?? ?????? ????? ?????? ????? ?? ?????? ? ?? ????? ?? ?? ??? Legion ?? ???? ?????? ???????? ???? ???? ????? ????? ???? ???? ?? ????????? ?????? ????? ???? ??????????? ????? ?? ????? ???? ??????.
??? ???????? Cado Labs? Legion ???? ?????????? ???? ????? ??????? ????????? SMTP? ????? ????? ????? ?? ?? ??? ??? (RCE)? ??????????? ?? ???????? ?????????? ?????? ? ???????? cPanel ? WebHost Manager (WHM) ??? [?].
???? ?????? ?? ??? ??????? ?????????? ?? ??????? ??????? ????? ?? ??? AndroxGh0st ???? ?? ????? ??? ???? ??????????? ????? ????? ???? Lacework ?? ?????? ???? ??? ?? [?].
???? ????? ?????? SentinelOne? ?? ??????[?] ?? ????? ??? ????? ????? ??? ??? ??? ?? AndroxGh0st ???? ?? ?????? ????? ????? ?? ??? AlienFox ??? ?? ?? ????? ????? ???? ???? ?????? ? ????? API ?? ????????? ???? ????? ??????.
Matt Muir? ???? ?????? ?? The Hacker News ?????????? ???: «?? ??? ?????? ?? Legion ???? ?? ??? ?????? ???????? ???????? ??????/??????? ?????? ?? ??? ???. ????????????? ??? ??????? ???? ?? ?????? ?? ???????? ? ??????? ???? ???? ?? ?? ???? ??? ?? ????? ???????.»
????? ?? ??????? ?? ?????? ???????? ???? ??????? ????? Legion ???? ??????????? ?? ??????? ?? ?? ?????????? ?????? ????? (CMS)? PHP ?? ???????????? ????? ?? PHP ????? ?????? ?? ???? ???????? ????? ??? ???.
Cado Labs ?????????? ???: “??? ???????? ?????? ??? ????????? ?? ????? ?? ????? ????????????? ?????? ????????????? ????? ????? ?????????? ?????? ????? ?????????? ???? ? ?????????? ?????? ????? Stripe ? PayPal ?? ??????? ???.”
???? ???? ?? ??? ????? ?????? ????????? ?? SendGrid? Twilio? Nexmo? AWS? Mailgun? Plivo? ClickSend? Mandrill? Mailjet? MessageBird? Vonage? Exotel? OneSignal? Clickatell ? TokBox.
??? ???? ??? ??????? ??? ??? ?? ????? ????? ?? ???? ???? ?? ???????? ?? ????? ? ?????????? ?? ???? ????? ????? ?????? ????? ??????????? ????? ? ????????? ??????????? ??????? ???? ????.
??? ???? ????? ?????? ??? ?? ?????? ?? ????? ?????? ???? ???????? ?????? ?? ???? ???? ??????? ?? Legion ??? ???? ??? ?? ???? ?????? ??? ????? ?????? ?????? ????? ??? ??? ? ???????? ?? ??????? ???? ???. ????? ??????? ?? ?? ?? ???? ???? ????? ??? ?? ???? ????? ??? ??? ?????? ???? ???.
????? ?? ???? Legion ?????? [?]AWS ?? ?? ??????? ?? ????? ?? ???????? ?????? ??????? ?????? ? ???????? ??????? SMS ?? ?? ??????? ???????? ???? ????? ???????????? ????? AT&T? Sprint? T-Mobile? Verizon ? Virgin ????? ??????.
Muir ???: “???? ????? ??? ???? ??????? ?? ???????? ?? ?? ????? ?????? ??????? ?? ??????? www.randomphonenumbers.com ??????? ??????. ??? ?? ?? ???? ????? ????? ????? ??????? ???? ????? ????? ?? ????? ??? ???? ???? ??? ??????? ??????.”
??? ???? ?? ???? ??? ???? ???? Legion ??????? ?? ?? ??? ??????? ?? ???? ????? ??? ?????? ??? PHP ???? ??? ?? ????? ?? ???? ?????? ?? ??? ??? ????? ?? ????? ????? ???? ???.
???? ???? ????? ??? ??? ?????? ?? ?? ??? ?????? “forzatools” ?? ?????? ??????? ??????? ???????? ???? ????? ???? ????? ???? ????? ?????????? ???? ?? ?? ???? ???? ?????? ?? ??? ????? ????? ???? ??? ?????????? ?? ????? ?? ??? ???? ????.
???? ?????? SentinelOne? Alex Delamotte ?? The Hacker News ???: ????? ??? ???? ????????? ???? ?? ?????? ?? ??? ?? ????? ?? ????? ??? AlienFox ?????? ???? ??? ? ??? ?? ???? ??????? ?? ?????? ????? ???? ?????.
Delamotte ????? ???: “???????? ????????? ????? ???? ????? ??? ??????? ?????? ????? ????? ???????? ? ?????????? ?????? ???. ?? ?????? ?? ???????? ?? ??? ????? ??? ??? ?? ??? ????? ?????? ????????? ??????????? ???? ?????? ???????? ???? ?? ?????? ??????? ? ????????? ????? ?? ?? ???????? ??? ????? ???????.”
Muir ?????????? ???: «??????????? ??? ??????? ?????? ?? ???????????? ?????? ?? ?????????? ? ?????????? ?? ???? ????? ?????? ???? ???? ????? ?????? ?? ??????? ??? ????????? ?????? ????? ??? ?? ????? ???? ? ????? ???? ?? secret ?? ???????? ????? ???????.»
?????
[?] https://www.cadosecurity.com/legion-an-aws-credential-harvester-and-smtp-hijacker
[?] https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys
[?] https://thehackernews.com/2023/03/alienfox-malware-targets-api-keys-and.html
[?] https://permiso.io/blog/s/legion-mass-spam-attacks-in-aws
[?] https://thehackernews.com/2023/04/new-python-based-legion-hacking-tool.html
??????? :
???? ??????
???? :
