这只麻雀不迁徙。[研究星期六]

您正在收听由N2K赞助的Cyberwire网络节目。

You're listening to the Cyberwire network powered by n two k.

今年前往Black Hat USA现场时，N2K Cyberwire团队将在SpectreOps Kennel Club的播客演播室进行现场录制。

Heading to this year's Black Hat USA, the n two k Cyberwire team will be on-site recording from our podcast studio in the SpectreOps Kennel Club.

如果您想加入我们的对话，或了解本周我们录制的更多精彩内容，请访问 sponsor.thecyberwire.com 获取更多信息。

If you're interested in joining us for a conversation or learning more about what we're recording throughout the week, visit sponsor.thecyberwire.com for more information.

也别忘了来演播室看看，亲自认识一下N2K Cyberwire的团队成员。

And make sure you stop by the studio and meet the n two k Cyberwire team.

我们现场见。

We'll see you there.

本集节目由Black Hat USA赞助支持。

This episode is supported by Black Hat USA.

如果您关注安全研究，就会知道很多重磅成果都是在Black Hat的舞台上发布的。

If you follow the research, you know a lot of it breaks on Black Hat stages.

这里有数百场同行评审的演讲、一百多项实战培训，还有Black Hat历史上规模最大的商业展区。

Hundreds of peer reviewed briefings, more than a 100 hands on trainings, and the largest business hall in Black Hat's history.

六天时间，掌握你明天需要用到的技能，8月1号到6号。

Six days to learn the skills you'll need tomorrow, August first through the sixth.

在 blackhat.com 购买简报通行证时，使用代码 Cyberwire，立减200美元。

Use code Cyberwire for 200 off your briefings pass at blackhat.com.

我们在拉斯维加斯见。

We'll see you in Vegas.

大家好，欢迎来到《网络安全研究星期六》。

Hello, everyone, and welcome to the CyberWires Research Saturday.

我是戴夫，来自Bitdefender，这是我们每周与研究人员和分析师的对话，他们追踪威胁与漏洞，解决棘手问题，在不断变化的网络空间中保护我们自身。

I'm Dave Bitdefender, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in a rapidly evolving cyberspace.

感谢您的收听。

Thanks for joining us.

随着Zegarsha越来越关注欧洲和乌克兰，我们自然也观察到俄罗斯和中国的高级持续性威胁组织之间出现了一些摩擦。

As Zegarsha is focusing more and more on Europe and the Ukraine, of course, we are seeing a little bit of conflict between Russian and Chinese APTs.

因此，我们特别留意那些对这两个大国具有战略意义的国家。

So we pay a lot of attention to countries that are in areas of interest for these two powers.

这是比特梵德的技术解决方案总监马丁·祖热茨。

That's Martin Zugec, Technical Solutions Director at Bitdefender.

今天我们讨论的研究题目是《FamousSparrow攻击阿塞拜疆石油与天然气行业》。

The research we're discussing today is titled FamousSparrow Targets Azerbaijani Oil and Gas Industry.

能给我们详细讲讲这项研究吗？

Well, take us through the research.

一开始是什么引起了你的注意？你们又发现了什么？

I mean, what initially caught your attention here, and what did you discover?

其实最早引起我们注意的是一些老信息，比如我们发现了与FamousSparrow相关的恶意软件，像Deed RAT、MOFU和Terndoor。

So what initially got our attention was actually old news, because we found some of the malware, Deed RAT, for example, MOFU, Terndoor, that is associated with the FamousSparrow.

但很快我们就发现，这些恶意软件样本和公开资料里记载的版本略有不同。

But what we found out early on is that these malware samples are slightly modified compared to what is publicly known.

这通常意味着，这个APT组织的工具库一直在持续更新和演变。

So that is always a sign that the part of portfolio from the APT keeps developing and keeps changing.

所以每当我们发现已知恶意软件的新版本，都会特别关注。

So we are always interested in following anytime we find new version of the known malware, it is something that we pay a lot of attention.

所以我们开始跟进整个事件，结果发现还有很多新东西，这项研究就是这样成型的。

So we started following the whole case, the whole incident, and we discovered there is actually quite a lot of new stuff, and that's how this research came together.

一开始是我们发现了已知恶意软件的修改版本，之后才逐步揭开了背后整个行动的全貌。

So it started with us finding modified version of known malware, and then we started discovering the whole operation behind it.

仔细读完这份报告，我发现整个攻击分成了三波行动。

Well, reading through the research, I mean, there were three waves of activity.

每次有什么不同？

What changed each time?

你能给我们讲讲你们都发现了什么吗？

Can can you take us through what you all saw?

是的。

Yes.

确实有三波攻击，但它们最终都指向了同一个目标。

So exactly, there were three waves of activity, and all of them came to the same door.

它们全都针对了邮件服务器。

All of them came to exchange server.

所以我们内部管这个叫‘代理地狱’，不管是代理壳还是代理精要，都归到这一类里。

So proxy hell, proxy shell, proxy nutshell, we call it internally proxy hell, it's kind of all encompassing.

没错。

Right.

其实这没什么新鲜的，我们从2022年就开始讨论这个问题了。

It's really nothing new because we are see we've been talking about it since 2022.

越来越多的攻击者把注意力集中在漏洞利用上。

More and more street directors are focused on vulnerability exploits.

而且每年这种情况都越来越明显。

And every single year, this is becoming more obvious.

这正是那种典型情况：你有个经常被盯上的服务，却一直不打补丁。

So this was one of those cases where you have one of these services that is commonly targeted, you don't patch it.

剩下的只是时间问题，到底谁、会有多少攻击者趁机溜进来。

It's only question of time who and how many threat actors will get inside to the same dog.

我们看到的是三次独立的攻击浪潮，每次都针对微软Exchange的代理地狱漏洞，但每次用的恶意软件版本都有细微差别，目的都是想在系统里长期潜伏下来。

So what we saw here was three separate waves of attack, every time focusing on proxy nutshell exploitation of Microsoft Exchange, but every time using slightly different version of the malware where they were trying to establish persistence to this environment.

我们还发现，这次事件中的受害者其实已经察觉到了这场持续的攻击。

We've also seen the victim in this case that discovered this ongoing operation.

他们尝试过清理系统。

They tried to clean it up.

但可惜的是，他们没把技术人员留下的后门彻底关闭，结果攻击者又带着另一套恶意软件回来了。

But unfortunately, they never close the antidote that the tech has used, so they came back with a different set of malvoys.

这次的受害者是谁？

Who was the victim in this case?

研究报告提到，受害者是阿塞拜疆的石油和天然气行业人员。

So the research mentions Azerbaijani oil and gas industry folks.

我们能确认到的，就只有这个程度吗？

Is that the degree to which we can identify them?

是的。

Yes.

没错。

It is.

这倒合理。

Fair enough.

那你觉得攻击者的目标是什么？

What do we suppose the attackers were after here?

他们是搞间谍活动，还是想掌控系统？

Were they is this an espionage kind of thing, or are they looking to gain control?

有什么看法吗？

Any insights there?

在这个案例中，几乎可以肯定是间谍行动。

So in this case, it was almost certainly espionage operation.

我们之所以点名阿塞拜疆和这个产业，是因为阿塞拜疆对欧洲和欧盟正变得越来越关键。

The reason why we decided to name the county and industry is that Azerbaijan is becoming critically important for Europe and European Union.

我们虽然没深入讨论地缘政治影响，但阿塞拜疆近年来一直在扩大其作为欧洲战略能源伙伴的角色，包括德国、奥地利，我记得他们就在过去十二个月左右签了合同。

We documented we didn't go too much into like geopolitical implications here, but Azerbaijan has been expanding its role as a strategic energy partner for Europe, including Germany, Austria, I believe they signed the contracts like in the last twelve months or so.

所以，它绝对是欧洲重要的能源伙伴，这也是我们的判断。

So this is definitely important energy partner for Europe, and that's what we believe.

而且，这基本上可以说是一个有根据的推测，因为在网络间谍活动中，你很难掌握所有信息。

And again, it's pretty much always, I would say educated guess, because in cyber espionage, you never have all the information.

所以你需要根据你看到的情况做出很多假设。

So you need to make a lot of assumptions based on what you see.

再说一次，在这种情况下，我们认为这是一次间谍活动，特别是因为阿塞拜疆对欧洲的重要性日益增加。

And again, in this case, what we can see is that this was, in our opinion, espionage obligation, specifically because how Azerbaijan is becoming more important for Europe.

我明白了。

I see.

研究里提到了DLL侧加载以及相关的特定技术。

The research mentions the use of DLL sideloading and particular techniques with that.

能给我们解释一下这具体是什么意思，以及攻击者为什么可能选择这种技术吗？

Can you explain to us what that means and why the threat actors may have selected this technique?

对我来说，如果抛开那些地缘政治的影响，DLL侧加载是这份研究里最有趣的部分。

So for me, if we put aside, like, all geopolitical implications, the DLL sideloading was the most imp interesting part of this research.

在深入讲这个新技术之前，如果不介意的话，我先简单介绍一下DLL侧加载的一般概念。

Now before we get to what is new about this one, if you don't mind, let me just briefly talk about DLL sideloading in general.

请说。

Please.

DLL侧载是一种规避防御的技术，攻击者利用的是Windows操作系统的固有行为。

So DLL sideloading is defense evasion technique, where the threat actors are actually relying on the behavior of the Windows operating system.

他们通常会找一个合法的进程来利用。

And what they are going to find is that they will use legitimate process.

当你运行这个进程时，系统会自动加载程序所需的动态链接库。

And when you run that process, it's going to load the libraries where the functions are available in the program.

攻击者可以替换掉原本的库文件，放一个同名的恶意文件进去。

And they can either replace the library with malicious library that has the same name.

这是最常用的手法。

That is the most common method.

如果你是防御方，在做监控时，可能会看到类似Outlook.exe这样的进程。

And pretty much what you are going to do is that if you are a defender and you are monitoring, you are going to see, let's say, outlook.

这是一个由微软签名的合法进程。

Exe, legitimate process signed by Microsoft in this case.

运行时，它会加载那个恶意的库。

And on execution, it is going to load library, that is malicious.

这就是 DLL 侧载。

So that is DLL sideloading.

几年前的事了，最近几周时间都混在一起了，我也说不准具体是啥时候。

Now, couple of years ago, and the last few weeks are kind of blending together.

所以我没法确定具体时间。

So I cannot say when.

但我们开始注意到，DLL 侧载的出现频率越来越高。

But we started noticing DLL sideloading appearing more and more.

我们第一次遇到这情况时，还专门做了一个详细解析，因为当时这方面的资料实在太少了。

We actually did like a detailed explainer when we first encountered it because there was not enough information for what we were seeing.

在我看来，最关键的要点是下面这一点。

The most important takeaway is following, in my opinion.

当我们发现 DLL 侧载是一种非常有效的手段后，没过多久，各种 APT 组织就都开始用，接着是一些以牟利为目的的网络罪犯也跟上了。

So when we saw DLL sideloading being used as effective technique, In a very short time, the same technique was adopted by various different APT groups, and then by financially motivated cybercriminals.

所以从这个技术刚崭露头角，到它在中文APT圈子里变得普遍，中间只隔了很短一段时间。其实这个技术本身早就存在，但最近才开始流行起来。

So there was a very short time between this is new technique, or this Well, the technique itself is known for a long time, but this is kind of new technique that is becoming more popular, until the moment when this became like a commodity technique across, especially the Chinese APT ecosystem.

背后有很多推测。

So there is a lot of theories behind.

我们观察到的所有这些高级APT组织，都有一个共同点——姑且称之为‘培训中心’，专门培养进攻型研究人员。

One thing that we are seeing with all these advanced APT groups, there must be, for the lack of better words, I'm going to call it academies for teaching offensive researchers.

经常出现的情况是，一个团队刚发明出新方法，很快整个生态里的其他团队就都跟上了。

So what we are seeing very often is one group comes up with new approach, and very quickly, all the groups from the same ecosystem are going to adopt that technique.

这很重要，因为每当我们发现DLL侧载的某个高级新变种，哪怕最初是在阿塞拜疆这样的地方发现的，也必须高度警惕——因为接下来几个月，其他APT组织几乎肯定会用上同样的手法。

Why it matters is that anytime we discover new advanced version of, for example, of the DLL sideloading, even if we found it in specific county, in this case Azerbaijan, it's really critical to pay attention because you are going to see the same technique used by other APT groups in the next few months, essentially.

所以尽管这项研究聚焦于阿塞拜疆的油气行业，但这个具体技术非常关键，因为我们相信，未来几个月内，会有多个不同背景的组织采用它。

So that is why even though the research is specifically focused on oil and gas industry in Azerbaijan, this specific technique is really critical because, again, we believe this will be adopted by multiple groups with different workloads in the next few months.

我们马上回来。

We'll be right back.

天哪。

Wow.

所以这大致就是背景、一点历史，以及为什么这件事很重要。

So that is kind of a high level, a little bit of history, and why this matters.

现在我可以告诉你，这次DLL劫持有什么新奇和不同之处吗？

Now I can tell you what was new and different about the DLL sideloading in this case, maybe?

对，请说。

Yeah, please.

通常来说，正如我提到的，DLL劫持的工作方式是：你有一个合法的进程，一个合法的可执行文件。

So typically, as I mentioned, the way how DLL sideloading works is you have legitimate process, legitimate executable.

当你运行它时，它会去加载一个被替换过的动态链接库。

When you execute it, it's going to locate library that have been replaced.

然后加载这个库，执行里面藏的恶意代码。

It's going to load that library and execute malicious code inside.

我们已经有多种检测技术在监控这种行为，比如异常路径和这类操作。

We have a lot of detection technology that is already looking at this, looking at unusual locations and this behavior.

这次的高级之处在于，恶意代码并不会在库被加载时立即激活。

Was advanced in this case is that the malicious code itself is not initialized when the library is loaded.

相反，这里涉及多个子 Git 步骤。

Instead, there were multiple sub git steps.

只有当这些步骤全部完成时，恶意代码才会被触发执行。

And when they all work together, only then malicious code is executed.

所以当宿主可执行文件运行时，它会加载这个恶意 DLL，并调用其中的一个函数。

So when the host executable is going to be executed, in this case, it's going to load malicious DLL, and it's going to trigger one of the functions.

这个恶意库中的函数只是在内存里修改某个 API，设置一个钩子。

The functions in this malicious library is just going to patch one of APIs in memory to create hook.

它并不会执行任何恶意操作，然后就停止运行了。

It is not going to execute anything malicious, and then it's going to stop working.

回到那个启动并加载了这个库的合法进程，它会继续执行，直到再次调用同一个库中的另一个函数。

Going back to that legitimate process that started that loaded this library and executed one of the functions, it will continue with execution until it comes to the moment in execution when it's going to call another function from the same library.

而正是第二个函数会调用 API 加载载荷，恢复恶意代码并执行它。

And it is the second function that is going to pretty much execute the loader from the API and restore the payload and execute it.

这意味着，我们通常在这些恶意库中看到的检测机制，往往会检查：‘我是不是在沙箱里运行？’

So what this means is that typically the detection that we are seeing in these malicious libraries, they are typically looking, Hey, am I running in the sandbox?

这是虚拟环境吗？

Is this virtual environment?

这种逻辑还挺常见的。

There is a lot of logic like this.

这种情况下没必要，因为这种高级的DLL劫持技术完全躲过了安全沙箱的检测。

In this case, this is not needed because this advanced DLL sideloading is completely hidden from security sandboxes.

如果沙箱运行它，大多数情况下只会觉得一切正常，毫无问题。

So if the sandbox is going to execute it, it is most probably in most cases just going to say, Hey, all of this is completely clean.

我没发现任何可疑的地方。

I haven't seen anything suspicious.

这是因为它是分多个阶段进行的吗？

And that's because it's happening in multiple stages?

对，而且这些阶段必须按特定顺序执行。

Yes, and you need to execute those stages in specific order.

比如，如果你看一下这个库，分析一下它导出了哪些函数，然后逐个尝试调用它们。

So for example, if you will have a look at this library, try to analyze what are exported functions, which functions are available to you, and then you will try to execute those functions one by one.

这里不会有任何恶意行为。

There is not going to be any malicious behavior.

你得在同一个会话里、按特定顺序执行这些函数，它才会变成恶意的。

You need to execute those functions kind of in the same session and in specific order, only then it becomes malicious.

所以无论做什么样的分析，这种行为都很难被发现。

So for any kind of analysis, this is actually going to be really hard to observe.

我记得当时做这项研究时，我立刻就想，去 VirusTotal 看一眼吧。

I remember when we were working on this research, I immediately went, okay, let me have a look at VirusTotal.

结果所有引擎都没检测到任何异常。

And this this was, like, completely undetected by all the engines.

研究里提到部署了几种后门家族。

Now the research mentions deployment of a couple of backdoor families.

有 Deed RAT 和 Terndoor。

You've got Deed RAT and Terndoor.

它们在这整个过程中扮演了什么角色？

What part do they play in all this?

是的。

Yes.

他们用了好几种不同的后门。

So there were a couple of different backdoors that they've used.

所有这些操作都是在初始入侵之后进行的，每次都用同一个入口。

And pretty much all of this was for the threat actors after the initial access, again, same door every single time.

他们只是在用一些我们早就熟悉的后门程序。

They were just going to use some of these backdoors that are well known to us.

让我们觉得有意思的是，这些后门之间有细微差别。

The only thing that was interesting for us is that there slight modifications between them.

有些地方被改过了。

Some bits have been changed.

对杨斯来说，这正好证明了这个工具包一直在持续更新和改进。

So again, for Yance, this is kind of the proof that the toolkit itself continues being actively developed and modified.

那这里有什么检测机会吗？

What are the opportunities for detection here?

如果我是防御方，我该留意哪些迹象？

If I'm a defender, what should I be looking for?

和以往一样，我们已经公开了完整的IOCs清单，每次都会这么做。

So we share it as we always do, the complete list of IOCs is publicly available, which we are doing every single time.

我建议分享这些信息，也是为了让其他安全公司能测试这种新的DLL劫持技术，确保他们的系统能识别并检测到这类行为。

My recommendation, the reason why we share this is also giving opportunities for other security companies to test out this new technique of DLL sideloading, and making sure that their technology is able to recognize and detect when this is happening.

通常，DLL劫持攻击是将合法的可执行文件和恶意DLL组合在一起。

Typically with DLL sideloading attacks, it is combination of legitimate executable with malicious DLL.

我们已经记录了这次攻击中使用的具体可执行文件。

We documented which executable was used in this case.

但如我之前所说，DLL劫持并不是某个特定程序的漏洞。

But as I mentioned before, DLL sideloading, it is not vulnerability of specific executable.

而是Windows操作系统本身的一种正常行为，被攻击者恶意利用了。

It is legitimate behavior of Windows operating system that are the threat actors abusing.

所以我们可以肯定，不仅不同组织会继续使用这种手法，而且我们还会看到更多不同的程序被用来实施同样的攻击流程。

So again, like, we are pretty sure that we are not only going to see the same technique used by different groups, but we are also going to see different executables that are vulnerable to the same execution flow.

你提到受害组织已经发现了一些问题，并尝试清除恶意软件，但最终没能成功。

You mentioned that the victim organization had discovered some things and and had efforts to remove the malware, but ultimately, they were not successful.

他们为什么会失败呢？

How why did they come up short?

关于这一点，我有非常强烈的看法——多年来，我们一直在记录攻击者如何积极寻找面向互联网的服务并加以利用。

So that is something that I have very strong opinions about for again, we we have been documenting for many years how the cigarette actors, again, are very actively looking for Internet facing services and abusing them.

我们仍然看到很多组织在打补丁方面反应迟缓，他们还没意识到利用窗口正在急剧缩短。

And we are still seeing organizations are very slow in patching, and they still don't understand how the time to exploit is shortening dramatically.

现在有很多报告和数据都在说明，新漏洞被武器化到底有多快。

So there is a lot of reports and numbers related to how quickly are these new vulnerabilities weaponized.

去年我们常说，一旦新漏洞的演示代码公开，不到24小时，攻击就会被规模化部署——这就是我所说的‘工业化利用’。

Typically, last year, we've been talking when there is new vulnerability and POC is available, you have less than twenty four hours before weaponization is industrialized, is what I would call.

这又是我们过去几周反复看到的攻击手法的又一个例子。

So again, this is another example of attack that we've seen many and many and many times over the last few weeks.

我们确实在2024或2025年做过一项有趣的研究，发现其中某个暴露在互联网上的服务也被攻陷了。

We did have interesting research 2024 or 2025, where one of these exposed internet facing services was compromised as well.

客户这个漏洞一个月都没补，可几年前，一个月不打补丁根本不算啥大事。

And the customer haven't patched this for a month, which, like few years ago, leaving something unpatched for a month was not considered such a big deal.

但就这个受害者来说，根据我们其他研究发现，漏洞刚公布不到一天，攻击就开始了。

But for example, what we've seen with this victim, from, again, from different research, was that within a month after the vulnerability was announced, so pretty much like twenty four hours after vulnerability was discovered, we started seeing attacks.

一个月后，我们发现有70个不同的威胁组织在同一台机器上活动。

One month later, we have seen 70 different threat actors occupying the same machine in the MZ.

不管你是看黑产团伙、初始访问经销商，还是高级持续性威胁组织，只要互联网暴露的服务有远程代码执行漏洞，立马就会成为他们的重点目标。

So, again, whether you are looking at, again, somewhere groups, initial access brokers, APTs, for all of them, any Internet facing service, any vulnerability that leads to remote code execution is immediately like a huge target that they will start focusing on.

那最终的关键点到底是什么？

What are ultimately the takeaways here?

根据你们收集和分享的信息，你们希望人们从中得到什么启发？

Based on the information you all have gathered and shared, what do you hope people come away with?

所以

So

其中一个重点是，即使研究内容跟你的地区无关，也一定要重视。

one of the key takeaways here should be it is important to pay attention to research even if it is not in your geo.

正如我之前提到的，我们花了大量时间讨论如何应对这种情况，毕竟这涉及石油和天然气行业。

So as I mentioned before, we actually spent quite a lot of time discussing how to address something like this, because it is oil and gas.

地点在阿塞拜疆。

It's in Azerbaijan.

但同时，我们觉得每个人都该关注这项研究，因为它讲的是一些很快就会在各地被广泛使用的攻击手法。

And at the same time, we believe everyone should pay attention to this research because it is talking about technique that is going to be used everywhere, very soon.

所以，其中一个关键点是，要理解APT组织之间是如何协作、如何共享技术的。

So again, like one of the takeaways should be understand how APT groups are working together, how they are sharing the knowledge.

不同国家的情况也不一样。

And this is different for different, counties.

我觉得它们各自采取的方式有所不同。

I would say they have different approach to this.

比如中国的一些APT组织，只要某个团队出了新方法或者改进了技术，其他所有团队都会迅速跟进。

But again, for example, with Chinese APTs, what we are seeing is anytime one of the groups come up with new or improved technique, all of them are going to adopt it real quickly.

感谢Bitdefender的马丁·祖热茨加入我们的讨论。

Our thanks to Martin Zugec from Bitdefender for joining us.

这项研究的标题是《FamousSparrowAPT攻击阿塞拜疆油气行业》。

The research is titled FamousSparrow APT Targets Azerbaijani Oil and Gas Industry.

我们在节目笔记里会附上链接。

We'll have a link in the show notes.

以上就是由N2K Cyberwire带来的‘研究星期六’。

And that's Research Saturday brought to you by N2K Cyberwire.

我们很想听听你对这个播客的看法。

We'd love to know what you think of this podcast.

你的反馈能帮助我们提供更前沿的洞察，让你在瞬息万变的网络安全领域始终领先一步。

Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity.

如果你喜欢我们的节目，欢迎在你常用的播客平台给我们打分和写评论。

If you like our show, please share a rating and review in your favorite podcast app.

也请填写节目笔记里的问卷，或者发邮件到 cyberwiren2k dot com。

Please also fill out the survey in the show notes or send an email to cyberwiren2k dot com.

本集由莉兹·斯托克斯制作，混音由埃利奥特·佩尔茨曼和特雷·赫斯特完成。

This episode was produced by Liz Stokes or mixed by Elliot Peltzman and Trey Hester.

我们的执行制片人是詹妮弗·艾本。

Our executive producer is Jennifer Eiben.

彼得·基尔佩是我们的出版人，我是戴夫·比特纳。

Peter Kilpey is our publisher, and I'm Dave Bitner.

感谢收听。

Thanks for listening.

我们下次再见。

We'll see you back here next time.

你好。

Hi.