u6697\u7f51\u8bba\u575b\u4e0a\u53d1\u5e03\u4e86\u4e00\u6761\u6d88\u606f\uff0c\u79f0\u4ed6\u4eec\u6b63\u5728\u51fa\u552e\u5c5e\u4e8eMBDA\uff0c\u5317\u7ea6\u548c\u610f\u5927\u5229\u56fd\u9632\u90e8\u768460GB\u673a\u5bc6\u548c\u9650\u5236\u4fe1\u606f\u3002Adastrea \u662f\u4e00\u4e2a\u5168\u65b0\u7684\u5e10\u6237\uff0c\u5c06\u81ea\u5df1\u5b9a\u4e49\u4e3a\u7f51\u7edc\u5b89\u5168\u4e13\u5bb6\u548c\u7814\u7a76\u4eba\u5458\u7684\u72ec\u7acb\u5c0f\u7ec4\u3002\u5728 8 \u6708 10 \u65e5\u7684\u53e6\u4e00\u7bc7\u5e16\u5b50\u4e2d\uff0c\u8be5\u6f14\u5458\u63d0\u4f9b\u4e86\u636e\u62a5\u9053\u4ece\u83f2\u5f8b\u5bbe\u7a83\u53d6\u7684 500MB \u519b\u4e8b\u60c5\u62a5\u6570\u636e\u3002\u6211\u4eec\u65e0\u6cd5\u83b7\u53d6\u548c\u5206\u6790\u6cc4\u6f0f\u3002\u5728 7 \u6708\u4efd\u7684\u5e16\u5b50\u4e2d\uff0c\u5a01\u80c1\u884c\u4e3a\u8005\u8fd8\u5206\u4eab\u4e86\u6258\u7ba1\u5728 MEGA \u4e0a\u7684\u6f14\u793a\u6587\u4ef6\uff08\u4ec5 47MB\uff09\uff0c\u5e76\u5199\u9053\u4ed6\u4eec\u5c06\u5728\u79c1\u4eba\u804a\u5929\u4e2d\u8ba8\u8bba\u6cc4\u6f0f\u7684\u4ef7\u683c\uff0c\u5171\u4eab\u4ed6\u4eec\u7684 XMPP \u5e10\u6237\u548c Protonmail \u7535\u5b50\u90ae\u4ef6\u5730\u5740\u3002\u5728\u8fd9\u4e9b\u58f0\u660e\u4e4b\u540e\uff0cMBDA\u5728\u65b0\u95fb\u7a3f\u4e2d\u5426\u8ba4\u6709\u4efb\u4f55\u59a5\u534f\u3002\u4e00\u5468\u540e\uff0c\u5373 8 \u6708 7 \u65e5\uff0c\u5a01\u80c1\u884c\u4e3a\u8005\u53d1\u5e03\u4e86\u6cc4\u9732\u6570\u636e\u7684\u65b0\u8bc1\u636e\u3002\u5361\u5df4\u65af\u57fa ICS-CERT \u80fd\u591f\u83b7\u5f97\u90e8\u5206\u79c1\u6709\u6cc4\u9732\u6570\u636e\uff0c\u8fd9\u4e9b\u6570\u636e\u5728\u5361\u5df4\u65af\u57fa\u5168\u7403\u7814\u7a76\u548c\u5206\u6790\u56e2\u961f\u7684\u5e2e\u52a9\u4e0b\u8fdb\u884c\u4e86\u5206\u6790\uff0c\u4ee5\u66f4\u597d\u5730\u4e86\u89e3\u5a01\u80c1\u53c2\u4e0e\u8005\u53d1\u5e03\u7684\u8bba\u575b\u5e16\u5b50\u7684 TTP \u548c\u771f\u5b9e\u6027\u3002<\/p>\n\n\n\n

\u6211\u4eec\u53d1\u73b0\u81f3\u5c11\u81ea 2020 \u5e74 12 \u6708\u4ee5\u6765\uff0c\u4e00\u4e2a\u4ee5\u524d\u672a\u77e5\u7684\u540e\u95e8\u7a0b\u5e8f\u6b63\u5728\u79ef\u6781\u4f7f\u7528\u3002\u6b64\u540e\u95e8\u7684\u4e3b\u8981\u7528\u9014\u662f\u8bb0\u5f55\u548c\u6cc4\u9732\u5bc6\u7801\uff0c\u4e0e\u5b83\u5229\u7528\u7684\u5b89\u5168\u652f\u6301\u63d0\u4f9b\u7a0b\u5e8f \uff08SSP\uff09 DLL \u7684\u529f\u80fd\u76f8\u5339\u914d\u3002\u9664\u4e86\u6536\u96c6\u7684\u5bc6\u7801\u5916\uff0c\u540e\u95e8\u7a0b\u5e8f\u8fd8\u6536\u96c6\u6709\u5173\u53d7\u611f\u67d3\u7cfb\u7edf\u7684\u5178\u578b\u4fe1\u606f\uff0c\u5e76\u4e3a\u653b\u51fb\u8005\u63d0\u4f9b\u591a\u4e2a\u547d\u4ee4\u6765\u64cd\u4f5c\u548c\u6267\u884c\u6587\u4ef6\u3002\u8be5\u540e\u95e8\u5305\u542b\u4e00\u4e2a\u52a0\u5bc6\u7684\u5916\u58f3\u4ee3\u7801\uff0c\u5141\u8bb8\u653b\u51fb\u8005\u6267\u884c\u901a\u8fc7\u52a0\u5bc6\u901a\u9053\u63a5\u6536\u7684\u4efb\u610f\u4ee3\u7801\u3002\u6211\u4eec\u5728\u65e5\u672c\u548c\u57c3\u585e\u4fc4\u6bd4\u4e9a\u53d1\u73b0\u4e86\u975e\u5e38\u6709\u9650\u7684\u53d7\u5bb3\u8005\uff0c\u5e76\u4e14\u4e0e\u4ee5\u524d\u5df2\u77e5\u7684\u6076\u610f\u8f6f\u4ef6\u5bb6\u65cf\u6216\u5a01\u80c1\u884c\u4e3a\u8005\u6ca1\u6709\u8054\u7cfb\u3002<\/p>\n\n\n\n

9 \u6708\uff0c\u6211\u4eec\u53d1\u5e03\u4e86\u5bf9 Metatron \u7684\u5206\u6790\uff0c\u8fd9\u662f\u4e00\u4e2a\u975e\u5e38\u590d\u6742\u7684\u65b0\u578b\u6076\u610f\u8f6f\u4ef6\u5e73\u53f0\uff0c\u5df2\u7528\u4e8e\u9488\u5bf9\u4e2d\u4e1c\u548c\u975e\u6d32\u7684\u7535\u4fe1\u516c\u53f8\u3001ISP \u548c\u5927\u5b66\u3002Metatron \u662f\u4e00\u4e2a\u6a21\u5757\u5316\u690d\u5165\u7269\uff0c\u901a\u8fc7 Microsoft \u63a7\u5236\u53f0\u8c03\u8bd5\u5668\u811a\u672c\u5f15\u5bfc\u3002\u540e\u95e8\u652f\u6301\u591a\u79cd\u4f20\u8f93\u6a21\u5f0f\uff0c\u5e76\u63d0\u4f9b\u8f6c\u53d1\u548c\u7aef\u53e3\u6572\u51fb\u529f\u80fd\uff1a\u5b83\u5b9e\u73b0\u4e86 67 \u79cd\u4e0d\u540c\u7684\u547d\u4ee4\u3002\u539f\u59cb\u6837\u54c1\u7531SentinelOne\u63d0\u4f9b\uff0c\u5e76\u4e0e\u4ed6\u4eec\u5408\u4f5c\u8fdb\u884c\u5206\u6790<\/a>.<\/p>\n\n\n\n

\u7ed3\u8bed<\/h2>\n\n\n\n

\u867d\u7136\u4e00\u4e9b\u5a01\u80c1\u53c2\u4e0e\u8005\u7684 TTP \u968f\u7740\u65f6\u95f4\u7684\u63a8\u79fb\u4fdd\u6301\u4e00\u81f4\uff0c\u4e25\u91cd\u4f9d\u8d56\u793e\u4f1a\u5de5\u7a0b\u4f5c\u4e3a\u5728\u76ee\u6807\u7ec4\u7ec7\u4e2d\u7ad9\u7a33\u811a\u8ddf\u6216\u7834\u574f\u4e2a\u4eba\u8bbe\u5907\u7684\u624b\u6bb5\uff0c\u4f46\u5176\u4ed6\u4eba\u4f1a\u66f4\u65b0\u4ed6\u4eec\u7684\u5de5\u5177\u96c6\u5e76\u6269\u5c55\u5176\u6d3b\u52a8\u8303\u56f4\u3002\u6211\u4eec\u7684\u5b9a\u671f\u5b63\u5ea6\u56de\u987e\u65e8\u5728\u7a81\u51faAPT\u96c6\u56e2\u7684\u4e3b\u8981\u53d1\u5c55\u3002<\/p>\n\n\n\n

\u4ee5\u4e0b\u662f\u6211\u4eec\u5728 2022 \u5e74\u7b2c\u4e09\u5b63\u5ea6\u770b\u5230\u7684\u4e3b\u8981\u8d8b\u52bf\uff1a<\/p>\n\n\n\n

    \n
  • APT\u6d3b\u52a8\u5728\u5730\u7406\u4e0a\u5206\u5e03\u975e\u5e38\u5e7f\u6cdb\u3002\u672c\u5b63\u5ea6\uff0c\u6211\u4eec\u770b\u5230\u884c\u4e3a\u8005\u5c06\u653b\u51fb\u8303\u56f4\u6269\u5927\u5230\u6b27\u6d32\u3001\u7f8e\u56fd\u3001\u97e9\u56fd\u3001\u5df4\u897f\u3001\u4e2d\u4e1c\u548c\u4e9a\u6d32\u5404\u5730\u3002<\/li>\n\n\n\n
  • APT \u5a01\u80c1\u53c2\u4e0e\u8005\u9009\u62e9\u7684\u76ee\u6807\u540c\u6837\u591a\u79cd\u591a\u6837\u3002\u5b83\u4eec\u5305\u62ec\u653f\u5e9c\u548c\u5916\u4ea4\u673a\u6784\u3001\u56fd\u9632\u627f\u5305\u5546\u3001\u91d1\u878d\u90e8\u95e8\u3001\u6280\u672f\u786c\u4ef6\u548c\u534a\u5bfc\u4f53\u90e8\u95e8\u4ee5\u53ca IT \u62db\u8058\u548c\u8d4c\u535a\u90e8\u95e8\u3002<\/li>\n\n\n\n
  • \u5730\u7f18\u653f\u6cbb\u4ecd\u7136\u662fAPT\u53d1\u5c55\u7684\u5173\u952e\u9a71\u52a8\u529b\uff0c\u7f51\u7edc\u95f4\u8c0d\u6d3b\u52a8\u4ecd\u7136\u662fAPT\u6d3b\u52a8\u7684\u4e3b\u8981\u76ee\u6807\u3002\u7136\u800c\uff0cAndariel \u4f7f\u7528\u52d2\u7d22\u8f6f\u4ef6\u8868\u660e\u8fd9\u4e0d\u662f APT \u653b\u51fb\u7684\u552f\u4e00\u52a8\u673a\u3002<\/li>\n<\/ul>\n\n\n\n

    \u4e0e\u5f80\u5e38\u4e00\u6837\uff0c\u6211\u4eec\u4f1a\u6ce8\u610f\u5230\uff0c\u6211\u4eec\u7684\u62a5\u544a\u662f\u6211\u4eec\u4e86\u89e3\u5a01\u80c1\u5f62\u52bf\u7684\u4ea7\u7269\u3002\u4f46\u662f\uff0c\u5e94\u8be5\u8bb0\u4f4f\uff0c\u5728\u6211\u4eec\u52aa\u529b\u4e0d\u65ad\u6539\u8fdb\u7684\u540c\u65f6\uff0c\u603b\u662f\u6709\u53ef\u80fd\u5728\u5176\u4ed6\u590d\u6742\u7684\u653b\u51fb\u4e0b\u98de\u884c\u3002<\/p>\n\n\n\n

    \u514d\u8d23\u58f0\u660e\uff1a\u5f53\u5c06APT\u7fa4\u7ec4\u79f0\u4e3a\u8bb2\u4fc4\u8bed\u3001\u4e2d\u6587\u6216\u201c\u5176\u4ed6\u201d\u8bed\u7684\u8bed\u8a00\u65f6\uff0c\u6211\u4eec\u6307\u7684\u662f\u8fd9\u4e9b\u7fa4\u7ec4\u4f7f\u7528\u7684\u5404\u79cd\u4f2a\u5f71\uff08\u4f8b\u5982\u6076\u610f\u8f6f\u4ef6\u8c03\u8bd5\u5b57\u7b26\u4e32\u3001\u811a\u672c\u4e2d\u7684\u6ce8\u91ca\u7b49\uff09\uff0c\u5176\u4e2d\u5305\u542b\u8fd9\u4e9b\u8bed\u8a00\u7684\u5355\u8bcd\uff0c\u57fa\u4e8e\u6211\u4eec\u76f4\u63a5\u83b7\u5f97\u7684\u4fe1\u606f\u6216\u4ee5\u5176\u4ed6\u65b9\u5f0f\u516c\u5f00\u548c\u5e7f\u6cdb\u62a5\u9053\u7684\u4fe1\u606f\u3002\u67d0\u4e9b\u8bed\u8a00\u7684\u4f7f\u7528\u5e76\u4e0d\u4e00\u5b9a\u8868\u793a\u7279\u5b9a\u7684\u5730\u7406\u5173\u7cfb\uff0c\u800c\u662f\u6307\u5411\u8fd9\u4e9bAPT\u5de5\u4ef6\u80cc\u540e\u7684\u5f00\u53d1\u4eba\u5458\u4f7f\u7528\u7684\u8bed\u8a00\u3002<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    \u4e94\u5e74\u591a\u6765\uff0c\u5361\u5df4\u65af\u57fa\u7684\u5168\u7403\u7814\u7a76\u4e0e\u5206\u6790\u56e2\u961f \uff08GReAT\uff09 \u4e00\u76f4\u5728\u53d1\u5e03\u9ad8\u7ea7\u6301\u7eed\u6027\u5a01\u80c1 \uff08APT\uff09 \u6d3b\u52a8\u7684\u5b63\u5ea6\u6458\u8981\u3002 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[103,43,17],"tags":[60,73],"class_list":["post-892","post","type-post","status-publish","format-standard","hentry","category-linux-infoarticle","category-infoarticle","category-infonews","tag-linux","tag-windows"],"views":1591,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=892"}],"version-history":[{"count":1,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/892\/revisions"}],"predecessor-version":[{"id":894,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/892\/revisions\/894"}],"wp:attachment":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}