I-Nobelium, iqembu elingemuva kokuhlasela kweSolarWinds, isenayo iqoqo elikhulu lamakhono okugebenga athuthukile enawo. Lesi isiphetho sochwepheshe bezokuphepha bakwa-Mandiant ocwaningweni lwakamuva. Ubungozi balaba -cishe abagebengu be-state-backed- abukadluli.
Ngonyaka odlule, abaduni beNobelium bakwazile ukugebenga uchwepheshe wezokuphepha waseMelika iSolarWinds. Kamuva, amakhasimende amaningi alo chwepheshe wezokuphepha agqekezwa, angaba ngu-18,000, okuhlanganisa iMicrosoft kanye nohulumeni wase-US. Lokhu nayo yonke imiphumela yako.
Uphenyo olwengeziwe ngesizinda sabagebengu luveze ukuthi abaduni beNobelium kusolwa ukuthi bathola usizo ezweni. Lokhu mhlawumbe yiRussia.
I-Nobelium yaziwa kakhulu ngamasu ayo athuthukile, amasu nezinqubo, eyaziwa nangokuthi i-TTP. Esikhundleni sokuhlasela izisulu zabo ngamunye ngamunye, bancamela ukukhetha inkampani eyodwa esebenzela amakhasimende amaningi. Ngokugebenga enkampanini yakamuva, izigebengu zifuna uhlobo 'lokhiye oyinhloko' oluvele 'luvule' iminyango kumakhasimende.
Ucwaningo lwe-Mandiant
Ucwaningo lukaMandiant lubonisa ukuthi i-Nobelium, namaqembu amabili abaduni i-UNC3004 kanye ne-UNC2652 ayingxenye yale nhlangano yokugebenga, aqhubekisele phambili nemisebenzi yawo ye-TTP iphelele. Ikakhulukazi for attack on cloud abathengisi kanye nama-MSP ukuze bafinyelele amabhizinisi engeziwe.
Amasu amasha ezigebengu ukusetshenziswa kwemininingwane etholwe ngemikhankaso ye-info-stealer malware yabanye abaduni. Ngalokhu, abaduni beNobelium bafuna ukufinyelela kokuqala kwezisulu. Izigebengu ziphinde zasebenzisa ama-akhawunti anamalungelo Wokuzenza Ongeyena Wohlelo “ukuvuna” idatha ye-imeyili ebucayi. Izigebengu ziphinde zasebenzisa zombili izinsiza zommeleli we-IP kubathengi nengqalasizinda entsha yendawo ukuze baxhumane nezisulu ezithintekile.
Amanye amasu
Baphinde basebenzise amakhono amasha e-TTP ukweqa imikhawulo yezokuphepha ezindaweni ezahlukahlukene, okuhlanganisa nemishini ebonakalayo, ukuze banqume ukulungiselelwa kwemizila yangaphakathi. Elinye ithuluzi elisetshenzisiwe yisilandi esisha se-CEELOADER. Izigebengu zize zikwazi nokungena ezinhlwini zemibhalo ezisebenzayo zama-akhawunti e-Microsoft Azure futhi zeba 'okhiye abakhulu' abanikeza ukufinyelela kunkhombandlela yamakhasimende eqembu elithintekile. Ekugcineni, izigebengu zikwazile ukusebenzisa kabi ukuqinisekiswa kwezinto eziningi zisebenzisa izaziso zohlelo lokusebenza kuma-smartphones.
Abacwaningi baseMandiant baqaphela ukuthi abaduni babethanda kakhulu idatha ebalulekile eRussia. Ngaphezu kwalokho, kwezinye izimo kwebiwa idatha yokuthi abaduni kufanele banikeze izindlela ezintsha zokuhlasela ezinye izisulu.
Inkinga eqhubekayo ye-Nobelium
Umbiko uphetha ngokuthi ukuhlasela kukaNobelium ngeke kuphele maduze. Ngokusho kwabacwaningi, abaduni bayaqhubeka nokuthuthukisa amasu abo okuhlasela kanye namakhono ukuze bahlale isikhathi eside ngaphakathi kwamanethiwekhi ezisulu, bagweme ukutholwa futhi baphazamise imisebenzi yokutakula.