{"id":17445,"date":"2020-03-02T14:57:28","date_gmt":"2020-03-02T14:57:28","guid":{"rendered":"http:\/\/hraicp.org\/?p=17445"},"modified":"2020-03-02T14:57:28","modified_gmt":"2020-03-02T14:57:28","slug":"%d9%87%d9%85%d9%87-%da%86%db%8c%d8%b2-%d8%af%d8%b1%d8%a8%d8%a7%d8%b1%d9%87-%da%af%d8%b1%d9%88%d9%87-apt27-2","status":"publish","type":"post","link":"https:\/\/hraicp.org\/?p=17445","title":{"rendered":"\u0647\u0645\u0647 \u0686\u06cc\u0632 \u062f\u0631\u0628\u0627\u0631\u0647 \u06af\u0631\u0648\u0647 APT\u06f2\u06f7"},"content":{"rendered":"<p style=\"text-align: justify\"><span style=\"color: #000000\">\u06a9\u0645\u06cc\u062a\u0647 \u0631\u06a9\u0646 \u0686\u0647\u0627\u0631\u0645 &#8211; \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 APT27 \u06a9\u0647 \u0628\u0627 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc LuckyMouse\u060c\u0648Emissary Panda\u060c\u0648BRONZE UNION\u060c\u0648Threat Group 3390 \u0648 Iron Tiger \u0646\u06cc\u0632 \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0647 \u0648 \u0635\u062f\u0647\u0627 \u0633\u0627\u0632\u0645\u0627\u0646 \u0631\u0627 \u062f\u0631 \u06a9\u0634\u0648\u0631\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0645\u0646\u0627\u0628\u0639\u060c \u06af\u0631\u062f\u0627\u0646\u0646\u062f\u06af\u0627\u0646 APT27 \u0631\u0627 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646\u06cc \u0628\u0627 \u0645\u0644\u06cc\u062a \u06cc\u0627 \u0627\u0635\u0627\u0644\u062a \u0686\u06cc\u0646\u06cc \u0645\u06cc\u200c\u062f\u0627\u0646\u0646\u062f.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"color: #000000\"><img fetchpriority=\"high\" decoding=\"async\" class=\"wp-image-17446 aligncenter\" src=\"https:\/\/hraicp.org\/wp-content\/uploads\/2020\/03\/Hacker_Cloud_shutterstock_531270244_700-300x171.jpg\" alt=\"\" width=\"756\" height=\"431\" srcset=\"https:\/\/hraicp.org\/wp-content\/uploads\/2020\/03\/Hacker_Cloud_shutterstock_531270244_700-300x171.jpg 300w, https:\/\/hraicp.org\/wp-content\/uploads\/2020\/03\/Hacker_Cloud_shutterstock_531270244_700.jpg 700w\" sizes=\"(max-width: 756px) 100vw, 756px\" \/><\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"color: #000000\">\u00a0\u062d\u0645\u0644\u0627\u062a \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0647\u062f\u0627\u0641 \u0645\u062e\u062a\u0644\u0641 \u0648 \u0645\u062a\u0641\u0627\u0648\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0631 \u062e\u0635\u0648\u0635 \u0641\u0646\u0627\u0648\u0631\u06cc\u200c\u0647\u0627\u06cc \u062a\u0633\u0644\u062d\u06cc\u0627\u062a\u06cc \u06af\u0631\u0641\u062a\u0647 \u062a\u0627 \u062c\u0627\u0633\u0648\u0633\u06cc \u0627\u0632 \u0641\u0639\u0627\u0644\u0627\u0646 \u062d\u0642\u0648\u0642 \u0628\u0634\u0631 \u062f\u0646\u0628\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"color: #000000\">\u0628\u062a\u0627\u0632\u06af\u06cc \u0646\u06cc\u0632 \u0645\u0631\u06a9\u0632 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0631\u0627\u0647\u0628\u0631\u062f\u06cc \u0627\u0641\u062a\u0627 \u0627\u0632 \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u0648\u0627\u0631\u062f\u06cc \u0627\u0632 \u0622\u0644\u0648\u062f\u06af\u06cc \u0628\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u0645\u0646\u0633\u0648\u0628 \u0628\u0647 \u06af\u0631\u0648\u0647 APT27 \u062f\u0631 \u0628\u0631\u062e\u06cc \u0627\u0632 \u062f\u0633\u062a\u06af\u0627\u0647\u200c\u0647\u0627\u06cc \u06a9\u0634\u0648\u0631 \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0645\u0631\u06a9\u0632 \u0628\u0627 \u0645\u0634\u0627\u0631\u06a9\u062a \u06cc\u06a9 \u0634\u0631\u06a9\u062a \u062f\u0627\u0646\u0634\u200c\u0628\u0646\u06cc\u0627\u0646 \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0639\u0631\u0636\u0647 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0634\u0646\u0627\u0633\u0627\u06cc \u0648 \u067e\u0627\u06a9\u0633\u0627\u0632\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u0630\u06a9\u0648\u0631 \u0646\u0645\u0648\u062f\u0647 \u06a9\u0647 \u062c\u0632\u06cc\u06cc\u0627\u062a \u0622\u0646\u0647\u0627 \u062f\u0631 <a style=\"color: #000000\" href=\"http:\/\/afta.gov.ir\/Portal\/home\/?news\/235046\/237267\/240415\/%D8%A7%D8%B2-%D8%B3%D9%88%DB%8C-%D9%85%D8%B1%DA%A9%D8%B2-%D8%A7%D9%81%D8%AA%D8%A7-%D8%A7%D9%86%D8%AA%D8%B4%D8%A7%D8%B1-%DA%A9%D8%AF%D9%85%D9%86%D8%A8%D8%B9-%D8%A7%D8%A8%D8%B2%D8%A7%D8%B1%D9%87%D8%A7%DB%8C-%D8%B4%D9%86%D8%A7%D8%B3%D8%A7%DB%8C%DB%8C-%D9%88-%D9%BE%D8%A7%DA%A9%D8%B3%D8%A7%D8%B2%DB%8C-%D8%A8%D8%AF%D8%A7%D9%81%D8%B2%D8%A7%D8%B1-%D9%85%D9%86%D8%B3%D9%88%D8%A8-%D8%A8%D9%87-%DA%AF%D8%B1%D9%88%D9%87-APT27\">\u0627\u06cc\u0646\u062c\u0627<\/a> \u0642\u0627\u0628\u0644 \u062f\u0633\u062a\u0631\u0633 \u0627\u0633\u062a.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"color: #000000\">\u0628\u0647 \u06af\u0632\u0627\u0631\u0634 \u0634\u0631\u06a9\u062a \u0645\u0647\u0646\u062f\u0633\u06cc \u0634\u0628\u06a9\u0647 \u06af\u0633\u062a\u0631 \u0645\u0646\u0637\u0642\u0647 \u062e\u0627\u0648\u0631\u0645\u06cc\u0627\u0646\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0635\u0644\u06cc\u200c\u062a\u0631\u06cc\u0646 \u0627\u0647\u062f\u0627\u0641 \u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a. \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644\u060c \u062f\u0631 \u0622\u0648\u0631\u06cc\u0644 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f9 \u0634\u0631\u06a9\u062a \u067e\u0627\u0644\u0648\u0622\u0644\u062a\u0648 \u0646\u062a\u200c\u0648\u0631\u06a9\u0632 \u0627\u0632 \u0622\u0644\u0648\u062f\u06af\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u062f\u0648\u0644\u062a\u06cc \u062f\u0631 \u062f\u0648 \u06a9\u0634\u0648\u0631 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0646\u0637\u0642\u0647 \u062e\u0628\u0631 \u062f\u0627\u062f \u06a9\u0647 \u062f\u0631 \u062c\u0631\u06cc\u0627\u0646 \u0622\u0646 \u062d\u0645\u0644\u0627\u062a\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u062c\u0648\u06cc\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2019-0604 \u062f\u0631 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 Microsoft SharePoint \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0631\u062e\u0646\u0647 \u0628\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u062d\u0627\u0648\u06cc \u0627\u06cc\u0646 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0648 \u0646\u0635\u0628 \u06cc\u06a9 \u0648\u0628\u200c\u0634\u0644 \u0645\u062e\u0631\u0628 \u0628\u0631 \u0631\u0648\u06cc \u0622\u0646\u0647\u0627 \u0645\u06cc\u200c\u06a9\u0631\u062f\u0646\u062f.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"color: #000000\">\u062d\u062f\u0648\u062f \u06cc\u06a9 \u0633\u0627\u0644 \u0642\u0628\u0644 \u0645\u062d\u0642\u0642\u0627\u0646 Secureworks \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0647\u0631 \u0633\u0647 \u0645\u0627\u0647 \u06cc\u06a9\u0628\u0627\u0631 \u0645\u062c\u062f\u062f\u0627\u064b \u0628\u0647 \u0634\u0628\u06a9\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc\u0627\u0646 \u062e\u0648\u062f \u0628\u0627\u0632\u06af\u0634\u062a\u0647 \u0648 \u0636\u0645\u0646 \u0628\u0631\u0631\u0633\u06cc \u0628\u0631\u0642\u0631\u0627\u0631 \u0628\u0648\u062f\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0648\u0628\u200c\u0634\u0644\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u0635\u0627\u0644\u062a\u200c\u0633\u0646\u062c\u06cc (Credential) \u067e\u06cc\u0634\u06cc\u0646\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u0638\u0631 \u062e\u0648\u062f \u0631\u0627 \u0645\u0648\u0631\u062f \u0631\u0635\u062f \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"color: #000000\">\u0627\u0632 \u062c\u0645\u0644\u0647 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc \u0628\u06a9\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06af\u0631\u0648\u0647 APT27 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0647 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0627\u0634\u0627\u0631\u0647 \u06a9\u0631\u062f:<\/span><\/p>\n<ul style=\"text-align: justify\">\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0632 \u0641\u0631\u0645\u0627\u0646 net user \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0646\u0627\u0645\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0628\u0631 \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0628\u0647\u0631\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u062f\u0631 \u0628\u0631\u062e\u06cc \u062d\u0645\u0644\u0627\u062a \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 APT27 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u06cc \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0639\u0628\u0648\u0631 \u0627\u0632 \u0633\u062f User Account Control \u0648 \u062a\u0631\u0641\u06cc\u0639 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647\u0631\u0647 \u06af\u0631\u0641\u062a\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/span><\/li>\n<li><span style=\"color: #000000\">\u062f\u0631 \u062c\u0631\u06cc\u0627\u0646 \u0628\u0631\u062e\u06cc \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0632 \u062f\u0631\u06af\u0627\u0647\u200c\u0647\u0627\u06cc \u06f5\u06f3\u060c\u0648\u06f8\u06f0 \u0648 \u06f4\u06f4\u06f3 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/span><\/li>\n<li><span style=\"color: #000000\">APT27 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 gsecdump \u0648 \u0646\u0633\u062e\u0647\u200c\u0627\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0634\u062f\u0647 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 Mimikatz (\u0645\u0639\u0631\u0648\u0641 \u0628\u0647 Wrapikatz) \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u0635\u0627\u0644\u062a\u200c\u0633\u0646\u062c\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 Domain Controller \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0647 \u0637\u0648\u0631 \u062e\u0627\u0635 \u0628\u0647 \u0647\u0645\u06cc\u0646 \u0645\u0646\u0638\u0648\u0631 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 RAR \u0628\u0631\u0627\u06cc \u0641\u0634\u0631\u062f\u0647\u200c\u0633\u0627\u0632\u06cc\u060c \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0648 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0641\u0627\u06cc\u0644 \u0641\u0634\u0631\u062f\u0647 \u0634\u062f\u0647 \u067e\u06cc\u0634 \u0627\u0632 \u0627\u0631\u0633\u0627\u0644 \u0622\u0646\u0647\u0627 \u0628\u0647 \u0633\u0631\u0648\u0631 \u0641\u0631\u0645\u0627\u0646\u062f\u0647\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">APT27 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u0631\u062d\u0644\u0647 \u0628\u0647 \u0645\u0631\u062d\u0644\u0647 \u0648 \u062f\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u0628\u0627 \u0627\u0646\u062f\u0627\u0632\u0647\u200c\u0627\u06cc \u0645\u0634\u062e\u0635 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0628\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062f\u0633\u062a\u0631\u0633 \u062f\u0631 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u06a9\u0647 \u067e\u06cc\u0634\u200c\u062a\u0631 \u0628\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 China Chopper \u0622\u0644\u0648\u062f\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0632 \u0641\u0627\u06cc\u0644 appcmd.exe \u0628\u0631\u0627\u06cc \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u062b\u0628\u062a \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0642\u0631\u0628\u0627\u0646\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647\u060c DLL Search Order Hijacking \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u062c\u0631\u06cc\u0627\u0646 \u0622\u0646 \u0627\u0632 \u06cc\u06a9\u06cc \u0627\u0632 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0628\u06a9\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0633\u06cc\u0633\u062a\u0645 \u0639\u0627\u0645\u0644 Windows \u062f\u0631 \u062c\u0633\u062a\u062c\u0648\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc DLL \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627 \u0634\u062f\u0646 \u062f\u0631 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0628\u0647\u0631\u0647\u200c\u062c\u0648\u06cc\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0637\u0631\u06cc\u0642 \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u0627\u0645\u0648\u0631\u06cc \u0647\u0645\u0686\u0648\u0646 \u062a\u0631\u0641\u06cc\u0639 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0631\u0628\u0631 \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0648 \u06cc\u0627 \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0627\u06cc \u0645\u062e\u0631\u0628 \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">APT27 \u0627\u0632 \u0645\u0639\u0631\u0648\u0641\u200c\u062a\u0631\u06cc\u0646 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647\u200c\u0637\u0648\u0631 \u0627\u0633\u062a\u0631\u0627\u062a\u0698\u06cc\u06a9 \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0647\u06a9 \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0647\u062f\u0627\u0641 \u062e\u0648\u062f \u0648 \u0622\u0644\u0648\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0622\u0646\u0647\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0627\u06cc\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0636\u0639\u0641 \u0627\u0645\u0646\u06cc\u062a\u06cc <a style=\"color: #000000\" href=\"https:\/\/msrc-blog.microsoft.com\/2014\/11\/18\/additional-information-about-cve-2014-6324\/\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2014-6324<\/a> \u062f\u0631 Windows \u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc <a style=\"color: #000000\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0604\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2019-0604<\/a> \u062f\u0631 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 Microsoft SharePoint \u0631\u0627 \u062f\u0631 \u06a9\u0627\u0631\u0646\u0627\u0645\u0647 \u062f\u0627\u0631\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u062f\u0631 \u0628\u0631\u062e\u06cc \u062d\u0645\u0644\u0627\u062a\u060c \u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u06cc\u06a9 \u062b\u0628\u062a\u200c\u06a9\u0646\u0646\u062f\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u0635\u0627\u0644\u062a\u200c\u0633\u0646\u062c\u06cc \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Microsoft Exchange \u0646\u0635\u0628 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 ScanBox \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0641\u0634\u0631\u062f\u0647 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0642\u0631\u0628\u0627\u0646\u06cc \u0628\u0647\u0631\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u0628\u0632\u0627\u0631 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0642\u0627\u062f\u0631 \u0628\u0647 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0644\u06cc\u062f \u062c\u062f\u06cc\u062f \u062f\u0631 \u0645\u0633\u06cc\u0631 HKEY_CURRENT_USER\\Software\\Classes\\ \u062f\u0631 \u0645\u062d\u0636\u0631\u062e\u0627\u0646\u0647 (Registry) \u0627\u0633\u062a.<\/span><\/li>\n<li><span style=\"color: #000000\">\u06af\u0631\u0648\u0647 APT27 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 Hunter \u062c\u0647\u062a \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062f\u0633\u062a\u0631\u0633 \u062f\u0631 \u0633\u0637\u062d \u0634\u0628\u06a9\u0647 \u0648 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0628\u0647\u0631\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u067e\u0633 \u0627\u0632 \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u060c \u0627\u062d\u062a\u0645\u0627\u0644\u0627\u064b \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u062f\u0646 \u0631\u062f \u067e\u0627 \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0642\u0637\u0639 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u062e\u0648\u062f \u0628\u0627 \u067e\u0648\u0634\u0647\u200c\u0647\u0627\u06cc \u0627\u0634\u062a\u0631\u0627\u06a9\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc APT27 \u0642\u0627\u062f\u0631 \u0628\u0647 \u0627\u06cc\u062c\u0627\u062f \u0633\u0631\u0648\u06cc\u0633\u06cc \u062c\u062f\u06cc\u062f \u0628\u0631 \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc \u0628\u0627 \u0647\u062f\u0641 \u0645\u0627\u0646\u062f\u06af\u0627\u0631 \u06a9\u0631\u062f\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062e\u0648\u062f \u0627\u0633\u062a.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u067e\u0631\u0648\u0633\u0647 \u0645\u0639\u062a\u0628\u0631 PowerShell \u062c\u0647\u062a \u0627\u062c\u0631\u0627\u06cc \u0628\u0631\u062e\u06cc \u0627\u0632 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a\u200c\u0647\u0627 \u0648 \u06a9\u062f\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u062e\u0648\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u067e\u0631\u0648\u0633\u0647 \u0645\u0639\u062a\u0628\u0631 svchost.exe \u0631\u0627 \u062a\u0633\u062e\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u062f\u0631 \u0622\u0646 \u062a\u0632\u0631\u06cc\u0642 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u062f\u0631 \u0628\u0631\u062e\u06cc \u062d\u0645\u0644\u0627\u062a \u0641\u0627\u06cc\u0644 \u0648 \u0645\u0633\u06cc\u0631 \u0627\u062c\u0631\u0627\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062f\u0631 \u0645\u0633\u06cc\u0631 Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ \u062b\u0628\u062a \u0648 \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0631\u062a\u06cc\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0645\u0627\u0646\u062f\u06af\u0627\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u06af\u0631\u0648\u0647 APT27 \u0627\u0632 \u0641\u0631\u0645\u0627\u0646 net view \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 <a style=\"color: #000000\" href=\"https:\/\/support.microsoft.com\/en-ae\/help\/313565\/how-to-use-the-at-command-to-schedule-tasks\" target=\"_blank\" rel=\"noopener noreferrer\">at<\/a> \u062f\u0631 \u0641\u0631\u0627\u0645\u06cc\u0646 \u0632\u0645\u0627\u0646\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 (Scheduled Task) \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0641\u0634\u0631\u062f\u0647 RAR \u0628\u0627 \u062e\u0627\u0635\u06cc\u062a \u062e\u0648\u062f\u0627\u062c\u0631\u0627\u06cc\u06cc \u0648 \u062f\u0631 \u0627\u062f\u0627\u0645\u0647 \u0646\u0635\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc HTTPBrowser \u06cc\u0627 PlugX \u0628\u0631 \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0633\u0627\u06cc\u0631 \u0642\u0631\u0628\u0627\u0646\u06cc\u0627\u0646 \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0628\u062f\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0632 \u067e\u0648\u062f\u0645\u0627\u0646 HTTP \u0628\u0631\u0627\u06cc \u0628\u0631\u0642\u0631\u0627\u0631\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u0633\u0631\u0648\u0631 \u0641\u0631\u0645\u0627\u0646\u062f\u0647\u06cc \u062e\u0648\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u06af\u0631\u0648\u0647 APT27 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 nbtscan \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 net use \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0633\u0627\u06cc\u0631 \u062f\u0633\u062a\u06af\u0627\u0647\u200c\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0647\u0645\u0686\u0646\u06cc\u0646 \u06af\u0631\u0648\u0647 APT27 \u0627\u0632 quser.exe \u062c\u0647\u062a \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0646\u0634\u0633\u062a\u200c\u0647\u0627\u06cc RDP \u0628\u0631\u0642\u0631\u0627\u0631 \u0634\u062f\u0647 \u0628\u0631 \u0631\u0648\u06cc \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u0628\u0647\u0631\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0627 \u0628\u062f\u0633\u062a \u0622\u0648\u0631\u062f\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u0635\u0627\u0644\u062a\u200c\u0633\u0646\u062c\u06cc \u0645\u0639\u062a\u0628\u0631 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0631\u0648\u0634 \u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u062f\u0631 \u0627\u062f\u0627\u0645\u0647 \u0627\u0632 \u0622\u0646\u0647\u0627 \u0628\u0631\u0627\u06cc \u06af\u0633\u062a\u0631\u0634 \u0622\u0644\u0648\u062f\u06af\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/li>\n<li><span style=\"color: #000000\">\u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u06af\u0631\u0648\u0647 APT27 \u0627\u0632 \u0648\u0628\u200c\u0634\u0644\u200c\u0647\u0627\u06cc \u0645\u062a\u0639\u062f\u062f\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/span><\/li>\n<li><span style=\"color: #000000\">\u062d\u062f\u0627\u0642\u0644 \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0642\u0627\u062f\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u062f\u0648\u062f\u0648\u06cc\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 Windows Management Instrumentation \u0627\u0633\u062a.<\/span><\/li>\n<li><span style=\"color: #000000\">\u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 Windows Remote Management \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/span><\/li>\n<\/ul>\n<p style=\"text-align: justify\"><span style=\"color: #000000\">\u062a\u0648\u0636\u06cc\u062d \u0627\u06cc\u0646\u06a9\u0647 \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0632 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06af\u0631\u0648\u0647 APT27 \u0628\u0627 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u062a\u0648\u0633\u0637 \u0636\u062f\u0648\u06cc\u0631\u0648\u0633 McAfee \u0642\u0627\u0628\u0644 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0627\u0633\u062a:<\/span><\/p>\n<ul>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!1B2D75F9C771<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!12A522CB9670<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!1CB4B74E9D03<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!1DD30422A1CB<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!2BEC1860499A<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!37FC73C754EF<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!3EEB4A7C6925<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!4251AAF38A48<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!57E85FC30502<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!70CFF7C176C7<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!728E5700A401<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!81ED75259075<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!850DF4A726A7<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!86A05DCFFE87<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!93E40DA0BD78<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!9DD9D006D40D<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!A13772805B77<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!A9C2FF438C73<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!B333B5D541A0<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!B7F958F93E2F<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!BD9E4C82BF12<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!C69D60B82252<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!C8D83840B96F<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Artemis!F43D9C3E17E8<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">ASP\/Shell.h<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-Chopper<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!014122D7851F<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!02826BB66363<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!0AE996B31A2C<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!1539B3A59212<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!15FD9C04D609<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!1606AB7A5473<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!1A76681986F9<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!20C446AD2D7D<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!225E10E362EE<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!372F5370085A<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!380C02B1FD93<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!40A9A22DA928<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!44CF0793E05B<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!46CF2F9B4A4C<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!5C3AB475BE11<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!5CD0E97A1F09<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!5EF719F8AEB9<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!692CECC94AC4<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!6A39A4E99334<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!6AAC7417EA1E<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!7EC917683763<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!8B4ED3B392EE<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!8EA5D8BB6B28<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!9271BCFBBA05<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!996843B55A7C<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!A554EFC88971<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!A631FC7C45CB<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!AF785B4DF71D<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!C66E09429AD6<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!C9C93C2D62A0<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!DDBDF0EFDF26<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!E3E0F3AD4FF3<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!E7DF18A17D8E<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!E7E555615A07<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!EA4DCAFC224F<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!EA8B9E0BF95F<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!F658BB17D699<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!F869A1B40F64<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FCVY!FAC4885324CB<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">BackDoor-FDRS!40CDD3CFE86C<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">DoS-FAK!19230C66AA4A<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic Trojan.em<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic Trojan.go<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic Trojan.gs<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic Trojan.gy<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic Trojan.hm<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic Trojan.i<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic.dx!BBFD1E703F55<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Generic.eof<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">GenericR-QAF!F0044BCB4B1D<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">GenericRXGO-YK!C419CDD0DECE<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">GenericRXHS-MH!9F8B60567642<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">GenericRXHT-WL!2BCB003D74F9<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">HTML\/Chopper.a<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">HTool-JSPRat<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Nbtscan<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Packed-LF!313909878C72<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Packed-LF!6F5E0882316C<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">PUP-XAV-HC<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic BackDoor<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic BackDoor.ml<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic PUP.abb<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic PUP.bmb<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic PUP.pk<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic PUP.z<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic PWS.mp<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic.cix<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic.com<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic.dxw<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic.erp<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic.grp<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">RDN\/Generic.hra<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Trojan-FMWJ!CD5AAA37EE16<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">Trojan-FPYL!62BCBFAE5276<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">W97M\/MacroLess.h<\/span><\/li>\n<li style=\"text-align: justify\"><span style=\"color: #000000\">\u0645\u0646\u0628\u0639: \u0634\u0628\u06a9\u0647 \u06af\u0633\u062a\u0631<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u06a9\u0645\u06cc\u062a\u0647 \u0631\u06a9\u0646 \u0686\u0647\u0627\u0631\u0645 &#8211; \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 APT27 \u06a9\u0647 \u0628\u0627 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc LuckyMouse\u060c\u0648Emissary Panda\u060c\u0648BRONZE UNION\u060c\u0648Threat Group 3390 \u0648 Iron Tiger \u0646\u06cc\u0632 \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc\u2026<\/p>\n","protected":false},"author":4,"featured_media":17446,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[4,13],"tags":[8513,7951,26,494],"class_list":["post-17445","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-s3-000","category-13","tag-apt27","tag-secureworks","tag-26","tag-494"],"_links":{"self":[{"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/posts\/17445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/hraicp.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17445"}],"version-history":[{"count":1,"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/posts\/17445\/revisions"}],"predecessor-version":[{"id":17447,"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/posts\/17445\/revisions\/17447"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hraicp.org\/index.php?rest_route=\/wp\/v2\/media\/17446"}],"wp:attachment":[{"href":"https:\/\/hraicp.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hraicp.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hraicp.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}