2023-01-10 22:00   Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges    #360 Netlab Blog #安全文章 OverviewOn Oct 21, 2022, 360Netlab's honeypot system captured a suspicious ELF file ee07a74d12c0bb3594965b51d0e45b6f, which propagated via F5 vulnerability with zero VT detection, our system observces that it communicates with IP 45.9.150.144 using SSL with forged Kaspersky certificates, this c

2023-01-09 11:13   警惕：魔改后的CIA攻击套件Hive进入黑灰产领域    #360 Netlab Blog #安全文章 概述2022年10月21日，360Netlab的蜜罐系统捕获了一个通过F5漏洞传播，VT 0检测的可疑ELF文件ee07a74d12c0bb3594965b51d0e45b6f&#

2022-12-07 20:58   快讯：使用22个漏洞传播的DDoS家族WSzero已经发展到第4个版本    #360 Netlab Blog #安全文章 概述近期，我们的BotMon系统连续捕获到一个由Go编写的DDoS类型的僵尸网络家族，它用于DDoS攻&#x5

2022-11-03 22:00   P2P Botnets: Review - Status - Continuous Monitoring    #360 Netlab Blog #安全文章 OriginsP2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets. In terms of time, Storm, which appeared in 2007, can be considered the progenitor of this area, when botnet threats were

2022-11-03 22:00   P2P Botnets: Review - Status - Continuous Monitoring    #360 Netlab Blog #安全文章 OriginsP2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets. In terms of time, Storm, which appeared in 2007, can be considered the progenitor of this area, when botnet threats were

2022-11-03 22:00   P2P Botnets: Review - Status - Continuous Monitoring    #360 Netlab Blog #安全文章 OriginsP2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets. In terms of time, Storm, which appeared in 2007, can be considered the progenitor of this area, when botnet threats were

2022-11-02 11:11   P2P 僵尸网络：回顾·现状·持续监测    #360 Netlab Blog #安全文章 缘起P2P结构的网络比传统的C/S结构具有更好的可扩展性和健壮性，这些优点很早就为botnet的作者所认识到并被用到他们的僵尸网络中。从时间上看，2007年出现的Storm可以算是这方面的鼻祖，那时botnet这种网络威胁刚为大众所知。Storm之后，陆续又有Karen、ZeroAccess、GameOver、Hijime、mozi等20来种P2P botnet先后出现，它们在技术上各有特点，共同点就是规模大、防御难度大，想让它们彻底消失比较困难，比如Mozi在作者已经明确放弃甚至被抓几年之后还在活跃，可谓“百足之虫死而不僵”。早期的P2P botnet主要针对Windows机器，比如Stor

2022-11-02 11:11   P2P 僵尸网络：回顾·现状·持续监测    #360 Netlab Blog #安全文章 缘起P2P结构的网络比传统的C/S结构具有更好的可扩展性和健壮性，这些优点很早就为botnet的

2022-11-02 11:11   P2P 僵尸网络：回顾·现状·持续监测    #360 Netlab Blog #安全文章 缘起P2P结构的网络比传统的C/S结构具有更好的可扩展性和健壮性，这些优点很早就为botnet的

2022-10-31 22:00   Fodcha Is Coming Back, Raising A Wave of Ransom DDoS    #360 Netlab Blog #安全文章 BackgroundOn April 13, 2022, 360Netlab first disclosed the Fodcha botnet. After our article was published, Fodcha suffered a crackdown from the relevant authorities, and its authors quickly responded by leaving "Netlab pls leave me alone I surrender" in an updated sample.No surprise, Fodch

2022-10-31 22:00   Fodcha Is Coming Back, Raising A Wave of Ransom DDoS    #360 Netlab Blog #安全文章 BackgroundOn April 13, 2022, 360Netlab first disclosed the Fodcha botnet. After our article was published, Fodcha suffered a crackdown from the relevant authorities, and its authors quickly responded by leaving "Netlab pls leave me alone I surrender" in an updated sample.No surprise, Fodch

2022-10-31 22:00   Fodcha Is Coming Back, Raising A Wave of Ransom DDoS    #360 Netlab Blog #安全文章 BackgroundOn April 13, 2022, 360Netlab first disclosed the Fodcha botnet. After our article was published, Fodcha suffered a crackdown from the relevant authorities, and its authors quickly responded by leaving "Netlab pls leave me alone I surrender" in an updated sample.No surprise, Fodch

2022-10-27 10:49   卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙    #360 Netlab Blog #安全文章 背景2022年4月13日，360Netlab首次向社区披露了Fodcha僵尸网络，在我们的文章发表之后，Fodcha遭受到相关部门的打击，其作者迅速做出回应，在样本中留下Netlab pls leave me alone I surrender字样向我们投降。本以为Fodcha会就此淡出江湖，没想到这次投降只是一个不讲武德的假动作，Fodcha的作者在诈降之后并没有停下更新的脚步，很快就推出了新版本。在新版本中，Fodcha的作者重新设计了通信协议，并开始使用xxtea和chacha20算法对敏感资源和网络通信进行加密，以躲避文件&流量层面的检测；同时引入了OpenNIC 域名做为主选

2022-10-27 10:49   卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙    #360 Netlab Blog #安全文章 背景2022年4月13日，360Netlab首次向社区披露了Fodcha僵尸网络，在我们的文章发表之后，Fodcha遭受到相

2022-10-27 10:49   卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙    #360 Netlab Blog #安全文章 背景2022年4月13日，360Netlab首次向社区披露了Fodcha僵尸网络，在我们的文章发表之后，Fodcha遭受到相