UAT-10608 드러나다: 웹 애플리케이션에 대한 대규모 자동 자격 증명 탈취

“graph TB %% Class definitions classDef technique fill:#ffcc99 classDef tool fill:#99ccff classDef malware fill:#ccffcc %% Node definitions tech_initial_access[“Technique – T1189 Drive-By Compromise
Description: Attacker gains initial access by exploiting a vulnerability in a public-facing website and executing code on the victim system.”] class tech_initial_access technique tool_react2shell[“Tool – Name: React2Shell (CVE-2025-55182)
Description: Pre-authentication remote code execution vulnerability in Next.js applications.”] class tool_react2shell tool tech_exploit_client[“Technique – T1203 Exploitation for Client Execution
Description: Exploits software vulnerabilities to execute code on a target system.”] class tech_exploit_client technique tech_script_proxy[“Technique – T1216 System Script Proxy Execution
Description: Uses system scripts to proxy execution of malicious code.”] class tech_script_proxy technique malware_loader[“Malware – Name: Loader Script
Description: Small shell script placed in /tmp with a randomized name and launched with nohup.”] class malware_loader malware tech_hide_artifacts[“Technique – T1564.011 Hide Artifacts: Ignore Process Interrupts
Description: Runs malicious processes in background to avoid detection.”] class tech_hide_artifacts technique tech_network_logon[“Technique – T1037.003 Network Logon Script
Description: Configures a logon script that runs each time a user logs on to the network.”] class tech_network_logon technique tech_private_keys[“Technique – T1552.004 Private Keys
Description: Searches for and extracts private SSH keys from the file system.”] class tech_private_keys technique tech_credentials_files[“Technique – T1552.001 Credentials In Files
Description: Collects credentials stored in files such as .env, authorized_keys, Docker configs, etc.”] class tech_credentials_files technique tech_cloud_metadata[“Technique – T1552.005 Cloud Instance Metadata API
Description: Queries cloud provider metadata services to obtain temporary IAM credentials.”] class tech_cloud_metadata technique tech_container_api[“Technique – T1552.007 Container API
Description: Accesses Kubernetes service-account tokens from the pod filesystem.”] class tech_container_api technique tech_remote_staging[“Technique – T1074.002 Remote Data Staging
Description: Stages collected data locally before exfiltration.”] class tech_remote_staging technique tech_automated_exfil[“Technique – T1020 Automated Exfiltration
Description: Automates data exfiltration through scripted processes.”] class tech_automated_exfil technique tech_web_service[“Technique – T1102 Web Service
Description: Utilizes legitimate web services for command and control communication.”] class tech_web_service technique tech_dead_drop[“Technique – T1102.001 Dead Drop Resolver
Description: Stores exfiltrated data in a web service acting as a dead-drop location.”] class tech_dead_drop technique tech_ssh[“Technique – T1021.004 SSH
Description: Uses SSH for remote service lateral movement.”] class tech_ssh technique tech_ssh_hijack[“Technique – T1563.001 SSH Hijacking
Description: Reuses harvested private keys to hijack existing SSH sessions.”] class tech_ssh_hijack technique tool_nexus[“Tool – Name: NEXUS Listener
Description: Web-based GUI that receives harvested data and displays it to operators.”] class tool_nexus tool %% Connections tech_initial_access –>|uses| tool_react2shell tool_react2shell –>|triggers| tech_exploit_client tech_exploit_client –>|enables| tech_script_proxy tech_script_proxy –>|launches| malware_loader malware_loader –>|applies| tech_hide_artifacts malware_loader –>|sets up| tech_network_logon malware_loader –>|collects| tech_private_keys malware_loader –>|collects| tech_credentials_files malware_loader –>|queries| tech_cloud_metadata malware_loader –>|accesses| tech_container_api malware_loader –>|stages| tech_remote_staging tech_remote_staging –>|exfiltrates via| tech_automated_exfil tech_automated_exfil –>|uses| tech_web_service tech_automated_exfil –>|uses| tech_dead_drop tech_web_service –>|provides C2 to| tool_nexus tool_nexus –>|enables| tech_ssh tech_ssh –>|augmented by| tech_ssh_hijack tech_ssh_hijack –>|reuses| tech_private_keys “

공격 흐름