AI安全专题周报（20261023）
报告编号：TIC-202610-AI04
报告周期：2026年10月17日—10月23日
一、报告概述
基于360威胁情报中心对本期公开网络安全素材的整理与分析，本周AI安全风险集中在AI网关供应链投毒、模型与云计费资源劫持、AI编码工具凭据泄露、智能体辅助入侵，以及AI应用组件漏洞。相关事件涉及恶意安装包投递、第三方模型API密钥暴露、跨租户应用凭据滥用、未授权模型调用及代码注入。
报告重点内容涵盖：
· AI供应链与开发凭据风险：LiteLLM恶意安装包可在Python启动时执行窃密载荷；OpenCode Console安全事件则使关联的第三方模型服务密钥面临泄露风险。
· AI资源与云身份滥用：Skynet代理指令显示攻击者试图借用暴露模型驱动攻击；云计费账户劫持活动通过钓鱼与外部项目绑定，让受害者承担未授权AI调用费用。
· AI辅助入侵与应用漏洞：ARTEX被用于加速供应链及云环境攻击，BUGSTER与日本API攻击调查提供了AI参与的具体证据；Stable Diffusion WebUI模型加载组件被披露存在代码注入风险。
───────────────────────────────────
二、本周重点安全事件
（一）LiteLLM 1.107.0安装包遭投毒，窃取凭据并植入后门
事件名称：LiteLLM 再次被劫持：恶意 1.107.0 Wheels 窃取凭证并加载远程代码
发布日期：2026-10-21
发布机构：JFrog Security Research
威胁概述：
JFrog披露，LiteLLM 1.107.0的恶意wheel安装包加入了Python启动钩子，可在应用尚未导入LiteLLM时执行凭据窃取，并提供每小时检查一次的远程代码加载通道。受影响范围还包括对应的官方Docker镜像。恶意载荷收集云服务及AI开发环境中的秘密信息；JFrog在10月22日更新称厂商已控制事件，受污染的发布版本和镜像已被下架。
IOC指标：
· SHA256：1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e
· URL：http://www.litellm.dev/healthcheck, https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt
· Domain：www.litellm.dev, litellm.dev
STIX详情：
{
"type": "bundle",
"id": "bundle--28dc2217-11a4-401a-9de4-d646be87843b",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"name": "Unknown Attacker",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "当前 litellm 1.107.0 供应链攻击的未知幕后攻击者；目前无证据将其与 TeamPCP 关联。",
"x_evidence": "原文称“The new 1.107.0 compromise uses different payloads and infrastructure. No evidence currently links it to TeamPCP or the earlier access path”。",
"x_confidence": 0.85
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"name": "litellm",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "被滥用的 LLM 接口/代理 Python 库；恶意 1.107.0 wheel 被注入三个启动文件并发布到 PyPI 和 Docker Hub。",
"x_evidence": "原文称 LiteLLM 是“a widely used Python interface and proxy for large language model providers”，并描述“malicious litellm 1.107.0 wheels”。",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"name": "privcollect",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "由 cook.py 解码启动的凭证窃取恶意软件，收集 SSH/GPG/云/AI 开发凭据、环境变量和 LiteLLM 数据库信息。",
"x_evidence": "原文称“The decoded program identifies itself as privcollect”，并描述其收集范围。",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--20dba1d4-75c4-4d04-a774-b3e669648f78",
"name": "http://www.litellm.dev/healthcheck",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "privcollect 加密窃取数据的回传 URL。",
"x_evidence": "原文 IoC 列表包含“Exfiltration URL: hxxp[:]//www[.]litellm[.]dev/healthcheck”。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--fd4da841-95ee-4e7d-b1e3-a03fd8727193",
"name": "www.litellm.dev",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "本次攻击的恶意外传域名。",
"x_evidence": "原文 IoC 列表包含“Exfiltration domain: www[.]litellm[.]dev”。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--e63020fd-4b33-4ffa-8d5a-773a84ab6e8c",
"name": "litellm.dev",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "攻击者注册的 LiteLLM 相似域名。",
"x_evidence": "原文称“Registration records show that litellm[.]dev was created on October 13, 2026”。",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--0ad0f2ef-bd57-4e5a-b832-9135498c40fe",
"name": "https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "C2 死信 URL，用于获取 domain.txt。",
"x_evidence": "原文 IoC 列表包含“C2 dead-drop URL: hxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt”。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--99f0bac6-7a41-4f2d-85a1-5d6d775b0c9e",
"name": "raw.githubusercontent.com",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "死信 URL 的托管域名，用于托管 domain.txt。",
"x_evidence": "死信 URL 本身包含 raw.githubusercontent.com。",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--ace1609a-9b86-4010-ba33-535e8f88d66f",
"name": "PyPI",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 litellm 1.107.0 wheel 的发布平台。",
"x_evidence": "原文称“PyPI has since removed the compromised 1.107.0 release”。",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--aba9630b-b9ed-4834-aaca-864d194ba4f8",
"name": "Docker Hub",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 litellm/litellm:1.107.0 镜像的发布平台。",
"x_evidence": "原文称“Docker Hub has since removed the affected image and all affected tags”。",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--c25c65d3-6957-4abb-a6a9-7e4a78674de1",
"name": "letters9813/pythonclient-test",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "GitHub 仓库，用于托管 domain.txt 死信 URL。",
"x_evidence": "原文 IoC 列表包含“Dead-drop repository: letters9813/pythonclient-test”。",
"x_confidence": 0.9
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"first_observed": "2026-10-21T16:27:25Z",
"last_observed": "2026-10-21T16:27:25Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "cook.pth",
"description": "恶意 wheel 中的 Python 启动钩子文件，位于 purelib 下，内容为 import cook。",
"aliases": [],
"evidence": "原文称“The first file, cook.pth, contains only: import cook”。",
"confidence": 0.95
},
"1": {
"type": "file",
"name": "cook.py",
"description": "恶意启动文件，包含 Base64 编码、zlib 压缩的 privcollect 程序。",
"aliases": [],
"evidence": "原文称“cook.py launches the privcollect credential stealer”。",
"confidence": 0.95
},
"2": {
"type": "file",
"name": "sitecustomize.py",
"description": "恶意 Python 启动文件，通过 sitecustomize 机制创建每小时远程代码加载器。",
"aliases": [],
"evidence": "原文称“sitecustomize.py creates an hourly remote-code loader”。",
"confidence": 0.95
},
"3": {
"type": "file",
"name": "domain.txt",
"description": "用于指示 C2 域名的死信文件，由远程代码加载器获取。",
"aliases": [],
"evidence": "原文称“a read-only retrieval of domain.txt, the dead-drop file used by the remote loader”。",
"confidence": 0.9
},
"4": {
"type": "file",
"name": "litellm/litellm:1.107.0 Docker image",
"description": "受影响的恶意 Docker 镜像，digest 为 sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e。",
"aliases": [],
"evidence": "原文称“The official litellm/litellm:1.107.0 Docker image is also affected”，并列出受影响镜像 digest。",
"confidence": 0.95
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--afb4ec26-b4a9-4b27-830d-759052777c61",
"relationship_type": "targets",
"source_ref": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"target_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "未知攻击者对 litellm 软件发起供应链攻击。",
"x_evidence": "原文标题为“LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f8fe7a5e-163d-423f-850b-fa1a40a07cfb",
"relationship_type": "uses",
"source_ref": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"target_ref": "infrastructure--ace1609a-9b86-4010-ba33-535e8f88d66f",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "未知攻击者使用 PyPI 发布恶意 litellm 1.107.0 wheel。",
"x_evidence": "原文称“PyPI has since removed the compromised 1.107.0 release”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d673193c-018f-4c19-b5e8-243347d33fcb",
"relationship_type": "uses",
"source_ref": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"target_ref": "infrastructure--aba9630b-b9ed-4834-aaca-864d194ba4f8",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "未知攻击者使用 Docker Hub 分发受影响镜像。",
"x_evidence": "原文称“Docker Hub has since removed the affected image and all affected tags”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d4bcd560-3dca-46a9-8134-db1367cfbf05",
"relationship_type": "uses",
"source_ref": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"target_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "未知攻击者利用 privcollect 凭证窃取恶意软件。",
"x_evidence": "原文称“malicious `litellm` 1.107.0 wheels contain an interpreter-startup credential stealer”，并指出“The decoded program identifies itself as privcollect”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f370ef3e-7373-4a40-bba7-5cca9b5750a8",
"relationship_type": "uses",
"source_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 litellm 1.107.0 wheel 包含 cook.pth。",
"x_evidence": "原文称“payload wheels are a functional copy of the legitimate project with three additional files”，包括 cook.pth。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2249382b-9275-42f1-ae72-410a0d09db6f",
"relationship_type": "uses",
"source_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 litellm 1.107.0 wheel 包含 cook.py。",
"x_evidence": "原文称 payload wheel 包含 cook.py 等三个额外文件。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a9d2aa61-23c6-464e-84cd-4577502066a2",
"relationship_type": "uses",
"source_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 litellm 1.107.0 wheel 包含 sitecustomize.py。",
"x_evidence": "原文称 payload wheel 包含 sitecustomize.py 等三个额外文件。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--20aed771-8d27-411f-a0ab-6ef9e151ea17",
"relationship_type": "uses",
"source_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"target_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 litellm wheel 包含 privcollect 凭证窃取器。",
"x_evidence": "原文称“malicious `litellm` 1.107.0 wheels contain an interpreter-startup credential stealer”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d3e268c2-5a23-4aa7-944b-9e714865cc92",
"relationship_type": "uses",
"source_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "cook.pth 通过 import cook 触发 cook.py 执行。",
"x_evidence": "原文称“The first file, cook.pth, contains only: import cook”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8faa73a6-86ed-4a5c-b7a2-5ffde76ae8ed",
"relationship_type": "executes",
"source_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"target_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "cook.py 解码并启动 privcollect。",
"x_evidence": "原文称“cook.py launches the privcollect credential stealer”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f62c5549-262c-443a-ae8f-9210da582063",
"relationship_type": "executes",
"source_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"target_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "sitecustomize.py 创建的远程代码加载器会运行第二份嵌入的 privcollect。",
"x_evidence": "原文称“the loader synchronously runs a second embedded copy of privcollect”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3b4de299-18bd-4764-8ded-a97fa99a3cb3",
"relationship_type": "downloads",
"source_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "sitecustomize.py 远程代码加载器下载 domain.txt 死信文件。",
"x_evidence": "原文称“Each cycle retrieves a prospective C2 domain from ... domain.txt”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d6daf6c6-a1fd-46b0-bada-7e6931e5239d",
"relationship_type": "downloads",
"source_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"target_ref": "url--0ad0f2ef-bd57-4e5a-b832-9135498c40fe",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "sitecustomize.py 从死信 URL 下载 domain.txt。",
"x_evidence": "原文 IoC 列表包含“C2 dead-drop URL: hxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1ed9c8c1-d41b-4f1f-8159-7d1972f23d8c",
"relationship_type": "communicates-with",
"source_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"target_ref": "url--20dba1d4-75c4-4d04-a774-b3e669648f78",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "privcollect 将加密窃取数据回传到 http://www.litellm.dev/healthcheck。",
"x_evidence": "原文称“The archive is sent over plaintext HTTP to hxxp[:]//www[.]litellm[.]dev/healthcheck”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a43f127b-fe8b-4192-8613-c0c4af7ed8d8",
"relationship_type": "communicates-with",
"source_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"target_ref": "domain-name--fd4da841-95ee-4e7d-b1e3-a03fd8727193",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "privcollect 与恶意外传域名 www.litellm.dev 通信。",
"x_evidence": "原文 IoC 列表包含“Exfiltration domain: www[.]litellm[.]dev”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7ccababa-32d7-47c0-9dc4-26f4ba8f84f3",
"relationship_type": "targets",
"source_ref": "malware--8ddd10d2-950b-45be-82c1-6120bffc0a67",
"target_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "privcollect 针对 LiteLLM 代理数据库中的凭据。",
"x_evidence": "原文称“LiteLLM proxy data reached through DATABASE_URL, including LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1e81dc4c-0656-42d8-ac0a-804eca1c588b",
"relationship_type": "uses",
"source_ref": "url--20dba1d4-75c4-4d04-a774-b3e669648f78",
"target_ref": "domain-name--fd4da841-95ee-4e7d-b1e3-a03fd8727193",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "回传 URL 使用恶意外传域名 www.litellm.dev。",
"x_evidence": "回传 URL 为 http://www.litellm.dev/healthcheck，使用 www.litellm.dev。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cc232081-e52a-4423-bfd6-9ad0849403db",
"relationship_type": "uses",
"source_ref": "domain-name--fd4da841-95ee-4e7d-b1e3-a03fd8727193",
"target_ref": "domain-name--e63020fd-4b33-4ffa-8d5a-773a84ab6e8c",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "www.litellm.dev 是攻击者注册相似域名 litellm.dev 的子域/相关域名。",
"x_evidence": "原文称“litellm[.]dev was created on October 13, 2026”，并提到“www[.]litellm[.]dev host”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--de2c19c4-c9cb-4aa4-a885-81fda2e5352f",
"relationship_type": "uses",
"source_ref": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"target_ref": "domain-name--e63020fd-4b33-4ffa-8d5a-773a84ab6e8c",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "未知攻击者注册并使用相似域名 litellm.dev。",
"x_evidence": "原文称“Registration records show that litellm[.]dev was created on October 13, 2026”。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--50c98149-4c6a-49b7-911d-0c33fdd18c38",
"relationship_type": "uses",
"source_ref": "intrusion-set--deae4bd0-74e5-406c-b2e7-5d725af5d1f9",
"target_ref": "infrastructure--c25c65d3-6957-4abb-a6a9-7e4a78674de1",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "未知攻击者使用 GitHub 死信仓库 letters9813/pythonclient-test。",
"x_evidence": "原文 IoC 列表包含“Dead-drop repository: letters9813/pythonclient-test”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--66ad2055-582a-4711-9659-9fd1287962f6",
"relationship_type": "uses",
"source_ref": "url--0ad0f2ef-bd57-4e5a-b832-9135498c40fe",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "死信 URL 指向 domain.txt 文件。",
"x_evidence": "死信 URL 路径以 .../main/domain.txt 结尾。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--229b54da-5f51-4a81-bf83-e8afcc382b97",
"relationship_type": "uses",
"source_ref": "url--0ad0f2ef-bd57-4e5a-b832-9135498c40fe",
"target_ref": "domain-name--99f0bac6-7a41-4f2d-85a1-5d6d775b0c9e",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "死信 URL 托管在 raw.githubusercontent.com 上。",
"x_evidence": "死信 URL 为 https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--35160ede-5409-456e-9d3d-38af7a81940d",
"relationship_type": "uses",
"source_ref": "url--0ad0f2ef-bd57-4e5a-b832-9135498c40fe",
"target_ref": "infrastructure--c25c65d3-6957-4abb-a6a9-7e4a78674de1",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "死信 URL 指向 GitHub 仓库 letters9813/pythonclient-test。",
"x_evidence": "死信 URL 路径包含 letters9813/pythonclient-test。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--889b5372-379b-44a2-8848-d3b28c7c1e5d",
"relationship_type": "uses",
"source_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"target_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "恶意 Docker 镜像包含 litellm 1.107.0。",
"x_evidence": "原文称“The official litellm/litellm:1.107.0 Docker image is also affected”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ef2f6670-e9c7-4469-8a7a-cc9ae4771100",
"relationship_type": "delivers",
"source_ref": "infrastructure--aba9630b-b9ed-4834-aaca-864d194ba4f8",
"target_ref": "observed-data--175c2020-bf1a-44e8-a328-99820d399f08",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "Docker Hub 曾分发受影响镜像。",
"x_evidence": "原文称“Docker Hub has since removed the affected image and all affected tags”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--09114ec7-c317-425f-9c61-b0cb611218b6",
"relationship_type": "delivers",
"source_ref": "infrastructure--ace1609a-9b86-4010-ba33-535e8f88d66f",
"target_ref": "infrastructure--1431aa5b-3b83-498d-90a7-8609eabfa33f",
"created": "2026-10-21T16:27:25Z",
"modified": "2026-10-21T16:27:25Z",
"description": "PyPI 曾分发恶意 litellm 1.107.0 wheel。",
"x_evidence": "原文称“PyPI has since removed the compromised 1.107.0 release”。",
"x_confidence": 0.95
}
]
}报告链接：
https://research.jfrog.com//post/litellm-hijacked-again/
───────────────────────────────────
（二）Storm-0940滥用ARTEX加速ConnectWise供应链攻击
事件名称：AI驱动、使用ARTEX的大规模国家级行动实现供应链入侵
发布日期：2026-10-21
发布机构：Microsoft Threat Intelligence
威胁概述：
微软披露，Storm-0940使用ARTEX智能体渗透测试框架自动化开展侦察、密码喷洒及应用凭据滥用，并将该组织与ConnectWise多租户应用供应链入侵关联。攻击者借助已有授权的应用访问下游Microsoft 365环境，进一步执行Microsoft Graph侦察和权限修改尝试。微软同时强调，发现受影响应用或登录成功，不等同客户数据已经被访问或外泄。
IOC指标：
· IP（节选）：144.172.64.128, 144.172.64.99, 144.172.64.60, 187.15.88.186, 187.15.90.217
上述VPN地址仅适合结合10月15日至16日的相关应用访问及Graph活动开展调查，不能单凭地址命中判定失陷。
STIX详情：
{
"type": "bundle",
"id": "bundle--9e890589-bae0-4100-a48e-87aec1ef1db4",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"name": "Storm-0940",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "2021年起活跃、中国国家支持的威胁行为者，利用ARTEX自动化渗透测试框架实施供应链攻击。",
"x_evidence": "原文称Storm-0940是China-state aligned actor，自2021年起活跃，并对ConnectWise supply chain compromise负责。",
"x_confidence": 0.98
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--c758042d-72fd-4773-a0f7-b1aad464c72c",
"name": "ARTEX",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "开源Agentic AI渗透测试框架，可自动化完成从侦察到数据窃取的攻击流程。",
"x_evidence": "原文称Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks。",
"x_confidence": 0.98
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ae2befc1-0df4-42e9-8ada-53d5cd45f7df",
"name": "ConnectWise supply chain compromise",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "针对ConnectWise多租户云备份应用的供应链攻击事件。",
"x_evidence": "原文称Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application。",
"x_confidence": 0.96
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--d4d87b1d-7d6c-424b-a647-ae675aee2291",
"name": "ConnectWise",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "遭供应链妥协的云备份应用提供商，其多租户OAuth应用被用于访问下游Microsoft 365客户环境。",
"x_evidence": "原文称ConnectWise Cloud Backup被滥用，并通过被攻陷的应用认证下游客户环境。",
"x_confidence": 0.97
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e0257477-87f4-401a-a293-cf3e1f1959be",
"name": "T1595",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "主动扫描云资源以识别受害目标。",
"aliases": [
"Active Scanning"
],
"x_evidence": "原文MITRE ATT&CK表列出T1595 Active Scanning：Scanning cloud resources to identify targets for compromise。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--424b698f-f06a-401b-b438-7916dea9a09c",
"name": "T1078.004",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "使用遭泄露的云账户获取访问权限，包括跨租户密码喷洒。",
"aliases": [
"Valid Accounts: Cloud Accounts"
],
"x_evidence": "原文称Storm-0940发起跨租户密码喷洒攻击，MITRE T1078.004为Valid Accounts: Cloud Accounts。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--93bd2fdf-b98c-4801-a305-ac05f1f61a3a",
"name": "T1195",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "攻陷多租户OAuth应用程序，以访问下游客户环境。",
"aliases": [
"Supply Chain Compromise"
],
"x_evidence": "原文称Storm-0940攻陷ConnectWise多租户OAuth应用程序并利用下游信任。",
"x_confidence": 0.96
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--f7ce9988-8993-4617-9be0-56b23f2f3bcc",
"name": "T1098.003",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "添加高特权云角色分配，包括将应用自我分配为Global Administrator。",
"aliases": [
"Account Manipulation: Additional Cloud Roles"
],
"x_evidence": "原文称T1098.003涉及addition of privileged cloud role assignments, including self assignment of global admin。",
"x_confidence": 0.93
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e60cf329-c7a6-4329-ac2b-26a144e120eb",
"name": "T1098.001",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "添加或修改应用程序凭据以建立持久化。",
"aliases": [
"Account Manipulation: Additional Cloud Credentials"
],
"x_evidence": "原文称T1098.001为Addition or modification of application credentials。",
"x_confidence": 0.94
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--cf71aba6-6840-428e-8bf2-a80930cab355",
"name": "T1528",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "窃取OAuth应用访问令牌或认证材料，用于非交互式登录。",
"aliases": [
"Steal Application Access Token"
],
"x_evidence": "原文称T1528 Steal Application Access Token涉及Compromising OAuth application authentication material。",
"x_confidence": 0.93
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--d8ecc067-fa79-4c19-b4e2-891311a28f3a",
"name": "T1087.004",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "通过Microsoft Graph等活动发现云账户。",
"aliases": [
"Account Discovery: Cloud Account"
],
"x_evidence": "原文称T1087.004 Account Discovery: Cloud Account用于Identifying privileged cloud accounts for further targeting。",
"x_confidence": 0.94
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--48a88f92-fef6-4fcf-8a67-4c487f04860b",
"name": "T1580",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "发现并测绘云基础设施以支持进一步攻击。",
"aliases": [
"Cloud Infrastructure Discovery"
],
"x_evidence": "原文称T1580 Cloud Infrastructure Discovery用于Mapping cloud infrastructure for further targeting。",
"x_confidence": 0.94
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--f6fc0d61-2837-4e57-b022-b40681d1c312",
"name": "144.172.64.128",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940攻击基础设施IP，用于ConnectWise客户环境登录及Graph API活动。",
"x_evidence": "原文IOC表将144.172.64.128列为IP，并称这些IP被用于在ConnectWise应用客户环境中进行登录和Graph API活动。",
"x_confidence": 0.95
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--10c3d070-dfcd-48d1-b227-20458beeabd7",
"name": "144.172.64.99",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940攻击基础设施IP，2026-10-10至14执行跨租户密码喷洒并用于下游自动登录。",
"x_evidence": "原文称Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign。",
"x_confidence": 0.98
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--d325ee0e-29ba-4024-91f0-3836b3d87bb4",
"name": "144.172.64.60",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940攻击基础设施IP，用于ConnectWise客户环境登录及Graph API活动。",
"x_evidence": "原文IOC表将144.172.64.60列为IP，并称这些IP被用于在ConnectWise应用客户环境中进行登录和Graph API活动。",
"x_confidence": 0.94
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--817bdc05-4721-4bf4-902a-0b9ddd140d29",
"name": "187.15.88.186",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "通过被攻陷ConnectWise应用访问Graph API的VPN IP，仅2026-10-15/16调查相关。",
"x_evidence": "原文IOC表列出187.15.88[.]186，称这些VPN IP曾通过被攻陷应用访问Graph API，且仅10月15日和16日与调查相关。",
"x_confidence": 0.45
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--1f9d2e85-200b-4521-8000-c9aa9b00b90c",
"name": "187.15.90.217",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "通过被攻陷ConnectWise应用访问Graph API的VPN IP，仅2026-10-15/16调查相关。",
"x_evidence": "原文IOC表列出187.15.90[.]217，称这些VPN IP曾通过被攻陷应用访问Graph API，且仅10月15日和16日与调查相关。",
"x_confidence": 0.45
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--f2097b07-a605-4dfd-ab73-d307b7b22aeb",
"name": "187.15.89.186",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "通过被攻陷ConnectWise应用访问Graph API的VPN IP，仅2026-10-15/16调查相关。",
"x_evidence": "原文IOC表列出187.15.89[.]186，称这些VPN IP曾通过被攻陷应用访问Graph API，且仅10月15日和16日与调查相关。",
"x_confidence": 0.45
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--90e6155d-3e00-41a5-9f83-33ff36950f5e",
"relationship_type": "attributed-to",
"source_ref": "campaign--ae2befc1-0df4-42e9-8ada-53d5cd45f7df",
"target_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "ConnectWise supply chain compromise归因于Storm-0940。",
"x_evidence": "原文称Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise。",
"x_confidence": 0.97
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--29033bd6-c44c-49b8-8268-11f5c167d640",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "tool--c758042d-72fd-4773-a0f7-b1aad464c72c",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940使用ARTEX自动化渗透测试框架加速攻击。",
"x_evidence": "原文称Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks。",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--109fdf6c-d19b-4155-bd91-5139c7f79b75",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--e0257477-87f4-401a-a293-cf3e1f1959be",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940使用主动扫描技术进行云资源侦察。",
"x_evidence": "原文称Storm-0940 used ARTEX to accelerate scanning and reconnaissance，并在MITRE表中列出T1595 Active Scanning。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f37af4ff-9de3-47e2-82e9-fd9efe6688a8",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--424b698f-f06a-401b-b438-7916dea9a09c",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940使用遭泄露云账户进行跨租户密码喷洒。",
"x_evidence": "原文称Storm-0940 infrastructure conducted an automated cross-tenant password-spray campaign。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e9161669-b6fe-49be-8972-a284b6d253da",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--93bd2fdf-b98c-4801-a305-ac05f1f61a3a",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940攻陷ConnectWise多租户OAuth应用程序实施供应链妥协。",
"x_evidence": "原文称Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application。",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7e76459f-4e66-443e-b123-a7e6f4f0a23e",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--f7ce9988-8993-4617-9be0-56b23f2f3bcc",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940添加高特权云角色分配以实现持久化和提权。",
"x_evidence": "原文称T1098.003涉及addition of privileged cloud role assignments, including self assignment of global admin。",
"x_confidence": 0.93
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ebbdf971-5827-45de-bbea-32e0a9342f23",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--e60cf329-c7a6-4329-ac2b-26a144e120eb",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940添加或修改应用程序凭据以形成后门。",
"x_evidence": "原文称T1098.001为Addition or modification of application credentials，并描述凭据修改可形成持久化。",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1caf19da-7073-4cc3-9fb2-551379899134",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--cf71aba6-6840-428e-8bf2-a80930cab355",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940窃取OAuth应用访问令牌以获取凭据访问能力。",
"x_evidence": "原文称T1528 Steal Application Access Token涉及Compromising OAuth application authentication material。",
"x_confidence": 0.93
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--968fe45c-b6b4-476d-9a94-77b477aac9f3",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--d8ecc067-fa79-4c19-b4e2-891311a28f3a",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940通过Microsoft Graph发现云账户。",
"x_evidence": "原文称T1087.004 Account Discovery: Cloud Account用于Identifying privileged cloud accounts for further targeting。",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--56f56e56-cb40-4d39-9f2b-9b5c90ac2305",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "attack-pattern--48a88f92-fef6-4fcf-8a67-4c487f04860b",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940通过Microsoft Graph发现云基础设施。",
"x_evidence": "原文称T1580 Cloud Infrastructure Discovery用于Mapping cloud infrastructure for further targeting。",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c4a60263-e86f-44a1-9f5f-072a3ad29c3f",
"relationship_type": "targets",
"source_ref": "campaign--ae2befc1-0df4-42e9-8ada-53d5cd45f7df",
"target_ref": "identity--d4d87b1d-7d6c-424b-a647-ae675aee2291",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "ConnectWise supply chain compromise针对ConnectWise多租户云备份应用提供商及其下游客户。",
"x_evidence": "原文称ConnectWise supply chain compromise of a multi-tenant application。",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9b095486-add2-4dbe-9b6a-6af5b967087c",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "ipv4-addr--f6fc0d61-2837-4e57-b022-b40681d1c312",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940使用144.172.64.128作为攻击基础设施进行下游登录及Graph API活动。",
"x_evidence": "原文IOC表列出144.172.64[.]128，并称其用于ConnectWise应用客户环境中的登录和Graph API活动。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0090724e-7802-425a-b24e-4d477cf72697",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "ipv4-addr--10c3d070-dfcd-48d1-b227-20458beeabd7",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940使用144.172.64.99作为攻击基础设施进行跨租户密码喷洒和下游自动登录。",
"x_evidence": "原文称Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign。",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--621bca4d-ffac-4d21-9996-8275f0de9a6b",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "ipv4-addr--d325ee0e-29ba-4024-91f0-3836b3d87bb4",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940使用144.172.64.60作为攻击基础设施进行下游登录及Graph API活动。",
"x_evidence": "原文IOC表列出144.172.64[.]60，并称其用于ConnectWise应用客户环境中的登录和Graph API活动。",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--70848164-820a-4bd2-b60c-c26c265ef770",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "ipv4-addr--817bdc05-4721-4bf4-902a-0b9ddd140d29",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940可能使用187.15.88.186作为VPN/代理IP通过被攻陷应用访问Graph API。",
"x_evidence": "原文IOC表列出187.15.88[.]186，称该VPN IP通过被攻陷应用访问Graph API，且仅10月15/16日相关。",
"x_confidence": 0.45
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fc8e45e3-5dc6-4fbb-9a95-f2a8efd77890",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "ipv4-addr--1f9d2e85-200b-4521-8000-c9aa9b00b90c",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940可能使用187.15.90.217作为VPN/代理IP通过被攻陷应用访问Graph API。",
"x_evidence": "原文IOC表列出187.15.90[.]217，称该VPN IP通过被攻陷应用访问Graph API，且仅10月15/16日相关。",
"x_confidence": 0.45
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6f2ac2c8-f244-43f9-b028-a586ce2b4285",
"relationship_type": "uses",
"source_ref": "intrusion-set--504b234f-839b-479e-aa18-4d84da553a3c",
"target_ref": "ipv4-addr--f2097b07-a605-4dfd-ab73-d307b7b22aeb",
"created": "2026-10-22T04:56:37Z",
"modified": "2026-10-22T04:56:37Z",
"description": "Storm-0940可能使用187.15.89.186作为VPN/代理IP通过被攻陷应用访问Graph API。",
"x_evidence": "原文IOC表列出187.15.89[.]186，称该VPN IP通过被攻陷应用访问Graph API，且仅10月15/16日相关。",
"x_confidence": 0.45
}
]
}报告链接：
https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
───────────────────────────────────
（三）Skynet代理指令暴露大模型劫持与自主攻击设计
事件名称：自主 LLMjacking：“天网”代理劫持暴露的 AI 模型以发动攻击
发布日期：2026-10-21
发布机构：Symantec Threat Hunter Team
威胁概述：
Symantec通过AI蜜罐捕获了一套攻击代理指令，其设计是寻找未受保护的大语言模型端点，将他人的模型作为攻击推理引擎，并以越狱提示要求模型协助扫描、凭据收集、漏洞利用和挖矿。指令中的Skynet模式允许长时间无人值守运行，模型所有者承担计算费用。研究揭示的是捕获到的攻击请求与工具设计，不能据此认定全部预设动作均已成功执行。
IOC指标：
· SHA256：fcde1323acceb46fd88f2276c010bb98839dccce03dc512c56d9529428ceec68, b720a5e7c3a5b1760d15a8833a782f4fe7fc5c62b967fe57f607e72745ec0ccf
· IP：86.216.147.228, 13.140.161.91, 207.180.232.206
· Domain:Port：mine.c3pool.com:13333, auto.c3pool.org:80, auto.skypool.xyz:6666, xmrpool.eu:5555
STIX详情：
{
"type": "bundle",
"id": "bundle--5ed4180f-c2bb-49a9-a9e4-842955a7a262",
"spec_version": "2.1",
"objects": [
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"name": "Skynet",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "攻击者构建的自主攻击代理，可持续扫描、利用漏洞、窃取凭据并部署矿工。",
"x_evidence": "原文称 Attackers have built an autonomous offensive agent，并捕获到其指令集。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--98b05561-94f9-484d-90a4-dde88b470949",
"name": "FOFA",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "互联网资产搜索引擎服务，被 Skynet 用于发现暴露资产。",
"x_evidence": "原文称 internet-wide asset discovery through the FOFA search service。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--43a58504-632a-4c5b-9b24-914259ae10a5",
"name": "Prisma",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "数据库工具/ORM，Skynet 通过其转储数据库。",
"x_evidence": "原文称工具定义涵盖 database dumping through Prisma。",
"x_confidence": 0.9
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--0fa1ed7d-f6d9-411c-9b31-9c76b7f868b3",
"name": "Werkzeug debugger PIN",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Werkzeug 调试器 PIN 可被利用实现远程代码执行。",
"x_evidence": "原文称 remote code execution through the Werkzeug debugger PIN。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--599bba47-76d3-45da-8874-a3a75f57eb8b",
"name": "VS Code",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的开发工具。",
"x_evidence": "原文称 exploit modules aimed at VS Code。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--bc5f07db-794a-4d30-9d3f-fd72b0b955e3",
"name": "Django",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的 Web 框架。",
"x_evidence": "原文称 exploit modules aimed at Django。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--3d9a7da6-a044-43d9-aa40-a4f1b594e910",
"name": "Jupyter",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的交互式计算环境。",
"x_evidence": "原文称 exploit modules aimed at Jupyter。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--7fb0fddd-5e3b-4e05-b88f-4153f5bd6e2d",
"name": "Laravel",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的 PHP 框架。",
"x_evidence": "原文称 exploit modules aimed at Laravel。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--02940af4-68d0-452a-9024-f4ced13457e2",
"name": "Supabase",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的开源 Firebase 替代品。",
"x_evidence": "原文称 exploit modules aimed at Supabase。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--21b01d44-0312-4a36-9faf-5128e92656e5",
"name": "Next.js",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的 React 框架。",
"x_evidence": "原文称 exploit modules aimed at Next.js。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--d1023d7b-9992-488a-b5b5-c40ef5f7f3a2",
"name": "Flask/Werkzeug",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "被 Skynet 漏洞利用模块作为目标的 Python Web 框架。",
"x_evidence": "原文称 exploit modules aimed at Flask/Werkzeug deployments。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--605d7683-fc69-4574-bd31-11d492aec220",
"name": "Prisma Studio",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Prisma 的数据库管理组件，被 Skynet 用于自动转储数据库。",
"x_evidence": "原文称 automated dumping of databases exposed through Prisma Studio。",
"x_confidence": 0.9
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"name": "XMRig",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "开源门罗币挖矿软件，被恶意脚本下载并执行。",
"x_evidence": "原文称 The script downloaded... the open-source XMRig Monero-mining software。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--6481ad8b-e757-45ff-9c9e-4a939335bf17",
"name": "go2rtc",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "WebRTC 视频流服务器，恶意脚本查找其目录以隐藏矿工。",
"x_evidence": "原文称 it first looked for directories used by go2rtc。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--3244cb46-0e88-4631-b32b-168b3fa870ab",
"name": "Home Assistant",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "智能家居网关平台，可能运行 go2rtc 而成为攻击目标。",
"x_evidence": "原文称 go2rtc found in smart camera gateways and Home Assistant setups。",
"x_confidence": 0.85
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--36dcd74a-dcd5-4091-afb4-7c3c6b18ebb4",
"name": "86.216.147.228",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "矿池相关网络 IOC。",
"x_evidence": "原文 Network IOCs 列出 86.216.147[.]228。",
"x_confidence": 0.95
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--1c162ccb-5139-41a7-95d7-f62b09d4bee7",
"name": "13.140.161.91",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "矿池相关网络 IOC。",
"x_evidence": "原文 Network IOCs 列出 13.140.161[.]91。",
"x_confidence": 0.95
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--fc3a73df-b92d-4d75-a61e-8824e5ed6acb",
"name": "207.180.232.206",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "矿池相关网络 IOC。",
"x_evidence": "原文 Network IOCs 列出 207.180.232[.]206。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--30872524-082f-49e0-b28b-d012ea510a0d",
"name": "mine.c3pool.com",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "门罗币矿池地址，端口 13333。",
"aliases": [
"mine.c3pool.com:13333"
],
"x_evidence": "原文 Network IOCs 列出 mine.c3pool[.]com:13333。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--bb40ecda-436b-470a-b685-3c66d15c0652",
"name": "auto.c3pool.org",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "门罗币矿池地址，端口 80。",
"aliases": [
"auto.c3pool.org:80"
],
"x_evidence": "原文 Network IOCs 列出 auto.c3pool[.]org:80。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--5c6a337d-f8d2-4538-a480-7fa08d353b95",
"name": "auto.skypool.xyz",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "门罗币矿池地址，端口 6666。",
"aliases": [
"auto.skypool.xyz:6666"
],
"x_evidence": "原文 Network IOCs 列出 auto.skypool[.]xyz:6666。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--2a3a78ab-fe72-45d3-8720-97b79a7dff4d",
"name": "xmrpool.eu",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "门罗币矿池地址，端口 5555。",
"aliases": [
"xmrpool.eu:5555"
],
"x_evidence": "原文 Network IOCs 列出 xmrpool[.]eu:5555。",
"x_confidence": 0.95
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--dada3217-a65e-4de0-892c-2ee1207b0d76",
"name": "Monero Wallet",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "门罗币钱包地址，用于接收挖矿收益。",
"aliases": [
"47Ce53JfHMxhze2cTBCkn9G1bbHDWZHVYKNZccaKktr32bZVrCcJggQCSFYukkEoS9DvaYmzi313hJzkj9G8PZDT4x6HgS9"
],
"x_evidence": "原文 IOC 章节列出门罗币钱包地址 47Ce53...。",
"x_confidence": 0.9
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"first_observed": "2026-10-22T04:41:12Z",
"last_observed": "2026-10-22T04:41:12Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": ".trace",
"description": "恶意脚本用于隐藏 XMRig 矿工程序的文件名。",
"aliases": [],
"evidence": "原文称 hid the resulting binary under a filename... .trace。",
"confidence": 0.9
},
"1": {
"type": "file",
"name": "Shell Script",
"description": "恶意 Shell 脚本，下载并执行 XMRig，并配置隐藏部署。",
"aliases": [
"fcde1323acceb46fd88f2276c010bb98839dccce03dc512c56d9529428ceec68"
],
"evidence": "原文 IOC 章节将 fcde1323... 列为 Shell Script。",
"confidence": 0.95
},
"2": {
"type": "file",
"name": "Gzip compressed shell script",
"description": "gzip 压缩的恶意 Shell 脚本，解码后释放 Shell 脚本。",
"aliases": [
"b720a5e7c3a5b1760d15a8833a782f4fe7fc5c62b967fe57f607e72745ec0ccf"
],
"evidence": "原文 IOC 章节将 b720a5e... 列为 Gzip compressed shell script。",
"confidence": 0.95
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fa8b149f-36a8-42da-a26c-8af346ec7d51",
"relationship_type": "uses",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--98b05561-94f9-484d-90a4-dde88b470949",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 使用 FOFA 搜索引擎服务进行互联网资产发现。",
"x_evidence": "原文称工具定义涵盖 internet-wide asset discovery through the FOFA search service。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6428d985-b4f5-40c0-97e8-5dee384ba7e5",
"relationship_type": "uses",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--43a58504-632a-4c5b-9b24-914259ae10a5",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 使用 Prisma 转储数据库。",
"x_evidence": "原文称工具定义涵盖 database dumping through Prisma。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c684bb50-d359-4313-ad8b-a007d2a74a13",
"relationship_type": "uses",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--605d7683-fc69-4574-bd31-11d492aec220",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 使用 Prisma Studio 自动转储数据库。",
"x_evidence": "原文称 automated dumping of databases exposed through Prisma Studio。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6ebc879b-a65f-4713-8a15-3606bcd2b6ac",
"relationship_type": "exploits",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "vulnerability--0fa1ed7d-f6d9-411c-9b31-9c76b7f868b3",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 利用 Werkzeug debugger PIN 获取远程代码执行能力。",
"x_evidence": "原文称 remote code execution through the Werkzeug debugger PIN。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2d117dc5-a1e9-4957-8f31-486f3b249558",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--599bba47-76d3-45da-8874-a3a75f57eb8b",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 VS Code 作为目标。",
"x_evidence": "原文称 exploit modules aimed at VS Code。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ac052bfc-b69d-406f-b89a-bacc9375c561",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--bc5f07db-794a-4d30-9d3f-fd72b0b955e3",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 Django 作为目标。",
"x_evidence": "原文称 exploit modules aimed at Django。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0a01a0ee-1ee1-4450-bdf7-e77617cca72d",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--3d9a7da6-a044-43d9-aa40-a4f1b594e910",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 Jupyter 作为目标。",
"x_evidence": "原文称 exploit modules aimed at Jupyter。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2e9cc2ad-201f-4e1f-8fb7-3119dec747eb",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--7fb0fddd-5e3b-4e05-b88f-4153f5bd6e2d",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 Laravel 作为目标。",
"x_evidence": "原文称 exploit modules aimed at Laravel。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--97f2af0f-bc02-4b28-8ca7-73c7ef3a3922",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--02940af4-68d0-452a-9024-f4ced13457e2",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 Supabase 作为目标。",
"x_evidence": "原文称 exploit modules aimed at Supabase。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--92235eef-e71d-4dfc-8ba1-3b60f645293e",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--21b01d44-0312-4a36-9faf-5128e92656e5",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 Next.js 作为目标。",
"x_evidence": "原文称 exploit modules aimed at Next.js。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d3300521-a0b2-4ce5-8903-21c3f51056c2",
"relationship_type": "targets",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "tool--d1023d7b-9992-488a-b5b5-c40ef5f7f3a2",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 漏洞利用模块将 Flask/Werkzeug 作为目标。",
"x_evidence": "原文称 exploit modules aimed at Flask/Werkzeug deployments。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a1f9fa4a-aa78-4388-8cd9-6eac1c689089",
"relationship_type": "delivers",
"source_ref": "tool--81b4858e-4b92-477e-85dc-1ec65cc71f23",
"target_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "Skynet 投递了 gzip 压缩的恶意 Shell 脚本。",
"x_evidence": "原文称后续请求要求解码字符串，解码后为 gzip-compressed shell script。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f80914c7-fbcf-4b19-8175-133fccf407e3",
"relationship_type": "drops",
"source_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"target_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "gzip 压缩脚本释放出对应的恶意 Shell 脚本。",
"x_evidence": "原文 IOC 章节同时列出 Shell Script 与 Gzip compressed shell script，后者解码后得到前者。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--764f32ba-813e-4644-b7b9-1bb15ebeb207",
"relationship_type": "downloads",
"source_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"target_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "恶意 Shell 脚本下载 XMRig 挖矿软件。",
"x_evidence": "原文称 The script downloaded... the open-source XMRig Monero-mining software。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--96fa06be-d3dc-4c63-aa90-b19e0b81d69b",
"relationship_type": "executes",
"source_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"target_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "恶意 Shell 脚本执行 XMRig 挖矿软件。",
"x_evidence": "原文称攻击指令要求 deploy cryptocurrency miners quietly in the background。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fc53e0aa-99c5-42ba-a5e9-e4d0ae68a892",
"relationship_type": "drops",
"source_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"target_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "恶意 Shell 脚本将矿工程序以隐藏文件名 .trace 放置。",
"x_evidence": "原文称 hid the resulting binary under a filename designed to look like an unrelated logging utility, named .trace。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--aa65e902-2e7e-4dd2-bb8b-52dba7c96bbd",
"relationship_type": "targets",
"source_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"target_ref": "tool--6481ad8b-e757-45ff-9c9e-4a939335bf17",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "恶意 Shell 脚本以运行 go2rtc 的设备为目标进行隐藏部署。",
"x_evidence": "原文称 The script first looked for directories used by go2rtc... and placed the miner in the first one。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1ebb0474-d669-4245-99ce-2174ef5e4bc5",
"relationship_type": "targets",
"source_ref": "observed-data--52aa7fb5-c173-4a8f-a7f2-0fe95d1f96ae",
"target_ref": "tool--3244cb46-0e88-4631-b32b-168b3fa870ab",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "恶意 Shell 脚本可能影响运行 go2rtc 的 Home Assistant 智能家居网关。",
"x_evidence": "原文称 go2rtc is found in smart camera gateways and Home Assistant setups。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--89d4d9cb-30f7-4cca-b207-3c5da765b760",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "ipv4-addr--36dcd74a-dcd5-4091-afb4-7c3c6b18ebb4",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与矿池节点 86.216.147.228 通信。",
"x_evidence": "原文 Network IOCs 列出 86.216.147[.]228，脚本配置矿池故障转移。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fe7486ca-fedb-4671-acbe-115a124b9763",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "ipv4-addr--1c162ccb-5139-41a7-95d7-f62b09d4bee7",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与矿池节点 13.140.161.91 通信。",
"x_evidence": "原文 Network IOCs 列出 13.140.161[.]91。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e4724152-f0d6-4524-84fb-c3f60bc7088f",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "ipv4-addr--fc3a73df-b92d-4d75-a61e-8824e5ed6acb",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与矿池节点 207.180.232.206 通信。",
"x_evidence": "原文 Network IOCs 列出 207.180.232[.]206。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c911a3d2-f146-422d-a546-d835a25f4430",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "domain-name--30872524-082f-49e0-b28b-d012ea510a0d",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与门罗币矿池 mine.c3pool.com 通信。",
"x_evidence": "原文 Network IOCs 列出 mine.c3pool[.]com:13333。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6dee20c7-adc3-4290-8148-3883da1da13a",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "domain-name--bb40ecda-436b-470a-b685-3c66d15c0652",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与门罗币矿池 auto.c3pool.org 通信。",
"x_evidence": "原文 Network IOCs 列出 auto.c3pool[.]org:80。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c5a48ded-9c3c-4b3a-b263-0c312d2a8689",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "domain-name--5c6a337d-f8d2-4538-a480-7fa08d353b95",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与门罗币矿池 auto.skypool.xyz 通信。",
"x_evidence": "原文 Network IOCs 列出 auto.skypool[.]xyz:6666。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0e649b94-373f-4059-838c-3850e884b1b3",
"relationship_type": "communicates-with",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "domain-name--2a3a78ab-fe72-45d3-8720-97b79a7dff4d",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 与门罗币矿池 xmrpool.eu 通信。",
"x_evidence": "原文 Network IOCs 列出 xmrpool[.]eu:5555。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--75516f41-58a2-424b-8e3f-b1afe4e50252",
"relationship_type": "uses",
"source_ref": "malware--574f72ce-1eb2-4648-849f-2d434f20a1a2",
"target_ref": "campaign--dada3217-a65e-4de0-892c-2ee1207b0d76",
"created": "2026-10-22T04:41:12Z",
"modified": "2026-10-22T04:41:12Z",
"description": "XMRig 使用该门罗币钱包地址接收挖矿收益。",
"x_evidence": "原文 IOC 章节列出门罗币钱包地址 47Ce53...。",
"x_confidence": 0.9
}
]
}报告链接：
https://www.security.com/threat-intelligence/ai-llmjacking-skynet
───────────────────────────────────
（四）钓鱼劫持云计费账户，为未授权Gemini调用买单
事件名称：从钓鱼到大语言模型劫持：威胁行为者将云计费账户作为大语言模型使用的目标
发布日期：2026-10-20
发布机构：Wiz Research
威胁概述：
Wiz调查发现，攻击者利用搜索广告将用户引向假冒Google登录页面，窃取具备高权限的GCP账号凭据和多因素认证信息。攻击者随后修改组织策略，将外部控制的项目绑定到受害者计费账户，大量调用Gemini API。由于调用发生在攻击者的项目中，受害组织难以看到具体提示词和模型输出，却需承担相应费用。
IOC指标：
· IP：212.73.134.136
· Domain（节选）：gboogl.com, groosl.com, gprokl.com, gxoosl.com, gsoolg.com
STIX详情：
{
"type": "bundle",
"id": "bundle--b1e4223b-acba-4d4b-8712-76a31af053fa",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"name": "Unattributed Threat Actor",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "未归因威胁行为者，通过付费 Google Search 广告启动钓鱼并入侵 GCP 环境",
"x_evidence": "原文称“Threat actors are... compromising victim environments solely to abuse their finances for mass LLM execution”，且未对威胁行为者进行正式归因",
"x_confidence": 0.8
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--a3c79a09-3bb0-4072-b7e9-6214ebb3f781",
"name": "Automated Phishing Kit",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "自动化钓鱼工具包，捕获 Google 凭据和 MFA 后从源 IP 执行首次恶意登录",
"x_evidence": "原文称“the automated phishing kit immediately leveraged the harvested credentials to execute the first malicious login”",
"x_confidence": 0.9
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--aeef8266-de70-4921-ac53-8ac6f000c10a",
"name": "212.73.134.136",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼工具源 IP，用于首次恶意登录受害者 GCP 环境",
"x_evidence": "原文 IOC 表将 212.73.134[.]136 标记为“IP seen in the initial login from the phishing page”",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--bb015831-ab3b-4008-aeb8-535e9c352939",
"name": "gboogl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *.gboogl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--232aebd7-871f-49b3-a1d5-0cae71bc9558",
"name": "groosl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *.groosl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--3c7bd794-3bab-49ae-bf86-310c353feeb8",
"name": "gprokl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *.gprokl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--44a27ea7-eff2-4cf0-b293-c95cae71b8a8",
"name": "gxoosl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *.gxoosl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--e7e9e49c-faf6-4b4a-869c-4dc37b88e78a",
"name": "gsoolg.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *.gsoolg[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--431eb3d6-8bed-4c00-b1b3-56d5076bcdc1",
"name": "gzoozl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gzoozl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--c1f5a7ce-01f7-403a-866b-72eabad0e8e4",
"name": "groonl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *groonl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--4ca6f4df-56e1-4008-8a7b-f76628d769aa",
"name": "gsool.space",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gsool[.]space",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--ad83c5dc-41f6-4c12-988d-12b9b297ec9b",
"name": "gbrokl.space",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gbrokl[.]space",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--ade2f1a8-ee9f-47e2-85c7-5193face22cc",
"name": "gbrokl.xyz",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gbrokl[.]xyz",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--92d4896b-031f-4e4e-946c-fd0c86648ec1",
"name": "gsoosl.xyz",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gsoosl[.]xyz",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--db574dba-0b4b-40c2-a8f8-092aa7688bf4",
"name": "gsool.xyz",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gsool[.]xyz",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--325609c4-f7f7-4e15-a8bd-452492513124",
"name": "gpoosl.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gpoosl[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--7acb67df-c1a0-49a2-acdd-6a6b14e2d942",
"name": "groolg.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *groolg[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--5075797f-7da9-4770-928d-d83ac4d4d139",
"name": "gcslom.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gcslom[.]com",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--f3d7b19c-4499-446b-b0f4-03be65a40626",
"name": "gcoalg.com",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者钓鱼基础设施域名",
"x_evidence": "原文 IOC 表将其列为“Attacker infrastructure - phishing domain”，域名为 *gcoalg[.]com",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"name": "Phishing Infrastructure",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "攻击者用于 Google 凭据钓鱼的域名集合",
"x_evidence": "原文 IOC 表将多个 g*ool、g*osl 等域名统一标记为“Attacker infrastructure - phishing domain”",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--f0c48435-a6ef-43e5-a39b-4ccdbf86f241",
"name": "Paid Advertising Phishing",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "通过购买针对 Google Cloud 和 GCP 管理搜索词的付费 Google Search 广告启动钓鱼",
"x_evidence": "原文称“The threat actor purchased Google Search ads for common administrative search terms such as “google cloud” and “gcp”.”",
"x_confidence": 0.88
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--d35b889e-b82c-4589-a968-14924a3cdfa1",
"name": "Fake Login Page Credential and MFA Capture",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "通过伪造 Google 登录页面捕获受害者有效 Google Console 凭据和 MFA 验证码",
"x_evidence": "原文称“Victim users... input their account credentials and multi-factor-authentication (MFA) codes into the phishing page.”",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--ed39fcf7-c53c-409b-a0e1-8789c039a024",
"name": "GCP Persistence and Privilege Escalation",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "启用 Gemini API、创建高权限服务账户、删除域限制策略并分配 billing 管理员角色",
"x_evidence": "原文称攻击者“Enable the Gemini API product”、“Create service accounts with Gemini API keys”并分配“roles/billing.admin”等角色",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--926ccadc-cd3f-458e-94eb-4085cad55210",
"name": "Defense Evasion via Geo IP Switch and Billing Admin Downgrade",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "后续活动切换至受害者组织总部国家 IP，并将内部 billing 管理员降级为只读",
"x_evidence": "原文称“activity shifted to originate from IP addresses geolocated within each victim organization's headquartered country”及“demoted pre-existing internal billing administrators”",
"x_confidence": 0.85
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--bd7982db-ea26-42bc-9cca-2b6b6e1a7693",
"name": "Cross-Tenant Gemini API Abuse",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "通过外部租户自动大规模调用 Gemini API 造成未授权 AI API 费用",
"x_evidence": "原文称“threat actors linked external GCP projects directly to the victim’s billing accounts”，导致“unauthorized Gemini API usage”费用激增",
"x_confidence": 0.88
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6107f914-02cc-4200-9643-64af6a2b421c",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "attack-pattern--f0c48435-a6ef-43e5-a39b-4ccdbf86f241",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者使用付费广告钓鱼模式发起攻击",
"x_evidence": "原文称“The threat actor purchased Google Search ads for common administrative search terms...”",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9df57719-c402-4fae-b174-0bad2338a062",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "attack-pattern--d35b889e-b82c-4589-a968-14924a3cdfa1",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者使用伪造登录页面捕获凭据和 MFA",
"x_evidence": "原文称受害用户被导向“a fake Google login web page”并输入凭据和 MFA",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f89d00cc-41b4-4e9c-a361-bfb8ed20dcf1",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "tool--a3c79a09-3bb0-4072-b7e9-6214ebb3f781",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者使用自动化钓鱼工具包执行凭据捕获后的首次恶意登录",
"x_evidence": "原文称“the automated phishing kit immediately leveraged the harvested credentials...”",
"x_confidence": 0.92
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d2d4c4b2-794a-4ee5-b3f3-4f4a43c00abc",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者使用钓鱼基础设施域名实施凭据钓鱼",
"x_evidence": "原文 IOC 表将多个域名标记为“Attacker infrastructure - phishing domain”",
"x_confidence": 0.88
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bb77c348-db36-4c6f-a25a-5f649ddd0d35",
"relationship_type": "uses",
"source_ref": "tool--a3c79a09-3bb0-4072-b7e9-6214ebb3f781",
"target_ref": "ipv4-addr--aeef8266-de70-4921-ac53-8ac6f000c10a",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "自动化钓鱼工具包使用源 IP 212.73.134.136 执行首次恶意登录",
"x_evidence": "原文称“the automated phishing kit... execute the first malicious login... from 212.73.134[.]136, the source IP address of the phishing kit”",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8cee14ad-378e-4099-9647-51e8c050e3ee",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--bb015831-ab3b-4008-aeb8-535e9c352939",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gboogl.com",
"x_evidence": "原文 IOC 表列出“*.gboogl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--19a69b3b-4906-4441-9487-56c733f99703",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--232aebd7-871f-49b3-a1d5-0cae71bc9558",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 groosl.com",
"x_evidence": "原文 IOC 表列出“*.groosl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--79d32021-e621-4e24-8272-7ee6d58dac1b",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--3c7bd794-3bab-49ae-bf86-310c353feeb8",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gprokl.com",
"x_evidence": "原文 IOC 表列出“*.gprokl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--706ccb55-8b51-4605-99e0-bdf5f681e92d",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--44a27ea7-eff2-4cf0-b293-c95cae71b8a8",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gxoosl.com",
"x_evidence": "原文 IOC 表列出“*.gxoosl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b32b72cb-624a-4131-8fdd-4492027ce48a",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--e7e9e49c-faf6-4b4a-869c-4dc37b88e78a",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gsoolg.com",
"x_evidence": "原文 IOC 表列出“*.gsoolg[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d0651a6a-580c-40ca-9dda-8451690d3fe4",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--431eb3d6-8bed-4c00-b1b3-56d5076bcdc1",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gzoozl.com",
"x_evidence": "原文 IOC 表列出“*gzoozl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0d60dbf9-fcab-4056-a017-c0108752f7fc",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--c1f5a7ce-01f7-403a-866b-72eabad0e8e4",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 groonl.com",
"x_evidence": "原文 IOC 表列出“*groonl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e7b8fcfc-7423-4cf3-a61d-f61ea387e46a",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--4ca6f4df-56e1-4008-8a7b-f76628d769aa",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gsool.space",
"x_evidence": "原文 IOC 表列出“*gsool[.]space”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f6410246-9c01-4c6a-a69d-b57a5fd7a066",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--ad83c5dc-41f6-4c12-988d-12b9b297ec9b",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gbrokl.space",
"x_evidence": "原文 IOC 表列出“*gbrokl[.]space”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ed01bcfb-6a54-448f-91b0-5ff5b6900af3",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--ade2f1a8-ee9f-47e2-85c7-5193face22cc",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gbrokl.xyz",
"x_evidence": "原文 IOC 表列出“*gbrokl[.]xyz”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5a5a0fb6-5b99-4fe5-b89c-2167ff676a2c",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--92d4896b-031f-4e4e-946c-fd0c86648ec1",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gsoosl.xyz",
"x_evidence": "原文 IOC 表列出“*gsoosl[.]xyz”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--18986c01-1b46-469e-8a55-985433046321",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--db574dba-0b4b-40c2-a8f8-092aa7688bf4",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gsool.xyz",
"x_evidence": "原文 IOC 表列出“*gsool[.]xyz”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b4111cec-bb25-4bd5-ab20-3192e74f277d",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--325609c4-f7f7-4e15-a8bd-452492513124",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gpoosl.com",
"x_evidence": "原文 IOC 表列出“*gpoosl[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9dd3d9af-2530-4d77-a2c6-1f38b2e17df4",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--7acb67df-c1a0-49a2-acdd-6a6b14e2d942",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 groolg.com",
"x_evidence": "原文 IOC 表列出“*groolg[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9007297d-f924-4125-90c5-f9b7992bd966",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--5075797f-7da9-4770-928d-d83ac4d4d139",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gcslom.com",
"x_evidence": "原文 IOC 表列出“*gcslom[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9d04fe1e-2cb4-414e-9d4e-b70281cf0676",
"relationship_type": "consists-of",
"source_ref": "infrastructure--517da55d-4f1f-49e9-ae54-d6ad497187e8",
"target_ref": "domain-name--f3d7b19c-4499-446b-b0f4-03be65a40626",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "钓鱼基础设施包含域名 gcoalg.com",
"x_evidence": "原文 IOC 表列出“*gcoalg[.]com”为钓鱼域名",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7ce1fcaf-ebbc-4abf-8b25-b7e2f61345e4",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "attack-pattern--ed39fcf7-c53c-409b-a0e1-8789c039a024",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者进行 GCP 持久化和提权",
"x_evidence": "原文称“Once inside the environment, the threat actor leveraged the compromised account’s excessive privileges...”",
"x_confidence": 0.88
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a9824aa7-e6be-4d2b-b3bc-5f905ac4c37b",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "attack-pattern--926ccadc-cd3f-458e-94eb-4085cad55210",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者实施防御规避",
"x_evidence": "原文称“Once initial access was secured, threat actors employed defense evasion techniques...”",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a1b368f4-eabc-41f9-ae29-4f53e1c5720f",
"relationship_type": "uses",
"source_ref": "intrusion-set--67fe0f58-e1a2-4d1d-b130-990940f63358",
"target_ref": "attack-pattern--bd7982db-ea26-42bc-9cca-2b6b6e1a7693",
"created": "2026-10-21T04:50:48Z",
"modified": "2026-10-21T04:50:48Z",
"description": "威胁行为者通过外部租户大规模调用 Gemini API",
"x_evidence": "原文称“The primary objective of these intrusions was... leveraging hijacked cloud infrastructure to offload the costs of high-volume LLM inference”",
"x_confidence": 0.88
}
]
}报告链接：
https://www.wiz.io/blog/from-phishing-to-llmjacking
───────────────────────────────────
（五）OpenCode Console第三方模型API密钥面临泄露风险
事件名称：从一封“密钥泄露”邮件说起：OpenCode 蒸馏攻击事件全解析
发布日期：2026-10-19
发布机构：奇安信威胁情报中心
威胁概述：
奇安信威胁情报中心整理了OpenCode Console安全事件：未授权访问可能使部分用户关联的第三方模型服务API密钥暴露，涉及OpenAI、Anthropic及Google等提供商。公开声明称约1.4%的Console用户受到影响，并已通过邮件通知。OpenCode将事件与大规模蒸馏攻击关联，但公开技术细节不足以确认完整利用链及所有密钥的实际滥用情况，受影响用户应撤销关联密钥并检查调用账单。
IOC指标：
· 暂无公开IOC
STIX详情：
{
"type": "bundle",
"id": "bundle--7409ab9f-da87-416d-9ecc-8d107fd2275d",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"name": "Unknown Attacker",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "未披露具体身份的攻击者，对 OpenCode 遗留系统获得未授权访问并窃取第三方 API 密钥，实施大规模蒸馏攻击",
"x_evidence": "原始报告称：攻击者获得对 OpenCode 一套正处于停用流程中的遗留系统的未授权访问；官方将事件定性为与大规模蒸馏攻击相关的安全泄露。",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"name": "Distillation Attack",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者通过大量查询目标模型 API，收集返回结果（思维链推理过程）作为训练数据喂养自己的模型",
"aliases": [
"蒸馏攻击",
"distillation attack"
],
"x_evidence": "原文称：攻击者通过海量、构造精良的查询调用目标模型的 API，收集返回结果（尤其是思维链推理过程），将其作为训练数据喂养自己的模型。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--8a077061-7c0b-439f-b60e-854373edfd38",
"name": "T1552.001",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Unsecured Credentials: Credentials In Files。第三方服务商 API 密钥以文件/工作区形式存储，成为攻击目标",
"x_evidence": "原文技术附录：T1552.001 Unsecured Credentials: Credentials In Files；第三方服务商 API 密钥以文件/工作区形式存储，成为攻击目标。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2ca4def3-1153-4613-8323-926de6a4d1d1",
"name": "T1078",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Valid Accounts。攻击者持窃取的真实 API 密钥，以受害者身份调用模型服务",
"x_evidence": "原文技术附录：T1078 Valid Accounts；攻击者持窃取的真实 API 密钥，以受害者身份调用 Anthropic / OpenAI / Google 模型服务。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--83e9aad9-a86a-42fd-89e5-c9fc9a7b38f6",
"name": "T1496",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Resource Hijacking。盗用受害者账户的模型调用配额进行大规模推理（用于蒸馏），消耗受害者账单额度",
"x_evidence": "原文技术附录：T1496 Resource Hijacking；盗用受害者账户的模型调用配额进行大规模推理（用于蒸馏），消耗受害者账单额度。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--5996b6f6-64ef-461b-8e92-42f62c28903d",
"name": "T1657",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Financial Theft。多名用户报告产生数百至上千美元未经授权的 API 消费",
"x_evidence": "原文技术附录：T1657 Financial Theft；多名用户报告产生数百至上千美元未经授权的 API 消费（用户自述，未经官方核实）。",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--2e0c66b2-f802-446f-b4b2-fa3e8a223df4",
"name": "Anthropic",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "第三方 AI 服务商，其 API 密钥在事件中遭到泄露和滥用",
"x_evidence": "原文称：存储在 Console 工作区中的第三方 API 密钥，涉及 Anthropic、OpenAI、Google。",
"x_confidence": 0.95
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--e6207451-4d3c-4ed3-b00a-9de0004b1c37",
"name": "OpenAI",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "第三方 AI 服务商，其 API 密钥在事件中遭到泄露和滥用",
"x_evidence": "原文称：存储在 Console 工作区中的第三方 API 密钥，涉及 Anthropic、OpenAI、Google。",
"x_confidence": 0.95
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--d4c17450-41c2-4d75-b1f8-164b7865f1c9",
"name": "Google",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "第三方 AI 服务商，其 API 密钥在事件中遭到泄露和滥用",
"x_evidence": "原文称：存储在 Console 工作区中的第三方 API 密钥，涉及 Anthropic、OpenAI、Google。",
"x_confidence": 0.95
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--9ee4b406-c7fa-4719-8dd0-dba38edb1042",
"name": "NSA",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "美国国家安全局，联合发布针对大规模蒸馏活动的通报",
"x_evidence": "原文称：2026 年 9 月 8 日，美国 NSA、CISA、FBI 又联合发布通报 AA26-251A。",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--618323fa-5c6d-4ff9-9fab-43144e070492",
"name": "CISA",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "美国网络安全和基础设施安全局，联合发布针对大规模蒸馏活动的通报",
"x_evidence": "原文称：2026 年 9 月 8 日，美国 NSA、CISA、FBI 又联合发布通报 AA26-251A。",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--fe12e2c4-f3f2-433e-86ae-1ced260262fc",
"name": "FBI",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "美国联邦调查局，联合发布针对大规模蒸馏活动的通报",
"x_evidence": "原文称：2026 年 9 月 8 日，美国 NSA、CISA、FBI 又联合发布通报 AA26-251A。",
"x_confidence": 0.9
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d45e0609-29b7-4151-946c-795c5dc26670",
"name": "AA26-251A",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "美国 NSA、CISA、FBI 联合发布的通报，指控针对美国前沿模型的工业化规模蒸馏活动",
"x_evidence": "原文称：NSA、CISA、FBI 联合发布通报 AA26-251A，指控多家 AI 公司对美国前沿模型开展工业化规模的蒸馏活动。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"name": "OpenCode",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "开源 AI 编码工具。本次事件中一套正在下线流程中的遗留系统被未授权访问，Console 工作区中存储的第三方 API 密钥受影响",
"x_evidence": "原文称：开源 AI 编码工具 OpenCode 的托管服务 OpenCode Console 遭入侵，约 1.4% 的 Console 用户存储的第三方 AI 服务商 API 密钥疑似泄露。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--f3951655-cf95-412c-b3f9-77c3fcff58a3",
"name": "Dev Machine Guard",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "StepSecurity 发布的开源工具，可扫描开发机上的 AI 编码 Agent、MCP Server、IDE 扩展等",
"x_evidence": "原文称：可借助开源工具（如 StepSecurity 发布的 Dev Machine Guard，可扫描开发机上的 AI 编码 Agent、MCP Server、IDE 扩展等）批量发现 OpenCode 安装情况。",
"x_confidence": 0.85
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--8b8c3e0a-ad89-4786-b34e-a7f5a9d0e603",
"name": "OpenCode Legacy System",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "本次事件中正在下线流程中的遗留系统，被未授权访问",
"x_evidence": "原文称：攻击者获得对 OpenCode 一套正处于停用流程中的遗留系统的未授权访问。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--e563d4aa-4b2f-4719-9eda-477edef4ed64",
"name": "Claude",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Anthropic 的模型，相关 Claude API 密钥在事件中遭到泄露并被撤销",
"x_evidence": "原文称：Anthropic 已撤销其判定受影响的 Claude API 密钥。",
"x_confidence": 0.85
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--a94452f9-924f-4d98-9756-5541a7aefe6c",
"name": "Gemini",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Google 的模型，曾遭到大规模蒸馏活动针对",
"x_evidence": "原文称：Anthropic 与 Google 威胁情报团队先后披露了针对 Claude 和 Gemini 的大规模蒸馏活动。",
"x_confidence": 0.8
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--0117df67-65d3-4e8e-a188-57788aebda53",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"first_observed": "2026-10-19T08:17:15Z",
"last_observed": "2026-10-19T08:17:15Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "auth.json",
"description": "OpenCode 用于在开发者本机缓存已绑定的服务商凭证的文件",
"aliases": [],
"evidence": "原文称：OpenCode 会把已绑定的服务商凭证缓存在开发者本机，检查该文件可以确认某台机器是否绑定过服务商：macOS/Linux: ~/.local/share/opencode/auth.json。",
"confidence": 0.95
},
"1": {
"type": "file",
"name": "opencode",
"description": "OpenCode 的命令行执行文件",
"aliases": [
"opencode.exe"
],
"evidence": "原文称：CLI 安装痕迹可通过 ~/.opencode/bin/opencode 确认，Windows 下检查 PATH 中的 opencode.exe。",
"confidence": 0.9
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--095d610b-d258-4489-bf63-b56156687f74",
"relationship_type": "targets",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "infrastructure--8b8c3e0a-ad89-4786-b34e-a7f5a9d0e603",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者对 OpenCode 遗留系统获得未授权访问",
"x_evidence": "原文称：攻击者获得对 OpenCode 一套正处于停用流程中的遗留系统的未授权访问。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f54d3383-91e9-48d8-be41-956e928667bf",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者实施大规模蒸馏攻击",
"x_evidence": "原文称：官方将事件定性为与大规模蒸馏攻击相关的安全泄露。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--65b7bdc4-f081-4d35-a62f-06a3c35c7f70",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "attack-pattern--8a077061-7c0b-439f-b60e-854373edfd38",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者利用未受保护的凭证文件进行凭证访问",
"x_evidence": "原文技术附录：第三方服务商 API 密钥以文件/工作区形式存储，成为攻击目标。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5d04f7ca-0382-41de-92a2-0d5286db41d0",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "attack-pattern--2ca4def3-1153-4613-8323-926de6a4d1d1",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者使用窃取的真实 API 密钥以受害者身份调用模型服务",
"x_evidence": "原文技术附录：攻击者持窃取的真实 API 密钥，以受害者身份调用 Anthropic / OpenAI / Google 模型服务。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ab510826-35ce-49bd-9ef2-7ebe02b794f6",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "attack-pattern--83e9aad9-a86a-42fd-89e5-c9fc9a7b38f6",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者盗用受害者账户的模型调用配额进行大规模推理",
"x_evidence": "原文技术附录：盗用受害者账户的模型调用配额进行大规模推理（用于蒸馏），消耗受害者账单额度。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--40122cc0-4cb4-4578-8ba7-600b4fd8782d",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "attack-pattern--5996b6f6-64ef-461b-8e92-42f62c28903d",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者造成受害者未授权 API 消费",
"x_evidence": "原文技术附录：多名用户报告产生数百至上千美元未经授权的 API 消费。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1fc74d9f-105f-48a4-9997-4f606af2b90c",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "tool--e563d4aa-4b2f-4719-9eda-477edef4ed64",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者使用窃取的 Claude API 密钥调用 Claude 模型服务",
"x_evidence": "原文称：Anthropic 已撤销其判定受影响的 Claude API 密钥；多名用户账户出现非本人发起的模型调用。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1bf8480d-1d72-41a4-8e67-83277045bf57",
"relationship_type": "uses",
"source_ref": "intrusion-set--e71b4379-f3f1-4aae-be9f-be9b17f8df98",
"target_ref": "tool--a94452f9-924f-4d98-9756-5541a7aefe6c",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者使用窃取的 Google API 密钥调用 Gemini 模型服务进行蒸馏",
"x_evidence": "原文称：Google 项目因“过度滥用”被暂停；此前 Google 威胁情报团队披露针对 Gemini 的大规模蒸馏活动。",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c0837d70-f450-41e5-bec0-025f35856227",
"relationship_type": "targets",
"source_ref": "attack-pattern--8a077061-7c0b-439f-b60e-854373edfd38",
"target_ref": "observed-data--0117df67-65d3-4e8e-a188-57788aebda53",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "凭证访问技术以本地缓存凭证文件 auth.json 为目标",
"x_evidence": "原文技术附录：第三方服务商 API 密钥以文件/工作区形式存储（云端 Console 工作区、本机 auth.json），成为攻击目标。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7247d42b-19cf-4c40-a20a-f1046d324199",
"relationship_type": "targets",
"source_ref": "attack-pattern--8a077061-7c0b-439f-b60e-854373edfd38",
"target_ref": "infrastructure--8b8c3e0a-ad89-4786-b34e-a7f5a9d0e603",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "凭证访问技术针对 OpenCode 遗留系统/Console 工作区中的 API 密钥",
"x_evidence": "原文称：存储在 Console 工作区中的第三方 API 密钥被泄露；入侵位置为 OpenCode 遗留系统。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--190db448-42f7-4dd9-a463-6682095ae7f0",
"relationship_type": "targets",
"source_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"target_ref": "identity--2e0c66b2-f802-446f-b4b2-fa3e8a223df4",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "蒸馏攻击针对 Anthropic 提供的模型 API",
"x_evidence": "原文称：攻击者通过大量查询调用目标模型 API；本次事件涉及 Anthropic API 密钥被滥用。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9470cd15-654d-4e55-bb5d-ad30bcf6e749",
"relationship_type": "targets",
"source_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"target_ref": "identity--e6207451-4d3c-4ed3-b00a-9de0004b1c37",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "蒸馏攻击针对 OpenAI 提供的模型 API",
"x_evidence": "原文称：攻击者通过大量查询调用目标模型 API；本次事件涉及 OpenAI API 密钥被滥用。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--312b9d79-22ba-4a54-bc0b-0630029c28e1",
"relationship_type": "targets",
"source_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"target_ref": "identity--d4c17450-41c2-4d75-b1f8-164b7865f1c9",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "蒸馏攻击针对 Google 提供的模型 API",
"x_evidence": "原文称：攻击者通过大量查询调用目标模型 API；本次事件涉及 Google API 密钥被滥用。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e640f2eb-e93c-40de-8893-8d7d328238b0",
"relationship_type": "targets",
"source_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"target_ref": "tool--e563d4aa-4b2f-4719-9eda-477edef4ed64",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "大规模蒸馏活动针对 Claude 模型",
"x_evidence": "原文称：Anthropic 与 Google 威胁情报团队先后披露了针对 Claude 和 Gemini 的大规模蒸馏活动。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9530f54b-1f7f-4793-9f6e-20b0ba9ac456",
"relationship_type": "targets",
"source_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"target_ref": "tool--a94452f9-924f-4d98-9756-5541a7aefe6c",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "大规模蒸馏活动针对 Gemini 模型",
"x_evidence": "原文称：Anthropic 与 Google 威胁情报团队先后披露了针对 Claude 和 Gemini 的大规模蒸馏活动。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e313995b-0fdf-4d45-ae38-1c4e94fa19d3",
"relationship_type": "targets",
"source_ref": "attack-pattern--2ca4def3-1153-4613-8323-926de6a4d1d1",
"target_ref": "identity--2e0c66b2-f802-446f-b4b2-fa3e8a223df4",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者使用有效账户技术以受害者身份调用 Anthropic 服务",
"x_evidence": "原文技术附录：攻击者持窃取的真实 API 密钥，以受害者身份调用 Anthropic / OpenAI / Google 模型服务。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8d496721-f001-4a86-976f-5c4060970aed",
"relationship_type": "targets",
"source_ref": "attack-pattern--2ca4def3-1153-4613-8323-926de6a4d1d1",
"target_ref": "identity--e6207451-4d3c-4ed3-b00a-9de0004b1c37",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者使用有效账户技术以受害者身份调用 OpenAI 服务",
"x_evidence": "原文技术附录：攻击者持窃取的真实 API 密钥，以受害者身份调用 Anthropic / OpenAI / Google 模型服务。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c3a530fc-fdf2-43ca-9348-9355d8904dac",
"relationship_type": "targets",
"source_ref": "attack-pattern--2ca4def3-1153-4613-8323-926de6a4d1d1",
"target_ref": "identity--d4c17450-41c2-4d75-b1f8-164b7865f1c9",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "攻击者使用有效账户技术以受害者身份调用 Google 服务",
"x_evidence": "原文技术附录：攻击者持窃取的真实 API 密钥，以受害者身份调用 Anthropic / OpenAI / Google 模型服务。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--43d11baf-764c-4622-8453-222c8ed46572",
"relationship_type": "uses",
"source_ref": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"target_ref": "identity--2e0c66b2-f802-446f-b4b2-fa3e8a223df4",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "OpenCode Console 支持绑定 Anthropic 服务商密钥",
"x_evidence": "原文称：开发者把 Anthropic、OpenAI、Google 的密钥绑定到 Console。",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--61012d54-7f58-4bd0-b421-24fa0d7258a2",
"relationship_type": "uses",
"source_ref": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"target_ref": "identity--e6207451-4d3c-4ed3-b00a-9de0004b1c37",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "OpenCode Console 支持绑定 OpenAI 服务商密钥",
"x_evidence": "原文称：开发者把 Anthropic、OpenAI、Google 的密钥绑定到 Console。",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--415d07b9-d759-41e9-b4f3-d43d03962920",
"relationship_type": "uses",
"source_ref": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"target_ref": "identity--d4c17450-41c2-4d75-b1f8-164b7865f1c9",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "OpenCode Console 支持绑定 Google 服务商密钥",
"x_evidence": "原文称：开发者把 Anthropic、OpenAI、Google 的密钥绑定到 Console。",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c076e3f9-e834-4a8b-940c-95d5be75bd72",
"relationship_type": "hosts",
"source_ref": "infrastructure--8b8c3e0a-ad89-4786-b34e-a7f5a9d0e603",
"target_ref": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "OpenCode 遗留系统承载 OpenCode 服务/Console",
"x_evidence": "原文称：开源 AI 编码工具 OpenCode 的托管服务 OpenCode Console 遭入侵；入侵位置为 OpenCode 一套正在下线流程中的遗留系统。",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7c4e7fc6-5145-4740-82e0-d193de85567e",
"relationship_type": "uses",
"source_ref": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"target_ref": "observed-data--0117df67-65d3-4e8e-a188-57788aebda53",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "OpenCode 使用本机 auth.json 文件缓存服务商凭证",
"x_evidence": "原文称：OpenCode 会把已绑定的服务商凭证缓存在开发者本机。",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f8537c20-844f-4456-8b5e-ed8b7df612db",
"relationship_type": "consists-of",
"source_ref": "tool--8b004885-d507-4283-b6dc-3a3701723dad",
"target_ref": "observed-data--0117df67-65d3-4e8e-a188-57788aebda53",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "opencode 是 OpenCode 的命令行执行组件",
"x_evidence": "原文称：CLI 安装痕迹可通过 ~/.opencode/bin/opencode 确认。",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c79ae7a5-730d-4e73-a8c5-f3dd651f4f94",
"relationship_type": "indicates",
"source_ref": "tool--f3951655-cf95-412c-b3f9-77c3fcff58a3",
"target_ref": "observed-data--0117df67-65d3-4e8e-a188-57788aebda53",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "Dev Machine Guard 可发现开发机上的 OpenCode 二进制安装痕迹",
"x_evidence": "原文称：可借助 Dev Machine Guard 批量发现 OpenCode 安装情况。",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2d7b031d-5672-4444-8147-181d7e23aa66",
"relationship_type": "attributed-to",
"source_ref": "campaign--d45e0609-29b7-4151-946c-795c5dc26670",
"target_ref": "identity--9ee4b406-c7fa-4719-8dd0-dba38edb1042",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "AA26-251A 通报由 NSA 联合发布",
"x_evidence": "原文称：美国 NSA、CISA、FBI 又联合发布通报 AA26-251A。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9e5076d9-33fb-4c03-984b-11729f121b9e",
"relationship_type": "attributed-to",
"source_ref": "campaign--d45e0609-29b7-4151-946c-795c5dc26670",
"target_ref": "identity--618323fa-5c6d-4ff9-9fab-43144e070492",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "AA26-251A 通报由 CISA 联合发布",
"x_evidence": "原文称：美国 NSA、CISA、FBI 又联合发布通报 AA26-251A。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--287e42b7-50d0-42c8-bf3b-b1a4de98d04d",
"relationship_type": "attributed-to",
"source_ref": "campaign--d45e0609-29b7-4151-946c-795c5dc26670",
"target_ref": "identity--fe12e2c4-f3f2-433e-86ae-1ced260262fc",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "AA26-251A 通报由 FBI 联合发布",
"x_evidence": "原文称：美国 NSA、CISA、FBI 又联合发布通报 AA26-251A。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8c341b68-2a6c-4a9f-8dc7-2a3feb41643a",
"relationship_type": "indicates",
"source_ref": "campaign--d45e0609-29b7-4151-946c-795c5dc26670",
"target_ref": "attack-pattern--7c7af055-8726-4f23-9360-c1882131c5c6",
"created": "2026-10-19T08:17:15Z",
"modified": "2026-10-19T08:17:15Z",
"description": "AA26-251A 通报描述/指出了大规模蒸馏活动",
"x_evidence": "原文称：AA26-251A 指控多家 AI 公司对美国前沿模型开展工业化规模的蒸馏活动。",
"x_confidence": 0.85
}
]
}报告链接：
http://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247520943&idx=1&sn=5c950426f02eff0ae6768e1def0b2447
───────────────────────────────────
（六）BUGSTER利用AI助手实施凭据窃取与数据库入侵
事件名称：“下一次漏洞利用机会”：威胁行为者如何使用人工智能帮助规划和执行多种类型的网络犯罪活动
发布日期：2026-10-21
发布机构：Palo Alto Networks Unit 42
威胁概述：
Unit 42调查发现，名为BUGSTER的威胁行为者将Hermes Agent、DeepSeek与Cursor等工具用于侦察、编写攻击脚本及规划网络犯罪活动。研究确认其针对印度高校实施攻击，并在一次入侵中外泄含个人信息的数据库记录。攻击者还通过专门的AI助手获取VoIP欺诈建议和构建Wi-Fi密码破解流程，显示AI可帮助低技能操作者组织多种攻击活动。
IOC指标：
· IP：162.243.3.92
报告链接：
https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
───────────────────────────────────
（七）日本组织遭AI辅助API攻击，APK逆向暴露后端入口
事件名称：日本近期AI辅助的网络攻击：调查攻击基础设施与技术 - JPCERT/CC官方博客
发布日期：2026-10-21
发布机构：JPCERT/CC
威胁概述：
JPCERT/CC在调查日本组织的信息泄露和未授权访问事件时，确认攻击者使用AI扫描已知漏洞并通过API发起攻击。攻击服务器中的文件显示，攻击者分析Android及Flutter应用安装包以识别后端API，使用相关逆向工具，并测试服务端请求伪造等问题。调查还发现面向日本以外用户的应用，说明相关攻击面可能跨越不同地区和服务。
IOC指标：
· IP：210.149.87.120, 118.26.36.16, 69.10.51.162
STIX详情：
{
"type": "bundle",
"id": "bundle--235dad1e-c786-413d-9ddf-4258964772bc",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"name": "Unknown Attacker",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "未具名攻击者，使用 AI 扫描已知漏洞并通过 API 实施攻击。",
"x_evidence": "原文称 attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs。",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--d9ef01af-1b54-43d5-944f-e2559dbf0133",
"name": "JPCERT/CC",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "日本协调中心，发布本次攻击警报并调查攻击基础设施。",
"aliases": [
"JPCERT Coordination Center"
],
"x_evidence": "原文称 JPCERT/CC issued an alert ... has been investigating infrastructure。",
"x_confidence": 0.98
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--f43c272b-232c-4c47-af79-ea4c1d5a417d",
"name": "Japan",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "受攻击目标所在国家，多个日本组织发生信息泄露。",
"x_evidence": "原文称 multiple organizations in Japan。",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--6fa184e9-8a74-41bf-96b0-9ae79f16c8f2",
"name": "Server-Side Request Forgery",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者在目标应用 API 中测试并可能利用的漏洞类型。",
"aliases": [
"SSRF"
],
"x_evidence": "原文称 tested the associated APIs for vulnerabilities such as server-side request forgery (SSRF)。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--a8e122f4-4468-4476-b85b-cfb360a92625",
"name": "Blutter",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "用于逆向 Flutter 应用、分析 AOT 编译 Dart 代码的工具，在攻击服务器上被发现。",
"x_evidence": "原文称 files associated with two tools: Blutter, used for reverse engineering Flutter applications。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--54ee88d0-a8de-4103-872d-68a6b1fecc78",
"name": "jadx",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "用于分析 Android 应用的工具，在攻击服务器上被发现。",
"x_evidence": "原文称 jadx, used for analyzing Android applications。",
"x_confidence": 0.95
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--23b90ab4-8a02-4419-90fa-be837d7ab52f",
"name": "210.149.87.120",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击基础设施 IP，原文附录 B 列为 IoC。",
"x_evidence": "原文附录 B: 210.149.87[.]120",
"x_confidence": 0.95
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--d48f8280-f18b-46ee-9c90-17eca0a7eb4e",
"name": "118.26.36.16",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击基础设施 IP，原文附录 B 列为 IoC。",
"x_evidence": "原文附录 B: 118.26.36[.]16",
"x_confidence": 0.95
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--dd171a21-963e-42be-9d83-f1f4505a54fb",
"name": "69.10.51.162",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击基础设施 IP，原文附录 B 列为 IoC。",
"x_evidence": "原文附录 B: 69.10.51[.]162",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--1283a510-270e-4641-991e-eed724791fca",
"name": "HTTPS_Redirect_SSRF_Test_Script",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击服务器上的 Python 脚本，功能为 HTTPS 服务器并向特定请求返回 HTTP 302 重定向，用于测试 SSRF 漏洞。",
"x_evidence": "原文称 Python script that appears to have been used to test for SSRF; script functions as an HTTPS server and returns an HTTP 302 redirect response。",
"x_confidence": 0.85
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--43c6b4f5-c714-49d3-9487-693f069c88c3",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"first_observed": "2026-10-21T04:38:42Z",
"last_observed": "2026-10-21T04:38:42Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "apk_extract/",
"description": "攻击服务器上可能与 APK 提取有关的目录。",
"aliases": [],
"evidence": "原文称 The server also contained directories such as apk_extract/。",
"confidence": 0.6
},
"1": {
"type": "file",
"name": "strings_libapp.txt",
"description": "攻击服务器上的文件名，可能用于存储从本机库提取的字符串。",
"aliases": [],
"evidence": "原文称 Filenames such as strings_libapp.txt suggest that the files may have been used to store strings extracted from native libraries。",
"confidence": 0.55
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--db05f817-2d03-4bac-8dcc-07ee6582d5b6",
"relationship_type": "targets",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "location--f43c272b-232c-4c47-af79-ea4c1d5a417d",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者针对日本多个组织实施攻击。",
"x_evidence": "原文称 multiple organizations in Japan。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3102768a-0a37-4fb7-b137-a60b4991fd58",
"relationship_type": "uses",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "tool--a8e122f4-4468-4476-b85b-cfb360a92625",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者服务器上发现 Blutter 相关文件，表明其使用 Blutter 进行 Flutter 应用逆向。",
"x_evidence": "原文称 files associated with two tools: Blutter, used for reverse engineering Flutter applications。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cfa9425f-e8ed-4db6-82ef-8271c6c2e0ea",
"relationship_type": "uses",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "tool--54ee88d0-a8de-4103-872d-68a6b1fecc78",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者服务器上发现 jadx 相关文件，表明其使用 jadx 分析 Android 应用。",
"x_evidence": "原文称 jadx, used for analyzing Android applications。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--10671995-2ddd-484d-86ff-469b235cd445",
"relationship_type": "uses",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "observed-data--43c6b4f5-c714-49d3-9487-693f069c88c3",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者服务器上存在 apk_extract/ 目录，可能与 APK 提取有关。",
"x_evidence": "原文称 The server also contained directories such as apk_extract/。",
"x_confidence": 0.6
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--350c80e4-bcbd-4c73-8596-f36e85581bf2",
"relationship_type": "uses",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "observed-data--43c6b4f5-c714-49d3-9487-693f069c88c3",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者服务器上存在 strings_libapp.txt，可能用于存储从本机库提取的字符串。",
"x_evidence": "原文称 Filenames such as strings_libapp.txt suggest that the files may have been used to store strings extracted from native libraries。",
"x_confidence": 0.55
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4806db90-4c8c-4dd0-8b14-3980dca06d6e",
"relationship_type": "uses",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "tool--1283a510-270e-4641-991e-eed724791fca",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者使用 Python 脚本测试 SSRF 漏洞。",
"x_evidence": "原文称 Python script that appears to have been used to test for SSRF。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--609b4390-182c-4c74-9e8e-cc1ff7fe8177",
"relationship_type": "uses",
"source_ref": "tool--1283a510-270e-4641-991e-eed724791fca",
"target_ref": "attack-pattern--6fa184e9-8a74-41bf-96b0-9ae79f16c8f2",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "该 Python 脚本与 SSRF 漏洞测试相关。",
"x_evidence": "原文称 Python script related to SSRF testing。",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bf4c04fd-68ba-44f5-9eb4-02cf0ce6ff56",
"relationship_type": "exploits",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "attack-pattern--6fa184e9-8a74-41bf-96b0-9ae79f16c8f2",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "攻击者测试并利用 SSRF 类漏洞。",
"x_evidence": "原文称 tested the associated APIs for vulnerabilities such as server-side request forgery (SSRF)。",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--49c6de53-4e5d-418e-8df4-562971b2617a",
"relationship_type": "controls",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "ipv4-addr--23b90ab4-8a02-4419-90fa-be837d7ab52f",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "该 IP 为攻击者控制的攻击基础设施。",
"x_evidence": "原文附录 B 将 210.149.87[.]120 列为攻击基础设施 IP。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--76bd967a-56be-4a68-adad-9db13ad8b228",
"relationship_type": "controls",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "ipv4-addr--d48f8280-f18b-46ee-9c90-17eca0a7eb4e",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "该 IP 为攻击者控制的攻击基础设施。",
"x_evidence": "原文附录 B 将 118.26.36[.]16 列为攻击基础设施 IP。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--49f3cc5a-752e-4e1a-8a8a-e97afa2b3681",
"relationship_type": "controls",
"source_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"target_ref": "ipv4-addr--dd171a21-963e-42be-9d83-f1f4505a54fb",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "该 IP 为攻击者控制的攻击基础设施。",
"x_evidence": "原文附录 B 将 69.10.51[.]162 列为攻击基础设施 IP。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8dde3cdb-d1fd-4443-8a60-b1a8783ba759",
"relationship_type": "uses",
"source_ref": "identity--d9ef01af-1b54-43d5-944f-e2559dbf0133",
"target_ref": "intrusion-set--467b014d-9ec3-40f2-af12-ec49e8445a47",
"created": "2026-10-21T04:38:42Z",
"modified": "2026-10-21T04:38:42Z",
"description": "JPCERT/CC 调查该未具名攻击者及其基础设施。",
"x_evidence": "原文称 JPCERT/CC has been investigating infrastructure that may have been used in these attacks。",
"x_confidence": 0.9
}
]
}报告链接：
https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
───────────────────────────────────
（八）Stable Diffusion WebUI模型加载组件存在代码注入漏洞
事件名称：AUTOMATIC1111 stable-diffusion-webui软件的代码注入漏洞(CVE-2026-111986)
发布日期：2026-10-18
发布机构：SecurityVulnerability.io
威胁概述：
公开漏洞通告披露，AUTOMATIC1111 Stable Diffusion WebUI在模型实例化过程中存在代码注入漏洞CVE-2026-111986，影响1.10.1及之前版本。问题涉及sd_models.py中的get_obj_from_str函数，攻击者可能通过操纵Target参数引入非预期代码。该组件位于AI生图服务的模型加载链路，部署方应限制不可信配置和模型输入，收敛服务暴露，并持续跟踪厂商修复公告。
IOC指标：
· CVE：CVE-2026-111986
报告链接：
https://securityvulnerability.io/vulnerability/CVE-2026-111986
───────────────────────────────────
三、本周AI安全风险观察
AI软件供应链的检查对象不能只限于源代码。LiteLLM事件中，构建后的wheel包含源码归档中没有的启动文件，安装后的执行行为与代码仓库审查结果可能出现差异。
AI资源滥用同时涉及身份和费用。模型端点、第三方API密钥、云组织策略及计费账户权限，均可能被用来转移调用成本或扩大访问范围。
智能体正在降低攻击编排门槛。ARTEX、BUGSTER及API攻击调查呈现出自动化侦察、脚本生成和工具调用的结合；蜜罐捕获的代理指令则显示了攻击者进一步放大自主运行的意图。
AI应用仍需落实传统安全边界。模型加载代码、移动应用暴露的后端API及跨租户应用授权，均需进行输入验证、权限约束和审计，不能依赖工具或模型本身作为安全边界。
───────────────────────────────────
四、安全建议
处置受污染的LiteLLM环境：核查1.107.0安装包及对应容器镜像，隔离受影响工作负载，移除恶意启动钩子，并轮换可能暴露的云服务、开发及模型API凭据；同时检查构建产物与实际安装文件。
核查ConnectWise及云应用授权：依据厂商指南处理受影响连接，审核Microsoft 365租户内应用凭据、服务主体登录和权限变更，保存相关审计记录；结合访问时段和行为判断地址指标的意义。
保护模型与云计费入口：为大模型API启用身份认证，限制不必要的公网暴露和出站访问；收紧云账号及计费管理权限，监控外部项目绑定、组织策略修改、异常模型调用和费用激增。
处理OpenCode相关凭据风险：核对受影响通知与关联的第三方模型服务，撤销并轮换可能泄露的密钥，检查近期调用记录及账单，避免长期在开发工具中保存高权限凭据。
加固AI应用及后端API：限制不可信模型与配置输入，关注Stable Diffusion WebUI修复进展；对API实施服务端身份认证、授权与SSRF防护，并排查移动应用中的嵌入式秘密信息及异常访问。
───────────────────────────────────
五、报告总结
本周AI安全风险贯穿安装包、开发工具、云身份和模型运行服务。LiteLLM供应链投毒与OpenCode凭据风险表明，AI开发链中的安装与集成环节可成为窃密入口；云计费账户劫持和Skynet代理指令则体现了攻击者对模型资源及使用费用的关注。
ARTEX、BUGSTER和日本API攻击调查展示了AI与既有攻击工具的组合方式，包括侦察、凭据滥用和后端接口测试。与此同时，Stable Diffusion WebUI漏洞说明模型加载链路也需要常规应用安全治理。
组织应优先核查受影响安装包和集成账号，轮换暴露凭据，收紧应用授权与云计费权限，并结合模型调用审计、API访问监控和厂商处置指南降低风险。
───────────────────────────────────
报告说明
本报告由360威胁情报中心基于2026年10月17日至10月23日公开威胁情报整理形成，重点分析LiteLLM安装包供应链投毒、ARTEX与ConnectWise供应链攻击、Skynet大模型劫持代理、云计费账户滥用、OpenCode模型API密钥泄露风险、BUGSTER辅助网络犯罪、日本AI辅助API攻击及Stable Diffusion WebUI代码注入漏洞等事件，为企业AI应用、Agent开发环境、软件供应链、云身份与计费安全防护提供参考。
情报时效性：2026年10月17日—10月23日 威胁评估等级：高风险（多源情报验证）