روی آن فایل ZIP کلیک نکنید! پسوندهای .ZIP برای فریب قربانیان مسلح شدهاند!
?? ????? ??????? ?????? ???? ???? ????? ?? ????? ???? ?????? ?? ??? “??????? ???? ?? ??????” ?? ??????? ???? “?????????” ?? ????????? ??????? ???? ?? ?????? ?? ?? ????? ?????? ?????? ?? ????? .ZIP ??????? ???.
???? ?????? mr.d0x ???? ????? ??? ???[?]: “?? ??? ???? ??????? ??? ?? ????????? ??????? ???? (????????????? WinRAR) ?? ?? ?????? ????????? ??????? ? ?? ?? ????? .zip ??????? ??????? ?? ????????? ?? ??? ????.”
?? ??? ?????? ????? ????? ????????? ?? ??????? ?? HTML ? CSS ?? ???? ???? ??????[?] ?? ???? ????? ????? ???? ?? ????????? ????? ???????? ?????? ?? ????? ?????? ? ?? ?? ?? ????? .zip ??????? ??????? ???????? ????????? ?????? ???????[?] ?? ????? ??????.
?? ?? ??????? ???? ???????? ????? ?? ???? ?? ???? contained ?? ??????? ZIP ???? ???? ??????? ?? ????? ???????? ?? ???? ???????? ????? ??? ?? ??????? ?? ?? ???? ???????? ?????? ????? ???.
mr.d0x ???????? ???: «?? ??????????? ???? ???? ?????????? ?? ???? ???????????? ??? ? ????? ?? ????? ???? ???? ?????? ???? ??????? ?? ???? ?????? ?? ?????? ??????. ??? ???? ?? ???? “invoice.pdf” ?????. ???? ????? ??? ??? ???? ???? ??????? ?????? ?? exe. ?? ?? ???? ????? ?? ???? ??????.”
????? ?? ???? ???? ????? ?? Windows File Explorer ???????? ???????? ?? ????? ?????? ???? ??? ?? ?? ?? ????? ???? ?? ???? .ZIP ??? ?????? ?? ?? ???????? ?? ?????? ?? ??? ??????? ?????????? ??? ???? ?? ????? .zip ??????[?] ?????? ????? ????.
??? ???? ???: “??? ???? ??? ?????? ???? ???? ???? ????? ?????? ???? ?? ???? ZIP ?? ?????. ?????? ?? ????? ??? ??? ?? ????? ???? ????? .zip ?? ?? ????? ????? ????? ???? ???? ?? ??? ?????? ?????????? ?????? ? ?????? ?????? ?? ??? ??????.”
??? ????? ????? ????? ?? ?? ???? ??? ????? ???? ??? ???? (TLD) ?? ???? “.zip” ? “.mov” ?? ????? ???[?] ?? ???? ????????? ?? ?? ???? ????? ???????? ?????? ? ???? ????? ?????????????? ?????? ?? ???? ???[?]? ????? ???? ???.
??? ?? ??? ???? ??? ?? .ZIP ? .MOV ?? ?? ??? ????? ???? ?????? ????? ? ?? ??? ?????? ???? ??????? ??????? ?????? ?? ?????? ?? ?? ??????? ???? ??????? ?? ????? ?? ???? ?? ??? ???? ? ???? ?? ???? ???? ?? ?? ??? ?????? ?? ??????? ?? ?????? ????.
Trend Micro ?? ??? ???? ???[?]: ???????? Zip ???? ???????? ???? ?? ????? ????? ?????? ???? ??????? ???????? ??????? ?? ?? ?????? ????? ?? URL ???? ?? ??? ???? ?? ????? ?????? ?????? ???????.
????? ?? ??????????? ZIP ?? ???????? ?????? ??????????? ???? ????????? ??? ?????? ???? ???? ?? ???????? ???? ?? URL??? ????? ?? ZIP ???? ?????? ??????? ?? ????? .zip TLD ??????? ????.
????????? ????????[?] ?? ??? ???? ?? ???? ??? ???? ?? ??????? ??? ??? ????? ? ??? ??????? ????? ??? ???[?]? ?????? ?????? ????????? ?? ?? ??? ?? ??? ??????? ?? ?? ???? ???? ???? ?????? ????? ???.
??? ??? ?????? ?? ???? ???? ??????? ?? ???? ????? ?????? Group-IB ????? ??? ?? ??? ???? ?????? ?? ????? ?? ??????? ?? ??????? ??????[??] ?? ??????? ???? ??? ? ???? ??? ??????????? ?? ?? ?????? ?? ??? ??? ??????? ???? ???.
?????? ???? ??????? ?? ?????? ???? ???????? ??????? ?????? ??? ?? ??? ???? ?? ??? ???? ?? ??? ???? ?? ??? ???? ??????? ?? ????? ??? ???.
????? ?????? ??? ????????? ??????? ? ?????? ?????? ?? ??? ?????????? ??? ????????? ?????? ?? ?????????? ???? ??????? ????? ??????? ?? ???? ??????? ? ????????????? ???? ????? ???????.
??? ???? ????? ?? ??????? ???[??]: «?????????? ?????? ???????? ???????? ?????? ????? ??????? ?? ??? ???? ?????? URL ???? ??? ?????? ??????????? ??? ? ???? ????? ????? ??????????? ????.»
“??? ????? ?? ?????? ????? ?????? ?? ?? ??????? ? ????????? ?? ???? ???? ??????? ????? ???? ?????? ?????? ??? ?? ???? ???????.”
??? ????? ?????[??] ?? Perception Point? ????? ????? ?????? ?????????? ?? ???? ????? ????? ?? ??? ???? ????? ??? ??? ???? ?????? ????. ????? ?? ????? ?? ??? ???? ?? ???? ?????? ????? ???.
??? ????? ????? ??????? ?????? ?? ??? ????? ?? ????? ?????? ??? ??? ?? ?? ???????? ?????????? ??? ? ????????? ???????? ??? ?? ???? ????? (rpmsg.)[13] ???? ???????? ?????? ??????? ??????? ???????.
Phil Hay ? Rodel Mendrez? ?????? Trustwave ?? ??? ???? ????? ?????[??]: «??????? ?? ???????? ?????????????? rpmsg ?? ??? ???? ??? ?? ?????? ?????? ????? ?? ???? ???????? URL? ?? ?????????? ???? ????? ????? ???????.»
????? ????? ?? ???? Proofpoint ?????? ??? ???[??] ?????? ?????????? ??????? ?? ????????? ?????? ?? ??????? ?????????? ???? ????? ????? ?????? ? ??????? ???? ?? ???? ??????? ?? ????????????? ???? ?? ?? ???? ?? ???????? URL??? ??????? ?? ???????? ???? ?? ???? ???????? API.
??? ???? ??????? ??????? ???????? ???: “?????? ??????? ?? ??????? ????????? ????????? ?????? ?? ???? Teams ????? ??????? ????? ??????? ?? API ?? ???? ?????? Teams ???? ????? ???? ?? ???????? ????? ?? ???????? ????? ??? ???.”
??? ??? ?? ??????? ?? ???????????? ???????? ??????? ?? ????????? ?? ?? ??????????? ???? ?? ????? ???? ????? ??????? ????? ???.
?????
[?] https://mrd0x.com/file-archiver-in-the-browser
[?] https://github.com/mrd0x/file-archiver-in-the-browser
[?] https://www.cisa.gov/news-events/alerts/2023/05/25/cisa-warns-hurricanetyphoon-related-scams
[?] https://twitter.com/RakeshKrish12/status/1660530829624500224
[?] https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech
[?] https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html
[?] https://www.trendmicro.com/en_us/research/23/e/future-exploitation-vector-file-extensions-as-top-level-domains.html
[?] https://arstechnica.com/information-technology/2023/05/critics-say-googles-new-zip-and-mov-domains-will-be-a-boon-to-scammers
[?] https://www.wired.com/story/google-zip-mov-domains-phishing-risks
[??] https://thehackernews.com/2023/04/researchers-uncover-thriving-phishing.html
[??] https://www.group-ib.com/media-center/press-releases/phishing-kits-2022
[??] https://perception-point.io/news/perception-point-report-finds-that-advanced-phishing-attacks-grew-by-356-in-2022
[??] https://en.wikipedia.org/wiki/Rpmsg
[??] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-encrypted-restricted-permission-messages-deliver-phishing
[??] https://www.proofpoint.com/us/blog/threat-insight/dangerous-functionalities-in-microsoft-teams-enable-phishing
[??] https://thehackernews.com/2023/05/dont-click-that-zip-file-phishers.html
??????? : ???? ??????
???? : ???? ??? ??????? ????? ????????
