Amadey zararli dasturidan foydalanadigan jinoyatchi endi dunyo bo'ylab, jumladan Avstraliyadagi ba'zi kompyuterlar ham, 180 000 zararlangan kompyuterdan ma'lumotlarga kirish yoki ularni o'g'irlash imkoniyatiga ega emas, deb xabar berdi Avstraliya Signallar Direktorati (ASD). Agentlik operatorlari jinoyatchining operatsiyasining orqa tizimiga kirib, uni shu kompyuterlardan uzib qo'yishdi.
"Keyingi qadamlarimiz Amadey nazoratchisini barcha shu jabrlanuvchilardan uzib qo'yish bo'ldi", — dedi ASDning razvedka bo'yicha direktor o'rinbosari vazifasini bajaruvchi Tauri Gregory ABC Newsga 27-oktabrda e'lon qilingan intervyuda.
ASD — Avstraliyaning xorijiy signallar razvedkasi va kiberxavfsizlik agentligi. Uning hujumkor kiberoperatsiyalari Avstraliya hukumatining aniq ruxsatini talab qiladi va xorijdagi kiberjinoyatchilarni ularning infratuzilmasini o'chirish orqali to'xtata oladi.
ESETning Amadey tahliliga ko'ra, Amadey 2018-yilda jinoyatchilarga xizmat sifatida sotilgan. Har bir xaridor o'z serverlarida o'z nazorat panelini ishlatadi.
Amadey bilan zararlangan kompyuterlar o'z xaridorining buyruq va nazorat (C2) serveri bilan bog'lanib, uning buyruqlarini bajaradi. Amadeyning asosiy vazifasi ko'proq zararli dasturlarni, masalan StealC ma'lumot o'g'irlovchisini o'rnatishdir. U shuningdek, ma'lumotlarni o'g'irlashi va xaridorga mashinaga masofadan kirish imkoniyatini berishi mumkin.
Amadey kompyuterlarga eng ko'p soxta dastur yangilanishlari, buzilgan dastur o'rnatuvchilari va boshqa zararli dastur yuklovchilari orqali yetib borgan.
Jinoyatchining Amadey operatsiyasi ko'plardan biri edi. Kuzatuvda ESET infratuzilmani baham ko'rmagan 53 ta alohida Amadey botnetini aniqladi.
Nazoratni jabrlanuvchilardan uzib qo'yish avvalgi o'g'irlikni bekor qilmaydi. Microsoft tahliliga ko'ra, ma'lumot o'g'irlovchilari tomonidan o'g'irlangan ma'lumotlar hujumchilar ularni ishlatishdan oldin oylar davomida foydalanilmasdan qolishi mumkin. O'g'irlangan sessiya cookie-si hujumchiga ko'p faktorli autentifikatsiyani (MFA) chetlab o'tish imkonini berishi mumkin.
27-oktabrda e'lon qilingan ASDning yillik kiberxavfsizlik tahdidlar hisobotida bu operatsiya tasvirlanmagan.
Amadey infratuzilmasi iyun oyida ham Operation Endgame — xususiy hamkorlar bilan ishlaydigan xalqaro huquqni muhofaza qilish operatsiyasi tomonidan buzilgan. 15-19 iyun kunlari operatsiya Amadey, StealC va SocGholish zararli dasturlari bilan bog'liq serverlarga qaratilgan.
Europolning iyun oyidagi e'loniga ko'ra, Avstraliya Operation Endgame-ni birgalikda boshqaradigan to'qqiz davlatdan biri. U iyun oyidagi harakat haftasida ishtirok etgan davlatlar ro'yxatida yo'q edi va e'lon ASDni tilga olmaydi.
Alohida holatda ASD bir biznesdan o'g'irlangan 5 terabayt ma'lumot sotuvga qo'yilganligi haqida xabar oldi. Biznes o'zi buzilganini bilmagan. Ma'lumotlar biznes hujjatlari, shaxsiy ma'lumotlar va kirish ma'lumotlari hamda parollarni o'z ichiga olgan.
Agentlik ma'lumotlarni sotilishidan oldin kirib, ularni yo'q qildi. Yo'q qilingan fayllar orasida avstraliyaliklardan o'g'irlangan taxminan 4,8 million va boshqa davlatlardagi jabrlanuvchilardan olingan yuz minglab fayllar bor edi.
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers.
"The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27.
ASD is Australia's foreign signals intelligence and cyber security agency. Its offensive cyber operations need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure.
Amadey was sold to criminals as a service in 2018, according to ESET's analysis of Amadey. Each buyer runs its own control panel on its own servers.
Computers infected with Amadey check in with their buyer's command-and-control (C2) server and carry out its orders. Amadey's main job is to install more malware, such as the StealC infostealer. It can also steal credentials and give the buyer remote access to the machine.
The most common ways Amadey reached computers were fake software updates, cracked software installers, and other malware loaders.
The criminal's Amadey operation was one of many. In its tracking, ESET identified 53 separate Amadey botnets that did not share infrastructure.
Disconnecting a controller from its victims also does not undo earlier theft. Credentials stolen by infostealers can sit unused for months before attackers use them, according to Microsoft's analysis. A stolen session cookie can allow an attacker to bypass multi-factor authentication (MFA).
ASD's annual cyber threat report, published on October 27, does not describe the operation.
Amadey's infrastructure was also disrupted in June by Operation Endgame, an international law enforcement operation that works with private partners. Between June 15 and 19, the operation targeted servers associated with Amadey, StealC, and the SocGholish malware.
Australia is one of nine countries whose law enforcement and judicial authorities run Operation Endgame together, according to Europol's June announcement. It was not on Europol's list of countries that took part in the June action week, and the announcement does not mention ASD.
In a separate case, ASD said it received a tip that 5 terabytes of data stolen from a business were for sale. The business did not know it had been hacked. The data included business documents, personal data, and login credentials and passwords.
The agency broke in and destroyed the data before it could be sold. The destroyed files included an estimated 4.8 million stolen from Australians and hundreds of thousands taken from victims in other countries.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.