اپراتورهای BlackCat در حال توزیع یک باج‌افزار پنهان با عنوان WinSCP از طریق Malvertising

?? ????? ??????? ?????? ????  ???? ????? ????? ????? ????? ?? ????????? [?]BlackCat ?????? ??????? ?? ?? ???????? malvertising ???? ????? installer??? ???? ???????? ??????? ????? WinSCP ??????? ???????.

?????? Trend Micro ?? ?????? ?? ???? ????? ????? ??? ?? ??? ???? ?????[?]: «???????? ???? ?? ??????? ?? ???? ????? ?? ??????? ?? ???? ????? ?? ????????? ??? ?????????? ?????? ??????? ?????. ?? ??? ????? ????? ???? ?? ???? ?? ?? ?????? ????? WinSCP ??? ?? ?? ?????? ?????? ???????? ???? ?????? ???? ???.»

[?]Malvertising ?? ??????? ?? ????????? ??????? SEO[4] ???? ?????? ??????? ?? ???? ??????? ?????? ????? ????. ??? ??????? ???? ????? ????????? ?? ????? ????? ?????? ??? ???? ????? ??????? ???? ?? ????? ????? ?????? ???? ? ???? ????? ????? ???? ??????? ?????? ?? ????? ???? ???.

???? ??? ??? ?? ???????? ?? ?? ?? ?????? ??????????? ????? WinSCP ???? ?????? ??????? ????? ???? ????? ?? ??? ????? ?? ??? ???? ???? ?? Cobalt Strike Beacon[5] ??? ?? ???? ?????? ???? ?? ?? ???? ??? ??? ???? ??????? ????????? ?? ???????? ?????? ????? AdFind ???? ????? ??? ???? ??? ??????? ??????.

?????? ????? ??? ???? Cobalt Strike ????? ???? ?????? ?????? ?????? ???? ????? ???????? ????? (PowerView)? ???? ????? (PsExec)? ?????? ????????? ?????????? (KillAV BAT) ? ??????? ???????? ????? (?????? PuTTY Secure Copy) ???? ?????????? ???? ???????. ?????? ??????? ?? ????? ???? ????? ?????????[?] ???? ???????? ????????? ?????? ?? ??????? ?? ???? Bring Your Own Vulnerable Driver ?? BYOVD[7] ?????? ??? ???.

?? ??? ?????? ???? ?? ???? ??? ???? ????? ?????? ????? ???? ??? ???? ????? ????? ???? ?? ???? ???????? ???? ??? ???? ???? ????? ?????????? post-exploitation ???? ? ???? ????? ?? ??????? ?? ???????? ????? ? ?????? ?? ??? ??? ????? AnyDesk ? ?????? ?????? ?? ??????? ???????? ??????? ?? ?????????? ????.

Trend Micro ???: «????????? ???? ??? ????? ??? ?????? ???? ???????? ??? ???? ?? ??? ?????????? ????????? ??? ???? ???? ???????? ??????? ??????????? ????? ????? ????? ???? ??? ????? ?? ???????? ???? ????? ?????? ????? ????? ????? ? ???? ?? ????? ????? ???? ? ??????? ???? ?????.»

??? ????? ????? ????? ?? ????? ????? ??? ?? ?? ?????? Google Ads ???? ????? ??????? ??????? ???????. ?? ?????? ????? ?????????? ?? ????? ???? ?? ??? ???[?] ?? ?? ?? ????? ???????? ???? ??????? BATLOADER ??????? ?????? ?? ??? ???? ??? ????????? ????? ??????? ?????.

?????? ???? ????? ?????? Avast ?? ??????? ?????? ???? ????????? ????? Akira ????? ???[?] ?? ?? ???????? ??? ??? ?? ???????? ??? ?? ???? ?????? ????? ?? ????????? ??????? ????. Akira ?? ???? ????????? ?? ???? ???? ???? ??? ?? ?? ???? ????? ??? ??? ?? ????? ???? ???[??] ?? ????????? ?????? ?? ??? ???? ???.

?????? Avast ????????: « Akira ??? ????? ?? ????????? Conti v2 ???? ?? ???? ??? ?????????? ??? ???? ?? ????????? ??? ??????? ????? ?? ????? ??? ??? Conti ????? ?????????.» ??? ???? ???? ????? ???????? ???????? ??? ????????? ?? ??? ????.

??????? Conti/TrickBot? ?? ??? ?????? Gold Ulrick ?? ITG23? ?? ??? ?? ???? ?? ?? ???? ?? ??? ????????? ???? ???? ?? ???? ????? ????? ?? ???????? ????? ??[??]. ??? ??? ???? ????? ?????????? ?? ?? ????? ?? ???? ??? ????? ??????? ????? ???????? ??????? ??????? ? ?? ???????? ? ??????????? ????? ???? ????? warez ??? ??????? ???????.

IBM Security X-Force? ?? ??? ???? ??? ?? ????????? ??? ???? ?? ??????????? ???? ???????? ? ????????? ????????? ???? ???? ?? ??????? ???? ???????? ?????????? ? ?????? ?? ???????????? ?????? ???? ?????? ????? ?????????? ???? ????? Aresloader? Canyon? CargoBay? DICELOADER? Lumma C2? Matanbuchus? [??]Minodo (?????? ????)? [??]Pikabot? SVCReady? Vidar  ??????? ???????.

?????? ?????? ? ???? ???????? ?????? ??????? ?????[??]: «?????????? ???????? ?????? ?? ??????????? ??????? ???? ????? ?? ITG23 ? ????? ????? ???? ??????? ???????. ?????????? ???? ITG23 ? ???? ???????? ????? ? ??????? ????? ?? ???? ??????? ?? ????????? ????? ?????? ???.»

??????? ????? ????? ???????? ????? ??????? ??????????? ???????? ?????? ???? ??????? ? ???????? ? ???? ?? ?????? ?? ?? ?? ???? ???????? ?????????? ???????? ???? ??? ?? ????? ???????? ?? ??? ????? ??? ?? ????? ???????? ??? ????????? ?????? ?? ????? ?????[??] ???.

??? ???? ???? ?? ???? ???? ????????? ???????? ?? ????? (RaaS) ?? ??? Rhysida ??? ?? ?????? ??????? ?????? ????? ????? ? ?????? ?? ?? ????? ?????? ????? ??????? ????? ? ????? ? ???????? ??? ????? ???? ???? ???.

SentinelOne ?? ?? ????? ??? ???[??]: «Rhysida ?? ?????? ????????? ???????? ????????? (PE) ?????? ?? ???? ??? ?? ?? ??????? ?? MINGW/GCC ??????? ??? ???. ?? ?? ????? ???????????? ???? ??? ?????? ??? Rhysida-0.1 ????? ??? ???? ?? ???? ?????? ??? ????? ?? ????? ????? ????? ???.»

?????

[?] https://thehackernews.com/2023/06/improved-blackcat-ransomware-strikes.html

[?] https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html

[?] https://thehackernews.com/2023/04/crypto-stealing-opcjacker-malware.html

[?] https://www.sentinelone.com/blog/breaking-down-the-seo-poisoning-attack-how-attackers-are-hijacking-search-results

[?] https://www.reliaquest.com/blog/cobalt-strike-servers-ransomware

[?] https://www.reddit.com/r/crowdstrike/comments/13wjrgn/20230531_situational_awareness_spyboy_defense

[?] https://thehackernews.com/2023/04/ransomware-hackers-using-aukill-tool-to.html

[?] https://thehackernews.com/2022/11/microsoft-warns-of-hackers-using-google.html

[?] https://decoded.avast.io/threatresearch/decrypted-akira-ransomware

[??] https://blog.cyble.com/2023/06/28/akira-ransomware-extends-reach-to-linux-platform

[??] https://thehackernews.com/2022/05/conti-ransomware-gang-shut-down-after.html

[??] https://thehackernews.com/2023/04/fin7-and-ex-conti-cybercrime-gangs-join.html

[??] https://apa.aut.ac.ir/?p=9769

[??] https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now

[??] https://thehackernews.com/2023/06/8base-ransomware-spikes-in-activity.html

[??] https://www.sentinelone.com/blog/rhysida-ransomware-raas-crawls-out-of-crimeware-undergrowth-to-attack-chilean-army

[??] https://thehackernews.com/2023/07/blackcat-operators-distributing.html