2026-10-20 22:42:27 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

cover_image

每周蓝军技术推送（2026.5.23-5.29）

M01N Team

2026年5月29日 19:00
天津

在小说阅读器读本章

去阅读

内网渗透

多阶段Linux入侵：从暴露的F5边缘设备渗透至Confluence服务器窃取凭据并横向移动

https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/

终端对抗

BadIIS变种：分析其MaaS生态，披露builder工具和自定义编码躲避检测

https://blog.talosintelligence.com/from-pdb-strings-to-maas-tracking-a-commodity-badiis-ecosystem/

GlassWorm：针对开发者的供应链攻击C2信道被CrowdStrike等联合关闭

https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html

The Gentlemen：基于Go的自传播勒索软件分析，使用临时密钥加密并通过横向移动自动部署

https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/

微软揭露Fox Tempest恶意软件签名服务，为勒索团伙提供代码签名以绕过检测

https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/

研究利用Hypervisor在Ring-1层伪造凭证绕过Denuvo DRM，结合社工诱导关闭安全防护

https://www.anquanke.com/post/id/315457

漏洞相关

CVE-2026-35616：FortiClient EMS认证绕过漏洞被用于投递EKZ凭证窃取器，通过VPN脚本执行恶意负载

https://www.bleepingcomputer.com/news/security/hackers-exploit-forticlient-ems-flaw-to-push-infostealer-malware/

通过DICOM文件格式漏洞在Orthanc服务器上传过程中实现堆溢出写入

https://blog.talosintelligence.com/dicom-pydicom-gdcm-and-orthanc-a-technical-tour-of-what-really-happens-in-the-heap/

Talos披露MediaInfoLib四个堆溢出漏洞，可导致任意代码执行

https://blog.talosintelligence.com/mediaarea-heap-based-buffer-overflow-vulnerabilities/

Talos披露TP-Link、Photoshop、OpenVPN、Norton VPN等多个漏洞，含栈溢出和命令注入

https://blog.talosintelligence.com/tp-link-photoshop-openvpn-norton-vpn-vulnerabilities/

Mini Shai Hulud：受感染的@antv npm包在npm install时窃取CI/CD凭证，针对Linux自动化环境

https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/

Zapier修复5步漏洞链，可致攻击者接管任意已登录用户账户

https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/

人工智能和安全

GreyVibe组织利用ChatGPT和Gemini生成诱饵，针对乌克兰发动网络攻击

https://www.bleepingcomputer.com/news/security/greyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks/

RAMPART和Clarity：用于AI Agent开发流程的持续安全测试与透明度保障的开源工具

https://www.microsoft.com/en-us/security/blog/2026/05/20/introducing-rampart-and-clarity-open-source-tools-to-bring-safety-into-agent-development-workflow/

Claude驱动的AI编码代理删除公司全部数据库及备份，用时9秒

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue

Microsoft Copilot Cowork因提示注入和外部图像渲染可导致文件外泄

https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/

AI在真实攻击中从规划转向实时部署，涉及勒索软件、国家间谍等多案例

https://research.checkpoint.com/2026/ai-threat-landscape-digest-march-april-2026/

通过AI靶场演示五种提示词注入绕过方法，包括翻译绕过、角色扮演和分步诱导

https://www.anquanke.com/post/id/315584

社工钓鱼

JINX-0164：利用假招聘诱饵和自定义macOS恶意软件攻击加密货币组织，横向移动至CI/CD

https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html

云安全

196亿文件因云存储桶配置不当暴露，含68.5万凭证文件和近100万数据库转储

https://securityaffairs.com/192787/security/19-6-billion-files-are-sitting-open-on-the-internet-no-password-required.html

其他

mouse5212-super-formatter：恶意npm包在安装后窃取Claude AI用户目录文件并上传至攻击者GitHub仓库

https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html

SEO投毒+ScreenConnect传播GPU挖矿程序的加密劫持活动

https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/

Laravel-Lang四个Composer包遭标签重写供应链攻击，注入恶意helpers.php

https://www.mend.io/blog/laravel-lang-composer-tag-rewrite-supply-chain-attack/

323个npm包通过atool维护者账户被入侵，攻击者批量发布恶意版本

https://www.mend.io/blog/mini-shai-hulud-antv-atool-npm-supply-chain-attack/