概述

本文对一起疑似朝鲜（DPRK）APT 组织 Kimsuky 发起的定向网络钓鱼攻击进行深度技术分析。攻击者以韩国陆军官方会议为诱饵，通过 LNK 捷径触发多阶段恶意链路，最终使用 Chrome Remote Desktop 实现隐蔽的长期远程控制。

一、引言

在异地组网和内网穿透的实践中，大多数技术人员通常会经历两个阶段的痛点。

为什么要写博客？

个人品牌建立

博客和开源项目是你在这个数字世界里的“数字资产”，它们会比任何面试表现都更持久地为你背书。传统的找工作是 Push（推）模式：你把简历投出去，祈祷 HR 在 3 秒内看到亮点。 建立博客是 Pull（拉）模式：你通过输出价值，让机会主动找上门。降低招聘方的“搜索成本”： 猎头或技术大牛在 Github 或 Google 搜索相关技术关键词时，如果你的项目或博客排在前列，你在公网留下了足够的 技术足迹。他们会认为你是该领域的专家，那个时候不是你在找工作而是工作找你。

Abstract: The history of computer science is a history of constant abstraction. But the next decade will be a history of “reverse collapse”. We are witnessing the grandest “garbage collection” project in modern commercial society — those once costly human intermediate layers will be completely eliminated. Welcome to the era of “function inlining”.

This article was generated by Gemini.

I. The Collapsing Tower of Babel: The End of Infinite Nesting

If we examine the current software engineering industry, or even the entire modern commercial society, from the perspective of computer science, we will find that its essence is an extremely inefficient “infinitely nested function call” system.

This part is visible to everyone. You can read the introduction here.

one

two

1
2

int main()
print()

Enter

PGg5a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3zIGNsYXNzPSJoZWFkaW5nLWVsZW1lbnQiIGlkPSJob3ctdG8tYWRkLWNoZWNrcyI+PHNwYW4+SG93IHRvIGFkZCBjaGVja3M8L3NwYW4+DQogIDxhIGhyZWY9IiNob3ctdG8tYWRkLWNoZWNrcyIgY2xhc3M9ImhlYWRpbmctbWFyayI+DQogICAgPHN2ZyBjbGFzcz0ib2N0aWNvbiBvY3RpY29uLWxpbmsiIHZpZXdCb3g9IjAgMCAxNiAxNiIgdmVyc2lvbj0iMS4xIiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIGFyaWEtaGlkZGVuPSJ0cnVlIj48cGF0aCBkPSJtNy43NzUgMy4yNzUgMS4yNS0xLjI1YTMuNSAzLjUgMCAxIDEgNC45NSA0Ljk1bC0yLjUgMi41YTMuNSAzLjUgMCAwIDEtNC45NSAwIC43NTEuNzUxIDAgMCAxIC4wMTgtMS4wNDIuNzUxLjc1MSAwIDAgMSAxLjA0Mi0uMDE4IDEuOTk4IDEuOTk4IDAgMCAwIDIuODMgMGwyLjUtMi41YTIuMDAyIDIuMDAyIDAgMCAwLTIuODMtMi44M2wtMS4yNSAxLjI1YS43NTEuNzUxIDAgMCAxLTEuMDQyLS4wMTguNzUxLjc1MSAwIDAgMS0uMDE4LTEuMDQyWm0tNC42OSA5LjY0YTEuOTk4IDEuOTk4IDAgMCAwIDIuODMgMGwxLjI1LTEuMjVhLjc1MS43NTEgMCAwIDEgMS4wNDIuMDE4Ljc1MS43NTEgMCAwIDEgLjAxOCAxLjA0MmwtMS4yNSAxLjI1YTMuNSAzLjUgMCAxIDEtNC45NS00Ljk1bDIuNS0yLjVhMy41IDMuNSAwIDAgMSA0Ljk1IDAgLjc1MS43NTEgMCAwIDEtLjAxOCAxLjA0Mi43NTEuNzUxIDAgMCAxLTEuMDQyLjAxOCAxLjk5OCAxLjk5OCAwIDAgMC0yLjgzIDBsLTIuNSAyLjVhMS45OTggMS45OTggMCAwIDAgMCAyLjgzWiI+PC9wYXRoPjwvc3ZnPg0KICA8L2E+DQo8L2gzPjxwPlRoaXMgY29udGVudCBpcyBub3cgaGlkZGVuIGFuZCByZXF1aXJlcyBhIHBhc3N3b3JkLjwvcD4KPHA+WW91IGNhbiBhZGQgY2F0ZWdvcmllcyBhbmQgdGFncyBpbiB0aGUgZnJvbnQgbWF0dGVyIGFib3ZlLjwvcD4K