Malware, kter\u00fd naka\u017een\u00e1 za\u0159\u00edzen\u00ed do botnetu p\u0159ipojoval, byl poprv\u00e9 zaznamen\u00e1n ji\u017e v\u00a0roce 2003<\/a>\u00a0a dle dat spole\u010dnosti CrowdStrike, kter\u00e1 se na v\u00fd\u0161e zm\u00edn\u011bn\u00e9m z\u00e1sahu v\u00fdznamn\u011b pod\u00edlela<\/a>, zahrnoval botnet je\u0161t\u011b v\u00a0leto\u0161n\u00edm roce v\u00edce ne\u017e 33\u00a0tis\u00edc kompromitovan\u00fdch syst\u00e9m\u016f. Do operace p\u0159isp\u011bly vedle ji\u017e jmenovan\u00fdch stran i\u00a0organizace Shadowserver a policejn\u00ed org\u00e1ny z\u00a0Bulharska, Ma\u010farska a Rumunska.<\/p>\n K\u00a0mimo\u0159\u00e1dn\u011b dlouh\u00e9 \u017eivotnosti botnetu Sality p\u0159isp\u011bla zejm\u00e9na jeho P2P architektura, v\u00a0r\u00e1mci n\u00ed\u017e jednotliv\u00e9 boty komunikovaly p\u0159i \u0161\u00ed\u0159en\u00ed instrukc\u00ed provozovatel\u016f p\u0159\u00edmo mezi sebou, a s\u00ed\u0165 tak nem\u011bla \u017e\u00e1dn\u00fd centr\u00e1ln\u00ed C2 server, jeho\u017e odstaven\u00ed by ji vy\u0159adilo z\u00a0provozu. Pr\u00e1v\u011b P2P architektura botnetu se v\u0161ak nakonec stala jeho slabinou.<\/p>\n Vzhledem k\u00a0tomu, \u017ee jednotliv\u00e9 uzly v\u00a0P2P s\u00edti nijak neov\u011b\u0159ovaly identitu ostatn\u00edch \u00fa\u010dastn\u00edk\u016f komunikace, bylo mo\u017en\u00e9 do botnetu p\u0159ipojit i \u201efale\u0161n\u00e9\u201c uzly a s\u00a0jejich pomoc\u00ed do botnetu \u0161\u00ed\u0159it informace, kter\u00e9 vedly k\u00a0postupn\u00e9mu odstra\u0148ov\u00e1n\u00ed legitimn\u00edch bot\u016f ze seznam\u016f peer\u016f, kter\u00e9 si ka\u017ed\u00fd bot udr\u017eoval (resp. k\u00a0nahrazov\u00e1n\u00ed validn\u00edch peer\u016f tzv. \u201esinkholy\u201c).<\/p>\n V\u00a0d\u016fsledku v\u00fd\u0161e popsan\u00e9ho naru\u0161en\u00ed P2P komunikace provozovatele botnetu dle dostupn\u00fdch informac\u00ed zcela p\u0159i\u0161li o\u00a0mo\u017enost zas\u00edlat kompromitovan\u00fdm syst\u00e9m\u016fm nov\u00e9 instrukce a payloady. Zm\u00ednku nicm\u00e9n\u011b zaslou\u017e\u00ed, \u017ee samotn\u00e9 naru\u0161en\u00ed P2P komunikace neznamen\u00e1 odstran\u011bn\u00ed n\u00e1kazy z\u00a0kompromitovan\u00fdch za\u0159\u00edzen\u00ed. Napaden\u00e9 syst\u00e9my tedy i\u00a0nad\u00e1le z\u016fst\u00e1vaj\u00ed infikovan\u00e9, nicm\u00e9n\u011b vzhledem k\u00a0tomu, \u017ee nyn\u00ed komunikuj\u00ed pouze se \u201esinkhole\u201c infrastrukturou, \u0161kodliv\u00ed akt\u00e9\u0159i je ji\u017e nemohou vzd\u00e1len\u011b ovl\u00e1dat.<\/p>\n CISA publikovala doporu\u010den\u00ed pro efektivn\u00ed komunikaci (nejen) p\u0159i IT a OT incidentech<\/p>\n Americk\u00e1 agentura CISA spole\u010dn\u011b s\u00a0partnersk\u00fdmi bezpe\u010dnostn\u00edmi organizacemi ve st\u0159edu zve\u0159ejnila doporu\u010den\u00ed pro efektivn\u00ed komunikaci b\u011bhem incident\u016f<\/a> zasahuj\u00edc\u00edch informa\u010dn\u00ed a provozn\u00ed technologie a b\u011bhem souvisej\u00edc\u00edch v\u00fdpadk\u016f infrastruktury.<\/p>\n P\u0159esto\u017ee zmi\u0148ovan\u00fd dokument je ur\u010den p\u0159edev\u0161\u00edm poskytovatel\u016fm slu\u017eeb, jeho z\u00e1kladn\u00ed principy jsou pou\u017eiteln\u00e9 v\u00a0de facto libovoln\u00e9m typu organizac\u00ed. A\u010dkoli jde o\u00a0relativn\u011b obecn\u00fd materi\u00e1l, lze jej pova\u017eovat za potenci\u00e1ln\u011b zaj\u00edmav\u00fd n\u00e1vod i\u00a0pro \u010desk\u00e9 organizace, kter\u00e9 dosud nemaj\u00ed krizovou komunikaci detailn\u011bji form\u00e1ln\u011b zpracovanou a dokumentovanou.<\/p>\n Chyba v\u00a0Lenovo ID umo\u017e\u0148ovala z\u00edskat p\u0159\u00edstup k\u00a0\u00fa\u010dt\u016fm na platform\u011b Dropbox<\/p>\n Na zaj\u00edmav\u00fd p\u0159\u00edklad rizikov\u00e9 interakce, kter\u00e1 m\u016f\u017ee vzniknout mezi dv\u011bma jinak legitimn\u00edmi slu\u017ebami, upozornila v\u00a0uplynul\u00e9m t\u00fddnu odborn\u00e1 m\u00e9dia<\/a> v\u00a0n\u00e1vaznosti na varov\u00e1n\u00ed, kter\u00e9 spole\u010dnost Dropbox zaslala n\u011bkter\u00fdm u\u017eivatel\u016fm sv\u00e9 platformy.<\/p>\n Kv\u016fli chyb\u011b v\u00a0procesu ov\u011b\u0159ov\u00e1n\u00ed e-mailov\u00e9 adresy u\u00a0slu\u017eby Lenovo ID mohli toti\u017e \u0161kodliv\u00ed akt\u00e9\u0159i \u00fadajn\u011b vytvo\u0159it na t\u00e9to slu\u017eb\u011b \u00fa\u010det s\u00a0adresou ob\u011bti a n\u00e1sledn\u011b z\u00edskat p\u0159\u00edstup k\u00a0\u00fa\u010dtu na platform\u011b Dropbox veden\u00e9mu pod stejnou e-mailovou adresou, a to ani\u017e by znali odpov\u00eddaj\u00edc\u00ed heslo. V\u00fd\u0161e uveden\u00fd postup m\u011bl b\u00fdt umo\u017en\u011bn v\u00a0d\u016fsledku existence zastaral\u00e9ho, ale st\u00e1le funk\u010dn\u00edho integra\u010dn\u00edho mechanismu mezi Lenovo ID a Dropboxem.<\/p>\n Podle dostupn\u00fdch informac\u00ed<\/a> m\u011bli \u0161kodliv\u00ed akt\u00e9\u0159i popsan\u00fdm zp\u016fsobem mezi 4.\u00a0a 21.\u00a0srpnem z\u00edskat p\u0159\u00edstup k\u00a0p\u0159ibli\u017en\u011b p\u011bt tis\u00edc\u016fm \u00fa\u010dt\u016f na platform\u011b Dropbox. Po identifikaci kompromitace Dropbox zablokoval v\u0161echny relace autentizovan\u00e9 prost\u0159ednictv\u00edm Lenovo ID a doplnil po\u017eadavek na zad\u00e1n\u00ed hesla k\u00a0existuj\u00edc\u00edmu \u00fa\u010dtu Dropbox p\u0159i vyu\u017eit\u00ed tohoto zp\u016fsobu p\u0159ihl\u00e1\u0161en\u00ed.<\/p>\n Nightmare Eclipse zve\u0159ejnil exploity pro Kaspersky Endpoint Security a CrowdStrike\u00a0Falcon<\/p>\n V\u00fdzkumn\u00edk vystupuj\u00edc\u00ed pod pseudonymem Nightmare Eclipse, zn\u00e1m\u00fd zejm\u00e9na publikac\u00ed exploit\u016f pro zranitelnosti postihuj\u00edc\u00ed opera\u010dn\u00ed syst\u00e9my Windows<\/a>, zve\u0159ejnil v\u00a0z\u00e1v\u011bru p\u0159edminul\u00e9ho t\u00fddne (mimo jin\u00e9<\/a>) proof-of-concept exploit HardBreacher<\/a>, kter\u00fd m\u00e1 umo\u017e\u0148ovat lok\u00e1ln\u00ed eskalaci opr\u00e1vn\u011bn\u00ed s\u00a0pomoc\u00ed zranitelnosti v\u00a0n\u00e1stroji Kaspersky Endpoint Security pro Windows.<\/p>\n Spole\u010dnost Kaspersky ji\u017e \u00fadajn\u011b relevantn\u00ed zranitelnost ze jmenovan\u00e9ho produktu odstranila<\/a> a zajistila distribuci odpov\u00eddaj\u00edc\u00edch z\u00e1plat.<\/p>\n Ve \u010dtvrtek v\u00a0uplynul\u00e9m t\u00fddnu pak jmenovan\u00fd v\u00fdzkumn\u00edk na v\u00fd\u0161e uvedenou aktivitu nav\u00e1zal a publikoval\u00a0exploit pro obdobnou zranitelnost v\u00a0produktu CrowdStrike Falcon<\/a>, kter\u00fd nazval FalconFlank<\/a>.<\/p>\n Vzhledem k\u00a0tomu, \u017ee historicky byly vybran\u00e9 exploity od Nightmare Eclipse v\u00a0podstat\u011b okam\u017eit\u011b po publikaci vyu\u017e\u00edv\u00e1ny \u0161kodliv\u00fdmi akt\u00e9ry, lze organizac\u00edm, kter\u00e9 v\u00fd\u0161e zm\u00edn\u011bn\u00e9 n\u00e1stroje vyu\u017e\u00edvaj\u00ed, doporu\u010dit ov\u011b\u0159it, \u017ee relevantn\u00ed z\u00e1platy byly v\u00a0jejich prost\u0159ed\u00ed korektn\u011b aplikov\u00e1ny.<\/p>\n Nov\u00e9 AI modely relevantn\u00ed pro kybernetickou bezpe\u010dnost<\/p>\n Uplynul\u00fd t\u00fdden byl a\u017e nezvykle bohat\u00fd na novinky v\u00a0oblasti kybernetick\u00e9 bezpe\u010dnosti a AI. Google p\u0159edstavil model Gemini 3.8\u00a0Flash Cyber<\/a>, kter\u00fd m\u00e1 b\u00fdt prost\u0159ednictv\u00edm programu Fairwind zp\u0159\u00edstupn\u011bn d\u016fv\u011bryhodn\u00fdm bezpe\u010dnostn\u00edm organizac\u00edm, Anthropic uvedl modely Claude Fable 5.1\u00a0a Claude Mythos 5.1<\/a>\u00a0a OpenAI n\u00e1sledn\u011b vydalo model GPT-6\u00a0Astra.<\/p>\n Asi nejv\u011bt\u0161\u00ed pozornost odborn\u00e9 komunity<\/a> si p\u0159itom z\u00edskal pr\u00e1v\u011b posledn\u00ed zmi\u0148ovn\u00fd model Astra, kter\u00fd OpenAI jako prvn\u00ed ze sv\u00fdch model\u016f ozna\u010dilo jako \u201ekriticky\u201c schopn\u00fd v\u00a0oblasti kybernetick\u00e9 bezpe\u010dnosti<\/a>, neb m\u00e1 b\u00fdt schopn\u00fd bez pr\u016fb\u011b\u017en\u00e9ho lidsk\u00e9ho veden\u00ed a p\u0159i dostupnosti vhodn\u00fdch n\u00e1stroj\u016f s\u00e1m efektivn\u011b nal\u00e9zat zranitelnosti a vytv\u00e1\u0159et exploity pro jejich vyu\u017eit\u00ed i\u00a0u\u00a0dob\u0159e zabezpe\u010den\u00fdch syst\u00e9m\u016f.<\/p>\n Je v\u0161ak vhodn\u00e9 zd\u016fraznit, \u017ee v\u00fd\u0161e uveden\u00e9 hodnocen\u00ed schopnost\u00ed modelu poch\u00e1z\u00ed od samotn\u00e9 spole\u010dnosti OpenAI a nikoli od objektivn\u00ed t\u0159et\u00ed strany.<\/p>\n T\u00e9m\u011b\u0159 22\u00a0tis\u00edc on-premise Exchange server\u016f z\u0159ejm\u011b st\u00e1le obsahuje nez\u00e1platovanou zranitelnost CVE-2026\u201362911<\/p>\n Organizace Shadowserver v\u00a0\u00fater\u00fd upozornila<\/a>, \u017ee v\u00a0r\u00e1mci sv\u00fdch sken\u016f identifikovala 21\u00a0899\u00a0ve\u0159ejn\u011b dostupn\u00fdch IP adres, na nich\u017e z\u0159ejm\u011b b\u011b\u017e\u00ed Microsoft Exchange Servery bez aplikovan\u00e9 z\u00e1platy na zranitelnost CVE-2026\u201362911. Tuto z\u00e1platu Microsoft publikoval v\u00a0r\u00e1mci srpnov\u00e9ho Patch Tuesday<\/a>.<\/p>\n Celkem\u00a0496 zraniteln\u00fdch server\u016f bylo p\u0159itom nalezeno v\u00a0prost\u0159ed\u00ed \u010cesk\u00e9 republiky<\/a>. Je v\u0161ak vhodn\u00e9 uv\u00e9st, \u017ee v\u00fd\u0161e uveden\u00e9 po\u010dty mohou b\u00fdt nep\u0159esn\u00e9, neb skeny realizovan\u00e9 ze strany Shadowserveru zpravidla vych\u00e1z\u00ed jen z\u00a0identifikace verz\u00ed slu\u017eeb b\u011b\u017e\u00edc\u00edch na serverech, nikoli z\u00a0aktivn\u00edch pokus\u016f o\u00a0potvrzen\u00ed zranitelnosti u\u00a0ka\u017ed\u00e9 jednotliv\u00e9 instalace.<\/p>\n Zmi\u0148ovan\u00e1 zranitelnost je typu \u201eauthentication bypass by capture-replay\u201c a p\u0159i \u0159et\u011bzen\u00ed s\u00a0dal\u0161\u00edmi zn\u00e1m\u00fdmi zranitelnostmi<\/a> ji lze vyu\u017e\u00edt i\u00a0pro vzd\u00e1len\u00e9 spou\u0161t\u011bn\u00ed k\u00f3du na zraniteln\u00e9m syst\u00e9mu.<\/p>\n Vzhledem k\u00a0tomu, \u017ee pro CVE-2026\u201362911 je \u00fadajn\u011b ji\u017e dostupn\u00fd PoC k\u00f3d<\/a>, lze tak vlastn\u00edk\u016fm posti\u017een\u00fdch syst\u00e9m\u016f doporu\u010dit odpov\u00eddaj\u00edc\u00ed z\u00e1platu urychlen\u011b aplikovat.<\/p>\n Dal\u0161\u00ed zaj\u00edmavosti<\/p>\n Pro pobaven\u00ed<\/p>\n There’s\u00a0also a unicode-handling bug in the URL request library, and we’re storing the passwords unsalted \u2026 so if we salt them with emoji, we can close three issues at\u00a0once!<\/p>\n O seri\u00e1lu<\/p>\n Tento seri\u00e1l vych\u00e1z\u00ed st\u0159\u00eddav\u011b za pomoci pracovn\u00edk\u016f N\u00e1rodn\u00edho bezpe\u010dnostn\u00edho t\u00fdmu CSIRT.CZ<\/a> provozovan\u00e9ho sdru\u017een\u00edm CZ.NIC<\/a> a bezpe\u010dnostn\u00edho t\u00fdmu CESNET-CERTS<\/a> sdru\u017een\u00ed CESNET<\/a>, bezpe\u010dnostn\u00edho t\u00fdmu CDT-CERT provozovan\u00e9ho spole\u010dnost\u00ed \u010cD – Telematika a bezpe\u010dnostn\u00edch specialist\u016f Jana Kop\u0159ivy ze spole\u010dnosti Nettles Consulting a Moniky Kut\u011bjov\u00e9 ze sdru\u017een\u00ed TheCyberValkyries. V\u00edce o seri\u00e1lu\u2026<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Z\u00e1sah proti v\u00edce ne\u017e 20\u00a0let existuj\u00edc\u00edmu botnetu Sality Europol spolu s\u00a0ministerstvem spravedlnosti Spojen\u00fdch st\u00e1t\u016f v\u00a0\u00fater\u00fd ozn\u00e1mil zavr\u0161en\u00ed \u00fasp\u011b\u0161n\u00e9…\n","protected":false},"author":2,"featured_media":205892,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[13],"tags":[74,73,78,75,77,76],"class_list":["post-205891","post","type-post","status-publish","format-standard","has-post-thumbnail","category-veda-a-technika","tag-science","tag-science-technology","tag-technika","tag-technology","tag-veda","tag-veda-a-technika"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@cz\/117230273564286066","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/posts\/205891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/comments?post=205891"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/posts\/205891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/media\/205892"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/media?parent=205891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/categories?post=205891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/cz\/wp-json\/wp\/v2\/tags?post=205891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\u0160kolen\u00ed](\"https:\/\/www.europesays.com\/cz\/wp-content\/uploads\/2026\/09\/1788791893_500_kubernetes-skoleni.png\"\/)
<\/a><\/p>\n![\"new-bug-prev\"](\"https:\/\/www.europesays.com\/cz\/wp-content\/uploads\/2026\/09\/new-bug-prev.png\")
<\/p>\n