安全机构:疑似朝鲜黑客组织攻击加密货币企业,窃取云资产与密钥

Gate News 消息,3 月 9 日,安全研究机构 Ctrl-Alt-Intel 披露,一组疑似与朝鲜有关的黑客针对质押平台、交易所软件供应商及加密交易所发起攻击。攻击者利用 React2Shell 漏洞(CVE-2025-55182)及已获取的 AWS 访问凭证入侵云环境,枚举 S3、EC2、RDS、EKS、ECR 等资源,并从 Secrets Manager、Terraform 文件、Kubernetes 配置及 Docker 容器中提取密钥和凭证。研究人员称,攻击者下载 5 个 Docker 镜像并窃取源代码,其中包括 ChainUp 客户相关软件组件。攻击基础设施涉及韩国服务器 64.176.226.36 及域名 itemnania.com。报告称该活动与朝鲜相关攻击特征一致,但归因置信度为中等,AWS 凭证来源未明确。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Commento
0/400
Nessun commento