[GH-ISSUE #3632] 病毒和后门程序 Viruses and backdoors

gitea-mirror commented

2026-05-05 13:52:18 -06:00

Owner

Copy link

Originally created by @MyBirdVery6 on GitHub (Sep 27, 2023).
Original GitHub issue: https://github.com/fatedier/frp/issues/3632

Describe the feature request

我的电脑因为使用 frpc 中了一次勒索病毒，入侵者通过frpc侵入电脑(可能植入了木马），破解了系统登录密码，使用勒索病毒加密了我的电脑，导致所有有价值的文件全部被加密了，通过服务器的网络日志，可以判断是因为frpc的加密不够，在互联网侧暴露导致被利用引起的。同时，通过各种杀毒软件检测，frpc所有版本，包括最新版，都存在木马Trojan:Win32/Malgent!MTB，存在远程执行漏洞，希望作者能尽快修复这些安全漏洞。
My computer was hit by a ransomware virus because of the use of frpc. The intruder invaded the computer through frpc (maybe implanted a Trojan horse), cracked the system login password, and used the ransomware virus to encrypt my computer, causing all valuable files to be encrypted. Through the server's network log, it can be determined that the encryption of frpc is not enough and it is exposed on the Internet side and is exploited. At the same time, through various anti-virus software detection, all versions of frpc, including the latest version, have the Trojan Trojan:Win32/Malgent!MTB and remote execution vulnerabilities. I hope the author can fix these security vulnerabilities as soon as possible.

Describe alternatives you've considered

I hope the author can fix these security vulnerabilities as soon as possible.

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @MyBirdVery6 on GitHub (Sep 27, 2023). Original GitHub issue: https://github.com/fatedier/frp/issues/3632 ### Describe the feature request 我的电脑因为使用 frpc 中了一次勒索病毒，入侵者通过frpc侵入电脑(可能植入了木马），破解了系统登录密码，使用勒索病毒加密了我的电脑，导致所有有价值的文件全部被加密了，通过服务器的网络日志，可以判断是因为frpc的加密不够，在互联网侧暴露导致被利用引起的。同时，通过各种杀毒软件检测，frpc所有版本，包括最新版，都存在木马Trojan:Win32/Malgent!MTB，存在远程执行漏洞，希望作者能尽快修复这些安全漏洞。 My computer was hit by a ransomware virus because of the use of frpc. The intruder invaded the computer through frpc (maybe implanted a Trojan horse), cracked the system login password, and used the ransomware virus to encrypt my computer, causing all valuable files to be encrypted. Through the server's network log, it can be determined that the encryption of frpc is not enough and it is exposed on the Internet side and is exploited. At the same time, through various anti-virus software detection, all versions of frpc, including the latest version, have the Trojan Trojan:Win32/Malgent!MTB and remote execution vulnerabilities. I hope the author can fix these security vulnerabilities as soon as possible. ![勒索病毒](https://github.com/fatedier/frp/assets/50436093/aecb0ee2-153c-4fd7-b5d9-6544f404d431) ### Describe alternatives you've considered I hope the author can fix these security vulnerabilities as soon as possible. ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [X] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror closed this issue

2026-05-05 13:52:19 -06:00

gitea-mirror commented

2026-05-05 13:52:21 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Sep 27, 2023):

Duplicate https://github.com/fatedier/frp/issues/2095

@fatedier commented on GitHub (Sep 27, 2023): Duplicate https://github.com/fatedier/frp/issues/2095

gitea-mirror commented

2026-05-05 13:52:21 -06:00

Author

Owner

Copy link

@JoeyC-Dev commented on GitHub (May 17, 2025):

It looks like frp is specifically being detected/listed as a virus (based on the reason column), no matter how code is being changed.

Be real honest, I have seen frp is trying to be used in Kubernetes clusters, like concept "feature gate". But in cloud environment, our client will ask us why it is being detected as "virus" and will have many compliance issues if using frp.

Maybe good for on-site cluster. But usually something like trivy will be used, and we will face for compliance issues again.

In most cases, client will directly ask the operator team to remove it, or we need a very valid report for compliance issue.

I understand that the maintainers may not want to deal with this "virus" issue any more. But if this application is indeed planned to be designed for Kubernetes, it is still necessary to consider this issue. When it comes to Kubernetes, it is no longer a simple issue.

FYI: @fatedier

Sorry for excusing. I want to comment this as I see this application is planned to be used for Kubernetes.

@JoeyC-Dev commented on GitHub (May 17, 2025): It looks like frp is specifically being detected/listed as a virus (based on the reason column), no matter how code is being changed. ![Image](https://github.com/user-attachments/assets/6a6d18fe-cba4-4449-99ff-ab02615ab29a) Be real honest, I have seen frp is trying to be used in Kubernetes clusters, like concept "feature gate". But in cloud environment, our client will ask us why it is being detected as "virus" and will have many compliance issues if using frp. Maybe good for on-site cluster. But usually something like [trivy](https://github.com/aquasecurity/trivy) will be used, and we will face for compliance issues again. In most cases, client will directly ask the operator team to remove it, or we need a very valid report for compliance issue. I understand that the maintainers may not want to deal with this "virus" issue any more. But if this application is indeed planned to be designed for Kubernetes, it is still necessary to consider this issue. When it comes to Kubernetes, it is no longer a simple issue. FYI: @fatedier Sorry for excusing. I want to comment this as I see this application is planned to be used for Kubernetes.

gitea-mirror commented

2026-05-05 13:52:22 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (May 19, 2025):

@JoeyC-Dev

I understand that the maintainers may not want to deal with this "virus" issue any more.

Please refer to issue #2095.

@fatedier commented on GitHub (May 19, 2025): @JoeyC-Dev > I understand that the maintainers may not want to deal with this "virus" issue any more. Please refer to issue #2095.

No Branch/Tag specified