Uphenyo lwakamuva lwezokuphepha kwe-inthanethi luthole i- umkhankaso wobunhloli bedijithali osebenzisa imidlalo ye-Windows ne-Android njengesicupho sokutheleleka abasebenzisi. Ngemuva kwalokho okubonakala kuyipulatifomu yokuzijabulisa elula kufihla i-malware eyinkimbinkimbi ekwazi ukuqopha umsindo, ukweba amadokhumenti, kanye nokulawula amadivayisi kude.
Leli cala lidale ukukhathazeka okukhulu phakathi kochwepheshe ngoba lihlanganisa izici ezimbili ezivame kakhulu: ukwanda kwe- imidlalo kuselula naku-PC kanye nesiko le landa izinhlelo zokusebenza ezitolo ezisemthethweni zangaphandleNakuba lo msebenzi ugxile esifundeni esithile saseShayina, indlela yokusebenza yabahlaseli iphindaphindeka kahle eYurophu naseSpain, lapho ukusetshenziswa kakhulu kwemidlalo nezinhlelo zokusebenza ezingekho emthethweni nakho kuyiqiniso.
Ipulatifomu yokudlala iphenduke ithuluzi lobunhloli be-inthanethi
Ngokusho kwethimba locwaningo lwe-ESET, ukuhlaselwa kuncike ku- ipulatifomu yokudlala eyaziwa ngokuthi iYanbian Red Tenenikeza imidlalo yamakhadi neyebhodi yendabuko. Le nkundla, etholakala kwi-Windows ne-Android, yafakwa engcupheni ukuze isabalalise i-spyware efihliwe, eyaziwa ngokuthi i-backdoors.
Abasebenzisi balande imidlalo kuwebhusayithi esemthethweni yesikhulumi, beqiniseka ukuthi iyizinhlelo zokusebenza ezisemthethweni neziphephile. Eqinisweni, babenjalo. Imidlalo ye-TrojanUmdlalo usebenzile futhi ukuvumele ukuthi udlale, kodwa ngesikhathi esifanayo ufake isofthiwe enonya ngemuva enamakhono amaningi okuhlola.
Endabeni ye-Windows, i-ESET ithole ukuthi iklayenti lomdlalo lishintshiwe nge- isibuyekezo esinonya okwagcina kufakiwe iminyango emibili ehlukene yangemuva kumakhompyutha athintekile. Ku-Android, imidlalo eminingana etholakala epulatifomu efanayo ishintshiwe ukuze ifake inguqulo yeselula yomnyango wangemuva.
Uphenyo luthi lokhu kuhlasela kubangelwe yiqembu le-ScarCruft, elaziwa nangokuthi I-APT37 noma i-ReaperNjengenhlangano yobunhloli be-cyber ehambisana nezintshisekelo zaseNyakatho Korea, leli qembu ligxile emisebenzini yalo e-Asia iminyaka eminingi, ikakhulukazi eNingizimu Korea nasezindaweni ezizungezile, yize ochwepheshe bengakuchithi ukuthi kungenzeka ukuthi amaqhinga afanayo angasetshenziswa kabusha kwezinye izimakethe, kufaka phakathi iYurophu.
Inhloso eyinhloko yomkhankaso ubunhloli babantu nezinhlangano Lokhu kuhlasela kuhlobene nesifunda saseYanbian, indawo yaseShayina enomphakathi omkhulu waseKorea futhi kubhekwa njengendawo yokuthutha ababaleki baseNyakatho Korea kanye nabaphambukeli. Ngakho-ke, lokhu akuyona nje ukuhlasela kwezomnotho kuphela, kodwa umsebenzi onesizathu esicacile sezepolitiki kanye nobuhlakani.
Iyini i-backdoor futhi kungani iyingozi kangaka?
Ingxenye eyinhloko yalo mkhankaso ukusetshenziswa iminyango yangemuva noma yangemuvaLolu uhlobo lwe-malware oluklanyelwe ukunika umhlaseli ukufinyelela okude nokuthule kudivayisi ethelelekile, kungaba yikhompyutha ye-Windows noma ifoni yeselula ye-Android.
Uma umnyango wangemuva usufakiwe, uvumela izigebengu ze-inthanethi lawula uhlelo ngokwengxenyeBangakwazi ukwenza imiyalo, balande i-malware eyengeziwe, bashintshe amafayela, bafake i-spyware entsha, noma bakhubaze izixazululo zokuphepha. Konke lokhu ngaphandle kokuthi umsebenzisi aqaphele noma yiziphi izinguquko ezisobala ezimweni eziningi.
Ngokungafani nezinye izinhlobo zamagciwane ezibonakala kakhulu, ezivame ukubangela ukuphahlazeka, ukuminyana, noma ama-pop-up, lezi zicabha zangemuva zenzelwe ungabonwa isikhathi esideNgenkathi umdlalo we-Trojan uqhubeka nokusebenza nokujabulisa umsebenzisi, isofthiwe enonya isebenza ngemuva iqoqa idatha ethakazelisayo.
Le ndlela yokungaqapheli kahle isibe yindlela ecacile yobugebengu be-inthanethi kanye nemisebenzi yobunhloli exhaswa nguhulumeni. Eqenjini elifana neScarface, iwusizo kakhulu. ukuhlala ngaphakathi kohlelo izinyanga noma ngisho neminyakaukukhipha ulwazi njalo, okubangela umonakalo osheshayo nosobala ovusa ama-alamu.
Ngaphezu kwalokho, ngokufihla i-backdoor emidlalweni ebonakala isemthethweni futhi etholakala kuwebhusayithi esemthethweni yesikhulumi, abahlaseli amathuba okuba isisulu sibethembe ayanda ngesikhathi sokulanda futhi uvale noma yikuphi ukusola kokuqala.
I-BirdCall: i-malware ye-Android eqopha umsindo futhi yebe idatha
Endabeni ye-Android, umnyango wangemuva ohlonzwe yi-ESET uqanjwe ngokuthi I-BirdCallLe malware ikhathaza kakhulu ngenxa yobubanzi bezimvume ezicelayo kanye nenani lolwazi elingalufinyelela uma isisulu sifaka umdlalo onegciwane.
I-BirdCall iyakwazi qoqa oxhumana nabo, imiyalezo ye-SMS, izingodo zezingcingoAmadokhumenti agcinwe kudivayisi, amafayela e-multimedia njengezithombe namavidiyo, kanye nokuqukethwe ebhodini lokunamathisela, lapho amaphasiwedi, amakhodi okuqinisekisa noma imininingwane yasebhange kuvame ukukopishwa khona.
Ngaphezu kwalokho, i-spyware ingenza umsebenzi ojwayelekile izithombe-skrini kanye nokuqoshwa kokhiyeLokhu kuvumela abahlaseli ukuthi bakhe kabusha izingxoxo, iziqinisekiso zokungena ngemvume, kanye nolunye ulwazi oluyimfihlo umsebenzisi alufaka kuzinhlelo zokusebenza zemiyalezo, amanethiwekhi omphakathi, noma izinsizakalo zezezimali.
Esinye sezici ezibucayi kakhulu yikhono layo loku Qopha umsindo we-ambient kusetshenziswa imakrofoni yocingo. Lo msebenzi uguqula ifoni ephathekayo ibe yidivayisi yokulalela eyimfihlo, evumela ukuthwebula izingxoxo noma imihlangano yobuso nobuso, into engathi sÃna kakhulu uma isisulu sinemithwalo yemfanelo yezepolitiki noma yebhizinisi noma siphatha ulwazi oluyimfihlo.
I-Malware nayo ingakwazi khipha okhiye abayimfihlo kanye neziqinisekiso okuhlobene nezinsizakalo nezinhlelo zokusebenza ezifakiwe, kanye nokukopisha amafayela omuntu siqu nawenkampani. Konke lokhu kuthunyelwa kubahlaseli kusetshenziswa izinsizakalo zamafu ezisemthethweni njengeDropbox ne-pCloud, isu elifihla ithrafikhi enonya njengokusetshenziswa okuvamile kwamapulatifomu asetshenziswa kabanzi.
Indlela imidlalo ethelelekile esatshalaliswa ngayo nokuthi kungani ingekho ku-Google Play
Uphenyo lwe-ESET lukwazile ukuthola ukuthi izisulu Balande imidlalo ye-Trojanized ngqo kuwebhusayithi yesikhulumi. kusuka ku-Yanbian Red Ten, besebenzisa isiphequluli kumadivayisi abo. Izihloko ezinikezwayo zazibonakala zisemthethweni, zihlobene nemidlalo yendabuko evela esifundeni, futhi zethulwa ngendlela evamile.
Izinhlelo zokusebenza nazo bezisebenza njenganoma yimuphi omunye umdlalo: zazivumela abasebenzisi ukuthi bancintisane nabangani, bahlanganyele emidlalweni yamakhadi, futhi bahlanganyele emiqhudelwaneni eku-inthanethi. ukubukeka kokujwayelekile Lokhu kuyisihluthulelo sokuvimbela umsebenzisi ukuthi angabi nokungabaza nokugcina uhlelo lufakiwe isikhathi eside.
I-ESET igcizelela ukuthi, ngesikhathi sokuhlaziywa komkhankaso, Ama-APK anonya awatholakalanga esitolo esisemthethweni se-Google Play.Konke kukhomba ukuthi ukusatshalaliswa kwenziwe kuphela kwiwebhusayithi esengozini, okuhambisana nokuziphatha okuvamile kwabasebenzisi abaningi abathi, befuna izici ezengeziwe noma izinguqulo zamahhala, balande imidlalo emakhasini angaphandle.
Ngokusho kwabacwaningi, akukaze kwenzeke ukuthola ngokunemba okuphelele Iwebhusayithi yaqala nini ukuthinteka? yesikhulumi. Kodwa-ke, ngokusekelwe ocwaningweni lwezinguqulo ze-BirdCall, kulinganiselwa ukuthi ukuhlasela kwaqala ngasekupheleni kuka-2024 futhi kwaqhubeka okungenani kwaze kwaba maphakathi no-2025.
Ngesikhathi sokuhlaziywa, okungenani imidlalo emibili ye-Android etholakala kusizinda sepulatifomu yayiye yaguqulwa yaba yiTrojan ukuze ifake iBirdCall. Ekhasini lokulanda, i-ESET ikwazile ukuhlonza ngokucacile izinkinobho ze ukulanda kwezihloko ezinegciwane, okwakungahlukaniseki kumsebenzisi ojwayelekile kunoma yiluphi olunye uhlelo lokusebenza olusemthethweni.
I-malware ehlala ishintshashintsha egxile ekuqapheleni.
Enye yezinto eziphawuleka kakhulu ezitholwe yilo mbiko ukuthi i-BirdCall akuyona ingxenye ye-malware engaguquki, kodwa i- iphrojekthi ngokuziphendukela kwemvelo njaloAbacwaningi be-ESET bathole okungenani izinhlobo eziyisikhombisa ezahlukene ze-spyware, kusukela ku-1.0, enomhla ka-Okthoba 2024, kuya ku-2.0, eyavela ngoJuni 2025.
Inguqulo ngayinye entsha yengeze noma yathuthukisa amakhono obunhloli, yathuthukisa izindlela zokuxhumana namaseva omyalo nokulawula (C&C) kanye namasu acwengisisiwe okugwema ukutholakala nge-antivirus kanye namathuluzi okuhlaziya. Ukusetshenziswa kwezinsizakalo zamafu njengeDropbox noma i-pCloud ukudlulisa idatha eyebiwe kuyisibonelo esihle salo mzamo wokungatholakali.
Le ndlela yokusebenza ibonisa ukuthambekela okucacile esimweni samanje sosongo: amaqembu athuthukile awasaneliseki ngokuqala imikhankaso eyodwa, kodwa Balondoloza futhi bavuselela inqwaba yabo ye-malware ngendlela efanayo naleyo inkampani yezobuchwepheshe ethuthukisa ngayo imikhiqizo yayo.
EYurophu naseSpain, lolu hlobo lokuziphendukela kwemvelo lubonisa ukuthi ukuhlaselwa okubonakala kukude namuhla, okugxile ezindaweni ezithile zase-Asia, kungaguquka ngokushesha kube izinsongo zomhlaba wonke nezingasetshenziswa kabushaImodeli efanayo ye-malware efihliwe emidlalweni ingashintshwa kalula ukuze ivumelane nezihloko ezidumile endaweni yethu.
Njengoba lo msebenzi uhlobene nobunhloli be-inthanethi, hhayi kakhulu nemikhankaso emikhulu yokukhwabanisa kwezomnotho, umthelela wokuqala ungase ubonakale ulinganiselwe. Kodwa-ke, ulwazi lubonisa ukuthi abaningi amasu athuthukiswe amaqembu kahulumeni Kamuva zamukelwa yizigebengu ezivamile ze-inthanethi, zandisa ukufinyelela kwazo kubasebenzisi kanye nezinkampani emhlabeni jikelele.
Kungani i-hook yemidlalo yevidiyo isebenza kahle kangaka
Ochwepheshe bezokuphepha kwe-inthanethi bayavuma ukuthi Imidlalo yevidiyo isibe yinto ebaluleke kakhulu Kubahlaseli, lokhu kungenxa yobuningi babadlali kanye nemikhuba yokulanda ngaphandle kweziteshi ezisemthethweni.
Kuvamile ukuthi abasebenzisi baseshe ku-inthanethi izinguqulo zamahhala zemidlalo ekhokhelwayo, ama-mods angekho emthethweni, ukufinyelela kwangaphambi kwesikhathi, noma okuqukethwe kwe-premium mahhala. Lokhu kusesha kubaholela ku- amakhasi anemvelaphi engabazekayoamaforamu, izixhumanisi ezabiwe ezinkundleni zokuxhumana noma iziteshi zemiyalezo lapho ukuqinisekiswa kokuphepha kungekho khona.
Kulesi simo, ipulatifomu enikeza imidlalo yesifunda noma izihloko ezikhethekile ibonakala ingasolisi kangako: abasebenzisi abaningi bahumusha ukuthi uma umdlalo ungaziwa kangako noma ugxile emphakathini othize, kuvamile ukuthi ungabi sezitolo ezisemthethweni. Lo mbono wenza kube lula... Ama-APK ayalandwa futhi afakwa kumawebhusayithi ezinkampani zangaphandle ngaphandle kokucabanga kabili.
Esinye isici esibalulekile ukuthi imidlalo yevidiyo ayisetshenziswa kuphela ekhaya. Namuhla, amaselula omuntu siqu nawomsebenzi Zivame ukuhlanganiswa, futhi akuvamile ukuthi isisebenzi sibe nezinhlobo ezifanayo zemidlalo engahleliwe efonini yaso yomsebenzi esingazifaka kudivayisi yaso. Uma i-malware efana ne-BirdCall ingena kuselula esetshenziselwa i-imeyili yenkampani noma ukufinyelela okude ezinhlelweni zangaphakathi, isango lolwazi lwenkampani lishiywa livulekile.
Kuzinhloli ze-inthanethi kanye nezigebengu, lokhu kuhlangana phakathi kokuzilibazisa nomsebenzi kuguqula imidlalo ibe yi- Ipulatifomu efanelekile yokungena ezindaweni zobungcweti ngaphandle kokuphakamisa izinsolo, kokubili eSpain nakwamanye amazwe aseYurophu lapho ukuhambahamba kwemisebenzi kanye nokusebenza ngocingo kuvamile khona.
Izimpawu zesixwayiso zokuthola imidlalo nezinhlelo zokusebenza ezisolisayo
Nakuba umkhankaso otholwe yi-ESET ugxile endaweni ethile, izincomo zochwepheshe ziyasebenza kunoma yimuphi umsebenzisi waseYurophu olanda imidlalo ku-Windows noma ku-Android. Kunezinhlobo eziningana izimpawu zokuxwayisa okufanele kukhunjulwe ngaphambi kokufaka izinhlelo zokusebenza ezingaziwa.
Enye yezinto ezicacile kakhulu yile izicelo zemvume ezeqile noma ezingahambisaniUma umdlalo wekhadi olula ucela ukufinyelela kumakrofoni, imiyalezo ye-SMS, irekhodi lamakholi, noma yonke isitoreji sedivayisi ngaphandle kwesizathu esisobala, kuyimbangela yokusola. Lokhu kuyasebenza uma kudinga ukuvumela izici zokufinyelela ngaphandle kwencazelo ekholisayo.
Kufanele futhi uqaphele izinhlelo zokusebenza ezilandiwe kusuka ku- amasayithi angaphandle, izixhumanisi ezinkundleni zokuxhumana noma amaqembu emiyalezoEsikhundleni sokuvela ezitolo ezisemthethweni njenge-Google Play noma, uma kukhulunywa nge-Windows, amapulatifomu aqashelwayo. Nakuba lezi zitolo zingenaphutha, zinezilawuli eziningi kunewebhusayithi engahleliwe.
Esinye isibonakaliso ukuntuleka kolwazi oluthembekile mayelana nesicelo: Amazwana ambalwa, unjiniyela ongaziwa noma amakhasi okusekela angekho. Uma, ngaphezu kwalokho, umdlalo uthembisa okuqukethwe kwe-premium okuvuliwe noma izici ezivame ukukhokhwa, ingozi yokuba yisicupho sokusabalalisa i-malware iyanda kakhulu.
Endaweni yedeskithophu, izincomo ziyafana: gwema ukufaka ama-executable avela emithonjeni engabazekayo, hlola isiginesha yesofthiwe uma kungenzeka, futhi ugcine uhlelo lokusebenza kanye nezixazululo zokuphepha zisesikhathini ukuze kuqiniswe ukutholwa kwezinsongo.
Okufanele ukwenze uma usola ukuthi idivayisi yakho inegciwane
Ochwepheshe bezokuphepha kwe-inthanethi batusa ukunaka izinguquko ezingavamile ekuziphatheni kwedivayisiNakuba kungezona zonke izimpawu eziqondile, zingaba uphawu lokuthi kukhona okungahambi kahle.
Phakathi kwezinkomba ezivame kakhulu yi- Ukushisa ngokweqile ngaphandle kwesizathu esicacile, kuphakeme kakhulu kunokusetshenziswa kwebhethri okuvamile, ukwehla kwejubane okungazelelwe, noma ukuminza njalo lapho kwenziwa imisebenzi elula.
Esinye isibonakaliso esikhathazayo yilesi ukusebenza okungalindelekile kwemakrofoni noma ikhameranoma ukubonakala kwezithonjana zokurekhoda lapho kungekho uhlelo lokusebenza olusetshenziswayo okungathethelela lowo msebenzi. Kwezinye izimo, abasebenzisi bathola nokwanda kokusetshenziswa kwedatha yangemuva, okungase kubonise ukuthi i-malware ithumela ulwazi ngaphandle.
Uma usola ukuthi umdlalo noma uhlelo lokusebenza lungase lube sengozini, isinyathelo esihlakaniphile kakhulu yilesi susa ngokushesha bese wenza ukuhlaziywa okugcwele nge isisombululo se-antivirus esaziwayoLokhu kusebenza kokubili ku-Android kanye ne-Windows. Kumadivayisi aphatha ulwazi olubucayi kakhulu, kungase kube ngcono ngisho nokubuyisela uhlelo kusuka ku-backup yangaphambilini ethembekile.
Ezindaweni zezinkampani eSpain nakwamanye amazwe aseYurophu, izinkampani kufanele zibe izinqubo zokuphendula ezigamekweni okuhlanganisa ukubuyekeza amadivayisi eselula, ukuhoxisa ukufinyelela, kanye nokushintshanisa iziqinisekiso uma kutholakala umnyango wangemuva onjenge-BirdCall kutheminali esetshenziselwa izinjongo zomsebenzi.
Uma sibheka konke okutholakale, leli cala libonisa izinga umdlalo obonakala ungenangozi we-Windows noma i-Android Lokhu kungaba yindlela yokusebenza kobunhloli be-inthanethi okuyinkimbinkimbi. Ukuhlanganiswa kwe-malware eqopha umsindo, yeba idatha yomuntu siqu, futhi isebenzisa izinsizakalo zamafu ukufihla umsebenzi wayo kudinga ukuqapha okukhulu, ikakhulukazi lapho ulanda izinhlelo zokusebenza ezivela eziteshini ezisemthethweni zangaphandle futhi usebenzisa amadivayisi afanayo kokubili ukuzijabulisa nomsebenzi, esimweni lapho iSpain kanye nalo lonke elaseYurophu kakade seziyizisulu ezivame kakhulu zemikhankaso ethuthukisiwe.
