2019 BOTNET趋势报告 Botnet Trend Report i g u th 5 b m o .c 关于绿盟科技 北京神州绿盟信息安全科技股份有限公司（以下简称绿盟科技公司），成立于 2000 年 4 月， 总部位于北京。公司于 2014 年 1 月 29 日在深圳证券交易所创业板上市，证券代码：300369。 绿盟科技在国内设有 40 多个分支机构，为政府、运营商、金融、能源、互联网以及教育、医疗 等行业用户，提供全线网络安全产品、全方位安全解决方案和体系化安全运营服务。公司在美国 硅谷、日本东京、英国伦敦、新加坡设立海外子公司，深入开展全球业务，打造全球网络安全行 业的中国品牌。 u th i g 版权声明 5 b 为避免合作伙伴及客户数据泄露，所有数据在进行分析前都已经过匿名化处理，不会在中 间环节出现泄露，任何与客户有关的具体信息，均不会出现在本报告中。 m o .c 2019 Botnet 趋势报告 目录 执行摘要 ···································································································································································C 关于绿盟科技伏影实验室································································································································································· 3 关于绿盟威胁中心 NTI ····································································································································································· 3 1. 2019 Botnet 安全事件概览 ··································································································································4 2. 2019 Botnet 威胁趋势分析 ··································································································································6 m o .c 2.1 Botnet 恶意软件趋势总览·························································································································································· 8 2.1.1 平台 ·············································································································································································································· 8 2.1.2 开发语言 ······································································································································································································ 9 2.1.3 文件类型 ····································································································································································································10 5 b 2.1.4 小结 ············································································································································································································10 2.2 入侵与传播方式分析 ································································································································································ 10 2.2.1 弱口令 ········································································································································································································11 u th 2.2.2 漏洞利用 ····································································································································································································12 2.2.3 鱼叉攻击 / 恶意文档 ················································································································································································18 2.2.4 小结 ············································································································································································································21 i g 2.3 持续性威胁分析 ········································································································································································ 21 2.3.1 DDoS 木马（DDoS Trojan） ···································································································································································22 2.3.2 勒索软件（Ransomeware） ··································································································································································34 2.3.3 挖矿木马（Crypto Mining Malware） ···················································································································································42 2.3.4 银行木马（Banker）················································································································································································46 2.3.5 广告捆绑与推广软件（Adware） ··························································································································································52 2.3.6 持续性威胁分析小结·····