?? ????? ??????? ?????? ???? ???? ????? ?????? ????? ?????? ?? ????? ?????? ?? ??? ????? ?? ??? ???????? ?? ?? ?? ?????? ???? ??????????? ???? ????? ??????? [?]XWorm ?? ????????? ???? ??? ?? ????????? ?? ?????????? Follina ??????? ??????.
Securonix ?? ??? ???? ?????? ?? ??? ??? MEME#4CHAN ?????? ??????? ??? ?? ???? ?? ????? ?????? ???????? ?????? ? ?????????? ?????????? ??????? ???? ?? ????? ?? ??? ???? ????????.
?????? ?????? Den Iuzvyk? Tim Peck ? Oleg Kolesnikov ?? ????? ????? ?? ?? The Hacker News ?? ?????? ?????? ??? ???? ????????[?]: «????? ???? ?? ?? PowerShell ?? ?? meme ?????? ???????? ??????? ?????? ? ?? ????? ?? ?? ?? ?????? XWorm ?????? ???? ???? ?????????? ???????? ??? ??????? ??????.»
??? ????? ?? ???? ????????? ????[?] ????????????? ?????? Elastic ??? ?? ??????????? ???? ????? ?? ????? ???? ?? ???? ???? ???????? ???? ??? ???? ????? ????? ?? ???? ?? ????? ?????????? XWorm ? Agent Tesla ?????? ???? ??????.
??? ????? ?? ????? ?????? ???? ????? ????? ??????? ?????????? ??? ???? ??????? ?? ?????? ??????? ?? ???????? ?????????? [?]Follina (CVE-2022-30190? ?????? ?/? ?? ????? CVSS) ?? ?? ???? ????? ?????? ?? ?? ??????? ???? PowerShell ?? ?????????? ???.
?? ????? ????? ????? ?? ??????? PowerShell ???? ?????? ???? ???? ?? ??????? ([?]AMSI)? ???????????? Microsoft Defender? ????? ??????? ? ?? ????? ?????????? ?????? ?????? ???? XWorm ?????????? ???????.
???? ??????? ?? ??? ?? ??????? ?? ??????? PowerShell ?? ??? $CHOTAbheem ??? ?? ???????? ???????? ?? [?]Chhota Bheem? ?? ?????? ????????? ???? ????????? ??????? ???? ???.
?????? ?? ????? ?? ????? ???? ????? ????? ?????? ????????? ???????? ???? ??????? ????? ?? The Hacker News ?????: “?? ???? ?? ????? ????? ?? ??? ?????? ?? ??? ?? ????? ?? ????? ??? ???? ??? ???????? ?????? ?????????/???? ????? ????? ????? ?????? ????? ???? ????? ???? ???.”.
XWorm ?? ??????? ?????[?] ??? ?? ???? ???? ?? ????????? ???????? ????? ?????? ? ????? ??? ????????? ?? ???????? ??? ?? ?? ?? ????? ?????? ??????? ???? ?? ?? ?????????? ????? ?????? ???.
??? ??????? ?????? ?? ????? ????????? ??? ???? ???????? ?????? ?????? DDoS ? ????????? ?? ????? ???? ?? ???? USB ??? ??? ? ?????????? ????? ?? ?????????? ???.
???? ???? ???? ????? ?? ??? ???? ?????? ???? ????? Securonix ??? ?? ??? ???? ????? ???????? ????? ?? ??? [?]TA558 ??? ?? ?? ????? ?????? ??? ??? ?? ???? hospitality ?? ????????? ???? ???? ???.
?????? ?? ??? ???? ?????: “????? ????????? ?????? ??????? ?? ????? ?????????? ???? ??????? ???????? ???? ?????????? ????? ?? ???????????? ??????? ?? ??? ??????? ????? ???[?]? ??? ????? ???? ?????? ????? ?? ???? ?????? ???? ??? ??? ?? ?? ???? ???????? ??? ???? ????? ?????? ??????? ?? ??? ???? ?? ???????? ????? VBscript ?? ??????? ???? ?????.”
?????
[?] https://thehackernews.com/2023/04/new-qbot-banking-trojan-campaign.html
[?] https://www.securonix.com/blog/securonix-threat-labs-security-meme4chan-advisory/
[?] https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla
[?] https://apa.aut.ac.ir/?p=9017
[?] https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
[?] https://en.wikipedia.org/wiki/Chhota_Bheem
[?] https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/
[?] https://thehackernews.com/2022/08/cybercrime-group-ta558-targeting.html
[?] https://apa.aut.ac.ir/?p=9176
[??] https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html
