{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nUue t\u00fc\u00fcpi lunavara, mis kr\u00fcpteerib faile ja lisab neile laiendi \".SaveTheQueen\", levib l\u00e4bi s\u00fcsteemi v\u00f5rgu kausta SYSVOL Active Directory domeenikontrollerites.<\/p>\n<p>Meie kliendid on hiljuti selle pahavaraga kokku puutunud. Toome siinkohal v\u00e4lja meie p\u00f5hjaliku anal\u00fc\u00fcsi, tulemused ja j\u00e4reldused.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Tuvastamine<\/h2>\n<\/h2>\n<p>\n\u00dcks meie klientidest v\u00f5ttis meiega \u00fchendust p\u00e4rast seda, kui nad kokku puutusid uue kr\u00fcpteerija lunavaraga, mis lisas laiendi \".SaveTheQueen\" nende keskkonnas uutele kr\u00fcpteeritud failidele.<\/p>\n<p>Meie uurimise k\u00e4igus, t\u00e4psemalt nakkusallikate otsimise etapis, saime teada, et nakatunud ohvrite levikut ja j\u00e4lgimist teostati kasutades <strong>v\u00f5rgukausta SYSVOL <\/strong> kliendi domeeni kontrollijas.<\/p>\n<p>SYSVOL on v\u00f5tmekaust iga domeenikontrolleri jaoks, mida kasutatakse r\u00fchmapoliitikaobjektide (GPO) ja sisselogimis- ning v\u00e4ljaregistreerimisskriptide toimetamiseks domeenikomplektidesse. Selle kausta sisu replitseerub domeenikontrollerite vahel andmete s\u00fcnkroniseerimiseks organisatsiooni saitidel. Kirje SYSVOList n\u00f5uab k\u00f5rgeid domeeni\u00f5igusi, kuid p\u00e4rast kompromiteerimist muutub see v\u00f5imsaks t\u00f6\u00f6riistaks r\u00fcndajatele, kes saavad seda kasutada pahavara kiireks ja t\u00f5husaks levitamiseks domeenis.<\/p>\n<p>Varonise auditeerimise ahel aitas kiiresti tuvastada j\u00e4rgmist:<\/p>\n<ul>\n<li> Nakkustatud kasutajakonto l\u00f5i SYSVOList faili nimega \u00abhourly\u00bb<\/li>\n<li> SYSVOList loodi palju logifaile \u2013 iga\u00fchel neist on domeeni seadme nimi<\/li>\n<li>Paljud erinevad IP-aadressid p\u00e4\u00e4sesid ligi failile \u00abhourly\u00bb<\/li>\n<\/ul>\n<p>\nJ\u00f5udsime j\u00e4reldusele, et logifaile kasutati nakatumisprotsessi j\u00e4lgimiseks uutel seadmetel ja et \u00abhourly\u00bb on ajastatud \u00fclesanne, mis t\u00e4itis pahavara uutel seadmetel Powershelli skripti abil \u2013 n\u00e4idised \u00abv3\u00bb ja \u00abv4\u00bb.<\/p>\n<p>T\u00f5en\u00e4oliselt sai r\u00fcndaja administreerimis\u00f5igused domeeni jaoks, et salvestada faile SYSVOL-i. Nakkunud seadmetes k\u00e4ivitas r\u00fcndaja PowerShelli koodi, mis l\u00f5i ajastatud \u00fclesande, et avada, dekr\u00fcpteerida ja k\u00e4ivitada pahavara.<\/p>\n<h2>\n<h2>Pahavara dekr\u00fcptimine<\/h2>\n<\/h2>\n<p>\nOleme proovinud mitmeid dekr\u00fcpteerimise meetodeid, kuid tulutult:<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOliime juba peaaegu alla andmas, kui otsustasime proovida \u201eMagic\u201d v\u00f5rratut<br \/>\nutiliiti <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> , mille autor on GCHQ. \u201eMagic\u201d p\u00fc\u00fcab megida faili kr\u00fcpteerimist, kasutades erinevate kr\u00fcpteerimisviiside paroolide \u00e4raarvamist ja m\u00f5\u00f5tes entroopiat. <\/p>\n<p><b class=\"spoiler_title\">T\u00f5lkija m\u00e4rkus<\/b> Vt.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Diferentsiaalne entroopia<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entroopia infoteoorias<\/a><\/noindex>. Artiklis ja kommentaarides ei arutata autorite poolt meetodite \u00fcksikasju, mida on kasutatud nii kolmanda osapoole kui ka patenteeritud tarkvaras <br \/>\n<img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u201eMagic\u201d tuvastas, et kasutati GZip-kodeerijat koos base64-kodeeringuga, mis v\u00f5imaldas meil faili lahti pakkida ja leida koodi sisestamise jaoks \u2013 \u201esisestaja\u201d.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Droppija: \u201ePiirkonnas on epideemia! \u00dcldine vaktsineerimine. Lahtine\u201d<\/h2>\n<p>\nDropp oli tavaline .NET-fail, millel polnud mingit kaitset. P\u00e4rast l\u00e4htekoodi lugemist <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> , m\u00f5istsime, et selle ainus eesm\u00e4rk oli shell-koodi sisestamine protsessi winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell-kood v\u00f5i tavalised raskused<\/h2>\n<p>\nKasutame Hexacorni autorimisriista \u2014 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> , et \"kompileerida\" shell-kood teostatavaks failiks silumiseks ja anal\u00fc\u00fcsiks. Siis avastasime, et see t\u00f6\u00f6tab nii 32- kui ka 64-bitistes masinates.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIsegi lihtsa shell-koodi kirjutamine natiivse t\u00f5lkega assemblerist v\u00f5ib olla keeruline, t\u00e4ieliku shell-koodi kirjutamine, mis t\u00f6\u00f6tab m\u00f5lemal t\u00fc\u00fcbil s\u00fcsteemides, n\u00f5uab eliitoskusi, nii et hakkasime imestama r\u00fcndaja sisukuse \u00fcle.<\/p>\n<p>Kui me compileeritud shell-koodi anal\u00fc\u00fcsisime <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, m\u00e4rkasin, et see laadis <strong> dinamika biblioteeke .NET <\/strong>, nagu clr.dll ja mscoreei.dll. See tundus meile kummaline \u2013 tavaliselt p\u00fc\u00fcavad kurjategijad teha shell-koodi nii v\u00e4ikseks kui v\u00f5imalik, kutsudes OS-i natiivfunktsioone, mitte neid laadides. <em>Miks kellelegi on vaja sisestada shell-koodisse Windowsi funktsionaalsust, selle asemel et otse kutseid teha? <\/em><\/p>\n<p>Nagu selgus, autor ei kirjutanud \u00fcldse seda keerulist shell-koodi \u2013 selle jaoks kasutati spetsiifilist tarkvara, et t\u00f5lkida t\u00e4idetavaid faile ja skripte shell-koodiks. <\/p>\n<p>Leidsime t\u00f6\u00f6riista <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, mis, nagu me arvame, v\u00f5iks kompileerida sarnast shell-koodi. Siin on selle kirjeldus GitHubist:<\/p>\n<p><em>Donut genereerib x86 v\u00f5i x64 shell-koodi VBScriptist, JScriptist, EXE-st, DLL-ist (sealhulgas .NET teekidest). See shell-kood saab manustada igasse Windowsi protsessi, et k\u00e4ivitada<br \/>\noperatiivm\u00e4lu.<\/em><\/p>\n<p>Oma teooria kinnitamiseks kompileerisime oma koodi, kasutades Donut\u2019it, ja v\u00f5rdlesime seda prooviga \u2013 ja\u2026 jah, me leidsime veel \u00fche komponendi kasutatud t\u00f6\u00f6riistakomplektist. P\u00e4rast seda suutsime juba v\u00e4lja t\u00f5mmata ja anal\u00fc\u00fcsida originaalset .NET t\u00e4idetavat faili.<\/p>\n<h2> Koodi kaitse <\/h2>\n<p>\nSee fail oli obfuskateeritud <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx \u2014 avatud l\u00e4htekoodiga .NET projekt, mis on m\u00f5eldud teiste arenduste koodi kaitsmiseks. Sarnane tarkvara v\u00f5imaldab arendajatel kaitsta oma koodi p\u00f6\u00f6rdprojekteerimise eest, kasutades selliseid meetodeid nagu: s\u00fcmbolite asendamine, juhtimisvoo varjamise tehnoloogiad ja viitamismeetodi peitmine. Kahjustava programmi autorid kasutavad obfuskaatoreid, et v\u00e4ltida avastamist ja keerulisemaks muuta p\u00f6\u00f6rdprojekteerimise protsessi.<\/p>\n<p>T\u00e4nu <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> me oleme koodi lahti pakkunud:<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Tulemus \u2013 kasulik koormus<\/h2>\n<p>\nSaadud muundamiste tulemusena on tegemist v\u00e4ga lihtsa lunavaraga. Ei \u00fchtegi mehhanismi s\u00fcsteemi kohaloleku tagamiseks, ei \u00fchtegi \u00fchendust k\u00e4sureaga \u2013 ainult vana hea as\u00fcmmeetriline kr\u00fcpteerimine, et muuta ohvri andmed loetamatuks.<\/p>\n<p>Peamine funktsioon valib parameetritena j\u00e4rgmised read:<\/p>\n<ul>\n<li> Faili laiendus, mida kasutada p\u00e4rast kr\u00fcpteerimist (SaveTheQueen) <\/li>\n<li> Autori e-post, et lisada see lunapaberisse<\/li>\n<li> Avalik v\u00f5ti, mida kasutatakse failide kr\u00fcpteerimiseks <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Kogu protsess n\u00e4eb v\u00e4lja j\u00e4rgmine:<\/strong><\/p>\n<ol>\n<li> Malware skannib oma seadme kohalikke ja \u00fchendatud kettaid\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Otsib kr\u00fcpteerimiseks faile\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> P\u00fc\u00fcab l\u00f5petada protsessi, mis kasutab faili, mida ta kavatseb kr\u00fcpteerida<\/li>\n<li> Nimeta fail \u00fcmber \u00abOriginaal_faili_nimi.SaveTheQueenING\u00bb, kasutades MoveFile funktsiooni, ning kr\u00fcpteerib selle <\/li>\n<li>P\u00e4rast seda, kui fail on autori avaliku v\u00f5tmega kr\u00fcpteeritud, nimetab pahavara selle uuesti, n\u00fc\u00fcd nimega \"Algne_failinimi.SaveTheQueen\".<\/li>\n<li>T\u00f6\u00f6tatakse r\u00fcnde\u00f5iguse n\u00f5udmise fail, mis salvestatakse samasse kausta\n<p><img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nArvestades kohaliku CreateDecryptor funktsiooni kasutamist, sisaldab \u00fcks r\u00fcnde\u00f5iguse funktsioon t\u00f5en\u00e4oliselt nagu parameetrit dekodeerimismehhanismi, mis vajab privaatv\u00f5tit.<\/p>\n<p>Kr\u00fcpteeriv viirus <strong>EI kr\u00fcpteeri faile<\/strong>, mis asuvad j\u00e4rgmistes kataloogides:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Samuti EI kr\u00fcpteeri ta j\u00e4rgmisi failit\u00fc\u00fcpe: <strong>EI kr\u00fcpteerib j\u00e4rgmisi failit\u00fc\u00fcpe:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Kokkuv\u00f5tted ja j\u00e4reldused<\/h2>\n<\/h2>\n<p>\nKuigi ennast r\u00fcnde\u00f5iguse viirus ei sisaldanud mingeid ebatavalisi funktsioone, kasutas r\u00fcndaja loominguliselt Active Directoryt, et levitada dropperit, ja see r\u00fcnde\u00f5igus andis meile huvitavaid, kuigi l\u00f5puks mitte liiga keerulisi takistusi anal\u00fc\u00fcsi ajal. <\/p>\n<p>Arvame, et pahavara autor:<\/p>\n<ol>\n<li>Kirjutas lunavara, millel on sisseehitatud s\u00fcstimine protsessis winlogon.exe, samuti<br \/>\nfailide kr\u00fcpteerimise ja dekr\u00fcpteerimise funktsiooniga<\/li>\n<li>Maskeeris pahavara ConfuserEx abil, muundas tulemi Donutiga ja lisaks peitis dropperi base64 Gzip<\/li>\n<li>Saalis ohvri domeenist k\u00f5rgendatud \u00f5igused ja kasutas neid kr\u00fcpteeritud pahavara ja ajastatud \u00fclesannete kopimiseks<br \/>\ndomeeni kontrollerite SYSVOL v\u00f5rgukausta<\/li>\n<li>K\u00e4itas PowerShelli skripti domeeni seadmetes pahavara levitamiseks ja r\u00fcnnaku edenemise logimiseks SYSVOL-is<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"R\u00fcnda nagu kuninganna: Varonis uurib kiiresti levivat lunavara \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKui teil on k\u00fcsimusi selle lunavara variandi kohta v\u00f5i mis tahes muude meie tiimide tehtud k\u00fcberkuritegevuse uurimiste kohta, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">v\u00f5tke meiega \u00fchendust <\/a><\/noindex> v\u00f5i taotlege <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">elavat r\u00fcnnakute reageerimise demonstratsiooni<\/a><\/noindex>, kus me vastame alati k\u00fcsimustele k\u00fcsimuste ja vastuste sessiooni raames.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Lunasta nagu kuninganna: Varonis uurib kiiresti levivat kr\u00fcpteerijat \"SaveTheQueen\" | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}