* [Blog](https://www.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/) * [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant) * 最新安全威胁评估报告... # 最新安全威胁评估报告 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2020%2F06%2Fthreat-assessment-hangover-threat-group%2F%3Flang%3Dzh-hans) [](https://twitter.com/share?text=%E6%9C%80%E6%96%B0%E5%AE%89%E5%85%A8%E5%A8%81%E8%83%81%E8%AF%84%E4%BC%B0%E6%8A%A5%E5%91%8A&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2020%2F06%2Fthreat-assessment-hangover-threat-group%2F%3Flang%3Dzh-hans) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2020%2F06%2Fthreat-assessment-hangover-threat-group%2F%3Flang%3Dzh-hans&title=%E6%9C%80%E6%96%B0%E5%AE%89%E5%85%A8%E5%A8%81%E8%83%81%E8%AF%84%E4%BC%B0%E6%8A%A5%E5%91%8A&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/2020/06/threat-assessment-hangover-threat-group/?lang=zh-hans&ts=markdown) [](mailto:?subject=最新安全威胁评估报告) Link copied By [Unit 42](https://www.paloaltonetworks.com/blog/author/unit-42/?lang=zh-hans&ts=markdown "Posts by Unit 42") Jun 07, 2020 1 minutes [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/06/Threat-brief-r3d3.png) Palo Alto Networks（派拓网络）威胁情报团队Unit 42的研究人员[最近公布](https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/)了Hangover威胁组织（又名Neon、Viceroy Tiger、MONSOON）的活动情况。该组织在南亚地区针对政府和军事组织进行BackConfig恶意软件攻击。因此，我们为Hangover组织的活动制作了这份威胁评估报告，相关技术和攻击活动可通过访问[Unit 42 Playbook Viewer](https://urldefense.proofpoint.com/v2/url?u=https-3A__pan-2Dunit42.github.io_playbook-5Fviewer_-3Fpb-3Dhangover&d=DwMFoQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=rlV3QLKXfVd47fRPwA7WrCCSjqFsgIzvhSPB3-jJ4YQ&m=Xv8_B8OGczyvHmuUYeNWEUwU34nrWZZZKWmiUeF45Yk&s=ODEaZUDDNWGS5odQGdDBW9L2evUW8yXWqF0QMktrZoA&e=)进一步了解。 Hangover组织是一个网络间谍组织，2013年12月首次被发现针对挪威一家电信公司进行网络攻击。网络安全公司Norman[报道](https://urldefense.proofpoint.com/v2/url?u=https-3A__web.archive.org_web_20170825010151_http-3A_enterprise-2Dmanage.norman.c.bitbit.net_resources_files_Unveiling-5Fan-5FIndian-5FCyberattack-5FInfrastructure.pdf&d=DwMFoQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=rlV3QLKXfVd47fRPwA7WrCCSjqFsgIzvhSPB3-jJ4YQ&m=Xv8_B8OGczyvHmuUYeNWEUwU34nrWZZZKWmiUeF45Yk&s=okD06RAh_PCOvvFPYjLwOHmuAEt9OStupH2dwBTY49g&e=)称，网络攻击是在印度出现的，该组织寻找并对巴基斯坦和中国等国家利益目标进行攻击。不过，也有迹象表明美国和欧洲同样存在Hangover组织的活动，主要针对政府、军方和民间组织。Hangover组织最初的入侵载体是进行鱼叉式钓鱼攻击活动，利用来自南亚本地和热点新闻诱使受害者更容易落入他们的社会工程技术陷阱，下载并执行带有攻击性的微软Office文档。当用户执行这种攻击性文档后，BackConfig和攻击者之间就建立了后门通信，开始进行间谍活动，有可能从被入侵的系统中泄露敏感数据。 整合[WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire?ts=markdown)、[DNS Security](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/dns-security?ts=markdown)以及[Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)产品的Palo Alto Networks（派拓网络）[威胁防御](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention?ts=markdown)平台可以检测到与该威胁组织相关的活动。Palo Alto Networks（派拓网络）客户还可以使用AutoFocus以及[Hangover](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Hangover)、[BackConfig](https://autofocus.paloaltonetworks.com/#/tag/Unit42.BackConfig)标签查看与此威胁评估相关的活动。 **结论** 根据Unit 42的研究发现，Hangover组织很活跃，正在针对南亚地区的政府和军事组织发起攻击。该组织继续使用被入侵的第三方基础设施，通过包含网络钓鱼链接的鱼叉式攻击邮件，为传送攻击性文档提供支持。 随着时间的推移，传送的文档也在不断发展演变，已从纯文本代码和URL转为编码格式。 从在文档中存储已编码的可执行文件到使用ZIP文件（包括打包文件），到最后从命令和控制服务器下载可执行文件。 安装传送文档中的BackConfig恶意软件是通过多阶段和多组件执行的，这很可能会逃避沙箱或其他自动分析和检测系统的监测。 包括使用基于虚拟化的安全（VBS）和批处理代码，计划的任务以及条件触发文件等等。 一旦完全安装，BackConfig恶意软件就会使用HTTPS与网络犯罪分子进行通信，这会很难发现并检测到，且会混合在其他类似流量中。 一旦受感染的系统处于犯罪分子控制之下，其目标就会因部署的插件、被入侵的系统或组织的类型而发生变化。 有关威胁影响的评估以及建议采取的措施，请详细阅读本次[威胁评估报告全文](https://unit42.paloaltonetworks.com/threat-assessment-hangover-threat-group/) ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/04/QR-Code-WechatIMG1252.jpeg) 敬请关注Palo Alto Networks（派拓网络）官方微信账号 *** ** * ** *** ## Related Blogs ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### AI代理已經來臨，威脅也隨之而來](https://www.paloaltonetworks.com/blog/2025/05/ai-agents-threats/?lang=zh-hant) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Strata Copilot - 加速迈向自主网络安全的未来](https://www.paloaltonetworks.com/blog/network-security/strata-copilot/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 防火墙已死？至少本世纪不会！](https://www.paloaltonetworks.com/blog/2023/08/ngfw-is-not-dead-yet/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 面对性命攸关的时刻，如何实现可靠的医疗物联网安全](https://www.paloaltonetworks.com/blog/2022/12/medical-iot-security-to-depend-on/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 利用业界首创的 AIOps for NGFW 革新防火墙运行](https://www.paloaltonetworks.com/blog/2022/03/industry-first-aiops-for-ngfw/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Prisma Access 是保护远程用户安全的领先云服务](https://www.paloaltonetworks.com/blog/2021/08/prisma-access-leading-cloud-service-secure-remote-users/?lang=zh-hans) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language