Trojan ea ho fihlella hole (ScreenConnect, AnyDesk, RustDesk, UltraViewer) scam ea tšehetso ea theknoloji: ho hula ethernet, lits'ebeletso tsa ho bolaea, le ho emisa banka.¶

Ha motho ea qhekellang a u kholisa hore u kenye sesebelisoa sa komporo e hole kapa a sebelisa sesebelisoa sa ho beha leihlo se hole komporong ea hau, ba fumana taolo e sa lekanyetsoang holim'a toeba ea hau, keyboard, sistimi ea faele le linako tse sebetsang tsa sebatli. Ha o ntse o hlahisa scan ninete ea tšireletso kapa kharetene e ntšo ea lekunutu holim'a sebali sa hau, opareitara e hula liak'haonte tsa hau ka khutso, e kotula li-password tse bolokiloeng, ebe e kenya lits'ebeletso tsa morao-rao tse tsoelang pele tse pholohang ha li qala bocha. Tataiso ena e fana ka mehato e potlakileng ea ho khaola khokahanyo ea data ea mohlaseli, ho felisa lits'ebeletso tsa phihlello tse sa lebelloang tse sa lebelloang, le ho notlela lits'ebetso tsa hau tsa banka le mekitlane pele lichelete li hlakola marang-rang.

Etsa sena hona joale¶

1. Khutlisetsa khokahanyo eohle ea Marang-rang hang-hang. Ntša thapo ea Ethernet ho tloha ka morao komporong ea hau kapa router, phenya switch ea hau ea Wi-Fi ho laptop ea hau, kapa u tobetse 'me u tšoare konopo ea matla ho router ea hau ea Wi-Fi metsotsoana e 10 ho fihlela mabone 'ohle a fifala. Seke oa senya nako ho leka ho loants'a moqhekelli bakeng sa taolo ea sekhesa sa toeba ho tobetsa konopo ea hakolla.
2. Hatella ho tima komporo e senyehileng haeba skrini se tingoa. Haeba mohlaseli a butse "Blank Guest Monitor" kapa a notleletse keyboard ea hau, tobetsa 'me u tšoare konopo ea matla ea komporo ea hau metsotsoana e 10 ka botlalo ho fihlela mochini o tima ka botlalo. E tlohele e tima ha u ntse u boloka liak'haonte tsa hau tsa lichelete ho sesebelisoa se arohaneng, se hloekileng.
3. Leletsa lefapha la bomenemene ba banka ho tsoa mohaleng o ikemetseng. Sebelisa mohala oa cellular ho letsetsa nomoro ea molao e hatisitsoeng ka morao ho karete ea hau ea mokitlane kapa karete ea mokitlane, kapa letsetsa nomorong ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) haeba ho etsahala tšokelo ea bosholu; bona dinomoro tsa tshohanyetso bakeng sa mabitso a machaba. Laela banka ho emisa hanghang liak'haonte tsohle tsa ho cheke, tsa polokelo le tsa mekitlane, 'me u batle hore ho hopoloe ka tšohanyetso ho Automated Clearing House (ACH), terata kapa phetisetso ea nako ea nnete.
4. Hlakola li-cookies tsa nako 'me u fetole li-password ho tsoa ho smartphone e hloekileng. U sebelisa mohala oa hau ho data ea cellular (e sa hokahaneng le Wi-Fi ea lapeng haeba komporo ea hau e senyehileng e se e le teng), kena ho lengolo-tsoibila la hau la mantlha, li-portal tsa banka le li-account tsa polokelo ea maru. Emisa linako tsohle tsa ho kena, hlakola lisebelisoa tse sa lemoheng tsa Multi-Factor Authentication (MFA), 'me u fetole li-password tsa hau.
5. Bulela khomphutha e nang le tšoaetso hore e be Mokhoa o Sireletsehileng Ntle le Marang-rang. Bulela komporo e senyehileng feela ha e ntse e khaotsoe inthaneteng, kenya Windows Safe Mode kapa MacOS Safe Mode ho lekola le ho hlakola lits'ebeletso tsa morao-rao tse sa lebelloang (ScreenConnect Client, AnyDesk Service, RustDesk Service) pele tsamaiso ea ho sebetsa e jara bakhanni ba marang-rang ba motho oa boraro.

Ho utloisisa sebopeho sa RMM ea khoebo le tlhaselo ea desktop e hole¶

Bomenemene ba morao-rao ba tšehetso ea tekheniki, bomenemene ba ho khutlisa chelete, le litlhaselo tsa ho iketsa motho e mong oa libanka ha se hangata li itšetlehang ka livaerase tsa k'homphieutha tse ngotsoeng ka tloaelo. Sebakeng seo, batšoantšisi ba ts'okelo ba hlekefetsa ts'ebeliso e nepahetseng, e saenneng ka dijithale ea Remote Monitoring and Management (RMM) lisebelisoa tsa software le li-desktop tse hole tsa khoebo. Hobane lits'ebetso tsena li na le litifikeiti tse nepahetseng tsa ho saena khoutu ea cryptographic ho tsoa ho barekisi ba software ba tšepahalang, mananeo a tloaelehileng a antivirus joalo ka Windows Defender kapa macOS XProtect ha a thibele ho kengoa ha ona.

Bahlaseli ba sebelisa li-binari tse nepahetseng tsa tšehetso tse hole¶

Ha motho ea hlokofalitsoeng a letsetsa nomoro ea mahala e bonts'itsoeng ho pop-up ea sebatli sa fake, a araba lengolo-tsoibila la invoice e potlakileng, kapa a latela litaelo tse tsoang ho mofuputsi oa bomenemene ba banka, mosebeletsi o ba laela hore ba khoasolle sesebelisoa se ka phethisoang kapa sa MSI. Li-platform tse hlekefelitsoeng haholo li kenyelletsa:

• ConnectWise ScreenConnect (eo pele e neng e le Control): Hangata e sebelisoa ka mokhoa o ikhethileng .msi kapa .exe sephutheloana se tsamaisoang ke seva se laoloang ke mohlaseli. Ha e se e phethiloe, e kenya ts'ebeletso e tsitsitseng ea Windows System (ScreenConnect Client (xxxx)) ho matha le NT AUTHORITY\SYSTEM litokelo, ho fana ka phihlello e khutsitseng, e sa lebelloang neng kapa neng ha komporo e le inthaneteng.
• Desk efe kapa efe (anydesk.exe): E sebelisoa khafetsa mekhoeng ea bolotsana ea marang-rang e shebaneng le Windows, macOS le lisebelisoa tsa mohala. Bahlaseli ba laela mohlaseluoa hore a balle holimo aterese ea AnyDesk ea linomoro tse 9, a kope maemo a phahameng a tsamaiso, 'me a behe "Unattended Access Password" hore a kopane hape ha mohlaseluoa a robetse.
• RustDesk (rustdesk.exe): Sesebediswa se bulehileng sa komporo se hole se ratwang ke di-scam syndicates hobane se khona ho iketsetsa li-server tsa li-relay, ka ho iphapanyetsa ho theola ho hlekefetsoa ha barekisi.
• UltraViewer, TeamViewer, Zoho Assist, le SimpleHelp: Hangata li tlanngoe ka liketane. Motho ea bolotsana ea hokelang ka UltraViewer kapa AnyDesk hangata o tla kenya e patiloeng ka khutso ScreenConnect kapa SimpleHelp sephutheloana se ka morao joalo ka bekapo backdoor.

Ts'ebetso ea ts'ebetso ea tšohanyetso: ho khaola khokahano le ho senya ts'enyo¶

Sebelisa flowchart e latelang ho emisa seshene e sebetsang e hole, ho arola sebaka sa ho sebetsa, le ho fumana hore na mochini o ka hloekisoa ka Mokhoa o Sireletsehileng kapa o hloka ho hlakola sistimi e felletseng.

flowchart TD
    A["Scam e ntseng e le teng kapa ea Haufinyane ea ho fihlella e hole e fumanoe"] --> B["Tlosa thapo ea Ethernet ka 'mele le ho tima Wi-Fi Router"]
    B --> C{"Na Screen Blacked Out kapa Mouse e notletsoe?"}
    C -- "Ee" --> D["Tšoara Konopo ea Matla a 'mele ea PC bakeng sa Metsotsoana e 10 ho Qoba"]
    C -- "Che" --> E["Fetola Mokhoa oa Sefofane 'me u Koale PC ka tloaelo"]
    D --> F["Sebelisa Smartphone e Hloekileng ho Lintlha tsa Cellular ho letsetsa Lefapha la Bomenemene ba Banka"]
    E --> F
    F --> G["Emisa Chelete / Lipolokelo, Hopola Lithapo/Zelle, Notlela Litsi tsa Mekitlane"]
    G --> H["Ho tsoa ho Smartphone e Hloekileng: Fetola Li-password tsa lengolo-tsoibila / tsa Banka 'me u bolaee linako"]
    H --> I{"Na Scammer e bile le phihlello e sa lebelloang kapa ea matha CMD/PowerShell?"}
    I -- "Ho joalo (Kotsi e Phahameng)" --> J["Boot PC Offline ho Mokhoa o Sireletsehileng ho Pholosa Litokomane tsa Motho Feela"]
    I -- "Che (Nako e Khutšoanyane e laoloang)" --> K["Tlosa Offline ho Mokhoa o Sireletsehileng ho Hlakola Litšebeletso le Lits'ebeletso tsa RMM"]
    J --> L["Etsa Ts'ebetso e Hloekileng e Felletseng ea Ts'ebetso ka USB Media Ho Tloha PC e Hloekileng"]
    K --> M["Tlosa Litšebeletso, Mesebetsi e Reriloeng, AppData, le Audit Browser Extensions"]

Papiso ea lisebelisoa tsa phihlello tse hole tse sebelisoang hampe ke bomenemene¶

Pele u leka ho hloekisa mochini kapa ho tlaleha ketsahalo ena ho sehlopha sa banka ea hau ea bosholu, tseba hore na ke lisebelisoa life tse hole tse kentsoeng. Hopola hore scammers ba lula ba kenya lisebelisoa tse peli kapa tse tharo tse fapaneng nakong ea thuto e le 'ngoe e le hore haeba u ka tlosa letšoao le bonahalang la desktop, tšebeletso ea bona ea bobeli e patiloeng e lule e sebetsa.

Mokhoa oa mohato ka mohato oa ho banka le oa lichelete (Metsotso e 30 ea pele)¶

Ka bolotsana ba ho fihlella ka thōko, tšoaetso ea k'homphieutha ke mokhoa oa ho fana feela; tsietsi ea mantlha ke bosholu bo matla ba lichelete. Bahlaseli ba sebelisa maqheka a kelello le a tekheniki, joalo ka ho hlophisa khoutu ea mohloli oa HTML (Inspect Element) ea leqephe la tepo la banka ea hau ho etsa ntho e etsahetseng ka phoso $40,000 tefello e fetelletseng sebakeng sa $400, ho u qhekella ka ho kenya chelete, ho reka likarete tsa limpho, kapa ho kenya chelete ka ATM ea Bitcoin. Leha o hanne ho romella chelete, mohlaseli ea nang le phihlello e hole a ka qala phetisetso ka kotloloho ha skrini sa hau se ntse se tima.

1. Beha mohatsetsi hanghang 'me u qale ho hopola¶

Letsetsa lefapha la bomenemene la setsi sa hau sa lichelete hang-hang u sebelisa mohala o hloekileng. Bolela ka ho hlaka: "Khomphuta ea ka e ile ea senngoa ke trojan ea ho kena ka thōko nakong ea ts'ehetso ea theknoloji / bolotsana ba ho iketsa eka ke banka. Motho ea sa lumelloeng o bile le monyetla oa ho fumana nako ea ka ea ho banka Inthaneteng." Batla mehato e latelang e tobileng:

• Lockout ea Boemo ba Libanka Marang-rang: Etsa hore banka e koale mangolo a hau a ho kena ka har'a Marang-rang le a mobile banking ka botlalo 'me e etse hore li-tokens tsohle tsa OAuth le li-cookie li se ke tsa sebetsa.
• ACH, Wire, le RTP Recall (SWIFT / Fedwire / Faster Payments): Kopa moemeli ho lekola akhaonte ea hau bakeng sa ntlo efe kapa efe e ntseng e emetse kapa e emetsoeng ke Automated Clearing House (ACH) ho fetisoa, ho fetisoa ka lichelete tsa malapeng / tsa machaba, Zelle / Venmo ditefo, kapa diteke tsa "Bill Pay" tse reretsweng matsatsi a tlang. Hangata basomi ba hlophisa cheke ea Bill Pay kapa phetisetso ea morao-rao ea ACH ho etsa matsatsi a 3 ho isa ho a 5 hamorao ka tšepo ea hore u ke ke ua hlokomela.
• Ho fetola Nomoro ea Ak'haonte: Hobane mohlaseli a ka 'na a sheba linomoro tsa akhaonto ea hau ka botlalo le ho sheba linomoro tsa akhaonto (kapa u khoasollotse litatemente tsa banka ea PDF ho tsoa ho sebatli sa hau), ho emisa karete ea banka feela ha hoa lekana. U tlameha ho kopa banka hore e koale linomoro tsa ak'haonte tse senyehileng 'me e fetole li-account tsa hau ho linomoro tse ncha tse nang le "Post No Debits" (PND) lithibelo litlalehong tsa khale.
• Sheba Liphetisetso tsa ka Hare tse Patehileng kapa Tsoelo-pele ea Chelete: Bahlaseli ba atisa ho nka chelete ea pele ho karete ea hau ea mokitlane e hokahaneng kapa Home Equity Line of Credit (HELOC) 'me u e fetisetse akhaonteng ea hau ea ho hlahloba pele, ebang ke ho etsa hore u lumele hore "ba u buselitse ka phoso ka phoso", kapa ho bokella chelete e ngata pele u kenya chelete e ngata ho tloha lebōpong la leoatle. Bolella setsebi sa bomenemene ba banka ho hlahloba hore na ho na le li-transfer tsa ka hare ho banka lipakeng tsa lipolokelo tsa hau, karete ea mokoloto, kapa liak'haonte tsa khoebo.

2. Emisa liofisi tsa mekitlane 'me u hlahlobe likopo tse ncha tsa kalimo¶

Ha o ntse o hokahane le komporo ea hau, batho ba qhekellang ba lula ba e batla Downloads kapa Documents lifoldara tsa mantsoe a bohlokoa joalo ka tax, 1040, W2, passport, license, kapa password mme o kenye dikgutliso tsa hao tsa lekgetho le diskena tsa ID.

1. Beha Security Freeze mahala ho liofisi tsohle tse kholo tsa mekitlane hang-hang u sebelisa smartphone ea hau e hloekileng:
2. Naheng ea Amerika: Emisa Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), le ChexSystems (1-800-428-9687).
3. United Kingdom: Ikopanye le Experian, Equifax, le TransUnion, 'me u ingolise bakeng sa Cifas Protective Registration.
4. Canada: Bea litemoso tsa ho emisoa ha mekitlane kapa bomenemene ka Equifax Canada le TransUnion Canada.
5. Naheng ea Australia: Kopa thibelo ea mokoloto ka Equifax, Illion, le Experian.
6. Hlahloba tlaleho ea mokitlane oa hau hang-hang bakeng sa lipotso tse thata tse entsoeng lihoreng tse 24 tse fetileng; Hangata batho ba qhekellang ba etsa kopo ea likalimo tsa hau tsa inthanete hanghang ka har'a sebatli sa morao-rao ha ba ntse ba bua le uena.

Ho felisa lits'ebeletso tsa phihlello tse hole ka mokhoa o bolokehileng (Windows le macOS)¶

Haeba u etsa qeto ea ho hlahloba mochine, boloka lintlha tsa molao bakeng sa ts'ebetsong ea molao, kapa u pholose linepe tsa hau tse ke keng tsa nkeloa sebaka pele u hlakola hard drive, ** le ka mohla u se ke ua bulela komporo ka mokhoa o tloaelehileng ha u ntse u hokahantsoe le Marang-rang**. Hang ha boot e tloaelehileng e phetheloa ka Wi-Fi e sebetsang, e tsitsitseng ScreenConnect kapa AnyDesk tšebeletso e tla letsetsa hae ho khomphutha ea scammer le ho ba lemosa hore mochini oa hau o khutletse inthaneteng.

Mohato oa 1: Ho qala ka mokhoa o bolokehileng ntle le marang-rang¶

Ho Windows 10 le Windows 11¶

1. Etsa bonnete ba hore thapo ea Ethernet ha e hoketsoe le router ea hau ea lapeng ea Wi-Fi ha e na polaka kapa Mokhoa oa Sefofane oa sebetsa.
2. Matla ho PC. Sekrineng sa ho saena sa Windows, tšoara konopo ea Left Shift ha u ntse u tobetsa Matla -> Qala hape.
3. Skrineng sa ho hlaphoheloa seputsoa, khetha Tharollo ea mathata -> Likhetho tse tsoetseng pele -> Litlhophiso tsa ho qala -> Qala bocha.
4. Ha lenane la likhetho tsa ho qala le hlaha, tobetsa 4 kapa F4 (Enable Safe Mode). Se ke oa hatella 5 (Safe Mode with Networking).

Ho macOS (Apple Silicon le Intel)¶

1. Tima Mac ebe o tima router ea hau ea Wi-Fi.
2. ** Apple Silicon (M1/M2/M3/M4):** Tšoara konopo ea Matla ho fihlela "Ho kenya likhetho tsa ho qala" ho hlaha. Khetha disk ea hau ea ho qala, tšoara ** Shift **, 'me u tobetse Tsoela pele ka Mokhoa o Sireletsehileng.
3. Intel Mac: Bulela Mac 'me hang-hang u tšoare konopo ea Shift ho fihlela fensetere ea ho kena e hlaha.

Mokhahlelo oa 2: Ho tsoma le ho felisa Litšebeletso tsa Windows tse phehellang¶

Uninstallation e tloaelehileng ka "Add or Tlosa Mananeo" hangata e hloleha ho tlosa tloaelo ScreenConnect MSI e haha ​​hobane bahlaseli ba hlobola ho kenngoa ha uninstaller ho Windows Registry kapa ho sebelisa liketsahalo tse ngata tlas'a mabitso a litšebeletso tsa hexadecimal.

1. Ho Windows Safe Mode, tobetsa Win + R, mofuta services.msc, ebe o tobetsa Enter.
2. Tobetsa kholomo ea Name ho hlopha ho latela alfabeta, 'me u hlahlobe tšebeletso e 'ngoe le e 'ngoe ka hloko bakeng sa mabitso a latelang:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Tlhokomeliso: Ho ka ba le tse peli kapa tse tharo tse arohaneng ScreenConnect Client likenyo tse nang le likhoele tse fapaneng tsa litlhaku tse 16 ka masakaneng, moo e 'ngoe le e' ngoe e emelang seva se fapaneng sa scammer).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent kapa SimpleHelp Remote Access
9. Bakeng sa tšebeletso e 'ngoe le e 'ngoe e belaetsang eo u e fumanang, e tobetse ka ho le letona ebe u khetha Properties.
10. Bala lebala la Tsela ea ho phethisoa ka hloko 'me u le ngole fatše (mohlala, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Fetola mofuta oa ho qala ** ho theoha ho ** E holofetseng **, tobetsa ** Emisa ** (haeba e sebetsa), ebe o tobetsa ** Etsa kopo ** le ** OK ** .
12. E latelang, bula Command Prompt e phahameng (Win + X -> ** Terminal (Admin)** kapa Command Prompt (Admin)) 'me u hlakole ka ho sa feleng ngoliso ea litšebeletso u sebelisa lebitso le nepahetseng la ts'ebeletso le thathamisitsoeng fensetereng ea thepa:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

Bakeng sa ScreenConnect, botsa maemo ohle a kentsoeng 'me u hlakole e' ngoe le e 'ngoe ka lebitso la eona la senotlolo sa tšebeletso:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Mokhahlelo oa 3: Ho hloekisa mesebetsi e reriloeng, lifoldara tsa ho qala, le li-directory tse patiloeng¶

Esita le ka mor'a hore Windows Service e hlakoloe, bahlaseli ba atisa ho hlophisa mosebetsi o hlophisitsoeng o khoasollang moemeli ea hole ka tsela. powershell.exe kapa mshta.exe nako le nako ha mosebelisi a kena.

1. Tobetsa Win + R, mofuta taskschd.msc, ebe o tobetsa Enter ho bula Task Scheduler.
2. Tobetsa Task scheduler Library fenstereng e ka letsohong le letšehali. Atolosa foldara e 'ngoe le e 'ngoe 'me u hlahlobe lebokose la Actions la mosebetsi o mong le o mong o reriloeng. Hlakola mosebetsi ofe kapa ofe o qalang li-binaries ho tloha C:\Users\<User>\AppData\, C:\ProgramData\, kapa invokes curl, bitsadmin, powershell -WindowStyle Hidden, kapa komporo efe kapa efe e hole e ka sebetswang.
3. Tobetsa Win + R, mofuta shell:startup, ebe o tobetsa Enter. Hlakola mekgahlelo efe kapa efe kapa .bat / .vbs mengolo e kentsoeng foldareng ea hau ea ho qala mosebelisi. Pheta sena ka ho thaepa shell:common startup ho lekola foldara ea ho qala sistimi ka bophara.
4. Numella ho shebella lifaele tse patiloeng ho File Explorer (** Sheba -> Bontša -> Lintho tse patiloeng **) 'me u hlakole ka letsoho li-directory tsa lits'ebetso le li-cache tsa tlhophiso bakeng sa lisebelisoa tsohle tse hole:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ le C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ le C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ le C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Mohato oa 4: Ho tlosa MacOS LaunchDaemons, LaunchAgents, le Lithuso tsa Lekunutu¶

Ho macOS, lisebelisoa tsa phihlello tse hole li theha phehello ka LaunchDaemons (tsamaiso ka bophara) le LaunchAgents (boemo ba mosebelisi), e kopantsoe le macOS TCC (Ponaletso, Tumello, le Taolo) ditumello tsa Ho Rekota skrineng le Ho fihlella.

1. Ha u ntse u le Mokhoeng o Sireletsehileng oa macOS (ntle le marang-rang), bula Finder, tobetsa Cmd + Shift + G (Go to Folder), 'me u hlahlobe litsamaiso tse tharo tse latelang ka bonngoe:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Hula leha e le efe .plist lifaele tse nang le connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, kapa simplehelp ho Lithole.
6. E latelang, bula /Applications/ le /Library/Application Support/ 'me u tsamaise liphutheloana life kapa life tse tsamaellanang tsa ho kena u le hole le lifoldara tsa tšehetso ho Lithōle.
7. Bula Litlhophiso tsa Tsamaiso -> Lekunutu & Tšireletso. Ela hloko likarolo tse peli tsa bohlokoa:
8. Screen & System Audio Recording: Khetha sesebelisoa leha e le sefe sa tšehetso se hole se thathamisitsoeng ebe u tobetsa ho tlosa (-) konopo ho hlakola bokhoni ba eona ba ho sheba ponts'o ea hau.
9. ** phihlello:** Khetha sesebelisoa leha e le sefe sa tšehetso se hole 'me u tobetse ho tlosa (-) konopo ea ho hlakola bokhoni ba eona ba ho laola sekhechana sa toeba le ho kopanya likonopo.
10. Full Disk Access: Netefatsa hore ha ho ts'ebeliso e sa tsejoeng kapa sephutheloana sa "terminal" se fuoeng Full Disk Access.

Ho khutlisa li-password tsa Windows le li-banner tsa fake tsa boot¶

Pele ba khaoha, bosholu ba boiphetetso hangata ba notlela bahlaseluoa lik'homphieutheng tsa bona ebe ba batla thekollo bakeng sa password. Ba sebelisa mekhoa e meraro ea mantlha:

1. Ho fetola password ea Windows ea lehae (net user) kapa ho eketsa ak'haonte e khopo ea admin¶

Ha kharetene ea skrineng ea bona e ntse e sebetsa, basomi ba atisa ho bula Command Prompt e phahameng ebe ba matha net user <YourUsername> <NewPassword> kapa theha ak'haonte ea molaoli ea ka morao (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * U ka hlahloba le ho lokisa joang: Ho Safe Mode, bula Command Prompt e phahameng (cmd.exe joalo ka Mookameli) ebe u thaepa net user. Haeba u bona ak'haonte eo u sa e tsebeng, e hlakole hang hang ka net user <RogueAccountName> /delete. Haeba phasewete ea hau ea lehae e fetotsoe, qala ho tsoa ho Windows Installation USB ho ea ho Windows Recovery Environment (WinRE) ho khutlisa Sebaka sa Pele sa Ts'ebetso ea Ts'ebetso, kapa ho saena ka Ak'haonte ea hau ea Microsoft e hokahaneng ka mor'a hore u tsose phasewete ea hau ho smartphone e hloekileng.

2. Ho nolofalletsa molaetsa oa molaetsa oa ho qala ka Registry (LegalNoticeCaption)¶

Hangata scammers lia fetoha HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ka ho beha LegalNoticeCaption le LegalNoticeText ho hlahisa nomoro ea mohala ea senotlolo sa Microsoft Security pele o kena. * Kamoo o ka lokisang: Ena ke sekirini sa mongolo se setle pele ho molaetsa o tloaelehileng oa ho kena ho Windows. Tobetsa **OK ** kapa tobetsa **Enter ** ho e feta, bula regedit ho Safe Mode, ea ho HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, ebe o hlakola mongolo o ka hare LegalNoticeCaption le LegalNoticeText.

3. Likotlolo tsa PIN ea Safe Boot (bcdedit)¶

Microsoft e tlositse lefa syskey.exe tool in Windows 10 version 1709. Kajeno, scammers ho fapana le hoo ba tšoaea Safe boot ka hare. msconfig ebe o qala komporo ea hau kantle ho marang-rang. Hobane li-PIN tsa Windows Hello PIN hangata li hloleha skrineng sa ho kena sa Safe Mode ntle le phihlello ea marang-rang, bahlaseluoa ba ts'oaroa ke loop ea boot. * U ka lokisa joang: Tšoara Shift + Restart skrineng sa ho kena, khetha Troubleshoot -> Likhetho tse tsoetseng pele -> Command Prompt, ebe o matha:

bcdedit /deletevalue {current} safeboot

Qala komporo bocha ka mokhoa o tloaelehileng (ho boloka router ea hau ea inthanete e sa kengoa) e le hore u ka kena ka password kapa PIN e bolokiloeng ebe u tlosa software e hole.

Hobaneng ha bosholu ba nako ea sebatli le bosholu ba infostealers ba hloka ho hlakola OS ka botlalo¶

Leha u hlakola ea ScreenConnect, AnyDesk, kapa RustDesk ditshebeletso ka Safe Mode, o tlameha ho lekola hore na moqhekelli o kentse kopo ya bobedi Infostealer (Lumma, RedLine, Vidar, Stealc) kapa u kopitse bukana ea profil ea hau ea sebatli.

Nakong ea seboka se hole se sa lebelloang, ho nka metsotsoana e ka tlase ho 8 hore mohlaseli a tsamaise mongolo oa PowerShell o kopitsang bukana ea hau ea data ea Google Chrome, Microsoft Edge, kapa Brave.C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) mmoho le tsa lehae DPAPI senotlolo sa master decryption. Ka lifaele tseo ho seva sa bona, mohlaseli o na le:

1. Lekunutu le leng le le leng le bolokiloeng taolong ea sebatli sa hau sa marang-rang se hahelletsoeng ka hare.
2. Li-cookies tsa nako e sebetsang (Cookies le Network\Cookies SQLite database): Leha lengolo-tsoibila kapa banka ea hau e sebelisa netefatso ea lintlha tse peli (2FA), ho ba le cookie ea hau ea "token" ea "cookie" e lumella motho ea hlasetseng ho kenya profil ea hau ea sebatli ho sebatli se sa tsebeng letho mochining oa hae mme a fihlelle ak'haonte ea hau ea Gmail, Outlook, Amazon kapa cryptocurrency ntle le ho hloka phasewete kapa 2FA khoutu.
3. ** Li-wallet tsa cryptocurrency tse thehiloeng ho sebatli (MetaMask, Phantom, Rabby):** Lifaele tsa vault tse patiloeng ka hare Local Extension Settings li hlakotsoe ka lebaka la ho qobella batho ba sa sebetseng inthaneteng.

Ha o tlameha ho kenya sistimi e hloekileng ea USB hape¶

Le ha ho tlosoa ha ts'ebeletso ea Safe Mode ho lekane haeba u ts'oara scammer nakong ea metsotsoana e 10 ka mor'a ho kenya AnyDesk 'me ha ho mohla u kileng ua ba fa maemo a phahameng a Administrator kapa phihlello e sa lebelloa, **o tlameha ho hlakola drive mme o kenye ts'ebetso e hloekileng ea OS ho tsoa thupeng ea USB ** haeba efe kapa efe ea tse latelang e etsahetse:

• Screen sa hau se ile sa ntšofala (Blank Guest Monitor) kapa mouse/keyboard ea hau e notletsoe.
• U bone Command Prompt (cmd.exe) kapa PowerShell fensetere e phatsimang skrineng.
• U siile komporo e sa lebelloa ha senokoane se ntse se etsa scan ninete ea tšireletso.
• U kentse ConnectWise ScreenConnect (e tsamaeang joalo ka SYSTEM ka ho sa feleng mme e lumella ts'ebetso e sa bonahaleng ea sengoloa sa khetla).

Ho etsa reinstall e bolokehileng: 1. Ha u ntse u le Mode o Sireletsehileng, hokela USB flash drive e ncha ho komporo e senyehileng ebe u kopitsa lifaele tsa data tsa motho feela (.jpg, .pdf, .docx, .xlsx, livideo tsa lelapa). Le ka mohla u se ke ua kopitsa .exe, .msi, .bat, .ps1, kapa lifoldara tsa profaele ea sebatli. 2. U sebelisa ** komporo e fapaneng, e hloekileng **, jarolla sesebelisoa sa semmuso sa Windows Media Creation ho tsoa ho Microsoft (microsoft.com/software-download) kapa u thehe sesebelisoa sa macOS se bootable. 3. Tlosa PC e senyehileng ho sesebelisoa se hloekileng sa USB, hlakola likarolo tsohle tse teng ho drive ea mantlha (Drive 0), ebe o kenya kopi e ncha ea sistimi e sebetsang.

Ho boloka tokelo ea hau ea molao ea ho buseletsoa banka¶

Hangata libanka li leka ho hana likopo tsa litefello tsa bomenemene ka bomenemene ba ho fihlella ka ho re hobane u tobetse "Khoasolla" ho AnyDesk kapa ScreenConnect, u "lumella" litšebelisano kapa ho se tsotelle. Ho tseba hore na ts'ireletso ea molao ea banka ea bareki e sebetsa joang sebakeng sa hau ho bohlokoa ha u bua le moahloli oa tseko ea bosholu ba banka ea hau.

United States: Molao oa Phetisetso ea Chelete ea Elektroniki (EFTA) le Regulation E (12 CFR § 1005)¶

Tlas'a molao oa federal Electronic Fund Transfer Act (Regulation E), Ofisi ea Tšireletso ea Lichelete ea Bareki (CFPB) e fane ka tataiso ea semmuso e bolelang hore: * Phihlello e susumeditsweng e ntse e le "Ho Fetisetsa Letlole la Motlakase ka Ntle ho Tumello": Tlas'a 12 CFR § 1005.2(m), phetisetso ea letlole ea elektronike e qaliloeng ke motho ea fumaneng monyetla oa ho kena akhaonteng ea moreki ka bomenemene kapa bosholu e hlalosoa ke molao e le e sa lumelloeng ke EFT, leha moreki a ile a qhekelloa hore a fane ka phasewete, paskhoutu ea nako e le ’ngoe, kapa ho kenya software e hole ea komporo. * Bohlasoa bo ke ke ba sebelisoa ho hana tleleime ea hau: Tlhaloso ea Semmuso ea CFPB ea Regulation E (Comment 6(b)-2) e bolela hore bohlasoa ba bareki (joalo ka ho oela bakeng sa phishing pop-up kapa ho fana ka phishing komporong e hole ho motho ea qhekellang) ha e khone ho sebelisoa ke banka ho beha molato o moholo ho moreki ho feta Regulation E lumella ($50 boholo haeba ho tlalehiloe matsatsing a 2 a khoebo; $500 boholo nakong ea matsatsi a 60). * Khetholla lipakeng tsa phetisetso ea Scammer-Clicked vs. Consumer-Clicked: Haeba senokoane se ile sa tsamaisa mouse 'me sa tobetsa "Romela" ka mor'a skrine e ntšo nakong ea lenaneo la AnyDesk/ScreenConnect, ke EFT e sa lumelloang e koahetsoeng ke Regulation E. Bolella banka ka lengolo: "Ha kea qala, ho fana ka tumello, kapa ho tobetsa konopo bakeng sa phetisetso ena; motšoantšisi oa litšokelo tsa botlokotsebe o phetisetse phetiso eo a le hole a sebelisa Remote Access Trojan ha a ntse a notlela skrini sa ka, e leng EFT e sa lumelloeng ke 12 CFR § 1005.2(m)." Hokela seo u se bolokileng. connection_trace.txt log kapa Windows Event Viewer Control Manager logs (Event ID 7045 ho bonts'a motsotso o nepahetseng oa ScreenConnect kapa AnyDesk service was installed) e le bopaki ba forensic.

United Kingdom, European Union, Canada le Australia¶

• United Kingdom (PSR & FOS): Haeba senokoane se ne se laola komporo ea hau ka kotloloho hore e tsamaise chelete, e tlalehe e le Tefo e sa lumelloeng tlas'a Melao ea Litšebeletso tsa Tefo ea 2017. Haeba scammer e ile ea thetsa skrine ea hau (Inspect Element puseletso ea bohata) ho u qhekella hore u fane ka tumello ea Tefo e Potlakileng, e tlalehe tlas'a Payment Services Regulator's (PSR) e tlamang Tefo e Dumeltsweng ya Push (APP) Boqhekanyetsi melao ea puseletso le ho eketsa ho hana leha e le hofe ho Tšebeletso ea Ombudsman ea Lichelete (Financial Ombudsman Service).FOS).
• European Union, Canada, le Australia: Tlaleha ketsahalo hang-hang ho banka ea heno le mapolesa a naha, u totobatsa hore trojan ea ho kena u le hole e sebelisitse kapa e qhekelletse lenaneo. Eketsa likhohlano tsa banka tse sa rarolloang ho Ombudsman for Banking Services and Investments (OBSI) Canada kapa Australian Financial Complaints Authority (AFCA) Australia tlas'a ePayments Code.

Lethathamo la ho lokisa le ho tlaleha ka morao ho ketsahalo¶

Tlatsa ntho e 'ngoe le e 'ngoe e lethathamong lena pele u hokela marang-rang a lapeng kapa u qala mokhoa o tloaelehileng oa ho banka inthaneteng:

• Ho itšehla thajana ho netefalitsoe: Khomphutha e senyehileng e ile ea khaoloa ho Ethernet le Wi-Fi pele ho ka rarolloa mathata.
• Liakhaonto tsa banka li emisitsoe le ho ngolisoa hape: Linomoro tsohle tsa li-check, savings, le tsa HELOC tse neng li bonahala komporong li koetsoe 'me li fanoe hape ka linomoro tse ncha tsa ak'haonte.
• Mela e reriloeng ea Bill Pay le ACH e hlakotsoe: E netefalitsoe le mookameli oa banka hore ha ho cheke ea Bill Pay ea nakong e tlang, lihokelo tsa banka tsa kantle (Plaid), kapa litaelo tsa mohala tse emeng li ile tsa eketsoa nakong ea seboka se hole.
• Mokitlane o homisa ho sebetsa: Tšireletso e hoama e behiloe ka Equifax, Experian, TransUnion, le ChexSystems.
• Melao ea ho fetisa mangolo-tsoibila e hlahlobiloe: E kentsoe ho Gmail/Outlook/Yahoo ho tsoa ho smartphone e hloekileng ebe e hlahlobjoa Litlhophiso -> Ho fetisa le POP/IMAP le **Melao / Lisefe ** bakeng sa melao e patiloeng e hlakolang kapa e fetisang mangolo-tsoibila a nang le "Bank", "Fraud", "Wire", kapa "Security Alert".
• Palo ea li-password tsa sebatli e fetotsoe: Phasewete e 'ngoe le e 'ngoe e bolokiloeng ka har'a Chrome, Edge, Firefox, kapa batsamaisi ba li-password tsa Safari e fetotsoe ho tsoa sesebelisoa se hloekileng.
• Litlaleho tsa forensic li bolokiloe le litlaleho tsa semmuso li kentsoe: Faela litlaleho le FBI IC3 (ic3.gov) le FTC (reportfraud.ftc.gov) ho la US, Bosholu ba Ketso (actionfraud.police.uk) UK, Canadian Anti-Fraud Centre, kapa Scamwatch (scamwatch.gov.au) Australia. Hape, tlalehela motho ea kenyang binary kapa ID ea khokahano ho connectwise.com/company/trust/report-abuse kapa anydesk.com/en/abuse.

Lipotso tse botsoang khafetsa¶

The scammer o ile a mpontša Windows Event Viewer ea ka le netstat ho Command Prompt mme e ne e tletse likete tsa litemoso, liphoso, le likhokahano tsa "FOREIGN ADDRESS". Na komporo ea ka e hlile e hacked pele ke ba bitsa?¶

Che. Ka bobeli `eventvwr` (Windows Event Viewer) le `netstat` ke lisebelisoa tse tloaelehileng tsa tsamaiso tse hahelletsoeng ka har'a kopi e 'ngoe le e' ngoe ea Windows, 'me basomi ba li hlekefetsa joalo ka lisebelisoa tsa kelello. Khomphuta e 'ngoe le e' ngoe e phetseng hantle ea Windows e hlahisa likete tsa tlhokomeliso e mosehla le li-logs tse khubelu tsa Phoso ho Event Viewer nakong ea li-boot-ups le liapdeite tsa morao-rao, le `netstat` e thathamisa khokahano e 'ngoe le e 'ngoe e tloaelehileng ea morao-rao sebatli sa hau le sistimi ea ts'ebetso e e etsang ho li-server tsa cloud joalo ka "Aterese ea kantle ho naha." Khomphuta ea hau e ne e bolokehile ka botlalo ho fihlela ha u latela litaelo tsa motho ea letselitseng ho khoasolla le ho sebelisa sesebelisoa sa bona sa phihlello u le umoutu.

Ke joang scammer e entseng hore sebaka sa ka sa marang-rang sa banka se bonts'e hore ba kentse ka phoso $40,000 akhaonteng ea ka ea ho hlahloba haeba ba sa khone ho senya seva sa banka?¶

Ha o ntse o hokahantsoe komporong ea hau ka AnyDesk kapa ScreenConnect, motho ea qhekellang o tima skrine sa hau ka metsotsoana e 15, a tobetse ka ho le letona chelete ea banka ho sebatli sa hau sa marang-rang, ebe o tobetsa **"Hlahloba" (`Developer Tools`)**. Sena se bula mongolo oa lehae oa HTML o hlahang ho tab ea hau ea sebatli. Motho ea qhekellang o ngola feela `$45,200.00` holim'a 'nete ea hau `$5,200.00` ho leka-lekana le ho eketsa mongolo oa mongolo oa bohata `"ACH REFUND OVERPAYMENT +$40,000.00"` skrineng sa hau. Phetoho ena e teng feela ka har'a memori ea nakoana ea sebatli sa hau (`DOM`) mme e nyamele hang ha o hlabolla leqephe (`F5`) kapa hlahloba tekanyo ea hau ho app ea hau ea smartphone. Ntle le moo, ba fetisetsa `$40,000` ho tsoa akhaonteng ea hau ea polokelo kapa mohala oa mokoloto ho ak'haonteng ea hau ea ho hlahloba 'me u rebole skrineng ho u qhekella hore u kenye chelete ea hau ho bona.

Haeba ke ntšitse AnyDesk kapa UltraViewer ho Control Panel, na ke bolokehile hore nka bulela Wi-Fi eaka hape?¶

Hangata ntle le ho hlahloba lits'ebeletso tsa Windows (`services.msc`) ho Safe Mode pele. Litsi tsa mehala ea thekenoloji ea litsebi li tseba hore hangata bahlaseluoa ba hlakola AnyDesk kapa UltraViewer hang ha ba emisa. Ka hona, nakong ea metsotso e 'meli ea pele ea ho hokela komporong ea hau, basomi ba tloaetse ho sebelisa phetiso ea faele e khutsitseng ho theola e 'ngoe e patiloeng **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) kapa **SimpleHelp** moemeli ea sa theheng tsela e khaoletsang ea komporo mme e ipata kahare `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Ntle le haeba o netefatsa ho Safe Mode hore ha ho rogue `SYSTEM` lits'ebeletso kapa mesebetsi e reriloeng e teng, kapa u hlakole ka botlalo ka USB OS, ho hokela Wi-Fi hang-hang ho ka khutlisetsa PC ea hau ho mohlaseli.

Na motho ea bolotsana a ka fumana likhomphutha kapa li-smartphones tse ling marang-rang a ka a Wi-Fi hobane feela ke kentse AnyDesk ho laptop e le 'ngoe?¶

Ho kenya AnyDesk kapa ScreenConnect ho beha komporo e itseng moo o neng o tsamaisa sephutheloana, eseng lifono tsa hau kapa lilaptop tse ling ka kotloloho. Leha ho le joalo, haeba u sebelisa ** Google Chrome, Microsoft Edge, kapa Apple iCloud password le syncing session ** ho laptop le smartphone, li-passwords leha e le life tseo scammer e li utsoang kapa liphetoho ho laptop e nang le tšoaetso li tla ama li-account tsa hau tsa maru tse arolelanoang. Hape, ha o ntse o hokahantsoe le laptop ea hau, mohlaseli a ka kena leqepheng la tsamaiso ea router ea hau ea lapeng (`192.168.1.1`) haeba e ntse e sebelisa password ea kamehla ea admin ebe e fetola router ea hau `DNS` litlhophiso. Kamora ho arola laptop e nang le tšoaetso, fektheri seta router ea hau ea Wi-Fi bocha kapa u netefatse litlhophiso tsa eona tsa DNS le password ea admin ho sesebelisoa se hloekileng.

Litataiso tse amanang¶

• Theknoloji ea tšehetso ea pop-up scam le ho tlosa komporo e hole ea AnyDesk/TeamViewer
• Ho koeteloa ha li-cookie, malware a infostealer, le ho hlakoloa ha li-password
• Fake CAPTCHA ClickFix PowerShell Win + R clipboard malware le tokiso ea Lumma Infostealer
• Tefo e lumelitsoeng (APP) ea bomenemene ho app: Zelle, Venmo, le Litokelo tsa ho pusetsoa tse potlakileng
• Tlolo ea akhaonto ea banka
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha

Mehloli le tataiso ea semmuso¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Setsi sa Tšireletso ea Naha (NSA), & Setsi sa Mebuso e Mecha ea Kabo le Tlhahlobo ea Litaba (MS-ISAC) (United States): Keletso e Kopanetsweng ya Cybersecurity (AA23-025A): Ho Sireletsa Khahlanong le Tšebeliso e Lonya ea Tlhokomelo le Tsamaiso ea Remoutu (RMM) Software.
• Ofisi ea Tšireletso ea Lichelete ea Bareki (CFPB) (United States): * Lichelete tsa Lichelete tsa Elektronike (Regulation E, 12 CFR Part 1005) Litlhaloso le Lipotso Tsa Semmuso mabapi le Li-EFT tse sa lumelloeng le ho Finyella ka Bomenemene*.
• Federal Trade Commission (FTC) (United States): Kamoo U ka Fumanang, Ho Qoba, le ho Tlaleha Litlhaselo tsa Tšehetso ea Theknoloji.
• Setsi sa Naha sa Ts'ireletso ea Cyber ​​(NCSC) & Action Fraud (United Kingdom): Ho Sireletsa Lisebelisoa ho Lisebelisoa tse sa lumelloeng tsa ho fihlella hole le bomenemene ba ho arolelana skrini.
• ConnectWise Trust & Security Response Center: * Ho Khetholla le ho Tlosa Rogue ScreenConnect (ConnectWise Control) Maemo a bareki*.