Staying ahead of emerging threats is paramount. At TeamT5, our dedicated analysts work tirelessly to research and translate findings into comprehensive threat intelligence reports. However, there are instances where traditional reports are not what customers are looking for. This is where Raw Intel comes in, offering invaluable real-time insights for cyber threat analysts.

Raw Intel serves as a crucial tool in our arsenal, providing users with detailed information gleaned from ongoing research efforts. When conducting searches on [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), users may encounter Raw Intel objects associated with specific IP addresses, domains, or hashes. These objects represent a snapshot of our analysts' research within a certain timeframe, offering insights into targeted industries, employed malware, and adversary profiles.

Please note that Raw Intel is the preliminary results of TeamT5’s latest research. If you need further investigation and analysis to obtain the most accurate information, please [contact us]((https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website).

![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)

 

Raw Intel empowers [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) customers with three major advantages:

## Real-Time Response Capability
In the ever-evolving landscape of cyber threats, timing is critical. Threat intelligence reports, while valuable, may entail a delay due to human review processes. Raw Intel bridges this gap, empowering organizations to self-identify threats in near real-time. By leveraging Raw Intel, threat analysts can proactively respond to emerging threats, minimizing the risk of being caught off guard during attacks.

## Granular Threat Visibility
Raw Intel offers a granular view of potential threats, equipping security teams with detailed information about malicious IP addresses and samples. This level of insight enables precision in threat identification, facilitating the development of targeted defense strategies. With Raw Intel, organizations can mitigate the risk of false positives and enhance overall cybersecurity posture.

In conclusion, Raw Intel serves as a cornerstone in modern cyber threat analysis, offering real-time insights and granular visibility into emerging threats. By leveraging this invaluable resource, organizations can bolster their defenses and stay one step ahead in the ongoing battle against cyber adversaries.

## Access to Intel Regardless of Subscribed Items
Since ThreatVision’s Raw Intel is not dependent on the user being subscribed to any particular report, users are able to easily access snippets of intelligence that are important to them and their investigation even if they are not subscribed to the particular report that the intel is from.

 

>Learn more about how Raw Intel can help your organization by [contacting us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) today!

 
 
*image courtesy: Pixabay

Raw Intel’s Role in Modern Cyber Threat Intelligence

掌握先機對於應對新興威脅至關重要。在 TeamT5，我們的專業分析師努力不懈地進行研究，並將發現轉化為全面的威脅情資報告。然而，有時傳統報告並不見得符合客戶所需。此時就是原始情資（Raw Intel）發揮功能之際，為網路威脅分析師提供寶貴的及時見解。

原始情資是我們軍火庫中的一個關鍵工具，將持續進行的研究工作中所獲得的詳細資訊，提供給使用者。當使用者在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 上進行搜尋時，用戶可能會遇到與特定 IP 地址、域名或雜湊相關的原始情資標的。這些標的代表我們分析師在特定時間範圍內的研究概要，提供有關目標產業、使用的惡意軟體和攻擊族群檔案的見解。

![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)

 

提醒您，原始情資是 TeamT5 最新研究的初步結果。如果您需要進一步的調查和分析以獲得最準確的資訊，請[與我們聯繫]((https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) 。

原始情資為 ThreatVision 客戶提供了三個主要優勢：
## 及時應變能力
在網路威脅不斷演變的情況下，時機至關重要。儘管威脅情資報告很有價值，但由於人工審查流程需要時間，可能會有延遲。原始情資彌補了這一差距，使組織能夠近乎及時地自我識別威脅。透過利用原始情資，威脅分析師可以主動應對新興威脅，最大程度地減少在攻擊中措手不及的風險。

## 細化威脅的能見度
原始情資提供了對潛在威脅的細節化視角，為安全團隊提供了有關惡意 IP 地址和樣本的詳細資訊。這種洞察水準使威脅識別更加精準，有助於制定針對性的防禦策略。憑藉原始情資，組織可以降低誤報風險，增強整體網絡安全性。

## 無論訂閱的項目為何，都能獲得原始情資
不論訂閱項目為何，使用者都能輕鬆取得對他們重要的情資片段。即使未訂閱該情資來源的特定報告，也能對他們的調查有所幫助。

簡言之，原始情資在現代網路威脅分析中扮演著重要角色，提供及時見解和新興威脅的細節的能見度。透過利用這一寶貴資源，組織可以加強其防禦措施，在持續與網路威脅族群作戰中，保持領先地位。

 

>現在就[聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)，了解更多原始情資如何助您的組織一臂之力！

*首圖來源: Pixabay

原始情資（Raw Intel）在現今網路威脅情資中所扮演的角色為何？ 

Threat Intelligence

In the dynamic landscape of cybersecurity, enterprises face persistent and evolving threats that can compromise their systems and sensitive data. Compromise assessment and threat hunting play a crucial role in fortifying an enterprise's security posture. Here are five compelling reasons why these practices are essential:

### 1. Identify vulnerabilities: Enhancing Security Posture

Intrusion assessments assist organizations in identifying potential vulnerabilities in their systems. By identifying vulnerabilities in enterprise systems that may be exploited by attackers and taking further measures to repair these vulnerabilities, the overall security defense and resilience of the enterprise can be strengthened.

### 2. Protect Sensitive Data: Safeguarding Customer and Employee Information

One of the primary goals of intrusion assessment is to protect sensitive information. Whether it refers to customer data, employee details or business data, threat hunting helps prevent cybercriminals from stealing this sensitive information.

### 3. Ensure Compliance: Meeting Regulatory Requirements

In some industries, such as healthcare and finance, strict regulations require companies to conduct regular intrusion assessments to ensure compliance requirements are met.

Regular assessments using threat hunting tools not only ensure your company is compliant, but also build a complete cybersecurity strategy and resilience.

### 4. Improving Incident Response: Critical in the Face of Cyber Attacks

Compromise assessments contribute significantly to the development and improvement of incident response plans. In the event of a cyberattack, having a well-structured response plan is critical. Identifying compromises early on allows enterprises to refine and implement effective incident response strategies promptly.

### 5. Building Trust with Clients and Stakeholders: Demonstrating Proactive Security Measures

By conducting intrusion assessment and threat hunting, enterprises can send a positive message to customers and stakeholders, showing that the enterprise is actively taking measures to protect its systems and data, and build trust and confidence.

## Conclusion 

Compromise assessment and threat hunting are not just reactive measures but proactive strategies that enterprises must embrace in the face of evolving cyber threats. By identifying vulnerabilities, protecting sensitive data, ensuring compliance, improving incident response, and building trust, these practices become essential components of a comprehensive cybersecurity strategy. In a digital era where threats are constant, enterprises that prioritize these assessments are better equipped to navigate the complexities of the cyber landscape and safeguard their digital assets.

 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/request-information/


 

*Picture source: pixabay

5 Benefits of Threat Hunting Strategies for Enterprises

在千變萬化的網路與資訊安全環境中，企業面臨持續且不斷變化的威脅，這些威脅可能會損害其系統和敏感資料。入侵評估（compromise assessment ）和威脅狩獵（threat hunting）在加強企業的資安防禦方面，發揮著至關重要的作用。 

以下是企業採納威脅狩獵策略的 5 個好處：

### 1. 識別漏洞：增強資安韌性

入侵評估可協助企業識別其系統中的潛在漏洞。 藉由找出企業系統內可能被攻擊者利用的漏洞，並進一步採取措施、修復這些漏洞，方能加強企業整體安全防禦與韌性。

### 2. 保護敏感資料：保護客戶和員工資訊

入侵評估的主要目標之一是保護敏感資料。無論是客戶資訊、員工詳細資訊或商業數據等機敏資訊，威脅狩獵都有助於防止網路犯罪分子竊取此類關鍵資訊。

### 3. 確保遵循法規：滿足監管要求

在某些產業，例如醫療保健和金融，嚴格的法規要求企業定期進行入侵評估，以確保滿足合規性要求。 
使用威脅狩獵工具進行定期評估，不僅可以確保公司合規，還可以建立完整的資訊安全策略與韌性。

### 4. 優化資安事件應變：面對網路攻擊至關重要

入侵評估對事件應變計畫的制定和改進，扮演關鍵角色。 如果發生網路攻擊，制定良好嚴謹的應變計畫十分重要。 及早識別危害使企業能夠及時改善和實施有效的資安事件應變策略。

### 5. 與客戶和利害關係人建立信任：展示積極主動的安全措施

進行入侵評估和威脅狩獵，企業能向客戶和利害關係人發出了正向的訊息，顯示企業積極採取措施保護其系統和數據，建立信任與信心。

## 結論

入侵評估和威脅狩獵不僅僅是應變措施，也是企業面對不斷變化的網路威脅時必須採取的主動策略。 透過識別漏洞、保護敏感資料、確保遵循法規、改進資安事件應變和建立信任，這些是企業建立全面、完整的資訊安全策略之重要組成環節。 

在威脅不斷、攻擊不止的數位時代，優先考慮入侵評估和威脅狩獵作法的企業，能夠更好地應對複雜的網路環境並保護其數位資產。

 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/request-information/


 
 
*圖片來源: Pixabay

企業採納威脅狩獵策略的 5 個好處

Products & Services

The following blog post is based on our Jan H1 Vulnerability Insights Report. TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. [Contact us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information about our vulnerability intelligence.


## Alerts of Exploiting Adobe ColdFusion

TeamT5 released mitigation and response guidelines to CVE-2023-29300 in Adobe ColdFusion. CVE-2023-29300 is a JAVA deserialization vulnerability resulting in arbitrary code execution. Adobe ColdFusion is a commercial rapid web-application development computing platform. Unauthorized threat actors can exploit CVE-2023-29300 and deploy webshell to target's devices and establish persistence. 

### Executive Summary

We assess the severity level of CVE-2023-29300 is critical and urge our customers to use this report to mitigate the effects. First, Adobe ColdFusion is widely used by large companies and organizations, with more than 3000 devices in Japan. Even worse, our investigation revealed that at least 66 Adobe ColdFusion devices in Japan has been compromised. The victims are across different sectors, including healthcare, education, and manufacturing industry. Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-29300 has been circulating in the wild. Public reports also provide the root cause analysis on CVE-2023-29300.[1]

Threat actors, including cybercriminals and state-sponsored APT groups, has been actively exploiting CVE-2023-29300 in the attacks. Specifically, we have detected that threat actors exploited CVE-2023-29300 to deploy webshells such as Behinder. Aligned with our observation, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-29300 to known exploited vulnerabilities catalog on January 8, 2024.[2] We summarized the activities in the **Exploitation Status** subsection. 

Based on the exploitation status, we depicted the **Possible Attack Scenario** in this report. We also concluded the malware and IOCs in **Appendix II: Malware and Appendix III: Indicators of Compromise (IoC)**, respectively. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Open-source nuclei-based vulnerability scanner
- Threat Hunting Tools, including a SIGMA rule and a nuclei-based webshell scanner.
 - SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process via malicious webshell.
 - Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

### Exploitation Status

CVE-2023-29300 has been actively exploited by threat actors, including cybercriminals and state-sponsored threat actors. We concluded all the related C2 in the report IoC.[3]

- Cybercriminals have exploited CVE-2023-29300 to deploy webshell in attacks. We have detected attacks against healthcare entities and Thai real estate entities.
- China-nexus APT group SLIME13 (as known as Flax Typhoon) exploited CVE-2023-29300 in the attacks.
- Notably, Chinese actors exploited CVE-2023-29300[4] in the 2023 HuWang Operation, China’s state-led penetration testing for enterprises.[5] Previously, China-nexus APT groups such as Amoeba, SLIME28, and SLIME37 have joined the HuWang Operation.



### Affected Products

ColdFusion 2018 (Update 16 and earlier versions)
 
ColdFusion 2021 (Update 6 and earlier versions)
 
ColdFusion 2023 GA Release (2023.0.0.330468)

### Mitigation and Response Advisory

#### 1. Official Patch Information

Adobe has released the official patches for CVE-2023-29300. 
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

#### 2. Open-source Nuclei-based Vulnerability Scanner

Our customers can leverage the open-source nuclei-based vulnerability scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

#### 3. Threat Hunting Tools

Cybercriminals and state-sponsored threat actors have already actively exploited CVE-2023-29300. TeamT5 vulnerability intelligence team prepared a SIGMA rule and a nuclei-based webshell scanner for our customers to detect potential threats. 

The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) includes:

- SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process
- Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

<figure>

![pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png](https://uploads.teamt5.org/upload/original/pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png)

<figcaption> The Nuclei-based webshell scanner
</figcaption>
</figure> 
 
Our customers can download all tools from the **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

## Possible Attack Scenario

Threat actors have to first abuse the unauthenticated ColdFusion Component (CFC) endpoint to exploit CVE-2023-29300. Public proof of concepts has exposed a ColdFusion Component endpoint `/CFIDE/adminapi/accessmanager.cfc` that also been exploited in the wild. Our customers can check if your ColdFusion Component endpoint has been attacked with following IIS log. 

`C:\inetpub\logs\LogFiles\W3SVC1\u_ex240112.log:2024-01-12 08:12:12 172.17.0.1 POST /CFIDE/adminapi/accessmanager.cfc _cfclient=true&method=foo 443 - 172.17.0.2 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_10_1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/37.0.2062.124+Safari/537.36 - 404 0 2 1466`

Our customers can also leverage the open-source nuclei-based webshell scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

CVE-2023-29300 is a deserialization vulnerability originated from the Web Distributed Data eXchange (WDDX) library. Once exploited, the vulnerability will allows the threat actors to load the payload via JNDI injection, connecting to the C2 and execute arbitrary codes.

The threat actors can deploy webshell to ColdFusion after successfully exploited CVE-2023-29300. With such webshell exists, the threat actors can still access ColdFusion Component even after patching the vulnerability. Our analysis found that more than 1% of the ColdFusion Components in Japan has been compromised. The webshells contains following malicious URI:
- COLDFUSION_SERVER/cf_scripts/config.cfm
- COLDFUSION_SERVER/cf_scripts/123.cfm
- COLDFUSION_SERVER/cf_scripts/system.cfm
- COLDFUSION_SERVER/cf_scripts/classes/GetVars.cfm
- COLDFUSION_SERVER/cf_scripts/classes/ckeditor.cfm

Based on the research, we provide a nuclei-based webshell scanner and a SIGMA rule for our customers to check if your ColdFusion Component endpoint has been compromised, and the nuclei-based webshell scanner can identify implanted webshells as follows. Our customers can download the tools from The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

Notably, we also detected that Chinese threat actors developed webshell designed for ColdFusion Markup, PowerShell[5]. PowerShell will download the second stage webshell from C2 `http://113.141.91.61:63211/11.aspx`. The second-stage webshell is Behinder[6], a famous open-source webshell in Chinese threat actors.

### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Behinder</td>
 <td>Webshell</td>
 <td>Behinder is a webshell developed by Chinese actor. It has different platform versions, such as PHP, ASP and JSP. Behinder loads an AES-encrypted binary payload which is difficult to detect by general firewall.</td>
 <td>Open-source</td>
 <td>2020.06</td>
 </tr>
</table>
 
### Appendix II: Indicators of Compromise (IoC)

**SHA-256**
 
```
hash= webshell
cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52
d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

```

```c2-IP= IP
113.141.91.61
```

### Appendix III: Other critical CVEs

TeamT5 also provides analysis of other caitical CVEs in **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please [contact TeamT5](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information.

 
 

[1] https://blog.projectdiscovery.io/adobe-coldfusion-rce/

[2] https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog

[3] https://github.com/gobysec/Research/blob/main/Adobe_Coldfusion_remote_code_execution_vulnerability_Analysis_(CVE-2023-38204)_zh_CN.md

[4] The HuWang Operation is China’s state-led penetration testing or red teaming operation for state-owned enterprises and critical information infrastructure (CII) operators, hosted by the Ministry of Public Security every summer. We have previously discovered that several APT groups such as Amoeba, SLIME28, and SLIME37 have joined China’s HuWang Operation.

[5] SHA-256: cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52

[6] d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

CVE-2023-29300: Adobe ColdFusion Vulnerability

本文改寫自 2024 年 1 月第一期的漏洞情資報告（VIR 2024 June H1）。
TeamT5 漏洞研究團隊致力於針對重大漏洞提供即時的應對措施與緩解方案。如欲進一步了解 TeamT5 的漏洞情資報告，[請與我們聯繫](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)。

>**CVE-2023-29300: Adobe ColdFusion 漏洞**
 
>CVE-2023-29300 是出現在 Adobe 旗下應用程式開發平台 ColdFusion 的 JAVA 反序列化漏洞。該漏洞將導致任意程式碼執行。未經授權的威脅行動者可利用 CVE-2023-29300 將 Webshell 部署到目標設備。


## Alerts of Exploiting Adobe ColdFusion

TeamT5 released mitigation and response guidelines to CVE-2023-29300 in Adobe ColdFusion. CVE-2023-29300 is a JAVA deserialization vulnerability resulting in arbitrary code execution. Adobe ColdFusion is a commercial rapid web-application development computing platform. Unauthorized threat actors can exploit CVE-2023-29300 and deploy webshell to target's devices and establish persistence. 

### Executive Summary

We assess the severity level of CVE-2023-29300 is critical and urge our customers to use this report to mitigate the effects. First, Adobe ColdFusion is widely used by large companies and organizations, with more than 3000 devices in Japan. Even worse, our investigation revealed that at least 66 Adobe ColdFusion devices in Japan has been compromised. The victims are across different sectors, including healthcare, education, and manufacturing industry. Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-29300 has been circulating in the wild. Public reports also provide the root cause analysis on CVE-2023-29300.[1]

Threat actors, including cybercriminals and state-sponsored APT groups, has been actively exploiting CVE-2023-29300 in the attacks. Specifically, we have detected that threat actors exploited CVE-2023-29300 to deploy webshells such as Behinder. Aligned with our observation, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-29300 to known exploited vulnerabilities catalog on January 8, 2024.[2] We summarized the activities in the **Exploitation Status** subsection. 

Based on the exploitation status, we depicted the **Possible Attack Scenario** in this report. We also concluded the malware and IOCs in **Appendix II: Malware and Appendix III: Indicators of Compromise (IoC)**, respectively. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Open-source nuclei-based vulnerability scanner
- Threat Hunting Tools, including a SIGMA rule and a nuclei-based webshell scanner.
 - SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process via malicious webshell.
 - Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

### Exploitation Status

CVE-2023-29300 has been actively exploited by threat actors, including cybercriminals and state-sponsored threat actors. We concluded all the related C2 in the report IoC.[3]

- Cybercriminals have exploited CVE-2023-29300 to deploy webshell in attacks. We have detected attacks against healthcare entities and Thai real estate entities.
- China-nexus APT group SLIME13 (as known as Flax Typhoon) exploited CVE-2023-29300 in the attacks.
- Notably, Chinese actors exploited CVE-2023-29300[4] in the 2023 HuWang Operation, China’s state-led penetration testing for enterprises.[5] Previously, China-nexus APT groups such as Amoeba, SLIME28, and SLIME37 have joined the HuWang Operation.



### Affected Products

ColdFusion 2018 (Update 16 and earlier versions)
 
ColdFusion 2021 (Update 6 and earlier versions)
 
ColdFusion 2023 GA Release (2023.0.0.330468)

### Mitigation and Response Advisory

#### 1. Official Patch Information

Adobe has released the official patches for CVE-2023-29300. 
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

#### 2. Open-source Nuclei-based Vulnerability Scanner

Our customers can leverage the open-source nuclei-based vulnerability scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

#### 3. Threat Hunting Tools

Cybercriminals and state-sponsored threat actors have already actively exploited CVE-2023-29300. TeamT5 vulnerability intelligence team prepared a SIGMA rule and a nuclei-based webshell scanner for our customers to detect potential threats. 

The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) includes:

- SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process
- Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

<figure>

![pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png](https://uploads.teamt5.org/upload/original/pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png)

<figcaption> The Nuclei-based webshell scanner
</figcaption>
</figure> 
 
Our customers can download all tools from the **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

## Possible Attack Scenario

Threat actors have to first abuse the unauthenticated ColdFusion Component (CFC) endpoint to exploit CVE-2023-29300. Public proof of concepts has exposed a ColdFusion Component endpoint `/CFIDE/adminapi/accessmanager.cfc` that also been exploited in the wild. Our customers can check if your ColdFusion Component endpoint has been attacked with following IIS log. 

`C:\inetpub\logs\LogFiles\W3SVC1\u_ex240112.log:2024-01-12 08:12:12 172.17.0.1 POST /CFIDE/adminapi/accessmanager.cfc _cfclient=true&method=foo 443 - 172.17.0.2 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_10_1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/37.0.2062.124+Safari/537.36 - 404 0 2 1466`

Our customers can also leverage the open-source nuclei-based webshell scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

CVE-2023-29300 is a deserialization vulnerability originated from the Web Distributed Data eXchange (WDDX) library. Once exploited, the vulnerability will allows the threat actors to load the payload via JNDI injection, connecting to the C2 and execute arbitrary codes.

The threat actors can deploy webshell to ColdFusion after successfully exploited CVE-2023-29300. With such webshell exists, the threat actors can still access ColdFusion Component even after patching the vulnerability. Our analysis found that more than 1% of the ColdFusion Components in Japan has been compromised. The webshells contains following malicious URI:
- COLDFUSION_SERVER/cf_scripts/config.cfm
- COLDFUSION_SERVER/cf_scripts/123.cfm
- COLDFUSION_SERVER/cf_scripts/system.cfm
- COLDFUSION_SERVER/cf_scripts/classes/GetVars.cfm
- COLDFUSION_SERVER/cf_scripts/classes/ckeditor.cfm

Based on the research, we provide a nuclei-based webshell scanner and a SIGMA rule for our customers to check if your ColdFusion Component endpoint has been compromised, and the nuclei-based webshell scanner can identify implanted webshells as follows. Our customers can download the tools from The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

Notably, we also detected that Chinese threat actors developed webshell designed for ColdFusion Markup, PowerShell[5]. PowerShell will download the second stage webshell from C2 `http://113.141.91.61:63211/11.aspx`. The second-stage webshell is Behinder[6], a famous open-source webshell in Chinese threat actors.

### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Behinder</td>
 <td>Webshell</td>
 <td>Behinder is a webshell developed by Chinese actor. It has different platform versions, such as PHP, ASP and JSP. Behinder loads an AES-encrypted binary payload which is difficult to detect by general firewall.</td>
 <td>Open-source</td>
 <td>2020.06</td>
 </tr>
</table>
 
### Appendix II: Indicators of Compromise (IoC)

**SHA-256**
 
```
hash= webshell
cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52
d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

```

```c2-IP= IP
113.141.91.61
```

### Appendix III: Other critical CVEs

TeamT5 also provides analysis of other caitical CVEs in **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please [contact TeamT5](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information.

 
 

[1] https://blog.projectdiscovery.io/adobe-coldfusion-rce/

[2] https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog

[3] https://github.com/gobysec/Research/blob/main/Adobe_Coldfusion_remote_code_execution_vulnerability_Analysis_(CVE-2023-38204)_zh_CN.md

[4] The HuWang Operation is China’s state-led penetration testing or red teaming operation for state-owned enterprises and critical information infrastructure (CII) operators, hosted by the Ministry of Public Security every summer. We have previously discovered that several APT groups such as Amoeba, SLIME28, and SLIME37 have joined China’s HuWang Operation.

[5] SHA-256: cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52

[6] d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

CVE-2023-29300: Adobe ColdFusion 漏洞

Today's enterprises continue to face increasingly complex security threats; in order to deal with these challenges, threat hunting is an indispensable strategy.

Enterprises cooperate with professional threat hunting teams and use threat hunting tools based on the latest threat intelligence to help enterprises take proactive defensive measures, strengthen the enterprise's cybersecurity resilience, and ensure uninterrupted business operations.

### 1. Proactively look for potential threats
Threat hunting is different from passive cybersecurity defense methods. It not only relies on known attack patterns, but also actively hunts unknown threats. Through proactive threat hunting, enterprises can take preventive measures before attacks occur, greatly improving their defense capabilities.

### 2. Reduce the attacker’s residence time
A successful attack often depends on how long the attacker remains on the corporate network. Threat hunting can significantly reduce the time attackers have to influence corporate networks, reduce the possibility of damage, and improve overall security.

### 3. Improve incident response efficiency
Rapid response after a security incident occurs is crucial. Threat hunting enhances an enterprise's incident response efficiency by providing more comprehensive and real-time threat intelligence. Security professionals can more quickly identify the source and method of attacks, take appropriate action, mitigate damage, and quickly restore normal operations.

###4. Adapt to the changing threat environment
Threat hunting is powered by the latest security intelligence, allowing enterprises to more flexibly adjust their security strategies to respond to emerging threats. This adaptability enables enterprises to better respond to the evolving threat environment, ensures that their security measures and strategies are future-proof, and strengthens the overall security resilience of the enterprise.


## Conclusion
The benefit of threat hunting is not only to help enterprises adapt to detect threats, but also to improve enterprises' ability to adapt to continuously evolving security challenges. This kind of proactiveness, immediacy and adaptability makes threat hunting an integral part of strengthening enterprise security resilience and helping to protect enterprises from emerging security threats.

 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/request-information/

 

*Picture source: pixabay

The benefits of threat hunting: The key to greater security resilience for Enterprise

當今企業持續面臨日漸複雜的資安威脅；為了應對這些挑戰，威脅狩獵是不可或缺的策略。

企業與專業的威脅狩獵團隊合作，採用基於最新威脅情資的威脅狩獵工具，協助企業採取主動積極的防禦措施，強化企業的資安韌性，確保業務營運不中斷。

### 1. 主動尋找潛在威脅
威脅狩獵有別於被動的資安防禦方式，不僅僅是依賴已知的攻擊模式，主動獵捕未知的威脅。透過主動威脅獵捕，企業能夠在攻擊發生前採取預防措施，大幅提升防禦能力。


### 2. 降低攻擊者的滯留時間
一個成功的攻擊往往取決於攻擊者在企業網路中的滯留時間。威脅狩獵可大幅縮減攻擊者影響企業網路的時長，減少損害的可能性，提高整體的安全性。

### 3. 提高資安事件應變效率
資安事件發生後的迅速應變至關重要。威脅狩獵透過提供更全面、即時的威脅情資，增強企業的事件應對效率。資安專業人員能夠更快速地識別攻擊的來源和方法，採取適當的措施，降低損害並快速恢復正常運作。

### 4. 適應不斷變化的威脅環境
威脅狩獵電機於最新的資安情資，使企業能夠更靈活地調整其資安策略以應對新興的威脅。這種適應性使企業能夠更好地應對不斷演變的威脅環境，確保其資安措施和策略不會過時，強化企業整體的資安韌性。

## 結論
威脅狩獵的好處不僅是協助企業應變發現威脅，更可提高企業適應持續演變的資安挑戰。這種主動性、即時性和適應性使得威脅狩獵成為強化企業資安韌性的不可或缺的一環，有助於保護企業免受新興的資安威脅。

 
 
 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/request-information/

 
 
*圖片來源: Pixabay

威脅狩獵對企業的好處：強化資安韌性的關鍵

アジア太平洋地域でトップクラスのサイバー脅威インテリジェンスとエンドポイント検出応答 (EDR) ソリューションを提供する TeamT5 は、4月24日から26日開催のサイバーセキュリティイベント Japan IT Week にて、ソリューションを展示します。

世界中からサイバーセキュリティ関連の専門家が集まるこのイベントは、最先端のサイバーセキュリティ技術とソリューションを紹介する絶好のプラットフォームです。 TeamT5 では、脅威インテリジェンス プラットフォーム ThreatVision と持続的標的型攻撃(APT)検出ツール ThreatSonar など、最新のソリューションを紹介します。

私たちは、脅威インテリジェンスこそがサイバー防御の要であると考えています。

企業がサイバー攻撃を予測し、事前に防御戦略を展開できるよう、行動指向でローカライズされたインテリジェンスを提供します。
27~29番ブースにて、インテリジェンス主導のサイバー防御をご体験いただけることを心よりお待ちしております。

## ソリューション

### 脅威インテリジェンスプラットフォーム‐ThreatVision
- 最新の脅威情勢の把握
全世界で猛威を振るう最新の悪意のあるプログラムの分析と追跡を行っており、分析結果に基づいた脅威インテリジェンスレポートとIoCをご提供しています。
最新のネットワーク脅威情勢が把握できるので、リアルタイムでリスク状況を予測し、既知かつ潜在的な脅威を正確に判断しながら事前にサイバー防御を講じることが可能です。

- 組織の意思決定
自組織に関係のある脅威のトレンドを把握し、サイバー戦略、投資判断に活かすことができます。

- 脅威に対するリスク管理
攻撃者のTTPを収集、把握し、自組織を同様の攻撃から守れるかシミュレーションします。
攻撃に使われたIoC情報を収集、管理するので、セキュリティ製品の遮断リストとして活用できます。また、脆弱性情報を収集、分析するので、パッチ管理にも役立ちます。

詳細はこちら: [ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)

### 脅威ハンティングツール‐ThreatSonar
- 脅威ハンティングによる事前防御
当社において最高水準のサイバーセキュリティ事前防御策である、APT（Advanced Persistent Threat）脅威ハンティングソリューションは、
自動展開、簡単な操作、異常の検出、そして悪意のある脅威を迅速に検出することが可能なので、攻撃が発生した場合の防御としても、速やかに対策を講じることができるように設計されています。また、エージェントのインストールが不要なため、手軽に導入、運用ができ、EDRとも併用できます。


- 進入した脅威の迅速な検知
フォレンジック機能によりメモリー内に潜むAPTマルウェアを能動的に検知し、脅威レベルを5段階で判定します。

- サイバーセキュリティ脅威の自動調査
インテリジェンス主導型の機能と自動調査機能によるアクティブ検出は、ハッカーが脅威を隠すために一般的に使用するTTP（戦術、技術、手順）に準拠しており、サイバーセキュリティインシデントの調査効率の向上を促進します。

詳細はこちら: [ThreatSonar](https://teamt5.org/jp/products/threatsonar/?utm_source=blog&utm_medium=website)


## 概要
- 会期: 2024年4月24日(水)～26日(金)
           10:00～18:00（最終日のみ 17:00 終了）
- 会場: 東京ビッグサイト 東ホール
- ブース位置: 27~29
- より詳しい情報: https://japan-it-week-2024.teamt5.org/




TeamT5 はJapan IT Weekに出展します

TeamT5, a provider of top cyber threat intelligence and endpoint detection and response (EDR) solutions in APAC, is going to showcase solutions at the upcoming cybersecurity event  - Japan IT Week.

This event, which attracts experts and professionals from around the world, is an excellent platform to showcase the cutting edge cybersecurity technologies and solutions. And TeamT5 will be showcasing our latest solutions, including threat intelligence platform ThreatVision and advanced persistent threat detection tool ThreatSonar.

We believe that threat intelligence is the cornerstone of cyber defense.
We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance. We sincerely welcome you to experience our intelligence-driven cyber defense at booth 27~29.

## Our Solutions
### ThreatVision, a powerful threat intelligence platform 
**Advantages:**

1. Grasp latest & advanced cyber threats 
2. Boost power to defend cyber attacks 
3. Expand insights & database for Advanced Persistent Threat (APT)

**Intro:**

Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 10+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

**More at** [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)

## ThreatSonar, a cyber threat forensic & analysis platform 
**Advantages: **

1. Assess system compromised events more precisely
2. Respond to cyber incidents faster
3. Deploy the tool automatically

**Intro:**

ThreatSonar is an easy-to-use tool to hunt cyber threats. Combining digital forensics and behavior-modeling techniques, ThreatSonar can do fast triage and hunt for anomalies.

Drive by cyber threat intelligence and run with automatic mode, it finds hidden infections with similar TTPs - Tactics, Techniques, and Procedures. Regular cybersecurity check-ups also help enterprises to better protect endpoints.

ThreatSonar offers both online and offline mode to protect endpoints in various situations. In short, ThreatSonar is an effective tool designed for assisting incident response.

**More at** [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website)

## TeamT5 at Japan IT Week
- Date: 

2024 / 4 / 24 ～26

10:00 ~18:00 (Last day closes at 17:00)
- Venue: Tokyo Big Sight, Japan
- Booth Number: 27~29
- Our Activity page: [link](https://japan-it-week-2024.teamt5.org/?utm_source=post&utm_medium=blog)


TeamT5 will showcase solutions at Japan IT Week

News

This year, Black Hat Asia is held online and in-person, April 16-19, 2024 in Singapore. Greg Chen, Charles Li, and Che Chang from TeamT5 will give a talk on the topic “Chinese APT: A Master of Exploiting Edge Devices”.

##Speech Info
- Time: Friday, April 19 | 2:30pm-3:00pm ( Hibiscus Junior Ballroom 3610 )
- Venue :MARINA BAY SANDS (10 Bayfront Ave, Singapore)

- Topic:
Chinese APT: A Master of Exploiting Edge Devices

- Speakers:
Greg Chen, CTI Researcher
Charles Li, Chief Analyst
Che Chang, Senior Cyber Threat Analyst

- Introduction:

China-nexus actors have compromised edge devices such as firewall, VPN, IoT devices, etc. against Taiwan Government since 2020 during COVID19, and have compromised those devices to build Botnet, spread disinformation, and exfiltrate sensitive data. However, edge devices belong to closed embedded platforms, and installing antivirus/EDR on those platforms and extracting malware are difficult. Moreover, some models have already reached end-of-life, so no patches are available. Worst of all, Chinese APT has owned the capabilities to find and exploit 0-day on edge devices such as Sophos Firewall, Array SSL VPN, and Barracuda Email Security Gatwall, etc.

Consequently, the presentation will reveal a surveillance router exploited in the wild by Chinese APT groups and will share multiple case studies of edge devices abused by Chinese threat actors such as spread disinformation, Botnet implanted, data exfiltration, and compromised C2. In addition, we also disclose the special and new malware family implanted in edge devices, such as port-knocking backdoors and living-of-the-land binary(LoLbin) attacks in edge devices. Lastly, this presentation also provides related approaches to mitigate attacks of edge devices.


## About Black Hat Asia
Black Hat is the world leading cybersecurity event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.


【Black Hat Asia 2024】TeamT5 Will Give the Talk on “Chinese APT: A Master of Exploiting Edge Devices”

Events

> Our cyber threat team gives observations on i-Soon’s leaked documents. This is an expert of WIRED's article. Read more at [WIRED](https://www.wired.com/story/isoon-china-hack-for-hire-leak/).

Hundreds of documents linked to a Chinese hacking-for-hire firm were dumped online this week. The files belong to i-Soon, a Shanghai-based company, and give a rare glimpse into the secretive world of the industry that supports China’s state-backed hacking. The leak includes details of Chinese hacking operations, lists of victims and potential targets, and the day-to-day complaints of i-Soon staff.

“These leaked documents support TeamT5’s long-standing analysis: China's private cybersecurity sector is pivotal in supporting China’s APT attacks globally,” Che Chang, a cyber threat analyst at the Taiwan-based cybersecurity firm TeamT5, tells WIRED. Chang says the company has been tracking i-Soon since 2020 and found that it has a close relationship with Chengdu 404, a company linked to China’s state-backed hackers.

 


*Image courtesy of pexels

【WIRED】Security News This Week: A Mysterious Leak Exposed Chinese Hacking Secrets

>TeamT5 資安威脅情資分析團隊接受 WIRED 訪問，針對近期「安洵信息公司」洩漏的文件進行評論與分析。本文為摘錄，完整文章請見 [WIRED](https://www.wired.com/story/isoon-china-hack-for-hire-leak/)。

...

Hundreds of documents linked to a Chinese hacking-for-hire firm were dumped online this week. The files belong to i-Soon, a Shanghai-based company, and give a rare glimpse into the secretive world of the industry that supports China’s state-backed hacking. The leak includes details of Chinese hacking operations, lists of victims and potential targets, and the day-to-day complaints of i-Soon staff.

“These leaked documents support TeamT5’s long-standing analysis: China's private cybersecurity sector is pivotal in supporting China’s APT attacks globally,” Che Chang, a cyber threat analyst at the Taiwan-based cybersecurity firm TeamT5, tells WIRED. Chang says the company has been tracking i-Soon since 2020 and found that it has a close relationship with Chengdu 404, a company linked to China’s state-backed hackers.

...

 

*首圖來源: pexels

【WIRED 採訪報導】Security News This Week: A Mysterious Leak Exposed Chinese Hacking Secrets

> Our cyber threat team gives observations on i-Soon’s leaked documents. This is an expert of CyberScoop's article. Read more at [CyberScoop](https://cyberscoop.com/isoon-chinese-apt-contractor-leak/).

A tranche of documents posted to GitHub five days ago reveals that Chinese contractors working to support Beijing’s hacking operations...Since their release over the weekend, the trove of documents from a Chinese offensive security company, I-SOON, have stunned researchers, who say the set of contracts, product manuals and employee lists leaked online provides an unprecedented view of how private companies support China’s increasingly aggressive hacking operations.

...

Analysts with the Taiwan-based TeamT5 cybersecurity firm said the leaked documents support their longstanding analysis that “China’s private cybersecurity sector is pivotal in supporting China’s APT attacks globally.”

...

The material also confirms prior TeamT5 findings highlighting the company’s work with the [Chinese government to target online gambling](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143), as well as the company’s own money-driven ransomware campaigns, which are likely being conducted because “China’s national security cut the budget to pay these private companies.”

...


 


*Image courtesy of pexels

【CyberScoop】Leaked documents show how firm supports Chinese hacking operations

>TeamT5 資安威脅情資分析團隊接受 CyberScoop 訪問，針對近期「安洵信息公司」洩漏的文件進行評論與分析。本文為摘錄，完整文章請見 [CyberScoop](https://cyberscoop.com/isoon-chinese-apt-contractor-leak/)。

A tranche of documents posted to GitHub five days ago reveals that Chinese contractors working to support Beijing’s hacking operations...Since their release over the weekend, the trove of documents from a Chinese offensive security company, I-SOON, have stunned researchers, who say the set of contracts, product manuals and employee lists leaked online provides an unprecedented view of how private companies support China’s increasingly aggressive hacking operations.

...

Analysts with the Taiwan-based TeamT5 cybersecurity firm said the leaked documents support their longstanding analysis that “China’s private cybersecurity sector is pivotal in supporting China’s APT attacks globally.”

...

The material also confirms prior TeamT5 findings highlighting the company’s work with the [Chinese government to target online gambling](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143), as well as the company’s own money-driven ransomware campaigns, which are likely being conducted because “China’s national security cut the budget to pay these private companies.”

...


 

完整文章請見 [CyberScoop](https://cyberscoop.com/isoon-chinese-apt-contractor-leak/)。

 

*首圖來源: pexels

Intelligence-Driven Cyber Defense

PRODUCT

Designed for APT & Ransomware Protection

An Engine to Hunt down Intruders

A Portal to See Through the Chaos

Build your Anti-Ransomware Plan TODAY

Blog