网络安全威胁信息共享平台

ANVA-BL-OSINT-11010000001256
CNCERT
Fri May 25 00:00:00 CST 2018
思科发布IoT VPNFilter僵尸网络分析
安全厂商思科发布僵尸网络VPNFilter利用IoT路由器、NAS网络存储设备攻击活动分析,VPNFilter分为三个攻击阶段,第一阶段通过修改NVRAM然后调用linux定时任务命令crontab建立持久机制,即使IoT设备重启也不会消失;第二阶段的样本不具备持久性,从C2接收指令,安装Tor模块,具备破坏设备和代理功能;第三阶段的样本也不具备持久性,以插件的方式作业,包括流量嗅探和Tor通信等。Talos认为VPNFilter第一阶段的RC4加密代码与 BlackEnergy代码相同,而将攻击者归因于俄罗斯。VPNFilter 利用各国的命令和控制(C2)基础设施,在5月8日感染了很多乌克兰境内及多个国家主机。预估至少有 54 个国家遭入侵,受感染设备的数量至少为 50 万台。受影响的设备主要有小型和家庭办公室(SOHO)中使用的 Linksys、MikroTik、NETGEAR 和 TP-Link 路由器以及 QNAP 网络附加存储(NAS)设备。暂时尚未发现其他网络设备供应商受感染。
物联网; 僵尸网络; 路由器; 俄罗斯; IOC; HASH; IP; URL; FILE
https://blog.talosintelligence.com/2018/05/VPNFilter.html
2018/05/23
talosintelligence
50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec
0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92
9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17
d6097e942dd0fdc1fb28ec1814780e6ecc169ec6d24f9954e71954eedbc4c70e
4b03288e9e44d214426a02327223b5e516b1ea29ce72fa25a2fcef9aa65c4b0b
9eb6c779dbad1b717caa462d8e040852759436ed79cc2172692339bc62432387
37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4
776cb9a7a9f5afbaffdd4dbd052c6420030b2c7c3058c1455e0a79df0e6f7a1d
8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1
0649fda8888d701eb2f91e6e0a05a2e2be714f564497c44a3813082ef8ff250b
f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344
afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719
d113ce61ab1e4bfcb32fb3c53bd3cdeee81108d02d3886f6e2286e0b6a006747
c52b3901a26df1680acbfb9e6184b321f0b22dd6c4bb107e5e071553d375c851
f372ebe8277b78d50c5600d0e2af3fe29b1e04b5435a7149f04edd165743c16d
be4715b029cbd3f8e2f37bc525005b2cb9cad977117a26fac94339a721e3f2a5
27af4b890db1a611d0054d5d4a7d9a36c9f52dffeb67a053be9ea03a495a9302
110da84f31e7868ad741bcb0d9f7771a0bb39c44785055e6da0ecc393598adc8
fb47ba27dceea486aab7a0f8ec5674332ca1f6af962a1724df89d658d470348f
b25336c2dd388459dec37fa8d0467cf2ac3c81a272176128338a2c1d7c083c78
cd75d3a70e3218688bdd23a0f618add964603736f7c899265b1d8386b9902526
110da84f31e7868ad741bcb0d9f7771a0bb39c44785055e6da0ecc393598adc8
909cf80d3ef4c52abc95d286df8d218462739889b6be4762a1d2fac1adb2ec2b
044bfa11ea91b5559f7502c3a504b19ee3c555e95907a98508825b4aa56294e4
c0f8bde03df3dec6e43b327378777ebc35d9ea8cfe39628f79f20b1c40c1b412
8f1d0cd5dd6585c3d5d478e18a85e7109c8a88489c46987621e01d21fab5095d
d5dec646c957305d91303a1d7931b30e7fb2f38d54a1102e14fd7a4b9f6e0806
c0f8bde03df3dec6e43b327378777ebc35d9ea8cfe39628f79f20b1c40c1b412
91.121.109.209
217.12.202.40
94.242.222.68
82.118.242.124
46.151.209.33
217.79.179.14
91.214.203.144
95.211.198.231
195.154.180.60
5.149.250.54
91.200.13.76
94.185.80.82
62.210.180.229
photobucket.com/user/nikkireed11/library
photobucket.com/user/kmila302/library
photobucket.com/user/lisabraun87/library
photobucket.com/user/eva_green1/library
photobucket.com/user/monicabelci4/library
photobucket.com/user/katyperry45/library
photobucket.com/user/saragray1/library
photobucket.com/user/millerfred/library
photobucket.com/user/jeniferaniston1/library
photobucket.com/user/amandaseyfried1/library
photobucket.com/user/suwe8/library
photobucket.com/user/bob7301/library
toknowall.com
zuh3vcyskd4gipkm.onion/bin32/update.php
Unix.Trojan.Vpnfilter-6425811-0
Unix.Trojan.Vpnfilter-6425812-0
Unix.Trojan.Vpnfilter-6550590-0
Unix.Trojan.Vpnfilter-6550591-0
Unix.Trojan.Vpnfilter-6550592-0

https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-28-fancy-bear/

主办:中国互联网网络安全威胁治理联盟

京ICP备10012421号-1 如有问题请联系  cctga@cert.org.cn