Ama-Hackers Agxile: I-NeedyMantis Malware, Ukuboshwa kwe-ShinyHunters kanye ne-AI Phishing

Ikhaya » Software » Ama-Hackers Agxile: I-NeedyMantis Malware, Ukuboshwa kwe-ShinyHunters kanye ne-AI Phishing

Intuthuko yakamuva ezweni lokugenca i-inthanethi iye yahamba ngezindlela ezimbili ngesikhathi esisodwa: amaqembu obunhloli axhumene nohulumeni afuna ukufinyelela isikhathi eside, kanye namaqembu okuphanga obugebengu aziphatha ngobudlova kakhulu kunokujwayelekile. I-Microsoft ishicilele ukuhlukaniswa kobuchwepheshe komndeni we-malware obizwa nge- NeedyMantis , osetshenziswe eqoqweni elilinganiselwe lokungenelela ezinkampanini zokuxhumana, amanyuvesi, izinhlangano ezingenzi nzuzo zezokwelapha, izinhlangano zikahulumeni kanye nezinkontileka zikahulumeni. Leli thuluzi libonakala lenzelwe ukugcina abangeneleli ngaphakathi kwenethiwekhi ngemuva kokungena kokuqala, kunokuba lisakazeke kabanzi.

Ngesikhathi esifanayo, iziphathimandla zaseDashi zibophe indoda eneminyaka engu-24 ubudala ngokuphathelene neShinyHunters , iqembu elihlobene nokwebiwa kwedatha okukhulu kanye nezinsongo zesihlengo. Ukuboshwa lokhu akuzange kunciphise isibindi saleli qembu emphakathini: zingakapheli izinsuku, lathi linecala lokungena ngenkani engosini yemisebenzi ye-FBI futhi lalihlobene nokuxhashazwa kobuthakathaka be-PeopleSoft. Ngokwehlukana, abacwaningi bathi iqembu elihambisana neShayina elibizwa nge- TA419 belilokhu lizenza ochwepheshe benqubomgomo ye-AI ukuze lintshontshe iziqinisekiso ezivela kubaphathi bezocwaningo, osonkontileka kanye namanyuvesi.

I-athikili ehlobene:

Ukuxazulula Inkinga Yewebhu: Kuchazwa Usongo, Ukubekeka Engcupheni, kanye Nengozi

I-Microsoft ixhumanisa i-NeedyMantis nokungenelela kwesikhathi eside

Ukuhlaziywa kweMicrosoft kuthi i-NeedyMantis ibilokhu ibonwa kusukela okungenani ngo-Okthoba 2025 futhi yabonakala emisebenzini embalwa eqondiwe. Izisulu zifaka phakathi izinhlangano zokuxhumana, amanyuvesi, izinhlangano ezingenzi nzuzo zezokwelapha, izinhlangano ezisebenzisana nohulumeni kanye nezinkontileka zikahulumeni. I-malware yenzelwe ukuphikelela nokulawula, hhayi ukuphazamiseka okukhulu.

Umzila oholela ku-NeedyMantis uvele ngokwengxenye ekuphenyweni kukaKaspersky mayelana nokuhlaselwa kwe-DAEMON Tools. Abafaki abasemthethweni abasayiniwe be- DAEMON Tools Lite baphethe ikhodi enonya kusukela ngo-Ephreli 8, 2026, futhi unjiniyela wabuyisela inguqulo ehlanzekile ngoMeyi 5. I-Microsoft ilandelela umsebenzi ohlobene njenge-Storm-3069, kodwa ayizange ibone i-NeedyMantis ngokwayo ifika kulolo chungechunge lwe-supply.

Iphakheji ye-malware ivame ukuba nezingcezu ezintathu: uhlelo olusemthethweni, i-DLL enonya eqanjwe ngefayela elilayishwa uhlelo, kanye nengobo yomlando ebethelwe enelebula elifanayo. Uma uhlelo lokusebenza luqala, lulayisha i-DLL eyisigebengu, inqubo eyaziwa ngokuthi i-DLL sideloading.

I-athikili ehlobene:

Lenguajes de programación para ciberseguridad: guía completa

Izinhlelo ezisemthethweni ezisetshenziswa kabi ngale ndlela zifaka phakathi i-Poedit, i-curl, i-Vim, kanye ne-TightVNC . I-malware iphinde yazifihla njenge-DLL exhunywe kwi-Microsoft Office, i-Broadcom, i-Intel, kanye ne-NVIDIA. Kwesinye isampula, yathatha indawo ye-WinSparkle.dll, ingxenye yokubuyekeza ye-Poedit.

Indlela umthwalo okhokhelwayo ofihla ngayo ithrafikhi yawo

Kusampula enemininingwane, umqhubi osevele engaphakathi kwenethiwekhi usebenzise i-Impacket ukukopisha inqwaba kusuka kufolda eyabiwe bese eyisebenzisa emshinini oqondiwe. Ukufinyelela kokuqala kungahluka kusuka kwesinye isimo kuya kwesinye.

Uma isilayishiwe, i-DLL ikhipha isigaba esilandelayo kungobo yomlando ebethelwe bese isiqhuba. Leso sigaba sinquma ingxenye eyinhloko, exhumana neseva yomyalo nokulawula nge-HTTPS bese ishintshela ekuxhumekeni kwe -WebSocket.

Ngaleso siteshi, opharetha bangalayisha futhi balayishe amamojula engeziwe futhi bathumele idatha kubo. I-Microsoft ayikaqinisekisi ukuthi lawo mamojula enzani. Inguqulo endala kusukela ngo-Okthoba 2025 yayihlanganisa imojula yokuphikelela eyayisebenzisa amasevisi e-Windows ; indlela yokuphikelela yenguqulo entsha yayingenazo izincazelo.

I-athikili ehlobene:

Umhlahlandlela Ophelele Wezinkundla Zokuphathwa Kokuhlukumezeka Eziqhutshwa yi-AI kanye Nezokuphepha

Ukunikezwa kweShayina kusalokhu kuqaphile

I-Storm-3069 ilebula yesikhashana i-Microsoft eyinika amaqoqo amasha noma asathuthuka kuze kube yilapho isiqiniseka kakhulu ngokuthi ubani osekelayo. Le nkampani ibone i-NeedyMantis ngaphandle komkhankaso we-DAEMON Tools futhi ithi amaqembu angaphezu kwelilodwa angase ayisebenzise. Ayikaze inqume ukuthi yonke imisebenzi ivela kumlingisi oyedwa.

I-Microsoft ihlola ukuthi lo msebenzi ubonakala sengathi uvela eShayina kodwa ayizange ihlanganise i-Storm-3069 nomlingisi wezwe laseShayina. Izinhloso kanye nesisulu esikhethiwe zibeka amaphethini ahambisana nenkampani ehlotshaniswa neShayina. UKaspersky uthole umbhalo wolimi lwesiShayina ku-malware ye-DAEMON Tools kodwa akazange awubeke eceleni.

I-Google Threat Intelligence Group ilandelela umlingisi ongemuva komkhankaso we-DAEMON Tools njenge- UNC6863 . UMandiant uchaze i-UNC6863 njengomlingisi osolwayo we-nexus yaseShayina owasebenzisa i-DAEMON Tools ukuze asebenzise i-malware. Ukuthi i-UNC6863 ne-Storm-3069 ziyafana yini akukacaci.

Izinkomba, ukutholwa kanye nokuhlanza

Izinkomba ezishicilelwe yiMicrosoft zifaka phakathi ama-hash amathathu e-SHA-256 axhunywe ku-loader yesigaba sokuqala kanye nezingobo zomlando ezibethelwe, kanye nesizinda se-C2 corp.tripswithenginecom ku-port 443 kanye ne-ejenti yomsebenzisi enekhodi eqinile ye-firefox/21.0.

• e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e – isilayishi sesigaba sokuqala i-WinSparkle.dll, esibonwe okokuqala ngoMeyi 21, 2026.
• 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef – ingobo yomlando ebethelwe ebizwa ngokuthi i-WinSparkle, yabonakala okokuqala mhla zingama-23 kuNhlaba, 2026.
• c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 – ingobo yomlando ebethelwe ebizwa ngokuthi i-libcurl, inguqulo endala, ebonwe okokuqala mhla zi-3 kuMfumfu 2025.

Izindlela zamafayela ezibonwa ngama-DLL anonya zifaka phakathi i-Poedit, i-libcurl, i-Vim, i-TightVNC, i-Office, i-Broadcom, i-Intel kanye nezingxenye ezihlobene ne-NVIDIA ngaphansi kwamafolda edatha yohlelo nohlelo oluvamile.

I-athikili ehlobene:

Umhlahlandlela Ophelele Wokuvikela Usongo lwe-API nge-WAF ne-WAAP

I-Defender ithola i-malware njenge -TrojanDropper:Win64/NeedyMantis kanye ne-Behavior:Win64/NeedyMantis. Imibuzo yokuzingela ibheka emuva ezinsukwini eziyisikhombisa kuphela, ngakho-ke ngeke ithole imicimbi emidala kusukela ngo-Okthoba 2025 noma ngoMeyi 2026 ngaphandle kokuthi ilungiswe. Ukushaya endleleni ye-Poedit kuphela akulona ubufakazi ngoba i-WinSparkle.dll nayo iyisakhi esivamile se-Poedit.

I-Microsoft incoma ukuvikelwa okulethwa ngamafu, ukuvimba ekuqaleni kokubona, i-EDR kumodi yokuvimba, ukuvikelwa kwenethiwekhi, ukuphazamiseka kokuhlasela okuzenzakalelayo, kanye nemithetho ethile yokunciphisa ubuso bokuhlasela. Iphinde iphakamise ukuhlola ithrafikhi ephumayo ukuze ithole ukuxhumana nesizinda se-C2, okungenziwa ngaphandle kwe-Defender. Noma ubani ofake i- DAEMON Tools Lite 12.5.1 ethintekile kufanele ayikhiphe, asebenzise ukuskena okugcwele, futhi athole inguqulo 12.6 kusayithi elisemthethweni.

Ukuboshwa kweDashi kubeka iShinyHunters ngaphansi kwengcindezi

Iziphathimandla zaseDashi ziqinisekisile ukuboshwa kwendoda eneminyaka engu-24 njengengxenye yophenyo lweShinyHunters, iqembu elisolwa ngokweba idatha kanye nokuphanga ezinhlanganweni ezingaphezu kuka-140 emhlabeni jikelele. Amaphoyisa athi le ndoda yaboshwa ngoSepthemba 15 futhi yayalelwa ukuba iboshwe okungenani izinsuku ezingu-90.

Imibiko eminingi ikhomba umsolwa njengoPepijn van der Stap , isigebengu se-inthanethi esilahlwe yicala esake sasebenzisa isibambo i-Umbreon. Wagwetshwa iminyaka emine ngo-2023, owodwa walengiswa, ngokweba idatha kanye nokuphanga abashushisi abathi kwaholela phakathi kuka-€1.5 million no-€2.7 million. Wakhululwa ejele ngoDisemba 2025.

Ngaphambi kokuboshwa kwakhe, u-van der Stap waziveza njengomuntu oguqukile futhi wasebenza esikhundleni esiphezulu sezokuphepha kwa- Neo Security , ngokusho kwezingxoxo kanye nemibiko yabezindaba. Wayephinde wavolontiya kwa-Dutch Institute for Vulnerability Disclosure, kamuva eyadalula isigameko sangaphakathi sezokuphepha kwe-inthanethi esihilela ukusetshenziswa kwe-AI okunonya futhi yathi akubonakali sengathi kuhlobene ne-ShinyHunters. I-Neo Security ayizange iphendule izicelo zokuphawula.

I-athikili ehlobene:

Ukuphepha Kwe-inthanethi Esikhathini Se-AI: Izingozi, Ukwephulwa Kwemithetho, Namasu Amasha

Amaphoyisa aseDashi acele usizo lomphakathi ukuthola izwi ocingweni lwangoFebhuwari 2026 lapho kwaklanywa khona isisebenzi sase-Odido ukuthi singene kusayithi elikhohlisiwe, okwaholela ekwebiweni kwedatha kubantu baseDashi abangaphezu kwezigidi ezingu-6.2 . I-ShinyHunters iqinisekisile ukuthi oshaye ucingo wayeyilungu, yize indoda eboshiwe ingahlobene ngokusemthethweni necala lika-Odido.

Abaphenyi basola nokuthi u-van der Stap uzame ukuhlela okungenani ukubulawa kwabantu ababili phesheya kwezilwandle , ngokusho kwe-RTL, ngokusekelwe olwazini olutholakale ngemuva kokuboshwa kwakhe. Iziphathimandla zaseDashi zichaze lowo mzila wophenyo njengohlukile ophenyweni lwe-ShinyHunters.

Ukwephulwa kwe-portal yemisebenzi ye-FBI kanye nokuxhashazwa kwe-PeopleSoft

Ezinsukwini ezimbalwa ngemuva kokuboshwa, iShinyHunters yathi idumela ngokwephulwa kwesicelo somsebenzi se-FBI, i-apply.fbijobs.gov . Imibiko ithi idatha eyebiwe ifaka izinombolo ze-Social Security kanye nemininingwane yomuntu siqu yezikhulu ezingaphezu kuka-5,000, kanye neziqu zemisebenzi noma amaqembu afana ne-ejenti ekhethekile, umhloli wokungenisa izinsongo, iyunithi enkulu yobugebengu be-inthanethi, kanye nabasebenzi abaphenya izinsongo ze-inthanethi ezisekelwa umbuso wangaphandle.

I-Reuters ihlole imibhalo eyabiwe yileli qembu futhi yathola amafayela abucayi engqondo nawezokwelapha ahilela abasebenzi be-FBI. Lokhu kwephulwa kwemithetho kuphakamise ukukhathazeka ngokuphikisa ubunhloli ngenxa yohlobo lwedatha. Ihhovisi alizange linikeze imininingwane eningiliziwe yomphakathi ngalesi sigameko.

I-ShinyHunters ithe ithole ukufinyelela ngokusebenzisa iphutha elisanda kulungiswa, i-CVE-2026-35273 , ku-Oracle PeopleSoft, ipulatifomu ye-HR kanye nokuqasha esetshenziswa kabanzi. I-Oracle ikhiphe ukulungiswa ngemuva kokuthi kubikwa ukuthi iphutha lisetshenziswe njengosuku olungenalo usuku oluqala ngoJuni.

I-athikili ehlobene:

Ukuxazulula Ukulayishwa Okungaphezulu kwe-AppSec: Kusukela Ekusakazekeni Kwamathuluzi Kuya Empumelelweni Yenhlangano

UMandiant ukhiphe imithetho yohlelo lokusebenza lwewebhu yokuvikela izinhlangano ezazingakwazi ukulungisa ngokushesha, kodwa iBleepingComputer ibike ukuthi iShinyHunters isebenzise icebo lokufaka ikhodi ye-URL ukuze ingayisebenzisi. Umbiko wangoSepthemba 25 ovela kuMandiant kanye neGoogle Threat Intelligence Group uqinisekisile ukuxhashazwa okukhulu kobuthakathaka bePeopleSoft emfundweni ephakeme, ubuchwepheshe, ukunakekelwa kwempilo, ezolimo, ezokuthutha kanye nohulumeni.

I-ShinyHunters itshele i-TechCrunch ukuthi ukwephulwa kwe-FBI kwakungengenxa yezimali futhi kwakuhloselwe ukuphikisa izinsolo ezibhekiswe eqenjini. Ithe ngeke ishicilele idatha ye-FBI eyebiwe. Inhloko yophiko lwe-cyber lwe-FBI, uBrett Leatherman, ubonge ozakwethu baseDutch futhi wanxusa amalungu asele ukuba azibophezele.

Ukulwa kobuholi ngaphakathi kwe-ShinyHunters

Imithombo eseduze nophenyo ithi izinyathelo zaleli qembu zakamuva eziyingozi ngokumelene ne-FBI kanye neqembu laseRussia i-Cl0p likhombisa ukushintsha kwesitayela salo esidala nesilinganiswa kakhulu. Kubikwa ukuthi lolu shintsho lulandele ukuthathwa yintsha eyisigebengu se-inthanethi esivela e-Amman, eJordan, eyaziwa ngokuthi uRey , esebenza ngaphakathi kwenhlangano ebizwa ngokuthi i-ScatteredLapsusHunters.

Leyo nhlangano ichazwa njengengxube ye-Scattered Spider, i-LAPSUS$ kanye ne-ShinyHunters. Kuthiwa uRey wayenengxabano nomdubuli waseDashi ngokulawula uphawu lwe-ShinyHunters kanye nedatha . Isithombe esikhulu se-Umbreon esishiywe ekhasini lokuguqulwa kwe-FBI sibonwe njengomzamo wokufaka i-Dutchman ekudubuleni.

URey ugcone uCl0p kanye ne-FBI ku-Twitter/X nge-meme; i-akhawunti yakhe yasuswa kamuva ngemuva kokuba intatheli ifune ingxoxo. Umbiko we-Wired uthi i-ShinyHunters kanye ne-SLSH babambisana isikhashana ne -TeamPCP ukuze benze imali ngeziqinisekiso ezibiwe, kwabe sekuthi i-ShinyHunters yaba yizigebengu futhi yagcina imali. UMandiant wayengene ngenkani kwi-TeamPCP futhi wanikeza iziqinisekiso kubahlinzeki bamafu, okwakwenza okhiye bangasebenzi.

I-athikili ehlobene:

Umhlahlandlela Ophelele Wokubambisana Okubomvu Kwezinhlelo Zokukhiqiza ze-AI

Umcwaningi waseMandiant u-Austin Larsen uthe iShinyHunters ibilokhu ixhaphaza futhi ingase ithole cishe amaRandi ayizigidi eziyi-100 ezisulu ngo-2026. UVan der Stap uthe ubugebengu bakhe bangaphambilini babubangelwa yisifiso sokuqoqa imininingwane, hhayi imali.

I-TA419 ehambisana neShayina izenza ochwepheshe benqubomgomo ye-AI

I-Proofpoint ithi iqembu elihambisana neShayina elibizwa nge- TA419 belilokhu lizenza ochwepheshe be-AI e-US, okubalwa kubo uLynne Edwards Parker, owayeyisekela lomqondisi oyinhloko we-White House Office of Science and Technology Policy. Lo mkhankaso ubulokhu usebenza kusukela ngo-Ephreli 2025.

Ama-imeyili abonakala engenangozi ekuqaleni futhi ayevame ukumema abamukeli ukuthi bajoyine 'iKomidi Elilulekayo Lenqubomgomo Ye-AI.' Uma umuntu ohlosiwe ephendula, abahlaseli bathumela ikhasi lokungena elingelona iqiniso elenzelwe ukweba iziqinisekiso. Izisulu zazihlanganisa ochwepheshe benqubomgomo ezinhlanganweni zokucabanga, osonkontileka bezokuvikela, amanyuvesi kanye nezinkampani zomthetho e-US naseJapane.

Le ndlela idala isiphequluli esingumgunyathi ngaphakathi kwekhasi lewebhu elisemthethweni, silingisa isixwayiso sokungena ngemvume sangempela ukuze izisulu zingabi naso ithuba lokubona ukuthi zidlulisela ulwazi. I-Proofpoint ayizange isho zonke izisulu, kodwa i-Reuters iqinisekisile ukuthi u-Alex Engler, owayeyisikhulu se-White House manje ohola i-Penn Center on Media, Technology, and Democracy, uthole omunye wemiyalezo futhi wathola ukuthi uvela kumuntu ozenzisa.

NgoFebhuwari, iqembu elifanayo lazenza isisebenzi esidumile se-Anthropic ngenkathi lihlose ochwepheshe benqubomgomo ye-AI. I-Proofpoint ilindele ukuthi i-TA419 iqhubeke nokusebenzisa ubungcweti bomhlaba wangempela ngokumelene nama-think tanks kanye nochwepheshe benqubomgomo. UParker akazange aphendule esicelweni sika-Al Jazeera sokuphawula.

I-athikili ehlobene:

Ukusungula Umkhawulo Wokuqukethwe Okuphephile Kwama-ejenti Okubhala Amakhodi e-AI

Lokho abantu nabavikeli okufanele bakubheke

Kumaqembu okuphepha, izinkomba ze-NeedyMantis kanye nokuxhashazwa kwe-PeopleSoft kubonisa indlela abahlaseli abahlanganisa ngayo isofthiwe ethembekile, iziqinisekiso ezibiwe kanye nobuthakathaka obaziwayo. Ukuhlola ithrafikhi ephumayo , ukubuyekeza imithwalo ye-DLL engavamile, kanye nokulungisa amapulatifomu e-HR noma okuqasha abonakalayo kunganciphisa iwindi.

Kubasebenzisi abavamile, umkhankaso we-TA419 uyisikhumbuzo sokuthi ama-imeyili acwebezelayo kanye nemiyalelo yokungena engokoqobo kusengaba ubugebengu bokweba imininingwane ebucayi. Ukuqinisekisa izimemo ezingalindelekile ngesiteshi sesibili nokusebenzisa ukuqinisekiswa kwezinto eziningi okumelana nobugebengu bokweba imininingwane ebucayi kuyasiza.

Kulezi zimo, intambo evamile ukufinyelela: amaqembu axhumene nohulumeni afuna ukuhlala efihliwe ngaphakathi kwamanethiwekhi, kuyilapho amaqembu ezigebengu efuna ukuguqula idatha eyebiwe ibe yizinkokhelo kanye nokusebenzisa umphakathi. Ukuhlaziywa kwe-NeedyMantis kukhombisa ukuthi ukulayisha eceleni kwe-DLL kanye ne-WebSocket C2 kungaguqula kanjani amathuluzi asemthethweni abe yindawo yokuhlala; ukuboshwa kwe-ShinyHunters kanye nokwephulwa kwe-FBI kukhombisa ukuthi uhlobo lobugebengu lungakhula ngokushesha kangakanani ngemva kwesiphithiphithi sangaphakathi; kanye ne-phishing ye-TA419 enesihloko se-AI ikhombisa ukuthi ubunjiniyela bezenhlalo busasebenza kangcono uma buboleka igama elithembekile. Azikho kulezi zindaba ezihlukanisiwe , futhi izifundo zokuzivikela ziyahlangana: ukulungisa ngokushesha, qaphela ithrafikhi engavamile kanye nemithwalo yamafayela, futhi uphathe izicelo zokungena ezingacelwanga ngokusola.

I-athikili ehlobene:

I-Indra ithatha u-30% we-TRC ukuqinisa ukuphepha kwe-inthanethi okuzimele