- 一个名为TeamPCP的新型黑客组织自2025年12月起活跃于互联网,通过自动化手段大规模传播一种此前未见的自传播后门程序。该组织利用未妥善保护的云平台构建分布式代理与扫描基础设施,用于数据窃取、勒索软件部署、敲诈及加密货币挖矿。其攻击手法以高度自动化和整合已知技术为特点,具备持续演进能力。
近期,TeamPCP发动持续攻击,利用不断演变的恶意软件扩大控制范围。上周,该组织通过入侵Trivy漏洞扫描工具开发商Aqua Security的GitHub账户,对几乎所有Trivy版本实施供应链攻击。周末期间,研究人员观察到其传播具备蠕虫能力的恶意软件,可自动感染新设备,无需用户交互。感染后,该程序扫描系统获取npm仓库访问令牌,并自动发布含恶意代码的新版本软件包。安全公司Aikido记录到其在60秒内攻击28个npm包。
新型黑客组织TeamPCP活跃
自传播后门与蠕虫结合
供应链攻击波及Trivy工具
npm包遭自动化投毒
- TeamPCP的恶意软件采用罕见且防篡改的控制机制,基于互联网计算机协议(ICP)的“容器”(canister)进行指令分发,增强了其隐蔽性与持久性。该机制使攻击者能远程操控蠕虫行为,同时避免传统C2服务器被追踪或关闭的风险。此外,该组织在攻击中部署了专门针对伊朗境内设备的数据擦除程序,显示出其攻击具有地域选择性,可能带有政治或破坏性目的。
尽管目前尚无明确归属证据,但其技术复杂度与资源投入表明背后可能存在国家支持或高度组织化的犯罪集团。此次攻击凸显开源软件供应链的脆弱性,尤其是依赖第三方账户权限的工具面临更高风险。安全社区呼吁加强GitHub等平台的多因素认证与权限审计。
使用ICP容器实现防篡改控制
针对伊朗设备的数据擦除程序
开源供应链安全风险上升
攻击可能具政治动机
- A newly identified hacking group, tracked as TeamPCP, has launched a persistent and evolving cyber campaign involving a self-propagating backdoor and a data wiper specifically targeting Iranian systems. First observed in December by security firm Flare, the group exploited poorly secured cloud platforms to build a distributed proxy and scanning network, which it used for data exfiltration, ransomware deployment, extortion, and cryptocurrency mining. TeamPCP is noted for its advanced automation and integration of established attack methods. In a recent escalation, the group compromised nearly all versions of the Trivy vulnerability scanner in a supply-chain attack after gaining privileged access to the GitHub account of Aqua Security, Trivy’s developer. Over the weekend, researchers observed TeamPCP deploying worm-capable malware that automatically spreads across systems without user interaction. Once installed, the malware harvests npm repository access tokens and publishes malicious versions of accessible packages. Security firm Aikido reported the worm targeting 28 npm packages in under a minute. Earlier versions required manual propagation, but recent updates enabled fully autonomous spreading. The malware uses a tamper-resistant command-and-control mechanism based on the Internet Computer Protocol (ICP) canister, enhancing its resilience. Detailed information limited on the full scope of affected systems and long-term objectives.
Key Takeaways:
TeamPCP uses advanced automation and evolving malware in large-scale attacks
Supply-chain compromise of Trivy scanner expands reach through npm packages
Malware spreads autonomously and targets Iranian systems with data wipers
Command-and-control leverages tamper-proof Internet Computer Protocol infrastructure
Source: Original Article
查看原文 →
View Original →