{"id":150625,"date":"2025-12-04T23:12:08","date_gmt":"2025-12-04T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2"},"modified":"2025-12-04T23:12:08","modified_gmt":"2025-12-04T21:12:08","slug":"analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","title":{"rendered":"Anal\u00fdza citliv\u00fdch dat zachycen\u00fdch \u010dervem Shai-Hulud 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Wiz zve\u0159ejnila v\u00fdsledky anal\u00fdzy aktivit \u010derva Shai-Hulud 2, b\u011bhem jeho\u017e \u010dinnosti byly v repozit\u00e1\u0159i NPM uve\u0159ejn\u011bny \u0161kodliv\u00e9 verze v\u00edce ne\u017e 800 bal\u00ed\u010dk\u016f, souhrnn\u011b \u010d\u00edtaj\u00edc\u00ed v\u00edce ne\u017e 100 milion\u016f sta\u017een\u00ed. Po instalaci infikovan\u00e9ho bal\u00ed\u010dku se aktivovan\u00fd \u010derv pokou\u0161\u00ed vyhled\u00e1vat d\u016fv\u011brn\u00e9 \u00fadaje, zve\u0159ej\u0148uje nov\u00e9 \u0161kodliv\u00e9 verze (pokud detekuje token p\u0159ipojen\u00ed k repozit\u00e1\u0159i NPM) a d\u00e1le shroma\u017e\u010fuje nalezen\u00e9 d\u016fv\u011brn\u00e9 \u00fadaje a vytv\u00e1\u0159\u00ed nov\u00e9 repozit\u00e1\u0159e na GitHubu. <\/p>\n

Na GitHubu bylo objeveno v\u00edce ne\u017e 30 tis\u00edc repozit\u00e1\u0159\u016f s ulo\u017een\u00fdmi daty, kter\u00e1 byla zachycena virem. P\u0159ibli\u017en\u011b 70 % z t\u011bchto repozit\u00e1\u0159\u016f obsahuje soubor content.json, 50 % \u2014 soubor truffleSecrets.json a 80 % \u2014 environment.json, kter\u00e9 obsahuj\u00ed p\u0159\u00edstupov\u00e9 kl\u00ed\u010de, citliv\u00e9 \u00fadaje a prom\u011bnn\u00e9 prost\u0159ed\u00ed nalezen\u00e9 v syst\u00e9mu v\u00fdvoj\u00e1\u0159e, kter\u00fd nainstaloval \u0161kodliv\u00fd bal\u00ed\u010dek s virem. Tak\u00e9 bylo v t\u011bchto repozit\u00e1\u0159\u00edch zji\u0161t\u011bno p\u0159ibli\u017en\u011b 400 soubor\u016f actionsSecrets.json s kl\u00ed\u010di nalezen\u00fdmi v prost\u0159ed\u00edch pro prov\u00e1d\u011bn\u00ed GitHub Actions. <\/p>\n

V souborech contents.json bylo p\u0159\u00edtomno v\u00edce ne\u017e 500 unik\u00e1tn\u00edch p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f a token\u016f pro p\u0159ipojen\u00ed k GitHubu. V souborech truffleSecrets.json byly nalezeny d\u016fv\u011brn\u00e9 informace, z\u00edskan\u00e9 p\u0159i anal\u00fdze na infikovan\u00e9m syst\u00e9mu pomoc\u00ed n\u00e1stroje TruffleHog, kter\u00fd shroma\u017e\u010fuje v\u00edce ne\u017e 800 typ\u016f \u00fadaj\u016f, mezi nimi\u017e jsou p\u0159\u00edstupov\u00e9 kl\u00ed\u010de, \u0161ifrovac\u00ed kl\u00ed\u010de, hesla a tokeny pou\u017e\u00edvan\u00e9 v r\u016fzn\u00fdch slu\u017eb\u00e1ch, cloudov\u00fdch prost\u0159ed\u00edch, produktech a datab\u00e1zov\u00fdch syst\u00e9mech. Celkov\u011b v truffleSecrets.json bylo identifikov\u00e1no v\u00edce ne\u017e 400 tis\u00edc unik\u00e1tn\u00edch z\u00e1znam\u016f, z nich\u017e p\u0159ibli\u017en\u011b 2,5 % (~10 000) bylo ov\u011b\u0159eno. <\/p>\n

P\u0159edpokl\u00e1d\u00e1 se, \u017ee zve\u0159ejn\u011bn\u00e9 d\u016fv\u011brn\u00e9 informace mohou slou\u017eit jako v\u00fdchoz\u00ed bod pro novou vlnu \u00fatok\u016f, proto\u017ee mnoho \u00fadaj\u016f z\u016fst\u00e1v\u00e1 aktu\u00e1ln\u00edch. Nap\u0159\u00edklad ov\u011b\u0159en\u00ed uk\u00e1zalo, \u017ee 60 % p\u0159\u00edstupov\u00fdch token\u016f k NPM zachycen\u00fdch ze zasa\u017een\u00fdch syst\u00e9m\u016f z\u016fst\u00e1v\u00e1 platn\u00fdch. <\/p>\n

Ve zpr\u00e1v\u011b jsou rovn\u011b\u017e uvedeny celkov\u00e9 statistiky z\u00edskan\u00e9 na z\u00e1klad\u011b anal\u00fdzy prom\u011bnn\u00fdch prost\u0159ed\u00ed z infikovan\u00fdch syst\u00e9m\u016f. 23 % spu\u0161t\u011bn\u00ed viru prob\u011bhlo na po\u010d\u00edta\u010d\u00edch v\u00fdvoj\u00e1\u0159\u016f, zat\u00edmco 77 % \u2014 v prost\u0159ed\u00edch pro kontinu\u00e1ln\u00ed integraci (60 % GitHub Actions, 5 % \u2014 Jenkins, 5 % \u2014 GitLab CI, 3 % \u2014 AWS CodeBuild). Na 87 % syst\u00e9m\u016f byl pou\u017eit Linux, 12 % \u2014 macOS a 1 % \u2014 Windows. 76 % spu\u0161t\u011bn\u00ed prob\u011bhlo v kontejnerech, 13 % \u2014 v z\u00e1kladn\u00edch syst\u00e9mech. <\/p>\n

60 % v\u0161ech infekc\u00ed vzniklo v d\u016fsledku instalace \u0161kodliv\u00fdch verz\u00ed bal\u00ed\u010dk\u016f @postman\/tunnel-agent-0.6.7 a @asyncapi\/specs-6.8.3. V 99 % p\u0159\u00edpad\u016f byl virus aktivov\u00e1n p\u0159i spu\u0161t\u011bn\u00ed p\u0159\u00edkazu \u201enode setup_bun.js\u201c, uveden\u00e9ho v package.json v sekci preinstall (zb\u00fdvaj\u00edc\u00ed 1 % pravd\u011bpodobn\u011b p\u0159ipad\u00e1 na pokusy o testov\u00e1n\u00ed).

\"Anal\u00fdza<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":150626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150625","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anal\u00fdza citliv\u00fdch dat, kter\u00e1 byla zachycena \u010dervem Shai-Hulud 2 | ProHoster","description":"Spole\u010dnost Wiz zve\u0159ejnila v\u00fdsledky anal\u00fdzy stopy \u010dinnosti \u010derva Shai-Hulud 2, b\u011bhem jej\u00ed\u017e aktivity byly v repozit\u00e1\u0159i NPM zve\u0159ejn\u011bny \u0161kodliv\u00e9 verze v\u00edce ne\u017e 800 bal\u00ed\u010dk\u016f, kter\u00e9 dohromady obsahuj\u00ed v\u00edc ne\u017e.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0447\u0435\u0440\u0432\u0451\u043c Shai-Hulud 2 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-04T21:12:08+00:00","article:modified_time":"2025-12-04T21:12:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150625","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:25:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-01-23 16:25:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/150625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=150625"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/150625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/150626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=150625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=150625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=150625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}