###From threat detection to risk management and prevention, ThreatSonar Plus empowers enterprises to navigate the AI era


Facing increasingly stealthy attacks driven by AI agents, traditional cybersecurity defenses are no longer sufficient. TeamT5, a leading threat intelligence provider in the Asia-Pacific region, today unveiled a new solution at CYBERSEC 2026 in Taiwan: **ThreatSonar Plus**, a ThreatSonar Plus Extensive Endpoint Assessment Platform built for AI environments. In addition to showcasing its advanced automated defense capabilities, TeamT5 also introduced its new brand identity, marking both a commitment to deep technological innovation and a milestone in its global expansion in AI cybersecurity.


##ThreatSonar Plus Eliminates Blind Spots in AI Agent Defense
As enterprises accelerate the adoption of AI agents to drive automation, new forms of cybersecurity risk are emerging. Sung-ting Tsai, CEO of TeamT5, noted that improperly configured AI agents may lead to sensitive data leakage or exposure to malicious code injection. Given that AI agents often integrate with external services, insufficient access control can easily result in unauthorized access to confidential data.

These threats are highly automated and difficult to detect, rendering traditional cybersecurity solutions ineffective. Enterprises must urgently reassess and establish protection mechanisms specifically designed for AI deployments.

The newly launched **ThreatSonar Plus** platform directly addresses these defense gaps in AI environments. Built around three core pillars—asset inventory, risk detection, and AI agent identification—the platform enables enterprises to gain precise visibility into critical assets and AI deployments. Through in-depth analysis, administrators can quickly identify high-risk vulnerabilities and prioritize remediation strategies accordingly.

**Key features of ThreatSonar Plus include:**
- AI agent risk identification, including sensitive data exposure, malicious commands, and autonomous agent behaviors
- Support for SEMI E187 to meet industry security and compliance requirements
- Rapid identification of high-risk vulnerabilities with severity-based prioritization for faster response
- System configuration assessment aligned with CIS benchmarks, with actionable hardening recommendations


##New ThreatVision Cybercrime Intelligence Reports Focus on Dark Web Cybercrime
In addition to endpoint security, TeamT5 has recently introduced ThreatVision Cybercrime Intelligence. Built on TeamT5’s 20+ years of APAC threat research, it covers the Deep & Dark Web, underground forums, Telegram, and cybercrime communities, delivering expert-validated intelligence insights that analyze cybercrime operations, ransomware activity, data trades, and dark web developments from attacker’s perspective.
ThreatVision Cybercrime Intelligence helps enterprises identify emerging cybercrime risks earlier, understand attacker tactics and targets, and prioritize defensive actions. By gaining visibility into cybercriminal activity across the Deep & Dark Web, enterprises can more accurately assess risk and shift from reactive response to proactive defense.

##From Asia-Pacific to Global Markets: Brand Transformation Signals Strategic Vision
Another highlight was the debut of TeamT5’s new brand identity. Built on the concept of “focus insights and sharpened vision,” the redesign reflects its precision in threat detection and ability to help clients make decisive security decisions.
CEO Sung-Ting Tsai said the rebrand marks TeamT5’s evolution into a more mature and trusted cybersecurity company, while reinforcing its global expansion strategy.

Founded in Taiwan, TeamT5 has established a strong foothold in Japan and South Korea, and in recent years has expanded into Southeast Asia, including Thailand, Vietnam, Malaysia, and Singapore, with further extension into European markets. As its global footprint grows, the company continues to strengthen local partnerships and service capabilities to enhance competitiveness. TeamT5 has also initiated plans for a public offering, progressing according to schedule to support future capital market entry and long-term brand sustainability.

 
 ![](https://uploads.teamt5.org/upload/original/ai-agents-emerge-as-a-new-cybersecurity-breach-point-team-t5-calls-for-rebuilding-enterprise-ai-cybersecurity-frameworks_pic.jpg)
 
 

###About TeamT5 
Founded in 2017, TeamT5 is a leading provider of cybersecurity threat intelligence and endpoint security solutions in the Asia-Pacific region. The company specializes in regional cyber threat research, including advanced persistent threats (APT) and ransomware. Leveraging high-precision threat intelligence and proprietary endpoint threat hunting technologies, TeamT5 delivers comprehensive security solutions to counter cyber espionage and ransomware attacks.

In 2022, TeamT5 received strategic investments from JAFCO Group, ITOCHU Corporation, and MACNICA, demonstrating strong international growth potential. The company was also recognized by Frost & Sullivan as the Best Threat Intelligence Company in Taiwan for two consecutive years (2023–2024).

AI Agents Emerge as a New Cybersecurity Breach Point — TeamT5 Calls for Rebuilding Enterprise AI Cybersecurity Frameworks

###從威脅偵測邁向風險管理與預防，ThreatSonar Plus 助企業應對 AI 新局

面對 AI Agent 衍生的隱蔽攻擊，傳統防線已不足應對。亞太威脅情資領導品牌 TeamT5（杜浦數位安全） 今（5）日於 2026 臺灣資安大會祭出重磅解方，推出為 AI 環境打造的 「ThreatSonar Plus」 全方位端點安全檢測平台。除了展示精準的自動化防禦實力，TeamT5 更於現場揭曉全新品牌視覺，不僅展現深耕技術的決心，更標誌著品牌邁向國際、掌握 AI 資安的重要時刻。

##ThreatSonar Plus 助企業掃除 AI 代理防禦盲點
隨著企業加速導入 AI 代理（AI Agent）落實自動化，新型態資安風險也隨之而來。TeamT5 杜浦數位安全執行長蔡松廷指出，AI Agent 若設定不當，將面臨重要資訊外洩、遭植入惡意程式等風險。由於 AI 代理常整合外部服務，若缺乏完善的存取控制，機密資料極易遭未經授權存取。

這類威脅具備高度自動化與隱蔽性，傳統資安方案已難以有效偵測，企業亟需重新檢視並建立專為 AI 導入設計的防護機制。

TeamT5 全新推出的「ThreatSonar Plus」平台，直擊 AI 環境下的防禦盲點。該平台**以資產盤點、風險偵測、AI 代理（AI Agent）辨識**為三大核心，協助企業精確掌握關鍵資產與 AI 部署現況。透過深度分析，管理者能快速識別高風險漏洞，並依優先順序制定修補策略。

**ThreatSonar Plus 核心特色**：
- 辨識 AI 代理風險：包含敏感資訊暴露、惡意指令與 AI 代理自主行為檢測
- 支援 SEMI E187 規範：協助企業滿足產業資安合規需求
- 快速識別高風險弱點：並依嚴重程度進行優先排序，協助快速應變
- 確認漏洞狀態：依據 CIS Benchmark 檢視系統設定，提供可執行之強化建議

##ThreatVision 新推出網路犯罪情資聚焦深暗網犯罪活動
除了端點安全之外，TeamT5 近期也推出 ThreatVision 網路犯罪情資，奠基於 TeamT5 超過 20 年亞太威脅研究經驗，涵蓋深暗網、地下論壇、Telegram 與網路犯罪社群，提供經專家驗證的情資洞察，從攻擊者視角剖析網路犯罪運作、勒索軟體活動、資料交易與暗網動態。

ThreatVision 網路犯罪情資可協助企業及早識別新興網路犯罪風險、理解攻擊者手法與鎖定目標，並排定防禦行動的優先順序。透過掌握深暗網犯罪動態，企業不僅能準確評估風險，更能從被動應變轉為主動防禦。

##立足亞太、放眼國際 品牌再造重塑核心定位與願景
TeamT5 參與本次大會的另一大焦點，為全新品牌識別正式亮相。新 Logo 以「聚光焦點，銳化視野」為設計核心，象徵 TeamT5 在暗處精準鎖定威脅，聚焦關鍵訊號，協助客戶更清晰辨識風險、做出決策，並果斷行動。TT 蔡松廷指出，藉由重塑品牌識別，盼能傳達 TeamT5 從科技新創，邁向更專業、可信賴的資安品牌定位，同時持續推動在國際市場的布局，強化全球發展動能。
 
TeamT5 自台灣出發，深耕日韓市場有成，近年也逐步將事業版圖拓展至泰國、越南、馬來西亞、新加坡等東南亞國家，並進一步延伸至歐洲市場，展現穩健的全球市場拓展實力。隨著海外市場的開展，TeamT5 也積極強化在當地合作與服務能量，提升整體競爭力。近期公司已啟動公開發行計畫，並依既定時程推進，為未來邁向資本市場及品牌永續發展奠定基礎。
 
 
 ![](https://uploads.teamt5.org/upload/original/ai-agents-emerge-as-a-new-cybersecurity-breach-point-team-t5-calls-for-rebuilding-enterprise-ai-cybersecurity-frameworks_pic.jpg)
 
 
 
###【關於TeamT5 杜浦數位安全】
成立於 2017 年，為亞太地區首屈一指的資安威脅情資與端點資安解決方案提供商。專精亞太地區網路威脅研究，涵蓋進階持續性攻擊（APT）、勒索軟體，憑藉精準的威脅情資與獨特的端點威脅狩獵技術，為客戶提供有效反制網路間諜與勒索攻擊之完整資安防護解決方案。2022 年獲日本最大創投 JAFCO 集富集團、日本最大跨國企業 ITOCHU 伊藤忠商事及日本最大資安解決方案提供商 MACNICA 共同投資，展現深具潛力的國際影響力。於2023-2024 年連續獲得國際顧問公司 Frost & Sullivan 評選為台灣最佳威脅情資公司。

AI Agent 成資安新破口   TeamT5：企業需重建 AI 資安機制

News

TeamT5, an Asia-born pioneer in cyber threat intelligence, will showcase its solutions at FIRSTCon 2026—one of the world’s leading cybersecurity conferences that brings together frontline incident response and security professionals.

Founded in Taiwan, TeamT5 leverages over two decades of threat research, deep expertise in regional languages, and a distinct geopolitical perspective to specialize in advanced persistent threats (APT) and ransomware across the Asia-Pacific region. At FIRSTCon 2026, the company will highlight ThreatVision, its intelligence platform designed to deliver localized, contextualized, and actionable insights for real-world cyber defense.

As part of the event, TeamT5 CTI team members Linda Kuo, Senior Threat Intelligence Analyst, and Li-An Huang, CTI Analyst, will present a talk titled “Short Videos, Crypto, and Crime: Inside the Chinese-Speaking Malware Ecosystem.” More details can be found in [speech brief](https://www.first.org/conference/2026/program#pShort-Videos-Crypto-and-Crime-Inside-the-Chinese-Speaking-Malware-Ecosystem)

Look forward to seeing you at FIRSTCon 2026.

 

### TeamT5 at FIRSTCON 2026
- **Date**: 2026 / 6 / 14 ～18 for booth showcase
- **Venue**: Sheraton Denver Downtown Hotel (1550 Court Place, Denver, CO 80202, USA)
- **Event Website**: [link](https://www.first.org/conference/2026/)

TeamT5 to Showcase APAC-Focused Threat Intelligence at FIRSTCon 2026

亞太資安威脅情資先驅 TeamT5 將參與全球指標性資安盛會 FIRSTCon 2026，並於現場展示其專為實戰防禦打造的威脅情資解決方案。

TeamT5 立足於台灣，憑藉**超過 20 年的資安研究經驗**、**深厚的亞太語言與文化理解**，以及**獨特的地緣政治視角**，長期專注於亞太地區的 APT 攻擊與勒索軟體威脅研究。本次 FIRSTCon 2026，TeamT5 將展出其威脅情資平台 ThreatVision，協助組織掌握在地化、具脈絡性且可立即行動的情資洞察。

TeamT5 CTI 團隊成員—— Linda Kuo（Senior Threat Intelligence Analyst）與  Li-An Huang（CTI Analyst）——將發表「Short Videos, Crypto, and Crime: Inside the Chinese-Speaking Malware Ecosystem」的演講。更多資訊介紹請參考[演講介紹](https://www.first.org/conference/2026/program#pShort-Videos-Crypto-and-Crime-Inside-the-Chinese-Speaking-Malware-Ecosystem)。

誠摯邀請您蒞臨，親身體驗 TeamT5 以情資驅動的資安防禦實力。



### TeamT5 杜浦數位安全參展 FIRSTCON 2026
- 日期：2026 / 6 / 14 ～18 攤位展出時段
- 地點：美國丹佛 Sheraton Denver Downtown Hotel（1550 Court Place, Denver, CO 80202, USA）
- 活動官網：[連結](https://www.first.org/conference/2026/)


###關於 FIRSTCon
FIRSTCon 提供全球事件應變與資安團隊一個高度信任的交流平台，促進最佳實務、工具與關鍵情報的分享，以強化整體資安韌性。TeamT5 的參與，展現其將根植於亞太的威脅情資帶入國際資安社群、共同提升全球防禦能力的承諾。

###關於 TeamT5
TeamT5 杜浦數位安全是深耕亞太地區的威脅情資研究團隊，結合台灣的地理位置與語言優勢，以及超過二十年的研究累積，長期專注於亞太區 APT 與勒索等重大威脅的研究與分析，為政府、金融與科技產業提供具在地脈絡的威脅情資洞察。

TeamT5 以研究為核心，持續追蹤威脅行為與攻擊手法的演變，將複雜且快速變化的攻擊活動整理為可供判斷的風險脈絡，協助企業與組織在攻擊發生前即掌握潛在風險，提升防禦決策的準備程度。

同時，TeamT5 持續關注新興與未知威脅，深入解析攻擊背景與行動模式，協助降低風險暴露時間。研究成果亦長期分享於國際資安會議與專業社群，並與客戶及合作夥伴建立穩定的長期關係，在實務交流與信任基礎上，持續強化整體防禦能力。


TeamT5 將於 FIRSTCon 2026 分享亞太區域的威脅情資洞見

Taipei, Taiwan, April 24, 2026 - TeamT5, a cybersecurity company specializing in cyber threat research and intelligence analysis, and the Taiwan Network Information Center (TWNIC) announced today that they have signed a Memorandum of Understanding (MOU). Under the MOU, the two organizations will establish a threat intelligence sharing framework, integrate complementary resources and deepen collaboration to strengthen Taiwan’s overall cybersecurity resilience and support the development of the cybersecurity industry.

The collaboration will cover intelligence exchange and joint research. TeamT5 will contribute expertise in advanced persistent threat (APT) research, including indicators of compromise (IOCs) and technical analysis of cybercrime activities. TWNIC will contribute DNS resolution-related data and anonymized datasets collected through honeypot mechanism, in accordance with applicable privacy, security, and internal governance requirement. Through high-quality intelligence sharing, both organizations aim to identify potential risks earlier and strengthen early warning and incident response capabilities.

TeamT5 has long been dedicated to cybersecurity threat research in the Asia-Pacific region, with extensive experience in APT intelligence and malware analysis. TWNIC, as Taiwan’s national network information center and a key operator within Taiwan’s Internet infrastructure, TWNIC plays a critical role in domain name management and internet governance. By combining their respective strengths, this partnership is expected to further enhance Taiwan’s participation, visibility, and contribution within the global cybersecurity community.

Sung-ting Tsai, Chief Executive Officer of TeamT5, said: “As cyber threats become increasingly sophisticated and persistent, no single organization can address them alone. Through our collaboration with TWNIC, we aim to establish a more robust intelligence exchange mechanism, transform research insights into actionable defense capabilities and help a more resilient cybersecurity environment for Taiwan. We also see this partnership as an opportunity to reinforce TeamT5’s role as a leading threat intelligence provider in the Asia-Pacific region and to expand our contribution tothe global cybersecurity landscape.”

Jo-Fan YU, Managing Director and Chief Executive Officer of TWNIC, said:
“As cyber threats continue to evolve, TWNIC, as a critical part of Taiwan’s Internet infrastructure, remains committed to strengthening DNS protection and advancing the collection, analysis, and application of threat intelligence. This collaboration with TeamT5 will broaden our intelligence sources and analytical depth, enabling more effective integration and use of information to detect and respond to malicious activities, and ultimately strengthen Taiwan’s overall cybersecurity resilience.”
Looking ahead, TWNIC will continue to serve as a bridge connecting domestic and international cybersecurity communities, promoting collaboration and exchange to build a more stable and trustworthy internet environment for Taiwan. The two organizations will also explore additional areas of cooperation, including cybersecurity research and technical exchange, to support the long-term development of Taiwan’s cybersecurity ecosystem.

 
![](https://uploads.teamt5.org/upload/original/pic_teamt5-and-twnic-sign-mou-to-advance-threat-intelligence-sharing-and-strengthen-taiwan-s-cybersecurity-resilience.jpg)
<center>TeamT5 and TWNIC Sign MOU to Strengthen Threat Intelligence Sharing and Cybersecurity Resilience in Taiwan</center>
<center>Left: Jo-Fan YU, Managing Director and Chief Executive Officer of TWNIC; 
Right: Sung-Ting Tsai, Chief Executive Officer of TeamT5.</center>
 

###About TeamT5
TeamT5 is a threat intelligence research team focused on the Asia-Pacific region. Leveraging Taiwan’s geographic position, language capabilities, and over two decades of research experience, TeamT5 specializes in the analysis of major threats such as APT activity and ransomware, providing regionally grounded threat intelligence to government, financial, and technology sectors.
With research at its core, TeamT5 continuously tracks the evolution of threat behavior and attack techniques, organizing complex activity into clear risk context. By monitoring both emerging and unknown threats and analyzing attacker behavior, TeamT5 helps organizations identify risks earlier, reduce exposure time, and strengthen preparedness. Research findings are shared across international security forums, while long-term partnerships are built on trust and practical collaboration.

###About TWNIC
The Taiwan Network Information Center (TWNIC) is Taiwan’s national network information center, responsible for managing critical internet resources and advancing Internet governance. It plays a key role in technological development, security enhancement, and multi-stakeholder collaboration within Taiwan’s internet ecosystem. TWNIC oversees the administration of the country-code top-level domains “.tw” and “.台灣,” continuously improving registration systems, security technologies, and service mechanisms to support Taiwan’s digital development.
In response to rapid technological advancements and emerging challenges such as artificial intelligence applications, cybersecurity risks, and online fraud, TWNIC actively promotes initiatives in network security, digital trust, and governance resilience. Through institutional frameworks, technical innovation, and cross-sector collaboration, TWNIC ensures the stability, integrity, and trustworthiness of the domain name space, contributing to a more reliable digital environment. Guided by principles of public interest, professional governance, and sustainable development, TWNIC is committed to building a secure, open, inclusive, and trusted digital ecosystem for Taiwan.

TeamT5 and TWNIC Sign MOU to Strengthen Threat Intelligence Sharing and Cybersecurity Resilience in Taiwan

2026-04-24 台北

專注於網路威脅研究與資安情資分析的 TeamT5 杜浦數位安全今日宣布，正式與台灣網路資訊中心（TWNIC）簽署合作備忘錄（Memorandum of Understanding, MOU）；雙方將建立威脅情資共享機制，透過資源整合與協同合作，提升台灣整體資安防護能力，並促進資安產業發展。

此次合作將聚焦於威脅情資的交換與研究，TeamT5 以其專長，提供進階持續性威脅（advanced persistent threat, APT） 相關之入侵指標、網路犯罪之技術分析；TWNIC 則以DNS 相關解析數據、蜜罐（Honeypot）所蒐集去識別化[曉李1] [易林2] 的資料。透過高品質的情資共享，雙方期望更快速辨識潛在風險，強化預警與應變能力。

TeamT5 長期深耕亞太地區資安威脅研究，具備豐富的 APT 情資、惡意軟體分析經驗。TWNIC 則作為台灣網路基礎設施的重要推動者，在網域名稱管理與網路治理領域扮演關鍵角色。此次合作結合雙方專業，將進一步提升台灣在國際資安社群中的能見度與影響力。

TeamT5 執行長蔡松廷表示：「面對日益複雜且持續演進的網路威脅，單一組織難以獨力應對。透過與 TWNIC 的合作，我們期待建立更緊密的情資交流機制，將研究成果轉化為實際防護能力，為台灣打造更具韌性的資安環境。同時，我們也希望透過此次合作，進一步強化 TeamT5 作為亞太威脅情資領航者的定位，持續在全球資安領域發揮關鍵影響力。」

TWNIC 執行長余若凡表示：「隨著網路威脅持續演變，TWNIC 作為台灣網路關鍵基礎設施的重要一環，持續投入於 DNS 防護與威脅情資的蒐集與分析，並致力於將這些能力轉化為能夠實際推動的防護機制。」余若凡進一步指出：「此次與 TeamT5的合作，將有助於擴展情資來源與分析深度，透過更有效的資訊整合與應用，強化對惡意行為的偵測與應對能力，進一步提升整體網路安全防護能量。」

未來，TWNIC 也將持續扮演連結國內外資安社群的角色，促進合作與交流，為台灣打造更穩定且可信賴的網路環境。

雙方也將在此合作基礎上，持續探索更多合作面向，包括資安研究、技術交流等，共同推動台灣資安生態系的長期發展。

 

![](https://uploads.teamt5.org/upload/original/pic_teamt5-and-twnic-sign-mou-to-advance-threat-intelligence-sharing-and-strengthen-taiwan-s-cybersecurity-resilience.jpg)
<center>TeamT5 與 TWNIC 簽署合作備忘錄，攜手推動威脅情資共享 強化台灣資安防護能量。</center>
<center>左為 TWNIC 執行長余若凡，右為 TeamT5 執行長蔡松廷。</center>

 


###關於 TeamT5
TeamT5 杜浦數位安全專精研究網路攻擊、資安威脅，由專家團隊提供完整的資安防禦與應變服務，藉由威脅情資平台與全時監控的防勒索 EDR，為企業提供有效的資安防禦。客戶來自美國、日本、臺灣、東南亞，產業別涵蓋政府機關、金融、科技、電信、資安服務提供商，持續保護機密文件，阻斷網路攻擊。

###關於 TWNIC
財團法人台灣網路資訊中心（TWNIC）為我國國家級網路資訊中心，長期負責我國網際網路關鍵資源管理及網路治理相關工作，並在網路技術發展、安全機制強化及多方合作協力上持續投入，為台灣網路基礎環境的重要推動力量。TWNIC 主要負責「.tw」及「.台灣」國碼頂級網域名稱管理，並持續精進相關註冊制度、安全技術及服務機制，以支持我國數位發展所需之基礎環境。面對數位科技快速演進，以及人工智慧應用、資安風險、網路詐騙等新興挑戰，TWNIC 持續就網路安全、數位信任與治理韌性等議題推動相關工作，並透過制度建構、技術強化及跨域合作，維護網域名稱空間之穩定、完整與可信任，協助建立更具信任基礎之數位環境。
TWNIC 持續以公共利益、專業治理及永續發展為核心，穩健推動安全、開放、包容且值得信任之數位環境，為台灣整體數位發展奠定更堅實基礎。

TeamT5 與 TWNIC 簽署合作備忘錄（MOU）攜手推動威脅情資共享 強化台灣資安防護能量

>TeamT5 is committed to upholding the highest security standards to ensure the integrity and functionality of our products. During recent security audits, our PSIRT team identified a vulnerability in ThreatSonar Anti-Ransomware. Details are in the paragraphs below.

The TeamT5 PSIRT team, upon discovering the vulnerability, followed the company’s [Vulnerability Disclosure Policy](https://teamt5.org/en/vulnerability-disclosure/). On March 2, 2026, they closely coordinated with TWCERT to report the vulnerability details, apply for a CVE, and carry out remediation work. Customers were also notified on March 18, 2026, to install the patch.

The vulnerabilities have been assigned CVE-2026-5966 and CVE-2026-5967.

This Notice once again strongly urges users to update immediately.

 

- **Vulnerability Description** 
Fixes for a root privilege escalation vulnerability and an arbitrary file deletion vulnerability.

- **Affected Products** 
ThreatSonar Anti-Ransomware versions 4.0.0 earlier.

- **Recommended Solution** 
 - For on-premises customers, please look at the links in the security update notice for the patch.
 - For cloud version customers, the patch has already been applied on 2026/03/03.

 

We apologize for any inconvenience this may cause and appreciate your prompt attention to this matter. If you require assistance or have any questions, please do not hesitate to contact our technical support team.

[Vulnerability Notice - 20260420] ThreatSonar Anti-Ransomware versions 4.0.0 earlier.

>TeamT5 致力於維持最高的安全標準以確保產品的完整性與功能性。近期，TeamT5 PSIRT 團隊於內部稽查時，發現 ThreatSonar Anti-Ransomware 產品中存在漏洞，相關說明如後文。

TeamT5 PSIRT 團隊發現漏洞後，依循本公司漏洞揭露政策進行通報處理流程，並於 2026/3/2 與TWCERT 密切聯繫，通報漏洞細節、申請 CVE 漏洞編號及進行產品漏洞修補作業，亦於 2026/3/18 通知客戶安裝修補程式。

本次揭露之漏洞 CVE 編號為 CVE-2026-5966 與 CVE-2026-5967。

本通告再次敬請用戶立即進行更新。

 

- **漏洞說明** 
修正 root privilege escalation 與 arbitrary file deletion 漏洞

- **影響版本** 
ThreatSonar Anti-Ransomware 4.0.0 以下版本

- **處理情形** 
 - 落地版本用戶請參考 TeamT5 客戶公告信連結進行更新修復
 - 雲端版本用戶已於 2026/03/03 完成修補更新

 

我們對可能造成的不便表示歉意，並感謝您的立即合作與理解。若您需要協助或有任何疑問，我們的技術支援團隊隨時準備提供協助。

【漏洞通告 - 20260420】ThreatSonar Anti-Ransomware 4.0.0 以下版本

【弱性に関するお知らせ】ThreatSonar Anti-Ransomware: [Link](https://teamt5.org/en/posts/vulnerability-notice-20260420-threat-sonar-anti-ransomware-versions-4-0-0-earlier/)

【弱性に関するお知らせ - 20260420】ThreatSonar Anti-Ransomware

TeamT5 is proud to announce our participation in [CyberSecMY Conference 2026 (CSMY2026)](https://cybersecasia.org/csmy2026), one of Malaysia’s premier cybersecurity events bringing together cybersecurity leaders, practitioners, and decision-makers across industries.

CSMY2026 serves as a vital platform for addressing today’s most pressing cybersecurity challenges and sharing best practices in an increasingly complex threat landscape. With 40+ distinguished speakers and panelists, the conference delivers deep insights into the latest cyber threats, trends, and defensive strategies shaping the future of security.

The event is expected to welcome 400+ senior security professionals from sectors including financial services, retail, IT, healthcare, public sector, enterprises, and consumer businesses. 

At CSMY2026, TeamT5 will demonstrate how our advanced threat intelligence and APT research empower organizations to proactively detect, understand, and mitigate sophisticated cyber threats. Our team looks forward to engaging with industry peers, exchanging insights, and supporting Malaysia’s cybersecurity resilience.

Visit TeamT5 at the exhibition area and connect with our experts to learn how actionable threat intelligence can strengthen your security posture.

## TeamT5 at CyberSecMY Conference 2026
- **Date**: May 19-20, 2026
- **City**: Kuala Lumpur, Malaysia
- We'll have a booth at the venue. Welcome to talk us at the booth.

 

###Speech: The Evolving Cybersecurity Landscape in APAC: Real-World Threat Cases from Malaysia
- **Time**: 2:25 PM in May 20 (It may subject to change under organizer's arrangement)
- **Speaker**: John Lu (Assistant Vice President, Global Engagement, TeamT5)
- **About Speaker**: 
John is the AVP of Global Sales at TeamT5 and a cybersecurity veteran with over 15 years of experience. Before transitioning into his global sales role, he spent seven years leading the technical support team at TeamT5, working closely with organizations to develop practical threat hunting strategies and translate complex threat intelligence into actionable security insights.

- **About Speech**:
 - Geopolitical drivers of state-sponsored espionage and its impact on regional stability.
 - The APT Landscape: Identifying major regional APT actors, TTPs, motivations, and target industries. 
 - Malaysia-Specific case studies.
 - Turning threat intelligence into proactive threat hunting strategies.

TeamT5 at CyberSecMY Conference 2026 (CSMY2026)

Events

For nearly two decades, TeamT5 has been deeply rooted in the Asia-Pacific region—researching threat actors, tracking attack campaigns, and uncovering overlooked risks and signals.

Today, we officially unveil TeamT5’s new brand identity. This transformation is more than a visual update; it is a definitive signal of our identity, our values, and our global trajectory.

##A Threat Intelligence Pioneer Rooted in Asia-Pacific
TeamT5 is a threat intelligence pioneer born in Asia.

Based in Taiwan, we leverage an unique geopolitical perspective and deep linguistic expertise to track Advanced Persistent Threats (APTs) and ransomware activity across the region.

We provide more than just data to government agencies, financial institutions, and technology leaders ; we deliver actionable insights grounded in regional context—intelligence that organizations can immediately deploy in high-stakes environments.

This rebranding does not change our direction. Instead, it is the purest expression of the mission we have upheld from the start: Transforming complex threats into decisive action.

##The Evolution: From Technical Roots to Global Trusted Partner
TeamT5’s mission has always been clear, though never simple:
**Transform complex threats into actionable intelligence that enables organizations to move from reactive defense to smarter detection and response.**

As threats evolve faster and become harder to track and interpret, the value of intelligence cannot stop at simply telling organizations what has happened.

This moment marks a pivotal step forward:
- **A Mature Identity**: We have evolved from a technical startup into a professional, trusted enterprise brand.
- **Global Unity**: We are establishing a unified presence as we expand our long-term footprint in international markets.
- **Operational Focus**: Our new visual identity reflects how we operate—remaining alert as threats evolve, acting swiftly in critical moments, and staying sharply focused on what truly matters.

**The concept of our new logo - The Spotlight: Sharpen the Sight. It symbolizes our role in the ecosystem.**

We are not defenders standing passively under the spotlight. Instead, we are intelligence hunters who precisely locate threats in the shadows, operating at the boundary between the visible and the unseen.
Our goal is not to illuminate everything. Rather, we focus on the signals that truly matter—so our customers can see more clearly, assess risks confidently, and act decisively.

 
![](https://uploads.teamt5.org/upload/original/teamt5-from-an-apac-threat-intelligence-pioneer-to-a-global-leader_en_pic.png)
 


##Our Core Values: Threat Intelligence that Powers Proactive Defense
We believe the value of threat intelligence lies not in the volume of information, but in whether it enables organizations to identify critical signals earlier.

TeamT5’s vision is to become **the most trusted threat intelligence partner in the Asia-Pacific region**, helping organizations move from **responding to attacks** toward **anticipating threats**.

Behind this vision are the four core values that have long guided TeamT5. These values are not just principles—they shape how we conduct research, build products, and collaborate with partners.

###Continuous Exploration
We never stop exploring.
Beyond monitoring known threats, we actively venture into the unknown—uncovering overlooked signals in complex threat landscapes and revealing emerging attack patterns and techniques.

###Precise Insight
Precision is the foundation of proactive defense.
We do more than track indicators—we analyze the logic behind threats so that intelligence can truly support critical decision-making.

###Agile Action
Speed is essential when facing cyber threats.
We track every step of the attacker, enabling action before threats escalate and transforming intelligence into real-time protection.

###Trusted Collaboration
Threat intelligence becomes stronger when shared.
Through open knowledge exchange and two-way communication, we build long-term partnerships with customers and collaborators based on trust—standing together against evolving threats.

##Continuing the Journey of Exploration
TeamT5 is both an explorer and an innovator in threat intelligence.

We lead the discovery of emerging threats, deconstruct adversary behavior, and build defensive capabilities that evolve as quickly as our adversaries.

This rebranding represents our continued commitment to **exploration, insight, action, and collaboration**. It also reaffirms our belief:
**When intelligence is done right, organizations gain the advantage in cyber defense.**

TeamT5’s founding mission remains unchanged—
**more precise intelligence, earlier action.**

We are ready. The next chapter starts now.

TeamT5: From an APAC Threat Intelligence Pioneer to a Global Leader

近二十年來，TeamT5 深耕亞太地區——研究威脅行為者、追蹤攻擊行動，並探索容易被忽略的風險與線索。今天，我們正式發布TeamT5 全新品牌識別，這不僅展現我們是誰、我們堅持什麼，也清楚描繪我們即將前往的方向。

##立足亞太的威脅情資領航者
TeamT5 是一家誕生於亞洲的威脅情資領航者。

我們立足台灣，憑藉獨特的地緣政治視角、深厚語言與在地研究能力，加上近二十年的研究經驗，專注追蹤亞太地區的進階持續性威脅 （APT）與勒索軟體威脅。從政府機構、金融單位到科技領導者，我們提供的不僅是精準的威脅情資，更是貼近在地情境與脈絡、能夠直接採取行動的的威脅情資洞察。

這次品牌再造，並非改變方向，而是更清楚地表達我們一直以來堅持的核心使命。

##將複雜威脅轉化為行動
TeamT5 的使命始終清楚簡單，卻也不容易：
將複雜的威脅，轉譯為可採取行動的情資洞察，協助組織從被動防禦，邁向更智慧的偵測與應對。

隨著威脅變得更快速、更難以追蹤判斷，情資的價值不能只停留在「告知發生了什麼事」。更重要的是，它必須能夠讓組織及早看見重要的訊號，促成行動——做出果斷、有信心的決策。

也因此，現在是 TeamT5 主動邁向下一階段的重要時刻。隨著我們在亞太地區乃至全球的影響力不斷擴大，我們需要一個能代表 TeamT5 視野格局、深度與可靠性的品牌形象。此次品牌重塑，象徵我們從新創、技術的形象，邁向更專業、可信賴的企業品牌，並建立全球一致的企業識別，推動我們在國際市場的長期布局。

這樣的演進，也反映在我們今日的全新視覺識別上。它呈現 TeamT5 在現實世界中的運作方式——在威脅持續演進時，我們保持敏銳、持續追蹤；在關鍵時刻，我們快速判斷、協助決策；資訊再多，我們仍要精準聚焦。

全新 Logo 概念——**「聚光焦點：銳化視野（The Spotlight: Sharpen the Sight）」**——象徵 TeamT5 的角色不是在聚光燈下被動防守，而是在暗處精準定位威脅的情資獵手，在可見與不可見的邊界行動。我們不追求照亮一切，而是聚焦在真正重要的關鍵訊號，讓客戶能更清晰看見、判斷，並果斷行動。

 
![](https://uploads.teamt5.org/upload/original/teamt5-from-an-apac-threat-intelligence-pioneer-to-a-global-leader_tw_pic.png)
 


##驅動主動防禦的威脅情資
我們相信，威脅情資的價值不在於資訊量，而在於能不能讓組織更早看見真正重要的訊號。

TeamT5 的願景，是成為亞太地區最值得信賴的威脅情資夥伴，協助組織從「回應攻擊」，走向「預判威脅」。

這願景的背後，有著 TeamT5 一直以來所堅持的四個核心價值。，它不僅是理念，更是我們研究、打造產品與合作方式的共同準則：

###持續探索（Continuous Exploration）
我們從不停止探索。不只關注已知威脅，更主動深入未知領域，在複雜的威脅環境中，找出被忽略的線索，揭露新的攻擊模式與新興手法。

###精準洞察（Precise Insight）
精準，是主動防禦的基礎。我們不僅關注指標，更深入理解威脅背後的邏輯，讓情資能真正支持關鍵決策。

###敏捷行動（Agile Action）
面對攻擊，速度至關重要。我們追蹤攻擊者的每一步，在威脅擴散前採取行動，將情資轉化為即時防護。

###信任協作（Trusted Collaboration）
情資能在社群分享過程中，變得更強大。透過開放的知識交流與雙向溝通，我們以信任為基礎，與客戶與合作夥伴建立的長期合作關係，並肩迎戰威脅。

##持續探索下一步
TeamT5 是威脅情資的探索者，也是創新者。
我們領先發現新型威脅、拆解攻擊者行為，並打造能與對手同樣快速進化的防禦能力。
這次品牌再造，代表我們對探索、洞察、行動與協作的持續承諾，也再次展現我們的信念：**當情資做到位，就能掌握攻防的主導權。**

**TeamT5 初衷不變—情資更精準，行動更超前。**

我們準備好，下一階段，現在開始。

TeamT5 威脅情資領航者，從亞太領先邁向全球

約20年間にわたり、TeamT5はアジア太平洋地域に深く根差し、脅威アクターの調査、攻撃キャンペーンの追跡、見過ごされがちなリスクや脅威の兆候解明に取り組んできました。

今日、弊社は正式に新たなブランドアイデンティティを発表します。この変革は単なるビジュアルの刷新ではなく、私たちのアイデンティティと価値観、そしてグロ－バルに向けた歩みを明確に示すものです。

##アジア太平洋にルーツを持つ脅威インテリジェンスの先駆者
TeamT5はアジアで生まれた脅威インテリジェンスのパイオニアです。

台湾を拠点に、独自の地政学的視点と高度な言語分析能力を活かし、アジア太平洋地域における高度持続的脅威（APT）やランサムウェアの活動を追跡しています。

私たちは政府機関、金融機関、テクノロジーリーダーなどに対して、単なるデータではなく、地域の文脈に基づいた実用的なインサイトを提供しています。これらは、組織の重要度の高い環境において即座に活用できる脅威インテリジェンスです。

今回のリブランディングは、私たちの進む方向を変えるものではありません。むしろ創業当初から掲げてきた使命ー「複雑な脅威を、決断につながる行動へと変えること」ーを最も純粋な形で表現するものです。

##進化：技術的ルーツから世界規模で信頼されるパートナーへ
TeamT5のミッションは決してシンプルではありませんが、常に明確です。

**「複雑な脅威を実用的なインテリジェンスへと変換し、組織が受動的な防御から、より高度な検知を対応へと移行できるように支援すること。」**

脅威はますます速い速度で進化し、追跡や分析が難しくなっています。こうした状況の中でインテリジェンスの価値は、単に「起きたこと」だけを伝えるに留まってはなりません。

より重要なのは、インテリジェンスによって組織が重要な兆候を早期にとらえ、具体的な行動につなげられるように支援することです。これにより組織は確信をもって迅速かつ的確な意思決定が行えます。

今回の節目はTeamT5にとって重要な前進を意味します。アジア太平洋地域、そして世界へと影響力が拡大していく中で、私たちはビジョンの規模、専門性の深さ、そしてお客様が信頼する確かな価値を反映したブランドが必要でした。

今回のブランドの刷新は、TeamT5の進化を象徴するもので、技術志向のスタートアップからより成熟し、専門性と信頼性を兼ね備えた企業ブランドへと成長した姿を示しています。また国際市場における長期的展開を見据え、統一されたグローバルブランディングアイデンティティを確立するものでもあります。

この進化は新しいビジュアルアイデンティティにも反映されており、現実の世界でTeamT5がどのように行動しているのかを示しています。

脅威が進化すれば、私たちは常に警戒を保ち、継続的に追跡します。
重要な局面が訪れれば、意思決定のための支援を即座に行います。
そして、どれだけ膨大な情報が存在したとしても、本当に重要なものに焦点を当て続けます。

**新しいロゴのコンセプト「スポットライト：視野を研ぎ澄ます（The Spotlight: Sharpen the Sight） 」これはサイバーセキュリティエコシステムにおけるTeamT5の役割を象徴しています。 **

私たちはスポットライトの下で受け身で立っているだけのディフェンダーではありません。見える領域と見えない領域の境界で活動し、影の中に潜む脅威を正確に特定するインテリジェンスハンターです。

私たちの目的は全てを照らし出すことではありません。本当に重要なシグナルに焦点を当てることで、お客様が状況をより明確に把握し、自信をもってリスクを評価し、迅速にかつ的確に行動できるよう支援することです。

 
![](https://uploads.teamt5.org/upload/original/teamt5-from-an-apac-threat-intelligence-pioneer-to-a-global-leader_en_pic.png)
 


##私たちのコアバリュー：能動的な防御を支える脅威インテリジェンス
私たちは、脅威インテリジェンスの価値は、情報の量ではなく、組織が重要な兆候をより早く見極められるようにすることにあると考えています。

TeamT5のビジョンはアジ**ア太平洋地域で最も信頼された脅威インテリジェンスパートナー**になることであり、組織が**攻撃への対応に追われる状態**から、**脅威を事前に予測**できる体制へと移行できるように支援することです。

このビジョンの背景にはTeamT5が長い間指針としてきた４つのコアバリューがあります。これらの価値は単なる理念ではなく、私たちがどのように調査を行い、製品を開発し、パートナーと協力していくかを形作るものです。

###継続的な探求（Continuous Exploration）
私たちは探求し続けることを止めません。
既知の脅威を監視するだけでなく、未知の領域にも積極的に踏み込みます。複雑な脅威環境の中で見過ごされがちな兆候を見つけ出し、新たに表れる攻撃パターンや手法を明らかにしていきます。

###鋭い洞察（Precise Insight）
精度こそが、プロアクティブな防御の基盤です。
私たちはインジケーターを追跡すること以上に、脅威の背後にあるロジックを分析することでインテリジェンスが重要な意思決定を真に支えられるようにします。

###機敏なアクション（Agile Action）
サイバー脅威に直面した際、スピードは極めて重要です。
私たちは攻撃者のあらゆる動きを追跡し、脅威が深刻化する前に行動できるよう支援、そしてインテリジェンスをリアルタイムの防御へとつなげます。

###信頼に基づく協力（Trusted Collaboration）
脅威インテリジェンスは共有されることで強くなります。
オープンな知識交換と双方向のコミュニケーションを通じて、私たちは顧客やパートナーとの長期的な信頼関係を築き、進化し続ける脅威に立ち向かいます。


##探究の歩みをこれからも
TeamT5は脅威インテリジェンスの探究者であり、イノベーターでもあります。
私たちは新たに出現する脅威の発見をリードし、攻撃者の行動を分析・解明するとともに、攻撃者と同じ速度で進化する防御能力を構築しています。

今回のリブランディングは、**探求、洞察、行動**、そして**協力**への私たちの継続的なコミットメントを示すものであり、また、私たちの信念を改めて再確認するものでもあります。

**脅威インテリジェンスが正しく機能すれば、組織はサイバー防御において主導権を得ることができる。**

TeamT5の創業以来のミッションは変わっていません。 
**—「より高精度のインテリジェンス、より先手のアクション」—** 

私たちの準備はできています。次の章が今、ここから始まります。

TeamT5: APAC地域の脅威インテリジェンス先駆者からグローバルリーダーへ

TeamT5 acknowledges the recent updates by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its [Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/news-events/alerts/2026/02/17/cisa-adds-four-known-exploited-vulnerabilities-catalog), which highlights vulnerabilities that have been seen exploited in the wild by malicious actors and underscores the importance of effective remediation and ongoing vigilance within the cybersecurity ecosystem.

We would like to clarify our position and provide accurate context regarding the historical vulnerability referenced in the KEV Catalog and related reporting:

**1. Historical Vulnerability Identified and Fully Remediated**

The vulnerability referenced in the KEV Catalog and in related media reports pertains to an issue identified in 2024 within our ThreatSonar Anti-Ransomware product. 

- The vulnerability was proactively discovered by TeamT5’s Product Security Incident Response Team (PSIRT) during internal security reviews.
- Upon discovery, TeamT5 immediately developed and released a patch, and we **proactively assisted all affected customers with updating to the remediated version.**
- All impacted customers have since migrated off the vulnerable versions; **no customer systems remain in service with the affected release.**

A public advisory was issued by TeamT5 in July 2024 with [full details about the vulnerability and patch guidance](https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/).

**2. Strengthening Security Posture and Resilience**

In direct response to this and similar industry risk signals such as those highlighted in recent CISA KEV updates, TeamT5 has invested significantly in strengthening our security practices:

- Enhancing our secure software development lifecycle and product security controls.
- Formalizing and standardizing internal incident response and vulnerability management processes.
- Engaging independent third-party security teams for red team exercises and external validation of our security defenses.

These investments reaffirm our commitment to industry best practices and customer protection.

**3. Ongoing Monitoring and Threat Detection**

TeamT5 maintains continuous monitoring of threats and exploitation activity impacting our products and the broader cybersecurity landscape. Our security and threat intelligence teams remain alert to emerging risks and stand ready to respond quickly with mitigations and customer support when needed.

**4. Commitment to Community and Transparency**

We support initiatives like the CISA KEV Catalog as an important resource for helping organizations prioritize remediation of vulnerabilities exploited in the wild. TeamT5 continues to collaborate with the cybersecurity community, share information responsibly, and ensure our customers are informed and protected.


TeamT5 Statement Regarding CISA’s KEV Catalog Updates

美國網路安全暨基礎設施安全局（CISA）近期更新其「[已知遭利用漏洞](https://www.cisa.gov/news-events/alerts/2026/02/17/cisa-adds-four-known-exploited-vulnerabilities-catalog)」（Known Exploited Vulnerabilities，KEV）目錄，包括 CVE-2024-7694。

TeamT5 就 KEV 目錄及相關報導所提及的歷史漏洞 CVE-2024-7694，說明如下：

**1. 歷史漏洞已完成全面修補**

此歷史漏洞為 2024 年於 ThreatSonar Anti-Ransomware 產品中識別之問題。
- 該漏洞由 TeamT5 產品安全事件回應小組（PSIRT）於內部安全檢視過程中主動發現。
- 在發現漏洞後，TeamT5 立即發布修補程式，**並主動協助所有受影響客戶更新至已修補版本。**
- 所有受影響客戶均已自受影響版本遷移完成；**目前無任何客戶系統仍在使用該受影響版本。**

TeamT5 並已於 2024 年 7 月發布公告，提供[漏洞完整資訊與修補指引](https://teamt5.org/tw/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/)。

**2. 強化安全態勢與韌性**

針對本次事件，以及近期 CISA KEV 更新所凸顯之同類產業風險訊號，TeamT5 已投入資源強化安全實務：
- 強化安全軟體開發生命週期（Secure SDLC）與產品安全控制措施。
- 建立標準化的內部事件回應與漏洞管理流程。
- 延請獨立第三方資安團隊執行紅隊演練，並進行外部安全防禦驗證。

這些措施強化並落實 TeamT5 對產業最佳實務與客戶保護之承諾。

**3. 持續監控與威脅偵測**

TeamT5 持續監控影響本公司產品及整體資安環境之威脅與漏洞利用活動。我們的資安與威脅情資團隊將持續關注新興風險，並在客戶需要時迅速提供緩解措施與相關支援。

**4. 實踐資安社群合作與透明揭露之承諾**

我們支持 CISA 所建立的 KEV 目錄機制，能協助企業與組織更有效地判斷哪些漏洞具有實際被攻擊利用的風險，並優先進行修補與防護。TeamT5 將持續與全球資安社群合作，揭露相關資訊，確保客戶能即時掌握風險、獲得必要協助，並維持最佳防護狀態。


TeamT5 關於 CISA KEV 目錄更新之聲明

TeamT5は、米国サイバーセキュリティ・インフラセキュリティ庁（CISA）が最近実施した[Known Exploited Vulnerabilities（KEV）](https://www.cisa.gov/news-events/alerts/2026/02/17/cisa-adds-four-known-exploited-vulnerabilities-catalog)カタログの更新を認識しています。このカタログは、悪意ある攻撃者によって実際に悪用されたことが確認されている脆弱性を示すものであり、サイバーセキュリティ環境システムにおける効果的な修正対応および継続的な警戒の重要性を強調するものです。

当社の立場を明確にし、KEVカタログおよび関連報道で言及されている過去の脆弱性について正確な背景情報を提供いたします。

**1. 過去に特定され、完全に修正済みの脆弱性**

KEVカタログおよび関連メディア報道で言及されている脆弱性は、2024年に当社のThreatSonar Anti-Ransomware製品内で特定された問題に関するものです。
- この脆弱性は、TeamT5のProduct Security Incident Response Team（PSIRT）が社内セキュリティレビューの過程で自ら発見しました。
- 発見後、TeamT5は直ちにパッチを開発・リリースし、**影響を受けたすべての顧客に対して修正版へのアップデートを積極的に支援しました。**
- 影響を受けたすべての顧客はその後、脆弱なバージョンから移行しており、**該当リリースを使用したまま稼働している顧客システムはありません。**

2024年7月、TeamT5は当該脆弱性およびパッチ適用方法に関する詳細を含む[公開アドバイザリ](https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/)を発表しました。

**2. セキュリティ態勢とレジリエンスの強化**

今回の件および、最近のCISA KEV更新で示されたものを含む同様の業界リスクシグナルへの直接的な対応として、TeamT5はセキュリティ実践の強化に大きく投資してきました。

- セキュアソフトウェア開発ライフサイクルおよび製品セキュリティ管理の強化
- 社内インシデント対応および脆弱性管理プロセスの定式化と標準化
- レッドチーム演習および外部セキュリティ防御の検証のための、独立した第三者セキュリティチームの活用

これらの投資は、業界ベストプラクティスと顧客保護に対する当社のコミットメントを改めて示すものです。

**3. 継続的な監視と脅威検知**

TeamT5は自社製品と広範囲のサイバーセキュリティランドスケープに影響を与える、脅威と侵略行動の継続的な監視を維持しています。我々のセキュリティおよび脅威インテリジェンスチームは、新たに出現するリスクに警戒を続け、必要に応じた迅速な緩和策や顧客支援を提供できる体制を維持しています。

**4. コミュニティおよび透明性へのコミットメント**

当社は、実際に悪用されている脆弱性の修正優先順位付けを支援する重要なリソースとして、CISA KEVカタログのような取り組みを支持しています。TeamT5は引き続きサイバーセキュリティコミュニティと協力し、責任をもって情報共有を行い、我々のお客さまへの情報提供と保護の徹底に努めてまいります。



CISAのKEVカタログ更新に関するTeamT5声明

We are pleased to announce that we will be exhibiting at **RSA Conference 2026**, one of the world’s leading cybersecurity events, taking place in San Francisco.
This year, we will join the **Taiwan Pavilion** and present our approach to threat **intelligence built from Asia-born insights with global relevance**.

- **Event**: RSA Conference 2026
- **Expo date**: March 24-26, 2026
- **Booth**: S-1561
- **Location**: Moscone Center at San Francisco, USA

##Threat Intelligence Pioneer, Born in Asia
Cyber threats do not emerge evenly across regions.Many large-scale campaigns and advanced persistent threats (APTs) are first observed in Asia before expanding globally.

As a threat intelligence team born and rooted in Asia, we focus on delivering early visibility into adversary behavior, regional geopolitical context, and long-term campaign evolution—helping organizations understand not only what is happening, but why it is happening.

At RSA Conference 2026, we will showcase how Asia-Pacific–centric intelligence can complement global security strategies and close critical visibility gaps.

##Our Threat Intelligence Approach
Our intelligence framework is designed to support security decision-making across strategic, tactical, and operational layers:
###Strategic: Geopolitical Insight & Adversary Profiling
We analyze geopolitical drivers and long-term adversary behavior to help organizations anticipate emerging threats, understand attacker motivations, and assess risk beyond isolated incidents.

###Tactical: Intelligence-Driven Threat Hunting
Our intelligence translates real-world adversary TTPs and active campaign insights into actionable threat hunting, enabling security teams to focus on relevant actors rather than generic indicators.

###Operational: Threat Response
We help organizations operationalize threat intelligence and ensure intelligence is embedded directly into detection and response workflows.

Together, these layers turn threat intelligence from static information into practical, actionable defense. For more about our threat intelligence reports and platform "ThreatVision", please check [here](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).


##Meet Us at RSA Conference 2026
Throughout the three-day event, our team will be available at Booth S-1561 to discuss:
- Asia-Pacific threat actors and campaigns
- Intelligence-driven threat hunting strategies
- Operationalizing threat intelligence at scale
- How regional intelligence enhances global defense

Whether you are building a CTI program, refining threat hunting workflows, or looking to strengthen operational response, we welcome the opportunity to connect.

 

**Threat Intelligence Pioneer, Born in Asia** 
📍 Visit us at RSA Conference 2026 – Booth S-1561 (Taiwan Pavilion)

 

![](https://uploads.teamt5.org/upload/original/teamt5-rsa-conference-2026_pic.png)

We’re Exhibiting at RSA Conference 2026

TeamT5 將參加 RSA Conference 2026，此為全球最具指標性的資安盛會之一，於美國舊金山舉行。
本次展會中，我們將進駐 Taiwan Pavilion（台灣館），並展示我們以亞洲視角出發、全球企業適用的威脅情資與洞見。
- **展會名稱**：RSA Conference 2026
- **展出日期**：3月24日~3月26日
- **展出地點**：美國舊金山 Moscone Center
- **攤位編號**：S-1561（Taiwan Pavilion）

##Threat Intelligence Pioneer, Born in Asia 威脅情資領航者
作為一支深耕亞洲的威脅情資團隊，我們專注於解析攻擊者行為背後的脈絡——包含地緣政治因素、長期對手活動與跨區域攻擊演進，協助組織不只看見「正在發生什麼」，更能理解「為何會發生」。

在 RSA Conference 2026，我們將分享亞洲威脅情資如何補足全球防禦視角中的關鍵盲點。

##我們的威脅情資特點
我們的威脅情資設計，旨在支援從策略到實務的完整資安決策流程，涵蓋三個層面：

###Strategic｜地緣政治洞察與對手輪廓分析
透過分析地緣政治趨勢與長期對手行為，協助組織提前辨識潛在威脅、理解攻擊者動機，並在事件發生前建立風險認知。

###Tactical｜以情資驅動的威脅獵捕
將真實世界的攻擊者 TTP 與活動中的攻擊行動，轉化為可實際執行的威脅獵捕策略，讓資安團隊聚焦於真正相關的對手與行動，而非大量雜訊。

###Operational｜威脅回應
透過行動導向情資，協助組織將威脅情資直接落實於偵測與回應流程中，確保情資不僅被閱讀，而是被有效使用。

採用我們的威脅情資與平台 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)，為您的企業打造資安韌性。

##歡迎於 RSA Conference 2026 與我們交流
展會三天展覽期間，我們的團隊將於台灣館攤位 S-1561 與現場來賓交流以下主題：
- 亞太地區威脅行為者與攻擊活動
- 情資導向的威脅獵捕實務
- 區域情資如何強化全球防禦策略

無論您正在建立威脅情資能力、優化獵捕流程，或尋求更有效的資安防禦運作方式，誠摯歡迎蒞臨交流。

 
**Threat Intelligence Pioneer, Born in Asia** 
📍 RSA Conference 2026｜Taiwan Pavilion (Booth# S-1561)

 

![](https://uploads.teamt5.org/upload/original/teamt5-rsa-conference-2026_pic.png)

TeamT5 將於 RSA Conference 2026 展出

This year, Japan Security Analyst Conference 2026 (JSAC2026) will be held on Jan. 21-23. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis. 

Our Vulnerability Researcher, Greg Chen, and Incident Response Engineer, Sharon Liu, will deliver a talk titled “Incident Response at the Edge: Unmasking the Massive Exploitation of Ivanti” from 16:10 to 16:50 on January 22.

### About Speech
Since April 2025, TeamT5 has been warning of large-scale exploitation campaigns against Ivanti Connect Secure VPN, in which hundreds of devices belonging to the governments and enterprises across more than 20 countries were compromised by the notorious SPAWN malware family (reference). In particular, over 40 companies’ Ivanti appliances were compromised in Japan, affecting high-value industries such as telecommunications, semiconductors, electronics, etc.

These attacks demonstrate the growing risks at the edge of enterprise networks. Despite being the backbone of remote access, VPN appliances often operate as "black boxes" —proprietary devices with only web-based maintenance access for IT. The lack of low-level shell control makes them opaque and proprietary, creating blind spots in enterprise security. Their limited visibility allows attackers to maintain long-term persistence while making these devices exceptionally hard to investigate.

This leads to the core focus of our presentation, which centers on the Ivanti VPN appliance and covers three main areas: (1) how we identify VPN devices compromised by the SPAWN malware family, (2) our methodology for investigating such black-box systems, and (3) the use of heuristic approaches beyond traditional pattern-based detection.

Ultimately, we demonstrate practical detection solutions capable of identifying the SPAWN malware families in Ivanti appliances, along with detection strategies that organizations can adopt to strengthen defenses against ongoing and future VPN-targeted attacks.





### About JSAC 2026
- Time: Jan. 21-23, 2026
- Venue: Akasaka Intercity Conference Center, Tokyo, Japan
- Website: https://jsac.jpcert.or.jp/en/index.html


Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.


【Japan Security Analyst Conference 2026】TeamT5 Will Give Speech on the the Massive Exploitation of Ivanti

日本資安分析研討會 Japan Security Analyst Conference 2026 (JSAC2026) 將於1月21-23日舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件應變與分析的技術、知識。

本年度活動中，於1月22日16:10-16:50，TeamT5 威脅情資團隊成員 Greg Chen (漏洞研究員) 與 Sharon Liu (資安事件應變工程師)共同發表演講，分析 Ivanti 漏洞帶來的大規模濫用事件。

歡迎蒞臨、聆聽本次演講。

### 關於JSAC 2026
- 時間：2026/1/21-1/23
- 地點：日本東京 Akasaka Intercity Conference Center
- 官網：https://jsac.jpcert.or.jp/en/index.html


日本電腦網路危機處理暨協調中心 (JPCERT/CC) 指出每天都會發生網路攻擊事件，攻擊者的技術也持續變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。



日本資安分析師研討會 JSAC2026

TeamT5のインテリジェンス主導型サイバーセキュリティソリューションについて学べるイベントへぜひご参加ください。

##今後のイベント
###2026/5/5 ～ 5/7　CYBERSEC
- 国：台湾
- 会場：台北南港展覧館 ホール2（台北）
- 詳細：[イベント公式サイト](https://cybersec.ithome.com.tw/2025/en/)


###2026/6/15 ～ 6/19　FIRSTCON
- 国：アメリカ
- 会場：Sheraton Denver Downtown Hotel（コロラド州デンバー）
- 詳細：[イベント公式サイト](http://www.first.org/conference/2026)


###2026 Digital Government Summit
- 国：台湾
- 開催都市：台北
- 詳細：[イベント公式サイト](https://egov.ithome.com.tw/2025/index.html)


###2026/12/2 ～ 12/3　Threat Analyst Summit
- 国：台湾
- 会場：ILLUME TAIPEI（台北）
- 詳細：[イベント公式サイト](https://tas.teamt5.org/?utm_source=websitecalendar&utm_medium=website)

 
 
###過去のイベント
###2026/1/21 ～ 1/23　JSAC
- 国：日本
- 会場：御茶ノ水ソラシティ カンファレンスセンター（東京）
- 当社のサイバー脅威インテリジェンス研究者が会場で講演を行います。
- 詳細：[イベント公式サイト](https://jsac.jpcert.or.jp/)

###2026/3/23~3/26 RSA Conference
- 国：アメリカ
- 会場：Moscone Center, San Francisco, CA
- ブース: S-1561 (Taiwan Pavilion)
- 詳細：[イベント公式サイト](https://www.rsaconference.com/usa)

 
 
※各イベントの内容は主催者の都合により変更となる場合があります。 
※本記事は随時更新されます。

【TeamT5 イベントカレンダー 2026】 ぜひお立ち寄りいただき、貴社のサイバー・レジリエンス強化にお役立てください！

Welcome to the event to learn about TeamT5's intelligence-driven cybersecurity solutions.

##Future Events
###2026/5/5~5/7 CYBERSEC
- Country: Taiwan
- Venue: Hall 2 of Taipei Nangang Exhibition Center, Taipei
- Official website: [link](https://cybersec.ithome.com.tw/2025/en/)

###2026/5/19~5/20 CyberSecMY
- Country: Malaysia
- City: Kuala Lumpur
- More about TeamT5’s booth and speech: [link](https://teamt5.org/en/posts/cyber-sec-my-conference-2026/)
- Official website: [link](https://cybersecasia.org/csmy2026)

###2026/6/15~6/19 FIRSTCON
- Country: USA
- Venue: Sheraton Denver Downtown Hotel, Denver, CO
- Official website: [event website](http://www.first.org/conference/2026)

###2026 Digital Government Summit
- Country: Taiwan
- City: Taipei
- Official website: [event website](https://egov.ithome.com.tw/2025/index.html)

###2026/12/2~12/3 Threat Analyst Summit
- Country: Taiwan
- Venue: ILLUME TAIPEI, Taipei
- Official website: [event website](https://tas.teamt5.org/?utm_source=websitecalendar&utm_medium=website)

## Past Events
###2026/1/21 ~ 1/23 JSAC
- Country: Japan
- Venue: Ochanomizu Sora City Conference Center, Tokyo
- Our cyber threat intelligence researchers will give a speech at the venue.
- More info: [event website](https://jsac.jpcert.or.jp/)

###2026/3/23~3/26 RSA Conference
- Country: USA
- Venue: Moscone Center, San Francisco, CA
- Booth: S-1561 (Taiwan Pavilion)
- More info: [event website](https://www.rsaconference.com/usa)

 
 

*The information of each event is subject to change by the organizer. 
*This article is updated from time to time.

【TeamT5 Event Calendar 2026】Come by to find suitable solutions and build cybersecurity resilience!

歡迎參加，了解 TeamT5 以情資驅動的資安解決方案。

##未來展會

###2026/5/5~5/7 臺灣資安大會
- 國家：臺灣
- 地點：台北南港展覽館2館
- 更多資訊：[TeamT5 參展資訊](https://cybersec2026.teamt5.org/)

###2026/5/19~5/20 CyberSecMY
- 國家：馬來西亞
- 城市：吉隆坡
- 更多資訊：[官網](https://cybersecasia.org/csmy2026)


###2026/6/15~6/19 FIRSTCON
- 國家：USA
- 活動地點：Sheraton Denver Downtown Hotel, Denver, CO
- 更多資訊：[活動官網](http://www.first.org/conference/2026)

###2026 數位政府高峰會
- 國家：臺灣
- 地點：台北富邦國際會議中心
- 更多資訊：[活動官網](https://egov.ithome.com.tw/2025/index.html)

###2026/12/2~12/3 威脅分析師高峰會(Threat Analyst Summit)
- 國家：台灣
- 地點：台北茹曦酒店
- 更多資訊：[官網](https://tas.teamt5.org/?utm_source=websitecalendar&utm_medium=website)


##過去展會
###2026/1/21 ~ 1/23 JSAC
- 國家：日本
- 地點：Akasaka Intercity Conference Center (東京)
- TeamT5 威脅情資研究員將會於本研討會發表演講
- 更多資訊：[官網](https://jsac.jpcert.or.jp/)
 
###2026/3/23~3/26 RSA Conference
- 國家：美國
- 地點：舊金山 Moscone Center
- 攤位：S-1561 (Taiwan Pavilion)
- 更多資訊：[官網](https://www.rsaconference.com/usa)

 
 
*各項活動資訊依據主辦單位為準 
*本文章不定期更新

【TeamT5 杜浦數位安全 2026 年參與展覽、研討會一覽表】歡迎參觀並了解情資驅動的頂尖解決方案

![](https://uploads.teamt5.org/upload/original/pic_teamt5-and-netpoleon-deepen-partnership-in-the-asia-pacific-region-to-enhance-regional-resilience-cybersecurity-capabilities.png)

**TeamT5**, a leading provider of threat intelligence and threat hunting solutions , today announced an enhanced strategic partnership with Netpoleon, region’s foremost cybersecurity solution distributor. Under this expanded collaboration, Netpoleon will extend its distribution coverage across Asia-Pacific to include TeamT5’s full portfolio of intelligence-driven cybersecurity solutions. Together, the two companies aim to empower enterprises and organizations to strengthen cyber defenses and build resilience against an increasingly complex and evolving threat landscape.



##Strengthened Partnership to Enhance Cyber Defense for Asia-Pacific Customers

Since forming their partnership, TeamT5 and Netpoleon have worked closely to combine intelligence-driven cybersecurity solutions with deep local market expertise, providing enterprises with faster and more accurate cybersecurity defenses. The deepened collaboration reflects a high level of mutual trust and a shared long-term vision, and both sides will continue to drive the advancement of cybersecurity defense across the Asia-Pacific region.

Currently, Netpoleon has a strong presence in the cybersecurity market including **Singapore, Malaysia, Thailand, Indonesia, Vietnam, India, the Philippines, Australia, and New Zealand**. Through their close cooperation, TeamT5’s solutions have been successfully implemented in three of the top five financial institutions in Vietnam, as well as in key infrastructure, real estate, retail, and government organizations. The solutions have also been deployed within Malaysian government agencies, demonstrating the tangible results of their partnership in the region.

##Comprehensive TeamT5 Solutions Strengthen Multi-Layered Defense

TeamT5’s strong technical expertise—rooted in its deep understanding of the Asia-Pacific threat landscape—has earned international recognition, most notably being named **Frost & Sullivan’s Threat Intelligence Company of the Year for two consecutive years**. The company has also received the **Computex Best Choice Award - Golden Award**, further demonstrating the industry’s acknowledgment of TeamT5’s innovation and technical leadership.

Netpoleon will expand promotion of TeamT5’s full suite of solutions, including:
- **ThreatVision**, a threat intelligence platform that consolidates years of research and tracking conducted by TeamT5 experts. It helps organizations quickly understand advanced persistent threat(APT) activities and dark web criminal trends, and identify and patch high-risk vulnerabilities before they are exploited.


- **ThreatSonar**, a threat hunting platform that integrates intelligence research with real-world attack–defense experience. It helps organizations pinpoint threat sources and compromise paths, uncover hidden threats, strengthen defense-in-depth, and protect endpoints—thereby minimizing potential future damage from cyber incidents.

**Sung-ting Tsai**, **TeamT5 CEO, remarks**, “Netpoleon is a leading cybersecurity distributor in the Asia-Pacific region, and we’re excited to deepen our partnership. This collaboration allows us to deliver TeamT5’s advanced technologies to more enterprises while leveraging Netpoleon’s strong regional expertise. Together, we’re strengthening our service capabilities and advancing our global strategy to enhance cyber defense worldwide.”

**Francis Goh**, **Chairman and CEO at Netpoleon, remarks**, “As the complexity of cybersecurity continues to increase, we are committed to empowering our channel partners across the region with best-in-class technologies. I believe that adding TeamT5 to our cybersecurity portfolio enables us to support our partners with greater value creation for their customers, especially with TeamT5 Asia Focus intelligence! “

 
**About Netpoleon ** 
Netpoleon Group is a Value-Added Distributor (VAD) of Network Security products, headquartered in Singapore with various full-fledged offices across APAC region in Australia, Cambodia, India, Indonesia, Malaysia, Myanmar, New Zealand, Philippines, Thailand and Vietnam.

Partnering with major leading technology vendors, Netpoleon continues to value-add the Vendor’s offering through pre-and post-sales services, as well as professional advisory services on Cybersecurity to our channel partners across the region. Netpoleon continues to look forward to being one of the Most Trusted Partners (MTP) to our Vendors, Resellers and Customers.

**About TeamT5** 
TeamT5 is a leading cybersecurity company** specializing in threat intelligence and advanced threat hunting**, with deep roots in the Asia-Pacific region. Leveraging Taiwan’s strategic location, linguistic diversity, and over 20 years of accumulated research expertise, TeamT5 focuses on analyzing APT attacks and ransomware threats to deliver the most localized intelligence and protection solutions for governments, financial institutions, and technology enterprises.
TeamT5 has been recognized for two consecutive years by international research and consulting firm Frost & Sullivan as Taiwan’s Threat Intelligence Company of the Year.

 
Media Contact: pr@teamt5.org

TeamT5 and Netpoleon Deepen Partnership in the Asia-Pacific Region to Enhance Regional Resilience Cybersecurity Capabilities

![](https://uploads.teamt5.org/upload/original/pic_teamt5-and-netpoleon-deepen-partnership-in-the-asia-pacific-region-to-enhance-regional-resilience-cybersecurity-capabilities.png)

亞太威脅情資領導者杜浦數位安全 TeamT5 宣布，與亞太資安解決方案供應商 Netpoleon 的合作關係進一步深化。此次合作擴大 Netpoleon 亞太區代理範圍，納入 TeamT5 全系列的情資驅動資安解決方案，雙方攜手，協助企業與組織，在面對日益複雜的網路威脅時，得以強化資安防護力、鞏固資安韌性。

##強化代理合作，攜手為亞太客戶強化資安防禦
TeamT5 與 Netpoleon 自合作以來，雙方致力於結合情資驅動的資安解決方案與豐富的在地市場經驗，提供企業更即時、更精準的資安防禦。此次合作深化，象徵雙方對長期夥伴關係的高度信任與共同願景，將持續推動亞太地區的資安防禦升級。

目前，**Netpoleon 已協助 TeamT5 的資安解決方案推廣至新加坡、馬來西亞、泰國、印尼、越南、印度、菲律賓、澳洲及紐西蘭等亞太市場**。透過雙方緊密合作，TeamT5 的資安解決方案已成功導入越南前五大金融機構中的三家，以及當地關鍵基礎設施、房地產、零售與政府單位等多元客戶，並進一步部署於馬來西亞政府單位，展現雙方合作在亞太市場的深耕成果。


##完整 TeamT5 解決方案健全多層防護
TeamT5 深耕亞太、洞悉駭客攻擊脈絡之技術實力，**連續兩年獲國際顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司，更獲 Computex Best Choice Award 金獎等國際肯定**，本次則有鑑於亞太地緣政治情勢持續升溫，國家級駭客事件增加，攜手亞太區域頂尖廠商 Netpoleon，讓更多企業能以高效的資安防護技術、前瞻的威脅情資研究，抵禦日益頻繁與多變的網路攻擊威脅。

Netpoleon 將擴大推廣 TeamT5 全系列解決方案，其一為 ThreatVision 威脅情資平台，彙整 TeamT5 專家團隊長年追蹤與研究的威脅情資，協助各層級團隊快速掌握進階持續性威脅（APT）攻擊活動與暗網犯罪動向，盡早修補易遭駭客利用的高風險漏洞。其二為 ThreatSonar 威脅鑑識分析平台，將威脅情資分析成果結合實務攻防經驗，落實於安全產品中，協助產業精準掌握威脅來源與擴散途徑，獵捕未知的潛在威脅，強化縱深防禦、保護端點安全，避免日後威脅發生可能帶來的損害。

**TeamT5 執行長蔡松廷表示**：「Netpoleon 是亞太地區極具影響力的資安通路夥伴，我們非常高興能夠進一步深化雙方的合作。透過這次合作擴展，我們不僅能將 TeamT5 的核心技術與產品帶給更多企業客戶，也能藉由 Netpoleon 在各國的專業團隊與市場經驗，強化我們在亞太區的服務能量。這是我們推動全球化布局、提升威脅防禦能量的重要一步。」 

**Netpoleon 董事長暨執行長 Francis Goh 表示**：「隨著網路安全情勢日益複雜，我們致力於為遍布該地區的通路合作夥伴提供一流的技術支援。我相信，將 TeamT5 納入我們的資訊安全產品組合，能夠幫助我們的合作夥伴為其客戶創造更大的價值，尤其是加入 TeamT5 專注於亞太地區的威脅情資產品之下！」 

 

**關於 Netpoleon 集團** 
Netpoleon 集團是網路安全產品加值經銷商，總部位於新加坡，在亞太地區設有多個設施完善的辦事處，包括澳洲、柬埔寨、印度、印尼、馬來西亞、緬甸、紐西蘭、菲律賓、泰國和越南。
Netpoleon 與多家領先的技術供應商合作，透過售前售後服務以及區域內通路合作夥伴的網路安全專業諮詢服務，持續提升供應商產品的價值。Netpoleon 展望未來，力求成為供應商、經銷商和客戶最值得信賴的合作夥伴。

 

**關於 TeamT5** 
TeamT5 是深耕亞太的威脅情資專家，憑藉台灣地緣優勢、語言能力與累積 20 年的研究，專精於分析亞太區域進階持續性威脅（APT）與勒索軟體威脅，為政府、金融、科技產業提供最在地化的情資洞察與防護方案。連續兩年獲國際顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司（Taiwanese Threat Intelligence Company of the Year Award）。

 
新聞聯絡窗口：pr@teamt5.org

TeamT5 與 Netpoleon 深化亞太區合作　共同拓展資安防護版圖

>Top threat analysts from the Asia-Pacific region gathered to share practical experience and forward-looking strategies, focusing on three key issues and urging all sectors to pay attention to threat intelligence and strengthen defense gaps.

[Taipei, December 3, 2025] The 2025 Threat Analyst Summit (TAS), hosted by leading threat intelligence firm TeamT5, took place on December 3–4 in Taipei, Taiwan. This year’s summit surpassed previous editions in scale and international reach, with nearly two-thirds of participants traveling from abroad and representing more than 20 countries. **Over 200 cybersecurity experts and practitioners attended the event, engaging in knowledge sharing, experience exchange, and in-depth discussions on the global threat landscape.**

The forum boasted a strong lineup of speakers, bringing together leading international cybersecurity and technology companies, including ITOCHU, MACNICA, LAC, Constella Security Japan, The Korea Financial Security Institute, Team Cymru, Recorded Future, Shreshta, Meta, DarkLab, Microlab.red, and Trend Micro, whose industry authorities provided insightful perspectives.

##Experts Highlight Persistent Security Gaps and Urge Stronger Commitment to Threat Intelligence

The summit continued the focus of the previous two TAS events, providing an in-depth look at the latest activities of APT groups across the Asia-Pacific region. This year’s program also expanded to key themes including cybercrime trends and the evolving landscape of information operation.

Looking back at the cybersecurity landscape in 2025, the year has been marked by a series of high-impact incidents, from the early-year CrazyHunter attack and the surge of APT campaigns exploiting VPN vulnerabilities, to the recent breach of a globally recognized beer manufacturer that forced a complete shutdown of its production lines. These events underscore that, despite rising cybersecurity awareness within enterprises, critical gaps in defense architectures persist, creating opportunities for attackers to exploit weaknesses. Strengthening these defenses proactively remains essential to mitigating future threats and reducing operational risk.

##VPN Vulnerabilities Emerge as Key Intrusion Vectors; Supply Chain Security Becomes a Critical Challenge

In cybersecurity architecture, "threat intelligence collecting and application" has become a crucial area that enterprise cybersecurity personnel urgently need to strengthen. Only through systematic intelligence analysis and application can early warnings, rapid responses, and prevention be achieved before attacks occur, effectively reducing risks and operational damage.

TeamT5 CEO Tsai Sung-ting (TT) stated that the **most frequent cybersecurity threat this year is network device intrusion**. Therefore, several case studies on VPN device intrusion were arranged for presentations. Currently, cybercriminal ransomware groups do not initially target specific companies. Instead, they determine their targets after obtaining vulnerability information on the original equipment manufacturer's (OEM) devices, often choosing high-value companies, attempting to gain root access, and then launching encrypted ransomware attacks.

Tsai Sung-ting pointed out that in the past year, Chinese hacker activities have become increasingly rampant, frequently infiltrating enterprise network environments through hardware and software vulnerabilities. Many of these cases involve equipment hosted by external vendors, which can be categorized as supply chain intrusion. Even if enterprises have deployed numerous protective measures, they may still suffer losses if their hosting vendors are attacked.

##Cybersecurity Remains a Complex Undertaking, Requiring Determination from Strategy to Execution

Tsai Sung-ting emphasized that in practice, even if the client company actively implements cybersecurity measures, if the vendor is negligent in management and lacks adequate protection, they are often unknowingly compromised by hackers, ultimately leading to serious losses. This shows that "supply chain cybersecurity management" is often the most easily overlooked aspect of corporate cybersecurity strategies, yet it is also a critical point with extremely high risks.

He added that large companies don't necessarily have good cybersecurity practices, especially in manufacturing or traditional industries. Willingness to invest resources, having the right strategies, and finding a professional team to assist are all challenges companies face in promoting cybersecurity. Cybersecurity is a long-term and continuous endeavor; however, the reality is that many companies are still at the stage of wanting to do it, and the journey from that to wanting to understand how to do it, and then to serious implementation, is long, testing the determination of business owners and management teams.

###About TeamT5 
Founded in 2017, TeamT5 is a leading provider of cybersecurity threat intelligence and endpoint security solutions in the Asia-Pacific region. Specializing in cyber threat research in the Asia-Pacific region, covering Advanced Persistent Threats (APTs) and ransomware, the company leverages precise threat intelligence and unique endpoint threat hunting technology to provide clients with comprehensive cybersecurity solutions for effectively countering cyber espionage and ransomware attacks. In 2022, it received joint investment from JAFCO, Japan's largest venture capital firm; ITOCHU, Japan's largest multinational corporation; and MACNICA, Japan's largest cybersecurity solutions provider, demonstrating its significant international potential. From 2023 to 2024, TeamT5 was consecutively recognized as Taiwan's Best Threat Intelligence Company by the international consulting firm Frost & Sullivan.

To promote cyber threat research and international cybersecurity cooperation in the Asia-Pacific region, the company piloted the Threat Analyst Summit (TAS) in 2022 and officially held its first TAS Threat Analyst Summit in 2023, successfully establishing an important platform for Asia-Pacific cybersecurity experts to share the latest threat dynamics and forward-looking strategies.

 
![](https://uploads.teamt5.org/upload/original/threat-analyst-summit-tas-2025-retrospect_pic1.jpg)
![](https://uploads.teamt5.org/upload/original/threat-analyst-summit-tas-2025-retrospect_pic2.jpg)
![](https://uploads.teamt5.org/upload/original/threat-analyst-summit-tas-2025-retrospect_pic3.jpg)

2025 Threat Analyst Summit Convenes Global Cybersecurity Leaders, Celebrates Record International Participation

>**亞太頂尖威脅分析師齊聚分享實戰經驗及前瞻策略** 
>**聚焦三大關鍵議題，籲各界重視威脅情資、補強防禦缺口**

【2025年12月3日，台北訊】 由威脅情資專家 TeamT5 杜浦數位安全主辦的「2025 TAS（Threat Analyst Summit）威脅分析師高峰會」於 12 月 3、4 日在台北茹曦酒店盛大登場。今年的高峰會規模較去年更大，約有三分之二的與會者來自海外，涵蓋 20 多國，超過 200 位資安產業專家與從業人士共襄盛舉，進行經驗分享及交流。

本次論壇講者陣容堅強，匯聚國際知名資安與科技領導企業，包括 ITOCHU、MACNICA、LAC、Constella Security Japan、The Korea Financial Security Institute、Team Cymru、Recorded Future、Shreshta、Meta、DarkLab、Microlab.red 以及 Trend Micro 等業界權威專家，將為論壇帶來精闢洞察。


##專家示警防禦仍現缺口，威脅情資需受重視
延續前兩屆 TAS 聚焦的議題，本次高峰會也將安排分享亞太地區 APT 族群的最新動態，並涵蓋網路犯罪（Cybercrime）、資訊戰（Information Operation）等重要議題。

回顧 2025 年整體資安態勢，從年初的 CrazyHunter 事件、APT 組織利用 VPN 設備漏洞發動猛烈攻擊，到近期全球知名啤酒大廠遭駭導致生產線全面停擺，一連串重大資安事件接連發生、餘波盪漾。這些案例凸顯出，即使企業整體資安意識已有所提升，防禦體系仍存在缺口，才使攻擊者有機可乘，應及早補強，防範於未然。


##VPN 漏洞為入侵熱點，供應鏈資安成新痛點
在資安防護架構中，「威脅情資蒐集與應用」已成為企業資安人員亟需強化的一環。唯有透過系統化的情報分析與應用，才能在攻擊未發生前及早預警、迅速應對及防堵，有效降低風險及營運損害。

TeamT5 執行長蔡松廷（TT）表示，今年發生最多的資安威脅就是網路設備的入侵，因此這次也安排了幾場針對 VPN 設備入侵的案例分享。目前網路犯罪勒索族群並非一開始就鎖定特定企業，而是在掌握原廠設備的漏洞資訊之後，再決定攻擊目標，往往挑選高價值的企業，想辦法取得最高權限，接著發動加密勒索。

蔡松廷指出，過去一年來，中國駭客行動日益猖獗，經常透過軟硬體漏洞滲透到企業網路環境，其中不少案例發生在由外部廠商代管的設備，可歸類為供應鏈入侵。即便企業本身部署了許多防護措施，但是當代管廠商遭到攻擊，企業仍可能因此受害。

##資安工作充滿挑戰，從起步到落實考驗決心
他強調，在實務上，即使甲方企業積極落實資安防護，若乙方廠商疏於管理、防護不足，往往在不知情的情況下遭駭客入侵，最終導致嚴重損失。顯示「供應鏈資安管理」常是企業資安策略中最容易被忽視的一環，卻也是風險極高的關鍵點。

蔡松廷補充，大公司資安不一定做得好，尤其是製造業或傳產更為明顯。願不願意投入資源、有沒有正確的策略，以及是否找到專業團隊來協助，這些都是企業在資安推動上面臨的挑戰。資安是一項長期且持續的工作，然而現實是，許多企業仍停留在想不想做的階段，而從想做、到想了解怎麼做，再到認真落實，會是一條漫漫長路，考驗著企業主和管理階層的決心。

###關於 TeamT5 杜浦數位安全
成立於 2017 年，為亞太地區首屈一指的資安威脅情資與端點資安解決方案提供商。專精亞太地區網路威脅研究，涵蓋進階持續性攻擊（APT）、勒索軟體，憑藉精準的威脅情資與獨特的端點威脅狩獵技術，為客戶提供有效反制網路間諜與勒索攻擊之完整資安防護解決方案。2022 年獲日本最大創投 JAFCO 集富集團、日本最大跨國企業 ITOCHU 伊藤忠商事及日本最大資安解決方案提供商 MACNICA 共同投資，展現深具潛力的國際影響力。於2023-2024年連續獲得國際顧問公司 Frost & Sullivan 評選為台灣最佳威脅情資公司。

為推動亞太網路威脅研究與跨國資安合作，自 2022 年試辦 TAS（Threat Analyst Summit）威脅分析師高峰會，並於 2023 年正式舉辦首屆 TAS 威脅分析師高峰會，成功打造出一個集結亞太資安專家分享最新威脅動態與前瞻策略的重要平台。

 
![](https://uploads.teamt5.org/upload/original/threat-analyst-summit-tas-2025-retrospect_pic1.jpg)
![](https://uploads.teamt5.org/upload/original/threat-analyst-summit-tas-2025-retrospect_pic2.jpg)
![](https://uploads.teamt5.org/upload/original/threat-analyst-summit-tas-2025-retrospect_pic3.jpg)

2025 TAS 威脅分析師高峰會盛況空前 20 多國逾 200 名資安專家齊聚

Ransomware attacks targeting organizations worldwide continue to surge, and Japan has become one of the regions hit hardest in recent years.


At TeamT5, we have been deeply involved in tracking these threats—monitoring the evolution of attack tools, detecting suspicious activities, and helping organizations safeguard their data and critical systems. We remain on the front line of this “invisible cyber war.”

Recently, TeamT5 was invited by TV Tokyo program Gaia’s Dawn (ガイアの夜明け) for an in-depth interview to share our insights on ransomware trends and our frontline threat intelligence work.


You can read the full written report here: [link](https://www.tv-tokyo.co.jp/plus/business/entry/202511/18090.html)

[TV Tokyo Interview] Ransomware: Current Threats

全球企業與組織正面臨急速攀升的勒索軟體攻擊，日本也成為近年受害最嚴重的區域之一。

TeamT5 長期專注於追蹤這類威脅，從攻擊工具演進、可疑行為偵測，到協助組織保護資料與關鍵系統，我們始終站在這場「看不見的網路戰爭」最前線。
也因此，TeamT5 近期受東京電視台節目「蓋亞的黎明（ガイアの夜明け）」邀請進行專訪，分享我們對攻擊趨勢的觀察與第一線威脅情資分析。


該節目的文字報導請見：[連結](https://www.tv-tokyo.co.jp/plus/business/entry/202511/18090.html)


【TV Tokyo 採訪報導】勒索軟體：當前的威脅

Taipei, November 26, 2025 — TeamT5 has once again been recognized for its outstanding innovation and leadership in cybersecurity. Two of its flagship products—the ThreatVision (Threat Intelligence Platform) and the ThreatSonar Anti-Ransomware (Endpoint Detection & Response)—have both won the 34th [Taiwan Excellence Award](https://www.taiwanexcellence.org/en). This recognition highlights TeamT5’s research and development strength, as well as its market competitiveness in the global cybersecurity industry.


##ThreatVision: Empowering Organizations with Asia-Pacific Threat Intelligence
**ThreatVision** is a threat intelligence platform designed for enterprises and government agencies. Built upon TeamT5’s years of advanced cyber threat research, it helps cybersecurity teams quickly identify and analyze advanced persistent threat (APT) activities, track dark web criminal trends, and address high-risk vulnerabilities before they can be exploited.

With its **localized Asia-Pacific threat insights**, ThreatVision delivers precise indicators of compromise along with deep correlations between malware and attack behaviors. The platform empowers users to anticipate attack patterns and take preventive measures—strengthening the overall resilience of their cybersecurity defenses.

##ThreatSonar Anti-Ransomware: Proactive Defense Against Ransomware Attacks
**ThreatSonar Anti-Ransomware** is an enterprise-grade, proactive defense solution that integrates **malicious behavior detection, intrusion prevention, and incident response capabilities into a unified platform.**

Its core technology automatically interrupts malicious processes before ransomware can encrypt critical files, drastically minimizing potential damage. By leveraging TeamT5’s accurate threat intelligence, ThreatSonar Anti-Ransomware enhances its ability to identify suspicious endpoint behaviors in real time—delivering a complete defense lifecycle from detection and alert to active protection, safeguarding enterprise assets with precision and reliability.

##Advancing Taiwan’s Cybersecurity Innovation and Global Competitiveness
The Taiwan Excellence Award, often regarded as the “Oscars of Taiwan’s Industry,” evaluates products based on R&D, design, quality, and marketing. TeamT5’s dual recognition demonstrates its commitment to innovation, excellence, and international expansion in cybersecurity technology and product development.

Tsai Sung-ting, CEO of TeamT5, remarked:“Our mission is to protect the cybersecurity of global clients through world-class cybersecurity research and technology. Receiving the Taiwan Excellence Award affirms TeamT5’s enduring commitment to innovation and excellence.”

![](https://uploads.teamt5.org/upload/original/pic_en_teamt5-honored-with-dual-taiwan-excellence-awards-for-innovative-cybersecurity-solutions.jpg)

 

###About TeamT5
TeamT5 is a leading cybersecurity company specializing in** threat intelligence and advanced malware analysis**, with deep roots in the Asia-Pacific region. Leveraging Taiwan’s strategic location, linguistic diversity, and over 20 years of accumulated research expertise, TeamT5 focuses on analyzing APT attacks and ransomware threats to deliver the most localized intelligence and protection solutions for governments, financial institutions, and technology enterprises.

TeamT5 has been recognized for two consecutive years by international research and consulting firm Frost & Sullivan as **Taiwan’s Threat Intelligence Company of the Year**.


Media Contact: pr@teamt5.org

TeamT5 Honored with Dual Taiwan Excellence Awards for Innovative Cybersecurity Solutions

【台北，2025年11月26日】 杜浦數位安全（TeamT5）再度以其卓越的資安創新實力獲得肯定，旗下兩項自主研發產品——ThreatVision 威脅情資平台與 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台，雙雙榮獲第 34 屆[台灣精品獎](https://www.taiwanexcellence.org/tw)。此殊榮象徵 TeamT5 在資安領域的研發實力與市場競爭力，獲得專業評審的高度肯定。

##ThreatVision：掌握亞太地區威脅的關鍵情資
ThreatVision 是 TeamT5 針對企業與政府打造的威脅情資平台，彙整本公司專家團隊長年追蹤與研究的威脅情資，協助各層級團隊快速掌握進階持續性威脅（APT）攻擊活動與暗網犯罪動向，盡早修補易遭駭客利用的高風險漏洞。
ThreatVision 提供在地化的亞洲威脅情資，以及入侵指標、惡意軟體與攻擊行為的深度關聯，讓使用者理解攻擊脈絡，並提前做好準備，有效強化整體資安防禦力。

##ThreatSonar Anti-Ransomware：主動防禦勒索軟體，有效封鎖攻擊
ThreatSonar Anti-Ransomware 為企業級主動防禦勒索軟體與惡意軟體的解決方案，整合惡意行為偵測、入侵防堵與事件回應功能。
其核心技術可在勒索攻擊尚未造成檔案加密前，即自動中斷惡意程序，大幅降低損害風險。藉由 TeamT5 的精準情資，強化 ThreatSonar Anti-Ransomware 偵測端點上是否有可疑的程式行為的能力，實現即時威脅偵測、告警到防護的完整流程，為企業組織資安建立堅實防線。

##TeamT5 展現資安技術創新與國際拓展實力
台灣精品獎素有「台灣產業界奧斯卡」之稱，評選過程嚴謹，從「研發」、「設計」、「品質」與「行銷」四大面向評估。此次 TeamT5 兩項產品同時獲獎，展現公司在資安技術創新與產品國際化的成果。
TeamT5 執行長蔡松廷表示：「我們致力於以世界級的資安研究與技術，守護全球客戶的數位安全。此次獲得台灣精品獎，是對 TeamT5 長期投入與創新的最佳肯定。」

![](https://uploads.teamt5.org/upload/original/pic_tw_teamt5-honored-with-dual-taiwan-excellence-awards-for-innovative-cybersecurity-solutions.jpg)

 

###關於杜浦數位安全 TeamT5
TeamT5 是深耕亞太的威脅情資專家，憑藉台灣地緣優勢、語言能力與累積 20 年的研究，專精於分析亞太區域進階持續性威脅（ APT）與勒索軟體威脅，為政府、金融、科技產業提供最在地化的情資洞察與防護方案。連續兩年獲國際顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司（Taiwanese Threat Intelligence Company of the Year Award）。

聯絡窗口：pr@teamt5.org

TeamT5 資安創新受肯定，雙產品榮獲台灣精品獎

**TeamT5**, a leading threat intelligence provider focused on the Asia-Pacific region, has integrated its **ThreatVision** platform with **Filigran’s OpenCTI**. This powerful collaboration enables modern security operations centers (SOCs) to harness the full power of contextual, actionable threat intelligence from both global and regional sources.

##Unmatched Visibility into Asia-Pacific Threats
Twice recognized as "Taiwan's Best Threat Intelligence Company" by Frost & Sullivan, TeamT5 has built a reputation for delivering unique and deep intelligence on cyber threats originating from the APAC region, including China, North Korea, and Vietnam. With years of research and frontline investigation, TeamT5's ThreatVision delivers:

- **In-depth insights into APAC threat actor TTPs**: Gain visibility into the evolving tools and methods used by regional adversaries.
- **Campaign tracking and attribution**: Stay informed about threat actor operations and motivations through comprehensive adversary profiling.
- **Technical vulnerability analysis**: Understand the real-world impact and exploitation methods behind high-profile vulnerabilities.

ThreatVision delivers this intelligence in enriched formats—from malware samples to actor profiles—helping analysts quickly contextualize and act on emerging threats.

##OpenCTI: The Foundation for Intelligence-Driven SOCs
Filigran’s **OpenCTI** is a powerful open-source threat intelligence platform that centralizes and connects knowledge about cyber threats. Built to support intelligence-driven operations, OpenCTI provides:
- **Structured knowledge modeling**: Connect threat indicators, actor behaviors, attack techniques, and campaign data in a single dynamic knowledge graph.
- **Collaborative workflows**: Enhance analyst collaboration through shared investigation, annotation, and threat mapping.
- **Flexible integrations and automation**: Enrich and distribute intelligence across the security stack using API connectivity and automated playbooks.

By integrating ThreatVision into OpenCTI, users benefit from enriched intelligence flows that directly enhance detection engineering, threat hunting, and incident response strategies.

##Real-World Use Cases Enhanced by the Integration
The synergy between TeamT5 and Filigran supports multiple high-impact cybersecurity workflows, including:
- **Threat Attribution**: Analysts can now trace TTPs and infrastructure back to APAC adversaries using ThreatVision’s detailed actor insights.
- **Correlated Intelligence**: TeamT5’s contextual intelligence correlating to indicators of compromise (IOCs) within OpenCTI, accelerating triage and validation.
- **Proactive Threat Hunting**: Use ThreatVision’s flash reports and technical findings to guide hypothesis-driven threat hunting.

 

###About Filigran
Filigran builds and maintains OpenCTI, an open-source platform designed to structure and operationalize cyber threat intelligence. Trusted by private and public sector organizations worldwide, Filigran supports intelligence-led security operations through open innovation, collaboration, and adaptability.

###About TeamT5
TeamT5 consists of elite cyber threat analysts specializing in Asia-Pacific threat actors. With deep regional insight and strong technical expertise, TeamT5 empowers security teams around the globe to stay ahead of sophisticated cyber threats. Trusted by government, defense, and enterprise customers, TeamT5 continues to deliver accurate, actionable threat intelligence and strategic guidance.




 
![](https://uploads.teamt5.org/upload/original/pic_teamt5-s-threatvision-now-integrated-with-filigran-s-open-cti.jpg)

TeamT5's ThreatVision Integrates with Filigran’s OpenCTI: Powering Intelligence-Driven SOCs

首屈一指的亞太威脅情資供應商杜浦數位安全（TeamT5）宣布，旗下 **ThreatVision 威脅情資平台**已正式與 Filigran 營運的 **OpenCTI** 平台完成整合。這項合作讓現代安全營運中心（SOC）能同時運用全球與在地的高品質威脅情資，構建以情資為核心的主動防禦與快速應變能力。

##ThreatVision：洞悉亞太威脅的脈絡
TeamT5 連續兩度榮獲 Frost & Sullivan「台灣最佳威脅情資公司」肯定，長期深耕亞太地區網路威脅研究，聚焦追蹤來自中國、北韓與越南等地的攻擊行動。憑藉多年研究成果與前線調查經驗，ThreatVision 平台提供針對亞太威脅的高品質情資洞察：
- **亞太威脅族群的戰術、技術與程序（TTP）分析**：掌握攻擊者所採用的工具與手法變化，強化對威脅行動的掌握度。

- **攻擊行動追蹤與歸因分析**：透過完整的攻擊者側寫，揭示駭客集團的運作模式與攻擊動機，協助組織理解行動背後的脈絡。

- **技術漏洞分析**：深入評估重大漏洞的實際影響與攻擊利用方式，支援防禦與修補決策。

ThreatVision 以結構化情資形式呈現上述內容，涵蓋惡意程式樣本、攻擊者檔案與入侵指標（IoC），協助分析人員迅速掌握關鍵資訊，判斷事件脈絡，並採取行動。


##OpenCTI：情資導向安全營運的基礎
Filigran 旗下的 OpenCTI 是強大的開放原始碼威脅情資平台，能整合並關聯各類網路威脅知識，協助組織推動情資驅動的資安營運。主要功能包括：
- **結構化知識圖譜模型**：在單一動態圖譜中連結威脅指標、行為模式、攻擊手法與活動資料。


- **協作式分析流程**：支援分析人員共用調查資料、標註情資，並繪製威脅地圖。


- **彈性整合與自動化機制**：透過 API 串接與自動化設定，將情資應用在防禦架構各面向。


ThreatVision 與 OpenCTI 的整合，能讓使用者取得更全面、脈絡更完整的情資流，強化偵測工程、威脅獵捕與事件回應策略。

##整合強化防禦流程　提升情資運用效能
ThreatVision 與 OpenCTI 的整合大幅提升各種資安作業的效率，包括：
- **威脅歸因分析**：透過 ThreatVision 的攻擊者情資，精準追蹤亞太駭客集團的 TTP 與基礎設施。


- **情資關聯分析**：TeamT5 提供具脈絡情資，可在 OpenCTI 中與 IoC 自動關聯，加速事件判定與優先排序。


- **主動威脅獵捕**：運用 ThreatVision APT 威脅情資週報（Flash Report）與技術分析驗證潛在威脅，提升威脅獵捕的精準度。

 

###關於 Filigran
Filigran 為 OpenCTI 的開發與營運團隊，致力推動威脅情資的結構化與應用性。OpenCTI 開放原始碼平台廣受全球公私部門信任，透過開放創新與協作模式，協助各組織建構情資導向的資安防禦體系。

###關於 TeamT5
TeamT5 由經驗豐富的威脅分析專家組成，專精於亞太地區駭客研究與長期追蹤。憑藉深厚的區域洞察與技術能力，協助全球安全團隊搶占防禦先機。TeamT5 深受政府、國防與企業組織客戶信任，致力提供高度精準、可廣泛應用的威脅情資與策略建議，協助各種組織強化整體資安韌性。

 
![](https://uploads.teamt5.org/upload/original/pic_teamt5-s-threatvision-now-integrated-with-filigran-s-open-cti.jpg)

TeamT5 ThreatVision 與 Filigran OpenCTI 完成整合，以深度情資強化防禦力

アジア太平洋地域でトップクラスのサイバー脅威インテリジェンスとEDR（エンドポイント検出応答）ソリューションを提供する TeamT5 は、11月18日(火)から19日(水)に開催されるCODE BLUE 2025に参加いたします。

今年は、サイバー脅威インテリジェンスチームメンバーが登壇し最新の研究結果を発表いたします。


##タイトル：「アンチデバッグのバイパス：実環境とシミュレーションのハイブリッドアプローチによるRootkit解析」

- **時間**：11月19日(水)09:00-09:40 
- **講演者**：Yong-Xu Yang, Heng-Ming Fan, Yu Xuan Luo
- **概要**：

ルートキットのリバースエンジニアリングは、高度な難読化とパッキングによってますます困難になっており、Windowsドライバーの動的デバッグを妨げています。SpeakeasyやQilingのようなUnicornベースのフレームワークは存在しますが、アンチシミュレーション技術においては依然として不十分です。

本研究は、部分的なパススルーによってハイブリッドな実環境・シミュレート環境でドライバーを実行するUnicornベースの半シミュレーションフレームワークを提案します。これは、実環境コンポーネントを抽出し、並列実行と構造化例外処理をサポートすることで、アンチシミュレーションおよびアンチデバッグ保護をバイパスします。Ring 3で分離して実行することで、オブジェクトとレジスタを正確に監視し、ルートキットのロジックとその自己保護メカニズムを明らかにすることができます。

本セッションでは、最新のアンチデバッグ技術、Unicornの応用、および市場シェアの高いアンチチートエンジンのカーネルドライバー保護のケーススタディを探ります。このセッションの後、参加者は内部ドライバー保護とルートキット分析についてより深く理解することができます。


##CODE BLUE 2025 概要
世界トップクラスのサイバーセキュリティ専門家による国際会議です。本会議はベンダー中立の立場から、欧米の著名な研究者による最新の研究成果を共有するとともに、日本をはじめとするアジア各国の優れた若手研究者を発掘し、その研究成果を世界へと発信しています。2013年度の開催以来、こうした取組みを積み重ねることで国内外のサイバー・セキュリティ・コミュニティから厚い信頼を得てきました。

- 詳細はこちら：https://codeblue.jp/

TeamT5 はCODE BLUE 2025に参加いたします

The biggest information security conference in Japan, CODE BLUE 2025, will be held in Tokyo on November 18-19. TeamT5, with its Taiwan headquarter & Japan subsidiary, is proud to sponsor and participate in this Asia top international cybersecurity event.


This year, our cyber threat intelligence team members will share their latest study - “Bypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis”.





See below for highlights of our events at CODE BLUE 2025.

## Topic: Bypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis

- **Time**: 11 / 19 (Wed.) 09:00-09:40 
- **Presenter**:  Yong-Xu Yang, Heng-Ming Fan, Yu Xuan Luo

Reverse engineering rootkits are increasingly challenged by advanced obfuscation and packing, hindering dynamic debugging of Windows drivers. While Unicorn-based frameworks like Speakeasy and Qiling exist, they are still insufficient in anti-simulation techniques.

This research proposes a Unicorn-based semi-simulation framework that executes drivers in a hybrid real-simulated environment via partial pass-through, extracting real environment components and supporting parallel execution and structure exception handling to bypass anti-simulation and anti-debugging protections. Running isolated in Ring 3, it can precisely monitor objects and registers, revealing rootkits’ logic and its self-protect mechanisms.

We will explore modern anti-debugging techniques, Unicorn applications, and a case study of a high-market-share anti-cheat engine’s kernel driver protections. After this session, attendees will gain a better understanding of internal driver protection and rootkit analysis.



##About CODE BLUE
CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on [CODE BLUE Official Website](https://codeblue.jp/en/program/time-table/day2-t2-01/).

*Image courtesy of CODE BLUE.


【TeamT5 x CODE BLUE 2025】Because Security Matters

日本最大的資訊安全會議 CODE BLUE 2025 將於 11 月 18 日至 19 日在日本東京舉辦。 TeamT5 很榮幸能夠贊助和參與這一亞洲頂級國際資安盛會。

今年，我們的資安威脅研究團隊成員將分享他們的最新研究 – 「Bypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis」。

請參閱下文，了解我們將於 CODE BLUE 2025 帶來的研究分享。


##講題 : Bypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis

- **時間** : 11月19(週三) 09:00-09:40 
- **講者** : Yong-Xu Yang, Heng-Ming Fan, Yu Xuan Luo


逆向工程 rootkit 正日益受到進階混淆和加殼技術的挑戰，這阻礙 Windows 驅動程式的動態偵錯。儘管目前已有基於 Unicorn 的框架，例如 Speakeasy 和 Qiling，但它們在反模擬技術方面仍然不足。

本研究提出了一個基於 Unicorn 的半模擬框架，揭示 rootkit 的邏輯及其自我保護機制。期望與會者將對內部驅動程式保護和 rootkit 分析有更深入的了解。

##資安研討會 CODE BLUE 介紹
CODE BLUE 是日本最大的國際資安研討會，旨在通過 CODE（技術）跨越 BLUE（海洋）將人們聯繫起來，為更美好的網路世界做出貢獻。 每年，世界頂級專家和研究人員齊聚一堂，分享最新發現並進行技術演講。 它是所有參與者交流資訊、合作資安事件應變和解決資訊安全問題的殿堂。

更多資訊，請參考 [CODE BLUE 官網](https://codeblue.jp/en/program/time-table/day2-t2-01/)。

*圖片來源: CODE BLUE


TeamT5 參與 CODE BLUE 2025

At TeamT5, we’ve been on the frontlines of this challenge, leveraging Open-Source Intelligence (OSINT) to uncover and analyze how cyber threat actors attempted to sway Taiwan’s 2024 Presidential Election. These operations combined disinformation, hack-and-leak campaigns, and even AI-driven tactics to influence public opinion.

To shed light on these threats and our findings, Che Chang, Senior Cyber Threat Analyst at TeamT5, will present a talk at OSINT-JP, sharing how OSINT can be applied as a critical defense in safeguarding democratic resilience.


##Speech Title
Protecting Democracy with OSINT: How TeamT5 Tracked Cyber Threats in Taiwan's 2024 Election

##Abstract
Open-Source Intelligence (OSINT) plays a vital role in protecting democratic processes from foreign interference. In this talk, TeamT5 will present how our team applied OSINT to safeguard Taiwan’s 2024 Presidential Election.

We begin by defining OSINT and influence operations (IO). OSINT refers to the collection and analysis of publicly available information, while IO represents deliberate efforts to shape public opinion for political advantage. During Taiwan’s election, such operations were used to discredit pro-Taiwan candidates and amplify pro-China narratives.

Since 2023, Chinese threat actors have launched multiple IO campaigns targeting elections, including an evolved tactic that combines hack-and-leak operations with coordinated disinformation. At the same time, the rapid advancement of generative artificial intelligence (AI) has further strengthened these campaigns. In the second part of the presentation, we will demonstrate how Chinese actors integrate AI into hack-and-leak and IO activities, enabling them to create and spread disinformation to broader audiences with greater speed and impact. We will show two Hack-and-Leak operations targeting Taiwan.

By sharing these findings, we aim to demonstrate how OSINT is not only a technical discipline but also a frontline defense of democratic resilience in the face of evolving threats.

##Speaker
Che Chang / Senior Cyber Threat Analyst, TeamT5

Che Chang is a Senior Cyber Threat Analyst at TeamT5 CTI team. His research interests include the Chinese underground market and influence operations. He is the author of "TeamT5 Information Operation White Paper Series." Che is the invited speaker of many global and regional conferences, including Black Hat Asia, HITCON Pacific, Code Blue, SANS CTI Summit, 2020 vGCTF Workshop and Cybersec in Taiwan. 

##About OSINT-JP 
- **Date**: 2025年10月18日
- **Time**: 13:00–18:00 (JST)
- **City**: Tokyo, Japan
- **Official Website**: https://osint.jp/2025.html 

TeamT5 Will Give Speech at OSINT-JP

[2025年10月1日] – サイバーセキュリティインテリジェンスのリーディングカンパニーであるTeamT5は、同社の主力脅威ハンティングソリューションであるThreatSonar脅威フォレンジック分析プラットフォームが、パートナーである[伊藤忠テクノソリューションズ株式会社](https://www.ctc-g.co.jp/)が提供するインシデントハンドリングサービス（CTC-IH）に導入されたことを発表いたします。

多くの企業では、SOC（セキュリティオペレーションセンター）サービスを導入していても、夜間や休日の対応遅延、セキュリティのスキルを持った要員の不足といった課題に直面しています。これらの要因により対応の遅れや不適切な対応につながり、セキュリティインシデントによる被害のリスクを増大させます。

このような企業の課題を解決するため、伊藤忠テクノソリューションズ株式会社はセキュリティ運用を幅広く支援するCTC-MSS（マネージドセキュリティサービス）の一環として、インシデント発生時の対応を支援するCTC-IHを提供しています。

ThreatSonarは脅威の検知と調査を迅速化するために設計され、数千ものAPTバックドアシグネチャを内蔵した脅威ハンティングおよびデジタルフォレンジックプラットフォームです。エンドポイントの詳細な可視化と高度な分析機能により、隠れた脅威を発見しサイバーセキュリティチームを支援します。CTC-IHはThreatSonarを活用しインシデント発生時にサイバーセキュリティの脅威を迅速に特定し、分析と対応を迅速化します。

ThreatSonarの具体的な用途とメリットは以下のとおりです。

- **迅速な初期フォレンジック**：ThreatSonarのスキャンによってインシデント対応チームは状況を迅速に把握できます。動作が非常に軽量なため、通常業務への影響を最小限に抑えながら数千台のエンドポイントに対し調査が可能です。
- **効果的な脅威トリアージとインシデント調査**：ThreatSonarはエンドポイントのセキュリティ状態を評価し、インシデントの重大度と詳細フォレンジック調査の必要性を判断するのに役立ちます。侵害されたシステムを迅速に特定し、インシデントの範囲を評価し、侵害の根本原因を調査できます。

 

このコラボレーションのようにTeamT5は、パートナーのサイバーセキュリティサービスの価値向上に貢献するべく実用的かつ強力なツールを提供しています。


TeamT5のCEOであるSung-ting Tsai氏は次のように述べています。「ThreatSonarがCTC-IHにおいて重要な役割を果たしていることを誇りに思います。これは、日々進化する脅威に対応するソリューションを追求し、パートナーのセキュリティサービスを高度化する当社の取り組みの成果です。」

サイバー脅威の複雑さと規模は日々増大しています。迅速な対応と効果的な防御のためには、プロアクティブな脅威ハンティングが不可欠となっています。TeamT5は、組織が攻撃者に対して常に一歩先を行くことができるよう、革新を続け、インテリジェンス主導のソリューションを提供し続けます。

###TeamT5について
TeamT5は、地理的・文化的優位性によってアジア太平洋地域におけるサイバー攻撃者に関する深い知見を有するトップクラスのサイバー脅威アナリストで構成されています。また、当社メンバーは主要なサイバーセキュリティカンファレンスでの招待・多数の講演の実績があります。2023-2024年度には、フロスト＆サリバンの台湾脅威インテリジェンス部門「カンパニー・オブ・ザ・イヤー」を受賞しました。

###Media Contact
pr@teamt5.org

 
![](https://uploads.teamt5.org/upload/original/JP_teamt5-s-threat-sonar-enhances-ctc-mss-s-incident-handling-service-with-advanced-threat-hunting-capabilities.png)

TeamT5のThreatSonar、高度な脅威ハンティング機能でCTC-MSSインシデントハンドリングサービスを強化

[Taipei, October 1, 2025] – TeamT5, a leading cybersecurity intelligence company, proudly announces that its flagship threat hunting solution, ThreatSonar Threat Forensic Analysis Platform, is now being leveraged by our partner ITOCHU Techno-Solutions Corporation([CTC](https://www.ctc-g.co.jp/)) for its CTC-IH (Incident Handling) services.

Many companies face security challenges despite using SOC services. Common issues include delayed responses during nights or holidays, and difficulty understanding alerts because of limited incident response knowledge. These factors often lead to slow or improper actions, increasing the risk and impact of security incidents. 

To facilitate the enterprises to overcome the above challenges, CTC-MSS offers a variety of services that correspond to various security measures. CTC-IH, as part of MSS offerings, supports the initial response after a cyber attack to minimize the damage.

Designed to accelerate threat detection and investigation, ThreatSonar, a threat hunting and digital forensics platform with built-in thousands of APT backdoor signatures, empowers cybersecurity teams with deep visibility into endpoints and advanced analytics to uncover hidden threats. As the ThreatSonar is leveraged by CTC-IH, it can quickly identify cybersecurity threats when an incident occurs, helping the incident response team to accelerate analysis and response. The specific applications and advantages of ThreatSonar include:

- **Quick initial forensic**: With ThreatSonar scan, the security team can quickly grasp the status of the event and shorten the incident investigation time. In addition, its lightweight deployment does not affect daily system operations and can be executed simultaneously on thousands of endpoints to improve efficiency.

- **Effective threat triage and incident investigation**: ThreatSonar can be used for assessing the endpoint security status, helping to determine the severity of the incident and whether subsequent in-depth forensics are required. It can quickly identify compromised systems, assess the extent of the incident and investigate the root cause of the compromise.

 

This collaboration highlights TeamT5’s commitment to enabling partners with powerful tools to elevate their cybersecurity offerings.

“We’re proud to see ThreatSonar playing a key role in our partner’s incident response operations,” said Sung-ting Tsai, CEO at TeamT5. “It reflects our dedication to building solutions that address today's evolving threat landscape while empowering our partners with enhanced capabilities.”

As cyber threats grow in complexity and scale, proactive threat hunting has become essential for rapid response and effective defense. TeamT5 continues to innovate and deliver intelligence-driven solutions that empower organizations to stay ahead of adversaries.

###About TeamT5
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023-2024 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.

###Media Contact
pr@teamt5.org

 

![](https://uploads.teamt5.org/upload/original/International_teamt5-s-threat-sonar-enhances-ctc-mss-s-incident-handling-service-with-advanced-threat-hunting-capabilities.png)

TeamT5’s ThreatSonar Enhances CTC-MSS’s Incident Handling Service with Advanced Threat Hunting Capabilities

[台北，2025年10月1日] – 威脅情資領導品牌杜浦數位安全 TeamT5 很榮幸宣布，其頂尖資安威脅獵捕解決方案「ThreatSonar 威脅鑑識分析平台」獲得合作夥伴伊藤忠商社集團旗下公司 ITOCHU Techno-Solutions Corporation([CTC](https://www.ctc-g.co.jp/)) 採用，為其資安事件處理服務（CTC-IH），提升服務效益。

許多公司儘管使用了資安營運中心（SOC）服務，卻仍然面臨安全挑戰。常見的挑戰包括在夜間或假日時段，事件應變延遲，以及因事件應變經驗不足而難以判讀告警。這些因素往往導致應變措施缺乏時效或未能妥善應對，進而擴大資安事件的風險與衝擊。
為了幫助企業克服上述挑戰，ITOCHU Techno-Solutions 的 CTC-MSS 提供各種資安措施相關的服務。資安事件處理服務（CTC-IH）作為資安服務的一環，旨在協助企業在遭受網路攻擊後的第一時間啟動應變措施，將損害降至最低。

ThreatSonar 專為加快威脅偵測與調查而打造，內建上千種進階持續性威脅（advanced persistent threat, APT）後門特徵，以利資安團隊深入調查端點裝置，並運用進階分析技術揭露潛藏的威脅。由於採用了 ThreatSonar，CTC-IH 團隊能夠在資安事件發生時，快速識別網路安全威脅、加快事件分析和應變速度。 


ThreatSonar 的具體應用與優勢包括：

- **快速初步取證**：ThreatSonar 掃描功能可協助資安團隊快速掌握事件狀態，縮短事件調查時間。此外，其輕量級部署不會影響日常系統運行，並可在數千個端點上同時執行，從而提高效率。
- **有效的威脅分類和事件調查**：ThreatSonar 可用於評估端點安全狀態，協助確定事件的嚴重程度及是否需要後續的深入取證。它更可以快速識別受感染的系統，評估事件的嚴重程度，並調查入侵的根本原因。

 

此次合作彰顯了 TeamT5 致力為合作夥伴提供強大工具，提升其網路安全產品與服務的承諾。
TeamT5 執行長蔡松廷表示：「在合作夥伴的資安事件處理服務中，我們很榮幸看到 ThreatSonar 發揮關鍵作用。這也展現了我們致力打造卓越解決方案的承諾，不僅應對持續變化的威脅情勢，更藉此強化我們合作夥伴的應變實力。」

隨著網路威脅日趨複雜且規模不斷擴大，主動進行威脅獵捕已成為快速應變和有效防禦資安事件的關鍵。TeamT5 將持續創新，提供各類威脅情資驅動的資安解決方案，幫助企業始終領先攻擊者一步，落實有效的資安防禦。

###關於杜浦數位安全 TeamT5
威脅情資領導品牌杜浦數位安全 TeamT5 基於地緣和語言優勢，有效掌握亞太地區的駭客攻擊，經常受邀參加世界級資安會議。更連續 2 年獲得國際顧問公司 Frost & Sullivan 肯定為「臺灣最佳威脅情資公司」。

###媒體聯絡窗口
pr@teamt5.org

 

![](https://uploads.teamt5.org/upload/original/International_teamt5-s-threat-sonar-enhances-ctc-mss-s-incident-handling-service-with-advanced-threat-hunting-capabilities.png)

日本 ITOCHU Techno-Solutions Corporation 採用 TeamT5 威脅獵捕解決方案 ThreatSonar 強化其資安事件處理服務

CyberCon Melbourne is just around the corner, bringing together the brightest minds in cybersecurity to discuss the most pressing challenges and emerging trends shaping our digital world. We’re excited to share that Li-an Huang (Threat Intelligence Analyst) and Linda Kuo (Senior Threat Intelligence Analyst), will be delivering a session on: “Fraud and exploitation in China's global e-commerce boom”.


##Why You Should Attend
Cyber threats are growing more sophisticated, and staying ahead requires more than just the right tools — it requires actionable intelligence and shared knowledge. This session will provide concrete insights that CISOs, IT leaders, and security professionals can apply immediately in their organizations.

##Event Details
- **Date**: October 16 (Thursday)
- **Time**: 11:20 am - 12:00 pm
- **Location**: Melbourne Convention and Exhibition Center (MCEC)

 
We invite you to join us at CyberCon Melbourne and be part of the discussion that is shaping the future of cybersecurity. Don’t miss the chance to gain valuable knowledge from one of the industry’s leading voices.

👉 Learn more about CyberCon Melbourne here: [link](https://melbourne2025.cyberconference.com.au/sessions/session-ccujt1yyvr)

TeamT5 Will Present at CyberCon Melbourne 2025

Join us and our partner Netpoleon Vietnam at CyberSec Vietnam Conference 2025!

Our Partner will feature ThreatVision, a comprehensive intelligence platform that specializes in providing Asia-Pacific-centered cyber threat intelligence. 


### CyberSec Vietnam Conference
- Date: September 24, 2025
- Venue: Sheraton Saigon Grand Opera Hotel, Ho Chi Minh Vity, Vietnam
- Booth number: 5
- Event website: https://cybersecasia.org/csvn2025


TeamT5 Will be at CyberSec Vietnam Conference 2025

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. Our CEO Sung-Ting Tsai took Korea Boannews’s interview and share insights.

Key Highlights:
- As Korea holds significant geopolitical and economic value, it becomes hackers’ target. Cybersecurity threats are present across all industries and government sectors.
- Silent attacks are more alarming than flashy ones. As our CEO says, "Security investment begins with understanding both yourself and your enemies."

 
Read full article: [Boannews](https://www.boannews.com/media/view.asp?idx=139094&kind=)

[Korea Boannews] TeamT5 CEO's Interview

>亞太威脅情資專家 TeamT5 長期關注亞太駭客族群與攻擊事件，執行長蔡松廷接受韓國 Boannews 訪問，分享看法。

專訪重點：
- 韓國擁有重要的地緣政治和經濟價值，因此成為駭客的攻擊目標。網路安全威脅針對各行各業，包括政府部門。
- 安靜潛伏的攻擊比引人注目的攻擊更令人擔憂。正如我們的執行長所說：「安全投資始於了解自己和敵人。」

 

全文請見 [Boannews](https://www.boannews.com/media/view.asp?idx=139094&kind=)

【韓國 Boannews】TeamT5 執行長蔡松廷接受韓國 Boannews 專訪

We’re excited to share that we will be delivering a speech in VirusBulletin (VB) where we’ll be discussing the China-nexus campaign with stealthy tactics.

Stay tuned for insights from our experts!

##About Speech
- **Date**: 2025 / 9 / 24
- **Time**: 15:00 - 15:30
- **Venue**: JW Marriott Hotel Berlin (Stauffenbergstrasse 26 Berlin, Germany, 10785)

 
- **Topic**: Google Calendar as C2 infrastructure: a China-nexus campaign with stealthy tactics
- **Speakers**: Tim Chen (Threat Intelligence Researcher), Still Hsu (Cyber Threat Intelligence Researcher)
- **Introduction**: 

In recent years, China-nexus threat groups have increasingly adopted tactics to obscure their malware footprint, particularly through the use of LOTS (living off trusted sites) and LOLBins (living off the land binaries and scripts). Our latest research has uncovered a new malware variant named Calendarwalk. Calendarwalk employs tactics not previously observed within the APT landscape, such as abusing LOTS through Google Calendar events and exploiting LOLBins via Windows Workflow Foundation. In this talk, we will examine Calendarwalk and the unique techniques it employs, followed by an analysis of its connection to APT41 based on our findings.

In December 2024, our team identified two dully undetected (FUD) samples exploiting XOML (Extensible Object Markup Language) in Windows Workflow Foundation (WF) to execute their payloads. Based on our observations, we believe this is the first documented instance of an APT employing this technique in a real-world scenario. Our analysis of these samples uncovered two shellcode payloads compressed and encoded using a consistent multi-stage compression/encoding chain. One of these resulted in an AES variant of Chatloader (also known as DodgeBox or StealthVector) that was previously associated with APT41, and the other being a never-before-seen malware that we have dubbed Calendarwalk.

Our analysis of Calendarwalk revealed significant hurdles posed by its obfuscation techniques, rendering static analysis ineffective on unmodified binaries. After circumventing these defences through targeted assembly patching, we confirmed its capabilities – including a novel C2 mechanism that retrieves and executes commands via Google Calendar events. During our research we have also discovered overlapping similarities with Google Calendar RAT (GCR), an open-source proof-of-concept RAT that was published on GitHub in 2023, suggesting the malware developer may have taken heavy inspiration from the project.

We believe Calendarwalk is also closely connected to Tabbywalk (also referred to as CurveBack or MoonWalk), a malware family attributed to APT41 last year. While Calendarwalk leverages Google Calendar for its C2 mechanism, Tabbywalk uses Google Drive for similar purposes. Both cases also involved the same version of Chatloader. We will explore the relationship between Calendarwalk and Tabbywalk to establish a potential attribution link.

Our research will highlight the evolving tactics and techniques used by Chinese APT groups, emphasizing their increasing reliance on LOTS and LOLBins to achieve their objectives.


>More at [Virus Bulletin 2025 official website](https://www.virusbulletin.com/conference/vb2025/).

TeamT5 Will be at VirusBulletin (VB)

We’re heading to ITSEC Summit 2025 !

Catch our Senior Threat Intelligence Analyst Linda Kuo as she shares “The Evolving Cybersecurity Landscape in APAC: Real-World Threat Cases from Southeast Asia.”

Don’t miss this chance to gain fresh insights into regional threat intelligence and defense strategies. See you there! 


###ITSEC Summit 2025
- Date: August 26-28, 2025 (Conference & Exhibition)
- Venue: The Ritz-Carlton Jakarta, Pacific Place
- Event website: https://itsecsummit.events/


TeamT5 Will be at ITSEC Summit 2025

TeamT5, a leading threat intelligence brand in the Asia Pacific region, has released its latest cybersecurity threat insights, highlighting a continued rise in advanced persistent threat (APT) incidents. The information technology sector—including the semiconductor industry—remains the most targeted in the region. TeamT5 recommends that organizations stay informed with up-to-date threat intelligence and enhance their cybersecurity defenses by understanding attackers’ tactics, techniques, and procedures.

In the first half of 2025, ongoing geopolitical tensions in the Asia-Pacific region—including China & Taiwan relations, intensified U.S.-China technological competition, and the India-Pakistan conflict—have extended into cyberspace. As a result, APT attacks have increased, with attackers employing more advanced techniques.

## Information Technology Sector is Top Targeted Industry in Asia-Pacific

In the Asia-Pacific region, TeamT5 identified over 200 targeted attacks out of more than 150,000 detected incidents. By industry, the information technology sector—including the semiconductor industry—was the most frequently targeted, followed by government agencies and critical infrastructure (including telecommunications, healthcare, energy, and transportation).

In Japan, the most targeted industry is manufacturing, with other sectors such as government, information technology, and financial institutions also facing persistent threats.

In Southeast Asia, the most targeted industries include government agencies and the energy sector.

And in Taiwan, the most targeted industries are the information technology sector (including the semiconductor industry) and critical infrastructure (including energy, healthcare, and transportation). Additionally, the CrazyHunter ransomware attack impacted several Taiwanese organizations, with victims spanning medical institutions, information technology sector and academic organizations. ([More analysis by TeamT5: [Case Study] CrazyHunter Ransomware Attacks Targeted Taiwan Hospitals](https://teamt5.org/en/posts/the-case-study-hospital-crazyhunter-ransomware-attack/))

##Two Key Attack Methods Are Worth Noting

Regarding attack methods, two key trends should be noted: first, the use of legitimate tools to deploy malicious software; and second, malware designed to target specific devices. Notably, the following critical vulnerabilities have been widely exploited by state-sponsored threat actors:
- Ivanti Connect Secure VPN: CVE-2025-0282 and CVE-2025-22457 
- Check Point VPN: CVE-2024-24919
- SAP NetWeaver: CVE-2025-31324

 

TeamT5 recommends that organizations using related equipment and services apply patches as soon as possible to mitigate the risk of attack.

TeamT5 also highlighted a key trend in cyberattacks during the first half of the year - China has escalated its own counter-narratives. They increasingly publicly attributed cyberattacks to the US and Taiwan. 

Such efforts serve to deflect scrutiny and delegitimize Western accusations of China’s malicious cyber operations.For example, in April, the Harbin Public Security Bureau (PSB) accused three US NSA agents of attacking the Harbin Asian Winter Games. In June, the Guangzhou PSB alleged that Taiwan’s Information, Communications and Electronic Force Command (ICEFCOM) was behind cyberattacks on Chinese tech firms, naming 20 ICEFCOM soldiers and linking the operation directly to Taiwan’s ruling Democratic Progressive Party (DPP).


In addition, TeamT5’s expert team has observed that generative AI tools are increasingly being used in information operation, enabling the rapid creation of fake content and images that are difficult to distinguish from real ones, thereby increasing the complexity of defense.

## Establishing a Clear Cybersecurity Strategy is Crucial for Future Threat Defense

Looking ahead to the second half of 2025, the cybersecurity landscape in the Asia-Pacific region will remain uncertain and challenging. To stay ahead and reduce risk in this ever-evolving threat environment, organizations must continuously leverage up-to-date threat intelligence and strengthen their detection and response capabilities. In the face of increasingly sophisticated attack methods, early adoption of threat intelligence-driven defense strategies will be key to ensuring operational stability and the security of digital assets.

 

###About TeamT5
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023-2024 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
 
Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA and Asia Pacific region. Clients include government agencies, financial business, and high tech enterprises.

press release contact: pr@teamt5.org

[2025 H1 APT Threat Landscape Insights] Asia-Pacific Emerges as Cyberattack Hotspot: Experts Highlight Critical Defense Priorities

亞太威脅情資領導品牌杜浦數位安全 TeamT5 發布最新資安威脅觀察，指出進階持續性威脅（APT）事件數持續上升，資訊科技產業（包含半導體產業）為亞太受攻擊次數最多的產業。建議企業與組織宜掌握最新威脅情資，透過掌握攻擊者手法，強化資安防禦力。

在 2025 年上半年，由於亞太地區地緣政治的對立情勢持續，包括兩岸關係、中美科技競爭、印巴衝突等，此緊張局勢延伸至網路世界，APT 攻擊事件增多，攻擊手段也更加先進。

##亞太區域資訊科技產業受網路攻擊者鎖定

在亞太區域內，TeamT5 從檢測到的逾 15 萬次的攻擊中，識別出逾 200 次針對性的攻擊。從產業別來看，資訊科技產業（包含半導體產業）受攻擊次數最多，其次是政府機構和關鍵基礎設施（包含電信、醫療保健、能源和運輸領域）。

在台灣，最常被攻擊的前兩大產業與亞太區域一致。此外，CrazyHunter 勒索軟體攻擊也影響了台灣企業組織，受害產業遍及醫療院所、資訊科技產業、學術機構。([深度分析與防禦措施請參考〈 TeamT5 專文如何應對 CrazyHunter 勒索軟體攻擊事件【TeamT5 詳解】〉](https://teamt5.org/tw/posts/crazyhunter-ransomware-attack/?utm_source=blog&utm_medium=website))

##兩大關鍵攻擊手法，建議企業宜及早修補漏洞

針對攻擊手法，應注意兩大關鍵：一是利用合法工具執行惡意軟體，二是惡意軟體針對特定目標裝置攻擊，特別是下述嚴重漏洞被國家支持的攻擊者大規模濫用：
- Ivanti Connect Secure VPN：CVE-2025-0282 和 CVE-2025-22457 漏洞
- Check Point VPN：CVE-2024-24919 漏洞
- SAP NetWeaver：CVE-2025-31324 漏洞

 

TeamT5 建議，有使用相關設備與服務的企業組織應及早修補漏洞，降低受攻擊風險。

TeamT5 更指出，從上半年資安攻擊中，有一點值得注意，即中國在全球資訊空間將「網路敘事」武器化的戰略，如：哈爾濱市公安局（PSB）指控 3 名美國國家安全局特工襲擊了哈爾濱亞冬會；廣州公安局指控台灣資通電軍是針對中國科技公司的網路攻擊的幕後黑手，並點名 20 名資通電軍成員，並將此次行動與台灣執政黨民進黨直接關聯，帶有政治目的。

此外，TeamT5 專家團隊也觀察到生成式 AI 工具更常運用於資訊戰，快速產製虛假資訊、圖片，真偽難辨，提升防禦難度。

##未來宜有明確資安防禦策略，防禦威脅
展望 2025 年下半年，亞太網路安全情勢仍將充滿變數與挑戰，企業與組織唯有持續掌握最新威脅情資、強化偵測與應變能力，才能在瞬息萬變的資安戰場中搶得先機、降低風險。面對日益精密的攻擊手法，及早部署威脅情資為基礎的防禦策略，將是確保營運穩健與數位資產安全的關鍵。

 

###關於杜浦數位安全 TeamT5 
TeamT5 杜浦數位安全專精網路威脅研究，協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。連續獲得國際頂尖顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司（2023~2024 Taiwanese Threat Intelligence Company of the Year Award），自主研發之威脅情資平台解決方案更獲國際大展 COMPUTEX - Best Choice Award 金獎肯定。 
 
團隊具備超過 20 年的惡意程式與進階持續性攻擊（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

媒體連絡信箱：pr@teamt5.org

[2025 H1 APT 威脅情勢洞察] 亞太為資安攻擊熱區 專家強調應注意利用合法工具與漏洞的攻擊

アジア太平洋地域における主要な脅威インテリジェンスブランドであるTeamT5は、最新のサイバーセキュリティ脅威インサイトを発表し、APT（高度持続的脅威）インシデントの増加が続いていることを明らかにしました。地域では、情報技術分野（半導体産業を含む）が最も多く標的となっています。TeamT5は、組織が最新の脅威インテリジェンスを活用し、攻撃者の戦術・技術・手順（TTP）を理解することで、防御態勢を強化すべきだと提言しています。


2025年上半期、アジア太平洋地域における地政学的緊張（中国と台湾の関係、米中の技術競争の激化、インドとパキスタンの対立など）がサイバースペースにも波及しました。その結果、APT攻撃は増加し、攻撃者はより高度な手法を用いるようになっています。

##攻撃対象産業と事例
アジア太平洋地域において、TeamT5は15万件以上のインシデントの中から200件超の標的型攻撃を特定しました。業種別では、情報技術分野（半導体産業を含む）が最も多く標的とされ、次いで政府機関や重要インフラ（通信、医療、エネルギー、交通など）が続きます。

日本では、製造業が最も多く標的となっており、政府機関、情報技術分野、金融機関も継続的な脅威にさらされています。

東南アジアでは、政府機関とエネルギー分野が主な標的です。

台湾では、情報技術分野（半導体を含む）および重要インフラ（エネルギー、医療、交通など）が標的とされています。さらに、CrazyHunterランサムウェア攻撃が複数の台湾組織に影響を及ぼし、被害は医療機関、情報技術分野、学術機関に及びました。（[詳細分析：[ケーススタディ] CrazyHunterランサムウェアが台湾の病院を標的に](https://teamt5.org/en/posts/the-case-study-hospital-crazyhunter-ransomware-attack/)）


##攻撃手法の傾向
攻撃手法に関しては、特に注目すべき2つの傾向があります。1つは、正規のツールを悪用してマルウェアを展開する手法であり、もう1つは、特定のデバイスを標的とするマルウェアの使用です。 また、以下の重大な脆弱性が国家支援型脅威アクターによって広く悪用されていることが確認されています：
- Ivanti Connect Secure VPN: CVE-2025-0282 and CVE-2025-22457 
- Check Point VPN: CVE-2024-24919
- SAP NetWeaver: CVE-2025-31324

 

TeamT5は、関連機器やサービスを使用している組織に対し、早急なパッチ適用を推奨しています。

##注意すべき攻撃動向とTeamT5のインサイト
TeamT5は、2025年上半期のサイバー攻撃における重要な傾向として、中国が自国に対する非難に反論する形で、米国や台湾にサイバー攻撃の責任を公然と主張するようになっていることを指摘しました。 

例として、4月には、ハルビン市公安局が米国家安全保障局（NSA）の職員3名を、アジア冬季競技大会に対する攻撃の犯人と名指ししました。6月には、広州市公安局が、台湾の情報通信電子部隊（ICEFCOM）が中国のテック企業に対するサイバー攻撃を行ったと主張し、ICEFCOMの兵士20名の名前を公開、台湾の与党である民進党（DPP）との関与を示唆しました。

さらに、TeamT5の専門家は、生成AIツールが情報戦に利用されるケースが増加していると指摘しています。これにより、リアルと見分けがつかない偽コンテンツや偽画像の作成が容易になり、防御の難易度が一層高まっています。

##結論
2025年後半に向けて、アジア太平洋地域におけるサイバーセキュリティの状況は引き続き不確実かつ困難なものとなるでしょう。この進化し続ける脅威環境で先手を打ち、リスクを軽減するためには、常に最新の脅威インテリジェンスを活用し、検知・対応能力を強化することが不可欠です。ますます巧妙化する攻撃手法に対抗するには、脅威インテリジェンスに基づいた防御戦略の早期導入が、業務の安定とデジタル資産の保護にとって鍵となります。


広報担当者へ: PR-JP@teamt5.jp

【2025年上半期 APT脅威情勢インサイト】 アジア太平洋地域がサイバー攻撃のホットスポットに浮上： 専門家が重要な防御優先事項を強調

Join TeamT5 for an insightful webinar: “Hackers Keep Evolving - How Proactive Threat Hunting Keeps Us Staying Ahead” !

###Webinar Info
- **Date**: August 14, 2025
- **Time**: 16:00-17:00 (GMT+8)

- **Sign Up :** [**link**](https://forms.gle/Nxyn6MkDoFqbr6DK6)

- **Main topics: **
 - **EDR Evasion Techniques in the Wild**: understand how modern attackers bypass endpoint defenses using stealthy techniques.
 - **Proactive Threat Hunting in Action**: learn how organizations are adopting threat hunting to uncover hidden threats, reduce dwell time, and gain deeper visibility beyond EDR.

 
![](https://uploads.teamt5.org/upload/original/pic_august-14-webinar-hackers-keep-evolving-how-proactive-threat-hunting-keeps-us-staying-ahead.jpg)

[August 14 Webinar] Hackers Keep Evolving - How Proactive Threat Hunting Keeps Us Staying Ahead

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. Our CTI analyst took Reuters’s interview and made comments. This is an expert of Reuters's article. Read more at [Reuters](https://www.reuters.com/sustainability/boards-policy-regulation/china-linked-hackers-target-taiwans-chip-industry-with-increasing-attacks-2025-07-16/).

......Targeting of semiconductors and the supply chain around them “is a persistent threat that has existed for long,” the representative said, and a “constant interest” for Chinese-related advanced hacking operators.

These groups often target “peripheral suppliers or related industries,” the representative said, such as a situation in June where a China-linked hacking group identified by TeamT5 as "Amoeba" launched a phishing campaign against an unnamed chemical company that plays a critical role in the semiconductor supply chain......


 
 
(cover source: pexels)

[Reuters] Exclusive: China-linked hackers target Taiwan's chip industry with increasing attacks, researchers say

>亞太威脅情資專家 TeamT5 長期關注中國駭客族群與攻擊事件，接受路透社 (Reuters)訪問，進行評論。本文為摘錄，完整文章請見 [Reuters](https://www.reuters.com/sustainability/boards-policy-regulation/china-linked-hackers-target-taiwans-chip-industry-with-increasing-attacks-2025-07-16/)。


......Targeting of semiconductors and the supply chain around them “is a persistent threat that has existed for long,” the representative said, and a “constant interest” for Chinese-related advanced hacking operators.

These groups often target “peripheral suppliers or related industries,” the representative said, such as a situation in June where a China-linked hacking group identified by TeamT5 as "Amoeba" launched a phishing campaign against an unnamed chemical company that plays a critical role in the semiconductor supply chain.......
 
 
（首圖來源：pexels）

【Reuters 採訪報導】Exclusive: China-linked hackers target Taiwan's chip industry with increasing attacks, researchers say

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. Our CTI analyst took The Washington Post’s interview and made comments. This is an expert of The Washington Post's article. Read more at [The Washington Post](https://www.washingtonpost.com/technology/2025/07/16/china-hacking-us-targets/).

 
......A Silk Typhoon run dating to December has netted about 100 known victims, according to researchers tracking its methods. Among them are government ministries in Spain and Finland, according to a person close to the investigations, and media companies in Japan, South Korea and the United States — including The Washington Post — according to Che Chang, an analyst with the Taiwan-based cybersecurity firm TeamT5.......



 
 
(cover source：pexels)

[The Washington Post] China’s cyber sector amplifies Beijing’s hacking of U.S. targets

>亞太威脅情資專家 TeamT5 長期關注中國駭客族群與攻擊事件，接受華盛頓郵報 (The Washington Post )訪問，進行評論。本文為摘錄，完整文章請見 [The Washington Post](https://www.washingtonpost.com/technology/2025/07/16/china-hacking-us-targets/)。

......A Silk Typhoon run dating to December has netted about 100 known victims, according to researchers tracking its methods. Among them are government ministries in Spain and Finland, according to a person close to the investigations, and media companies in Japan, South Korea and the United States — including The Washington Post — according to Che Chang, an analyst with the Taiwan-based cybersecurity firm TeamT5.......



 
 
（首圖來源：pexels）

【The Washington Post 採訪報導】China’s cyber sector amplifies Beijing’s hacking of U.S. targets

> We’re honored to be invited to deliver the speech, "Cybersecurity Dynamics in Asia: Case Studies of Ivanti Exploitation and Cross-Border Cyber Operations", at the ST Engineering CYBERSECURITY SUMMIT 2025.


China has been devoted their national resources to develop talents, capabilities and techniques in offensive cyber operations. Their successes are now recognized by so many CTI reports talking about their infiltration into entities around the whole world.

In this talk, we are going to use two case studies, including a global Ivanti exploitation activity in March 2025 and China's cyber espionage activities during the UA-RU conflict, to discuss China's motivation, achievement in cyber space.

See you there!

## Info
- **Date**: July 4, 2025
- **Time**: 14:30 - 16:00 (Breakout Track 2 - Cyber Threat Intelligence)
- **Venue**: 
Sands Expo & Convention Centre 
Roselle Simpor Ballroom, Level 4 
(10 Bayfront Ave, Singapore 018956) 
- **More info**: https://stenggcybersecuritysummit.sg/

[Speech] TeamT5 will be at ST Engineering CYBERSECURITY SUMMIT 2025 (Singapore)

> TeamT5 杜浦數位安全很榮幸受邀於 ST Engineering CYBERSECURITY SUMMIT 2025 發表演講。
 
本次演講主題為「Cybersecurity Dynamics in Asia: Case Studies of Ivanti Exploitation and Cross-Border Cyber Operations」。我們觀察到中國投入國家資源，致力於培養攻擊性網路行動的人才、能力和技術。如今，許多威脅情資報告都指出中國達成其目標，並探討了中國對全球組織的滲透。

而本次演講將透過兩個案例研究，包括 2025 年 3 月的全球 Ivanti 漏洞活動和中國在美國-俄羅斯衝突期間的網路間諜活動，探討中國在網路空間的動機和事件。

期待與您現場相見，交流資安態勢看法。

## 演講資訊
- **日期**: 2025年7月4日
- **時間**: 14:30 - 16:00 (Breakout Track 2 - Cyber Threat Intelligence)
- **地點**: 
Sands Expo & Convention Centre 
Roselle Simpor Ballroom, Level 4 
(10 Bayfront Ave, Singapore 018956) 
 
- **官網**: https://stenggcybersecuritysummit.sg/

【演講資訊】TeamT5 即將參與 ST Engineering CYBERSECURITY SUMMIT 2025 (新加坡)

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. Our CTI analyst took The New York Times’s interview and made comments. This is an expert of The New York Times's article. Read more at
 [The New York Times](https://www.nytimes.com/2025/06/19/world/europe/china-hackers-russia-war-ukraine.html).

The hacking campaign shows that, despite this partnership and years of promises not to hack each other, China sees Russia as a vulnerable target. In 2023, one group, known as Sanyo, impersonated the email addresses of a major Russian engineering firm in the hunt for information on nuclear submarines, according to TeamT5, a Taiwan-based cybersecurity research firm that discovered the attack last year and linked it to the Chinese government.

……

“China likely seeks to gather intelligence on Russia’s activities, including on its military operation in Ukraine, defense developments and other geopolitical maneuvers,” said Che Chang, a researcher with TeamT5.

……

 
 
(cover source：pexels)

[The New York Times] China Is Hacking Russia to Steal War Secrets

>亞太威脅情資專家 TeamT5 長期關注中國駭客族群與攻擊事件，接受紐約時報 (The New York Times)訪問，進行評論。本文為摘錄，完整文章請見 [The New York Times](https://www.nytimes.com/2025/06/19/world/europe/china-hackers-russia-war-ukraine.html)。

The hacking campaign shows that, despite this partnership and years of promises not to hack each other, China sees Russia as a vulnerable target. In 2023, one group, known as Sanyo, impersonated the email addresses of a major Russian engineering firm in the hunt for information on nuclear submarines, according to TeamT5, a Taiwan-based cybersecurity research firm that discovered the attack last year and linked it to the Chinese government.

……

“China likely seeks to gather intelligence on Russia’s activities, including on its military operation in Ukraine, defense developments and other geopolitical maneuvers,” said Che Chang, a researcher with TeamT5.


 
 
（首圖來源：pexels）

【The New York Times 採訪報導】China Is Hacking Russia to Steal War Secrets

Join TeamT5 and EclecticIQ for an exclusive webinar: “Strategic Intelligence: Translating APAC Threats to Business Risk” !

You may discover how to turn region-specific threat intelligence into actionable insights for smarter risk decisions. It’s a perfect opportunity for cybersecurity leaders navigating today’s complex APAC threat landscape.

###Webinar Info
- _Date: July 9, 2025_
- _Time: 11:00-12:00 (CEST) / 17:00-18:00 (CST)_

- **On-Demand Webinar Now Available :** [**link**](https://youtu.be/UgsbCdVJGyA?feature=shared)

- **Main topics: **
 - The strategic value of regional intelligence
 - The importance of threat intelligence from Asia-Pacific to European and US organizations
 - How to achieve faster identification of relevant threats and enhance threat hunting capabilities
 - Building a stronger security posture against APAC-specific threat actors

 
![](https://uploads.teamt5.org/upload/original/new-pic_july-9-webinar-automating-asia-pacific-cyber-threat-intelligence-at-scale.png)

[July 9 Webinar] Automating Asia-Pacific Cyber Threat Intelligence at Scale

We’re excited to share that we will be delivering a speech in the The Hague Threat Intelligence Exchange (Hague TIX 2025) where we’ll be discussing the latest Chinese state actors’s attack methods. 

Stay tuned for insights from our experts!

##About Speech
- **Date**: 2025 / 6 / 10
- **Venue**: George Maduroplein 1 (Madurodam), Den Haag, Netherlands

- **Topic**: KnockHuoDuo Unmasked: The Fruit of China's Evolving Zero-Day Exploitation Strategy
- **Speakers**: Charles Li (Chief Analyst), Greg Chen (Vulnerability Researcher), Yi-Chin Chuang (Cyber Threat Researcher)
- **Introduction**: 

In recent years, Chinese state actors have increasingly exploited zero-day vulnerabilities, surpassing all other nations combined. This surge reflects a deliberate policy shift since 2018, when China began systematically collecting vulnerabilities and treating them as national assets. Following this strategy, we identified an emerging Chinese state actor, KnockHuodou (UNC4841), specializing in vulnerability exploitation. Their expertise in pwning, binary exploitation, and reverse engineering has enabled some of the most sophisticated compromises. This presentation will reveal our research on KnockHuodou in 2024. 

We will start by introducing KnockHuodou and their recent campaigns, particularly their exploitation of zero-day vulnerabilities in edge devices. Next, we will present case studies to highlight the evolving threat they pose. KnockHuodou serves as a vivid example of how China-nexus actors can adopt the centralized vulnerability research in cyberattacks. In the last part of the speech, we will conclude with key implication based on our understanding of KnockHuodou, and how it represents the emerging Chinese cyber threats – because, as the saying goes, know the enemy and know yourself; in a hundred battles, you will never be in peril. We believe that intelligence is the best key for defending.

 

More details are at [the official website](https://www.thehagueprogram.nl/the-hague-tix/hague-tix-2025-welcome).

TeamT5 will be at The Hague Threat Intelligence Exchange (Hague TIX 2025) 

TeamT5, a provider of top cyber threat intelligence solution in APAC, is going to showcase solutions at the upcoming cybersecurity event - FIRSTCon 2025.

This event provides a forum for sharing goals, ideas, and information on how to improve global cyber security. FIRST is a front-line enabler in the global response community, providing access to the best practices, tools, and trusted communication with its member teams. And TeamT5 will be showcasing our threat intelligence platform ThreatVision.

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises and organizations foresee cyber attacks and deploy defense strategies in advance. 

We sincerely invite you to experience our intelligence-driven cyber defense at booth# 12.

## Our Solutions: ThreatVision, a powerful threat intelligence platform

Advantages:
1. Grasp latest & advanced cyber threats 
2. Boost power to defend cyber attacks 
3. Expand insights & database for Advanced Persistent Threat (APT)

Intro:
Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 20+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

More at [https://teamt5.org/en/products/threatvision/](https://teamt5.org/en/products/threatvision/?utm_source=event&utm_medium=website)

## TeamT5 at FIRSTCON 2025
- Date: 2025 / 6 / 22 ～27 for booth showcase

- Venue: 
Bella Center Copenhagen 
Center Blvd. 5, 2300 Copenhagen, Denmark

- TeamT5 Booth Number: 12

- Event Website: [link](https://www.first.org/conference/2025/)

 

![](https://uploads.teamt5.org/upload/original/pic_teamt5-will-showcase-solutions-at-firstcon-2025.jpg)

TeamT5 Will Showcase Solutions at FIRSTCON 2025

TeamT5 杜浦數位安全 為亞太威脅情資的頂尖品牌，即將於 FIRSTCON 2025 展出解決方案 ThreatVision。

FIRSTCON 2025 是全球資安專家共同參與的盛會 ，討論資安威脅情資、資安事件的應變對策等，打造資安韌性。

TeamT5 杜浦數位安全相信威脅情資是網路防禦的基石。我們提供行動導向的在地化情報，幫助企業和組織預見網路攻擊並部署防禦策略。歡迎蒞臨現場，了解我們的威脅情資見解與解決方案。

## 我們的解決方案: ThreatVision 威脅情資平台

#### 優點：
掌握最新、技術先進的資安威脅
增強防禦資安攻擊的能力
擴展進階持續性威脅（APT）的見解和資料庫

#### 簡介：


憑藉針對亞太地區惡意程式、進階持續性威脅（APT）族群和網路威脅逾 20 年的研究經驗，ThreatVision 威脅情資平台專為組織，提供以亞太地區為中心的豐富網路威脅情資。平台透過提供戰略、營運和戰術威脅情資，來滿足網路安全領域的不同角色，包括決策者、風險管理者和事件應變人員，協助 C 層級高階經理人、風險經理和事件處理人員了解威脅形勢、識別惡意行為者並部署有效的網路威脅防禦。

ThreatVision 提供可客製情資調查與諮詢服務，以及其易於使用的介面和精選報告，協助組織能做出明智的決策，有效地分配資安資源，並增強網路安全。

更多介紹，請見：[https://teamt5.org/tw/products/threatvision/](https://teamt5.org/tw/products/threatvision/?utm_source=event&utm_medium=website)

## TeamT5 杜浦數位安全參展 FIRSTCON 2025
- 日期：2025 / 6 / 22 ～27 攤位展出時段

- 地點：
丹麥哥本哈根 Bella Center Copenhagen
Center Blvd. 5, 2300 Copenhagen, Denmark

- TeamT5 攤位編號：12

- 活動官網：[連結](https://www.first.org/conference/2025/)

 

![](https://uploads.teamt5.org/upload/original/pic_teamt5-will-showcase-solutions-at-firstcon-2025.jpg)

TeamT5 杜浦數位安全即將於 FIRSTCON 2025 展出

![](https://uploads.teamt5.org/upload/original/en_apac-threat-intelligence-leading-brand-teamt5-s-threatvision-solution-awarded-computex-best-choice-award-golden-award.png)

TeamT5 is a leading brand in Asia Pacific threat intelligence. Its threat intelligence platform, ThreatVision won the [Best Choice Award at COMPUTEX TAIPEI](https://bcaward.computex.biz/WinnerYearDetail.aspx?index=9909&awtype=000000001&year=2025&sort=2). This recognition is the best proof of the long-term research results of TeamT5’s professional team, who excels at analyzing the attack methods of more than 165 advanced persistent threat (APT) groups to provide threat countermeasures and defense guidance. TeamT5 is the most reliable “intelligence-gathering team” who empowers enterprises and organizations to gain an upper hand in cybersecurity attacks.

ThreatVision provides a wealth of cyber threat intelligence centered on the Asia-Pacific region based on more than 20 years of research experience on malware, APT groups and cyber threats. The platform provides strategic, practical and tactical threat intelligence to meet the needs of various roles in the cybersecurity field, including decision makers, risk managers and incident responders, helping them to accurately understand the threat landscape, identify malicious actors and deploy effective defenses.

This product has been trusted and adopted by worldwide customers in government, finance, telecommunications, high-tech and other industries. The three major features are:

###1. Diverse Intelligence to Grasp Key Threat Information
- **Asia Pacific APT Intelligence**: Release weekly and monthly. The weekly report provides real-time threat intelligence and indicators of compromise (IoC) to defend attacks. The monthly report analyzes recent APT incidents and malware to help enterprises and organizations to overview the threat landscape.
- **Vulnerability Intelligence**: Provide technical details about highly exploitable vulnerabilities with clear guidance to help enterprises and organizations to mitigate potential risks.
- **Cyber Affairs**: Provide strategic cyber intelligence regarding the Chinese-speaking cyber world.Through comprehensive analysis in cybersecurity news, policies, regulations, and incidents, giving insights into the emerging tech giant, China's cyber capabilities.

###2. Informative Databases and Tools to Empower Threat Defense
ThreatVision provides downloadable threat hunting tools that can quickly and effectively detect attacks; the automated sample analysis allows users to utilize the sandbox via API to instantly compare and analyze suspicious samples; the attack group and malware databases offer users a systematic way to gain insight into the sources, methods, and targets of attack groups, as well as to facilitate search and obtain key malware information.

###3. Deep and Dark Web Monitoring to Timely Manage Leakage Risk
The deep and dark web (DDW), which accounts for more than 90% of the Internet, are websites that require permission and special methods to access. Due to high anonymity and difficulty in tracking, DDW have become cybercrime hotspots. ThreatVision provides DDW monitoring service, which can monitor whether confidential information such as credentials and personal information of enterprises and organizations has been leaked to the DDW, with automatic email alerts to timely flag the relevant security risks.

Sung-ting Tsai, founder and CEO of TeamT5, said: "After winning the Best Choice Award Gold Award in 2024 for the "ThreatSonar Anti-Ransomware" (endpoint detection and response platform), we are honored to receive high recognition again for the "ThreatVision" (threat intelligence platform). The company will uphold our faith in "intelligence-driven defense" and continue to assist enterprises and organizations in defending threats and foreseeing possible risks.”
 
The Best Choice Award, one of the honors at the world’s 2nd largest (largest in Asia Pacific) ICT procurement platform - COMPUTEX TAIPEI. The award focuses on functionality, innovation, and market potential as the main judging guideline. The committee of the Best Choice Award is recruited from government representatives, academicians, research analysts, editor-in-chiefs and experts in order to be fair and credible.


![](https://uploads.teamt5.org/upload/original/en_pic_apac-threat-intelligence-leading-brand-teamt5-s-threatvision-solution-awarded-computex-best-choice-award-golden-award.jpg)
<center>TeamT5 is awarded the COMPUTEX TAIPEI Best Choice Award again with its threat intelligence platform, “ThreatVision”. </center>

##About TeamT5
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023-2024 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
 
Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA and Asia Pacific region. Clients include government agencies, financial business, and high tech enterprises.
 
Website: https://teamt5.org/en/ 
Contact: pr@teamt5.org

 

> TeamT5 will present Besr Choice Award winner "ThreatVision" in 2025 COMPUTEX - InnoVEX. Please visit our booth #S1025a at Taipei Nangang Exhibition Center - Hall 2 (Taiwan) for more info.

APAC Threat Intelligence Leading Brand TeamT5's ThreatVision Solution Awarded Computex Best Choice Award - Golden Award

![](https://uploads.teamt5.org/upload/original/tw_apac-threat-intelligence-leading-brand-teamt5-s-threatvision-solution-awarded-computex-best-choice-award-golden-award.png)

TeamT5 杜浦數位安全（以下簡稱 TeamT5）為亞太威脅情資領導品牌，其「ThreatVision 威脅情資平台」獲得[台北國際電腦展（COMPUTEX TAIPEI）Best Choice Award 金獎](https://bcaward.computex.biz/WinnerYearDetail.aspx?index=9909&awtype=000000001&year=2025&sort=2)的肯定。TeamT5 專業團隊彙集長期研究成果，剖析逾 165 個亞太駭客族群，以及其進階持續性威脅（APT）攻擊手法，提供防禦對策與指引，在資安攻防戰取得先機，是各企業與組織最可靠的情資蒐集團隊。

「ThreatVision 威脅情資平台」憑藉針對亞太地區惡意程式、APT 攻擊族群和網路威脅逾 20 年的研究經驗，提供豐富的在地化網路威脅情資。本平台提供戰略、實戰和戰術威脅情資，可滿足資訊安全決策者、風險管理者和事件應變人員等各角色的不同需求，精準掌握威脅形勢、識別惡意行為者，並部署有效防禦。

本產品已獲國內外客戶信賴與採用，客戶遍布政府、金融、電信、高科技業等產業，具備 3 大特點：
###1.多元化情資，掌握資安攻防關鍵
- **亞太 APT 情資**：依據發布頻率分為週報和月報。週報提供即時防禦的威脅情資，以及可用來採取防禦行動的入侵指標（IoC）；月報深入解析近期 APT 攻擊事件並分析惡意軟體，協助企業與組織掌握威脅形勢全貌。
- **漏洞情資**：針對高度可利用的漏洞加以說明，提供循序漸進的方式，協助企業與組織減輕，乃至避免漏洞相關的潛在風險。
- **網路政策**：針對中文網路世界的最新政策、法規、網路事件等提供詳盡分析，讓使用者了解科技新興強權中國的網路能力。

###2.豐富資料庫與工具，助力威脅防禦
提供可下載的威脅狩獵工具，可快速有效地偵測攻擊；自動化樣本分析讓使用者可透過 API 串接沙箱，即時比對和分析可疑樣本；攻擊族群和惡意程式等資料庫提供系統化資訊，協助使用者洞悉攻擊族群的來源、手法和目標，並能快速搜尋和獲取惡意程式關鍵資訊。

###3.深暗網監測，及時掌握資料外洩風險
在網路世界佔比逾九成的深暗網，是需要權限和特別管道才能存取的網站；由於高匿名性和難以追蹤，因此成為網路犯罪的熱點。本平台提供深暗網監控服務，可為企業與組織監測憑證和個資等機密資料是否外洩至深暗網，並以電子郵件自動發送告警，協助及時掌握切身相關的資安風險。

TeamT5 創辦人暨執行長蔡松廷表示：「繼 2024 年以『ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台』獲得 Best Choice Award 金獎，很榮幸再次以『ThreatVision 威脅情資平台』 獲得高度肯定。本公司將秉持『情資驅動防禦』的初衷，持續協助企業與組織抵禦威脅，預見可能的風險。」
Best Choice Award 為全球第二大、亞洲最大 ICT 採購平台「COMPUTEX TAIPEI 台北國際電腦展」的大會獎項，以產品的功能、創新度與市場潛力為評選重點，由學術界、研究單位、產業領域專家的全方位評審團，選出獲獎產品，具備公平性與公信度。

 

![](https://uploads.teamt5.org/upload/original/tw_pic_apac-threat-intelligence-leading-brand-teamt5-s-threatvision-solution-awarded-computex-best-choice-award-golden-award.jpg)
<center>TeamT5 杜浦數位安全「ThreatVision 威脅情資平台」獲得 COMPUTEX Best Choice Award 金獎</center>

 

##關於 TeamT5 杜浦數位安全
TeamT5 專精網路威脅研究，並提供端點偵測與回應（EDR）解決方案，協助美日臺大型企業有效保護商業機密文件，讓營運不受網路攻擊影響。TeamT5 也獲得日本三大巨頭投資，包含日本最大創投 JAFCO 集富集團、日本最大跨國企業且在全球皆有商業投資的 ITOCHU 伊藤忠商事，以及日本最大資安解决方案提供商 MACNICA。

團隊具備超過 20 年的惡意程式與進階持續性威脅（APT）的研究經驗，運用地緣和語言優勢，有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

官網：https://teamt5.org/tw/ 
新聞聯絡窗口：pr@teamt5.org 

 

> TeamT5 杜浦數位安全將於 2025 COMPUTEX - InnoVEX 展出本次得獎產品「ThreatVision 威脅情資平台」，歡迎於 2025 / 5 / 20 ~ 23 蒞臨台北南港展覽館二館4樓 #S1025a 攤位了解。

TeamT5 再獲國際肯定 「ThreatVision 威脅情資平台」榮獲 Computex Best Choice Award 金獎

Embrace the Power of Intelligence at the Threat Analyst Summit 2025! 

In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, "Stay Informed, Stay Secure", underscores the critical role of continuous intelligence in safeguarding against emerging threats.

With the rapid evolution of ICT, TeamT5 encourages pioneering research that addresses not only technical challenges but also the legal, policy, economic, psychological, and societal aspects of cybersecurity. We invite you to submit presentations.

- Call for Presentations Detail: [link](https://tas.teamt5.org/cfp2025)
- Final Deadline for Submissions: July 15, 2025, 22:00 UTC+8 (14:00 UTC+0)  
- We will send a confirmation email to every submitter upon receiving your submission. If you do not receive this email, please contact us at cfp_tas@teamt5.org again.


2025 TeamT5 Threat Analyst Summit : Call for Presentations (Closed)

在不斷發展的網路安全態勢中，掌握先機不僅是防禦優勢，而且勢在必行。敬邀您加入今年的威脅分析師高峰會，現場將匯集產業專家與威脅情資專家共同探索與分享資安防禦策略。

隨著資通技術的快速發展，TeamT5 鼓勵開創性研究，不僅解決技術挑戰，還解決網路安全的法律、政策、經濟、心理和社會方面的問題。我們邀請您提交演講稿件。

- 徵稿詳情：[連結](https://tas.teamt5.org/cfp2025)
- 提交期限： 2025年7月15日 22:00 UTC+8 (14:00 UTC+0) 
- 收到您的稿件後，我們會向每位發送確認信。如果您沒有收到此信，請透過 cfp_tas@teamt5.org 再次與我們聯絡。


TeamT5 威脅分析師高峰會 2025：徵稿 (已截止)

Embrace the Power of Intelligence at the Threat Analyst Summit 2025!

In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, 'Stay Informed, Stay Secured,' underscores the critical role of continuous intelligence in safeguarding against emerging threats.

Together, let's elevate our cybersecurity defenses and ensure a safer digital future. We sincerely invite you to join us.

**Stay Informed. Stay Secured.**

##Agenda
![](https://uploads.teamt5.org/upload/original/2025-teamt5-threat-analyst-summit_1203_new.jpg)
![](https://uploads.teamt5.org/upload/original/2025-teamt5-threat-analyst-summit_1204_new.jpg)


(The organizer reserves the right to modify the event format, agenda, or program at any time if necessary.)


 

## Info
- **Date**: December 3 ~ 4, 2025
- **Venue**: ILLUME TAIPEI（No. 100, DunHua N Rd, Songshan District, Taipei City, Taiwan）
- **More info & Agenda**: [link](https://tas.teamt5.org/?utm_source=event&utm_medium=website)
- **Buy Ticket**: [link](https://teamt5.kktix.cc/events/tas2025/?utm_source=event&utm_medium=website)

2025 TeamT5 Threat Analyst Summit - Agenda is out now 

在不斷發展的網路安全態勢中，掌握先機不僅是防禦優勢，而且勢在必行。敬邀您加入今年的威脅分析師高峰會，現場將匯集產業專家與威脅情資專家共同探索與分享資安防禦策略。

參與本活動，您將可以：
- 掌握來自國際的專家見解 
- 深度了解進階持續性攻擊（APT）和網路犯罪的最新攻擊手段並進行防禦 
- 獲得應變資安威脅事件的最新策略 

面對資安威脅，不只積極面對，更以洞見機先的威脅情奠定防禦基底。
讓我們共同提升網路安全防禦能量，確保更安全的未來。

**隨時掌握先機，確保資訊安全! Stay Informed. Stay Secured.**

##議程
![](https://uploads.teamt5.org/upload/original/2025-teamt5-threat-analyst-summit_1203_new.jpg)
![](https://uploads.teamt5.org/upload/original/2025-teamt5-threat-analyst-summit_1204_new.jpg)

(主辦單位保留調整活動之權利)

##資訊
- **活動時間**：2025/12/3(三) - 2025/12/4(四)
- **活動地點**：茹曦酒店 ILLUME TAIPEI（臺北市松山區敦化北路100號）
- **活動介紹**：[連結](https://tas.teamt5.org/zh/?utm_source=event&utm_medium=website)
- **售票網頁**：[連結](https://teamt5.kktix.cc/events/tas2025/?utm_source=event&utm_medium=website)

TeamT5 威脅分析師高峰會 2025 - 議程公布

![](https://uploads.teamt5.org/upload/original/pic_update_eclecticiq-and-teamt5-join-forces-to-combat-asia-pacific-cyber-threats-with-enhanced-intelligence-capabilities.jpg)


>Strategic partnership delivers advanced threat detection and response for government agencies and high-risk industries across finance, telecoms, and critical infrastructure

**_Amsterdam, Netherlands & Taipei, Taiwan – May 6 2025 _** - Cyber threats are a major concern for all industries, with increased sophistication, and ransomware attacks reaching their highest levels in four years, according to the World Economic Forum's (WEF) [Global Cybersecurity Outlook 2025 report](https://www.weforum.org/publications/global-cybersecurity-outlook-2025/). To address this growing problem, EclecticIQ, the leading provider of threat intelligence solutions, has announced a strategic partnership with TeamT5, the premier threat intelligence company specializing in advanced persistent threat (APT) research in the Asia-Pacific (APAC) region.

This integration combines EclecticIQ's industry leading Intelligence Center Platform, with [TeamT5's APAC-focused intelligence](https://teamt5.org/en/products/threatvision/?utm_source=news&utm_medium=website) to provide security teams with high-fidelity, contextual threat insights that enhance detection, understanding, and mitigation of sophisticated regional and global threats.

"_In cybersecurity, speed and context make the difference between defense and disaster,_" said Cody Barrow, CEO of EclecticIQ. "_TeamT5's unparalleled regional insight complements our global platform, giving our customers the edge they need to combat sophisticated attacks originating from the APAC region. This partnership enables faster, more informed decision-making against threats that might otherwise go undetected._"

While global intelligence feeds often overlook region-specific actors, this partnership addresses that critical gap. Drawing on more than 20 years of APT research, TeamT5 provides visibility into over 160 adversary groups and 2,600+ malware families operating across Asia-Pacific, intelligence now fully integrated within EclecticIQ's ecosystem to bring enhanced capabilities in fighting against national-level APT attacks for global businesses operating in APAC.

"_By partnering with EclecticIQ, we're extending our deep knowledge of APAC threat actors to a global audience,_" said Sung-ting Tsai (TT), CEO of TeamT5. "_The integration of our APAC-focused threat intelligence with EclecticIQ’s platform empowers global security teams with the regional depth to see the full picture. Together, we’re taking threat intelligence to a new level by driving actionable and relevant insights._"

**Key Partnership Benefits:**
- **For Security Teams**: A unified view that consolidates indicators of compromise (IoCs), adversary TTPs, and targeted detection rules, streamlining workflows and accelerating response times.
- **For Strategic Leaders**: The ability to shift from reactive defense to proactive threat anticipation.
- **For Organizations**: Faster identification of relevant threats, enhanced threat-hunting capabilities, and a stronger security posture against APAC-specific threat actors.

For EclecticIQ and TeamT5 customers, this means faster identification of relevant threats, improved threat-hunting capabilities, and a stronger, more resilient security posture, at regional and global scale. For business leaders, it delivers confidence knowing that critical operations are protected against regional threats specific to APAC.

To learn more about this partnership, please visit: https://www.eclecticiq.com/news/eclecticiq-and-teamt5-join-forces-to-combat-asia-pacific-cyber-threats-with-enhanced-intelligence-capabilities

##About TeamT5
TeamT5 is a Taiwan-based leading brand in Asia Pacific threat intelligence, serving worldwide clients across governments and large-scale enterprises.​ Leveraging geographical and cultural advantages, TeamT5 excels in researching and analyzing APT groups, enabling effective threats detection and defense.​ As a two-time winner of “Taiwanese Threat Intelligence Company of the Year Award” by Frost & Sullivan, TeamT5 is the most reliable guardian in the evolving threat landscape.

Follow us on [Facebook](https://www.facebook.com/TeamT5.org/), [X](https://twitter.com/teamt5_official/), [LinkedIn](https://www.linkedin.com/company/teamt5/), [YouTube](https://www.youtube.com/@teamt5/featured) for more information.

###TeamT5 Media Contact
pr@teamt5.org

 

##About EclecticIQ
EclecticIQ is a global provider of threat intelligence technology and services that empower customers to neutralise critical cyber threats to their business. Guided by our values — being curious, bold, accountable, and collaborative — we help security teams make smarter, faster decisions with dynamic solutions that reduce complexity and streamline threat detection and response.

Visit https://www.eclecticiq.com/ or follow us on [LinkedIn](https://www.linkedin.com/company/eclecticiq/) and [X](https://twitter.com/EclecticIQ) for more information.

###EclecticIQ Media Contact
Emma Bailey, Account Executive at Berkeley Communications

emma.bailey@berkeleypr.com

EclecticIQ and TeamT5 Join Forces to Combat Asia-Pacific Cyber Threats with Enhanced Intelligence Capabilities

![](https://uploads.teamt5.org/upload/original/pic_update_eclecticiq-and-teamt5-join-forces-to-combat-asia-pacific-cyber-threats-with-enhanced-intelligence-capabilities.jpg)

>雙方的策略聯盟可大幅提升政府單位與金融、電信、關鍵基礎設施等高風險產業的進階威脅偵測與應變能力

荷蘭阿姆斯特丹和台灣台北 — 2025 年 5 月 6 日— 全球各產業面臨日益嚴峻的資安挑戰，根據世界經濟論壇（WEF）[《2025 年全球資安展望報告》（Global Cybersecurity Outlook 2025）](https://www.weforum.org/publications/global-cybersecurity-outlook-2025/)，整體威脅態勢更趨複雜，勒索病毒攻擊數量更達四年來新高。為因應這項日趨嚴重的問題，全球領先的威脅情資解決方案供應商 EclecticIQ 宣布，與專精於研究亞太進階持續性攻擊（APT）的杜浦數位安全（下稱「TeamT5」）策略聯盟。

此次整合將 EclecticIQ 的情資平台 Intelligence Center Platform 與 TeamT5 旗下[威脅情資平台 ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=news&utm_medium=website) 所聚焦亞太的情資相互結合，為全球資安團隊提供高精確度且脈絡化的威脅深入分析，強化對區域與全球複雜威脅的偵測和理解，並有效緩解風險。

「在資安領域，速度與脈絡是決定防禦成敗的關鍵，」EclecticIQ 執行長 Cody Barrow 表示，「TeamT5 無與倫比的亞太情資與我們的全球平台相得益彰，為客戶提供正符所需的利器，用以妥善應對來自亞太地區的複雜攻擊行動，同時更快做出資料導向的明智決策。」

多數全球情資來源常忽略活躍於特定區域的威脅族群，雙方合作正能彌補這項重大落差。TeamT5 擁有逾 20 年 APT 研究經驗，深入追蹤亞太區超過 160 個威脅族群與 2,600 個以上的惡意程式樣本；這些情資皆已整合至 EclecticIQ 生態系中，能協助在亞太區營運的全球企業提升對國家級 APT 攻擊的防禦力。

「透過與 EclecticIQ 的合作，我們將長年對亞太區威脅的深入分析推向全球，」TeamT5 執行長蔡松廷表示，「在我們聚焦亞太的威脅情資整合至 EclecticIQ 平台後，全球資安團隊就能更全面地掌握威脅全貌；以高實用度和高相關性的情資為驅動力，EclecticIQ 與 TeamT5 共同開創情資運用的新局。」

**合作關鍵優勢：**
- **資安團隊**：將入侵指標（IoC）、威脅族群的戰術、技巧和程序（TTP）與目標偵測規則整合至單一平台，簡化工作流程並縮短應變時間
- **決策者**：從被動防禦轉為主動預測威脅
- **組織**：更快識別相關威脅、強化威脅偵測能力，並提升對亞太區威脅族群的防禦能力

透過這項整合，EclecticIQ 與 TeamT5 的客戶將能更快識別相關威脅、提升威脅偵測能力，並在區域與全球建立更穩固的資安防線；同時可為企業在亞太區的關鍵營運資產提供保護，讓企業領導者對防禦亞太威脅更具信心。

##關於 TeamT5
TeamT5 為總部位於台灣的亞太威脅情資領導品牌，客戶涵蓋全球政府單位與大型企業。TeamT5 團隊善用其地緣與語言優勢，專精於研究和分析 APT 威脅族群，協助客戶有效偵測與防禦威脅。TeamT5 連續兩年獲得 Frost & Sullivan「台灣最佳威脅情資公司」肯定，在不斷演變的威脅態勢中，是企業和組織的最佳資安守護者。

歡迎追蹤我們的 [Facebook](https://www.facebook.com/TeamT5.org/)、[X](https://x.com/TeamT5_Official)、[LinkedIn](https://tw.linkedin.com/company/teamt5) 官方帳號和 [YouTube 頻道](https://www.youtube.com/@teamt5)。

 

##關於 EclecticIQ
EclecticIQ 為全球威脅情資技術與服務的領導供應商，致力協助企業因應攸關自身業務的網路威脅。秉持「求知、果敢、負責、合作」四大核心價值，EclecticIQ 提供能減少複雜度並簡化威脅偵測與應變流程的動態解決方案，協助資安團隊更快做出更明智的決策。

歡迎造訪網站進一步了解：https://www.eclecticiq.com/ 或追蹤 [LinkedIn](https://www.linkedin.com/company/eclecticiq/) 與 [X](https://twitter.com/EclecticIQ) 官方帳號。

EclecticIQ 與 TeamT5 攜手強化亞太情資能量，共同打擊全球網路威脅

TeamT5, a provider of top cyber threat intelligence and endpoint detection and response (EDR) solutions in APAC, is going to showcase solutions at upcoming innovation event InnoVEX (part of COMPUTEX).

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance. We sincerely welcome you to experience our intelligence-driven cyber defense at booth.

## Our Solutions
### ThreatVision, a powerful threat intelligence platform 
**Advantages**:
1. Grasp latest & advanced cyber threats 
2. Boost power to defend cyber attacks 
3. Expand insights & database for Advanced Persistent Threat (APT)

**Intro**:

Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 20+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

More at [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)

 

## ThreatSonar, a cyber threat forensic & analysis platform 
**Advantages**: 
1. Assess system compromised events more precisely
2. Respond to cyber incidents faster
3. Deploy the tool automatically

**Intro**:

ThreatSonar is an easy-to-use tool to hunt cyber threats. Combining digital forensics and behavior-modeling techniques, ThreatSonar can do fast triage and hunt for anomalies.

Drive by cyber threat intelligence and run with automatic mode, it finds hidden infections with similar TTPs - Tactics, Techniques, and Procedures. Regular cybersecurity check-ups also help enterprises to better protect endpoints.

ThreatSonar offers both online and offline mode to protect endpoints in various situations. In short, ThreatSonar is an effective tool designed for assisting incident response.

More at [ThreatSonar](https://teamt5.org/en/products/threatsonar?utm_source=blog&utm_medium=website)


## TeamT5 at InnoVEX
- Date: 2025 / 5 / 20～23
- Time: 9:30 ~ 17:30
- Venue: Taipei Nangang Exhibition Center - Hall 2, Taiwan
- Booth Number: S1025a


![](https://uploads.teamt5.org/upload/original/pic_teamt5-will-showcase-solutions-at-2025-innovex.png)

TeamT5 will showcase solutions at 2025 InnoVEX (COMPUTEX) 

TeamT5 杜浦數位安全 為亞太威脅情資的頂尖品牌，即將於 COMPUTEX 聯合展「亞洲指標新創展 InnoVEX」展出威脅情資平台 ThreatVision、威脅鑑識分析平台 ThreatSonar。


TeamT5 杜浦數位安全相信威脅情資是網路防禦的基石。我們提供行動導向的在地化情報，幫助企業和組織提前預見網路攻擊並部署防禦策略。歡迎蒞臨現場，了解我們的威脅情資見解與解決方案。


## 我們的解決方案
### ThreatVision 威脅情資平台

#### 優點：
- 掌握最新、技術先進的資安威脅
- 增強防禦資安攻擊的能力
- 擴展進階持續性威脅（APT） 的見解和資料庫

#### 簡介：
憑藉針對亞太地區惡意程式、APT（進階持續性威脅）族群和網路威脅的十多年研究經驗，ThreatVision 威脅情資平台專為組織，提供以亞太地區為中心的豐富網路威脅情資。平台透過提供戰略、營運和戰術威脅情資，來滿足網路安全領域的不同角色，包括決策者、風險管理者和事件應變人員，協助 C 層級高階經理人、風險經理和事件處理人員了解威脅形勢、識別惡意行為者並部署有效的網路威脅防禦。

ThreatVision 提供可客製情資調查與諮詢服務，以及其易於使用的介面和精選報告，協助組織能做出明智的決策，有效地分配資安資源，並增強網路安全。

更多介紹，請見： [ThreatVision 威脅情資平台](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

 


### ThreatSonar 威脅鑑識分析平台
#### 優點：
- 更準確地評估系統入侵事件
- 更快地回應資安事件
- 平台可自動部署

#### 簡介：
ThreatSonar 是一款易於使用的資安威脅工具。 ThreatSonar 結合數位取證和行為建模技術，可以快速分類並尋找異常情況。

ThreatSonar 基於 TeamT5 團隊對全球惡意程式研究的成果，內建惡意行為指標、軟體後門特徵，並結合智慧鑑識分析技術與風險模型，發掘潛藏在企業內部的未知威脅，提前預防網路攻擊。以此平台進行定期的資訊安全檢查，更可幫助企業更好地保護端點。

更多介紹，請見：[ThreatSonar 威脅鑑識分析平台](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website)

## TeamT5 杜浦數位安全參展 InnoVEX 資訊
- 日期：2025 / 5 / 20 ～23
- 時間：9:30 ~ 17:30
- 地點：台北南港展覽館二館4樓
- 攤位編號：S1025a

![](https://uploads.teamt5.org/upload/original/pic_teamt5-will-showcase-solutions-at-2025-innovex.png)

TeamT5 杜浦數位安全即將於 2025 InnoVEX (COMPUTEX) 展出

>[Press Release on PR Newswire](https://www.prnewswire.com/apac/news-releases/teamt5-warns-of-global-risks-posed-by-ivanti-vulnerability-302437073.html)

![](https://uploads.teamt5.org/upload/original/pic_teamt5-warns-of-global-risks-posed-by-ivanti-vulnerability.jpg)

TAIPEI, April 24, 2025 /PRNewswire/Asia Pacific threat intelligence leading brand TeamT5 detected that the China-nexus APT group exploited the critical vulnerability in Ivanti Connect Secure VPN appliances to infiltrate multiple entities around the globe. The victims include nearly 20 different industries across 12 countries. TeamT5 believes that the actor still maintained control over the victim's network at the time of analysis. We urge enterprises and organizations to take a comprehensive investigation.

##Ivanti High-Risk Vulnerability Exposes Systems to Potential Takeover by Attackers
TeamT5’s analysis assessed with high confidence that the actor was exploiting the vulnerabilities of Ivanti Connect Secure VPN appliances to launch attacks around the globe. The actor possibly exploited [CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US) or [CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US) to conduct initial access.

Both CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN with a CVSS score of 9.0. Successful exploitation allows the threat actor to achieve remote code execution, leading to intrusion of the internal network and malware implantation.

In the attack, the actor deployed a shared weapon among Chinese threat groups, SPAWNCHIMERA. SPAWNCHIMERA is developed specifically for Ivanti Connect Secure VPN and has all the functionalities of the notorious SPAWN family, including SPAWNANT (installer), SPAWNMOLE (socks5 tunnler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).

Moreover, TeamT5’s analysis suggests that other threat actors might also obtain the vulnerability information and start campaigns targeting Ivanti VPN appliances. We have observed massive exploitation attempts against Ivanti VPN appliances since April. Although most exploitation attempts failed, many Ivanti VPN appliances became paralyzed and unstable. 

##Widespread Impact Across Countries and Industries Calls for Urgent System Review
TeamT5 points out that the victim countries include Austria, Australia, France, Spain, Japan, South Korea, Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. The targeted industries include Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institution, Gambling, Government, Intergovernmental Organizations (IGOs), Information Technology, Law Firm, Manufacturing, Materials, Media, Non-Governmental Organizations (NGOs), Research Institute, and Telecommunication.

TeamT5 strongly recommends that affected organizations conduct a thorough incident investigation. Given the versatile TTPs of the actor, such as multi-layers of C2 infrastructure, evasion of monitor mechanism, and the usage of log wiper, without additional technical support, it would be a challenge to detect the actor’s malicious traces inside the network. 


##About TeamT5
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023-2024 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
 
Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA and Asia Pacific region. Clients include government agencies, financial business, and high tech enterprises.
 
 
 
Website: https://teamt5.org/en/ 
Contact: pr@teamt5.org

TeamT5 Warns of Global Risks Posed by Ivanti Vulnerability

![](https://uploads.teamt5.org/upload/original/pic_teamt5-warns-of-global-risks-posed-by-ivanti-vulnerability.jpg)

威脅情資領導品牌 TeamT5 杜浦數位安全研究指出，與中國有關聯之進階持續性威脅（APT）攻擊者，利用 Ivanti Connect Secure VPN 高風險漏洞發動攻擊，受害單位橫跨全世界 12 個國家，近 20 個不同產業。TeamT5 認為攻擊者仍持續控制受害者的網路，呼籲企業與組織完整盤點系統狀況。

##Ivanti 高風險漏洞使系統恐受攻擊者控制
TeamT5 初步判定攻擊者利用 Ivanti Connect Secure VPN 相關的高風險漏洞，展開攻擊；推測可能是利用 [CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US) 或 [CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US) 取得初步存取權限。

CVE-2025-0282 和 CVE-2025-22457 皆是 Ivanti Connect Secure VPN 的堆疊緩衝區溢位（stack buffer overflow）漏洞，CVSS 分數高達 9.0（滿分為 10 分）。漏洞成功利用後，攻擊者便可實現遠端程式碼執行，進而入侵內部網路和部署惡意程式。

以其中一例攻擊來說，攻擊者部署的是中國威脅族群的共用惡意程式 SPAWNCHIMERA。SPAWNCHIMERA 是專為 Ivanti Connect Secure VPN 所開發，具備 SPAWN 家族惡意程式的所有功能，包括 SPAWNANT （安裝程式）、SPAWNMOLE（socks5 網路隧道程式）、SPAWNSNAIL（SSH 後門程式）和 SPAWNSLOTH（記錄抹除程式）。

此外，TeamT5 分析研判，其他攻擊者可能也取得漏洞相關資訊，並著手展開針對 Ivanti VPN 設備的攻擊行動。自 4 月以來，我們發現針對 Ivanti VPN 設備的大規模漏洞攻擊嘗試。雖然絕大多數的漏洞攻擊嘗試都以失敗告終，但卻也造成這些 Ivanti VPN 設備被癱瘓且變得不穩定。

##受害國家與產業別眾多 宜完整盤點系統狀況
TeamT5 指出受害國家包括奧地利、澳洲、法國、西班牙、日本、南韓、荷蘭、新加坡、台灣、英國、美國、阿拉伯聯合大公國。而受害產業則包括汽車、化學、電信、營造、資安、教育、電子、金融、博弈、政府、法律、製造、媒體、企業集團、跨政府組織、非政府組織、資訊科技、研究機構。

TeamT5 建議受影響單位應即刻展開完整的事件調查。基於攻擊者手法的多變性，如多層次 C2 基礎架構、監控機制迴避與使用記錄抹除程式，若缺乏額外的技術協助，恐不易深入調查內部網路的攻擊者足跡。若需任何進一步的技術協助，可直接聯繫 TeamT5。


##關於 TeamT5 杜浦數位安全
TeamT5 專精網路威脅研究，並提供端點偵測與回應（EDR）解決方案，協助美日臺大型企業有效保護商業機密文件，讓營運不受網路攻擊影響。TeamT5 也獲得日本三大巨頭投資，包含日本最大創投 JAFCO 集富集團、日本最大跨國企業且在全球皆有商業投資的 ITOCHU 伊藤忠商事，以及日本最大資安解决方案提供商 MACNICA。

團隊具備超過 20 年的惡意程式與進階持續性威脅（APT）的研究經驗，運用地緣和語言優勢，有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

 

官網：https://teamt5.org/tw/ 
新聞聯絡窗口：pr@teamt5.org

全球面臨「Ivanti 漏洞」風險 TeamT5 呼籲全面清查

TeamT5, a leading brand in delivering Asia Pacific intelligence for government units, high technology enterprises, and banks across the globe and Threatray, a Swiss technology leader in malware identification, attribution and intelligence, announced today that they are entering into a joint research collaboration.

The collaboration between the two companies enables more precise tracking of threat actors and campaigns, leading to improved threat landscape reporting. Through TeamT5’s high quality data, Threatray will enhance the malware threat search and analytics engine. In turn, TeamT5 will gain access to Threatray’s unique binary intelligence capabilities, strengthening the research and intelligence-gathering capabilities.

As part of this joint research collaboration, TeamT5 will share its cyber espionage research findings with Threatray, while utilizing Threatray’s binary intelligence platform to enhance its analysis capabilities.

“For the TeamT5 CTI team, this partnership aims to boost our research capabilities, accelerate our analytical processes, and broaden our research visibility," said Sung-ting Tsai, CEO of TeamT5.

"This partnership combines unique data and binary analysis capabilities to deliver unparalleled insights into cyber threats. Together, we're setting a new standard in threat intelligence," said Endre Bangerter, Threatray CEO.

##About TeamT5
TeamT5 is a leading brand in delivering Asia Pacific intelligence. TeamT5 receives international recognition as 2023-2024 Taiwan's Best Threat Intelligence Company by Frost & Sullivan.

We are established in Taiwan and harness our geographical & cultural strengths to assist enterprises and organizations in fortifying their cybersecurity defenses through our intelligence-focused offerings. This allows analysts to foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks. 

Learn more at [https://teamt5.org/en/](https://teamt5.org/en/?utm_source=blog&utm_medium=website).

##About Threatray
Threatray is a leader in deep binary code analysis, unlocking the value of binary code for a new generation of malware detection and binary intelligence capabilities. Threatray's core technology consists of AI/ML models for binary code analysis and a highly scalable search engine for malware code, capable of matching unknown samples against a rapidly growing database of over 100 million binaries in seconds. This advanced technology powers our binary intelligence platform, specifically designed to support malware researchers and intelligence analysts with precise attribution, rapid classification, and intelligence generation capabilities. 

Learn more at https://www.threatray.com/

 
 

![](https://uploads.teamt5.org/upload/original/pic_uniting-for-discovery-teamt5-and-threatray-announce-joint-research-collaboration-to-unlock-new-frontiers.jpg)

Uniting for Discovery: TeamT5 and Threatray Announce Joint Research Collaboration to Unlock New Frontiers

TeamT5 與 Threatray 宣布戰略研究合作。兩者皆為其領域的佼佼者——亞太威脅情資領導品牌 TeamT5 以其獨到的研究能力為全球政府部門、高科技企業和銀行提供亞太威脅情資；瑞士技術領導者 Threatray 專注惡意軟體識別、歸因和情資。透過本次合作將使企業與組織更精確地追蹤威脅族群和其活動，進而提升威脅情資品質。

藉由合作，Threatray 將運用 TeamT5 的優質威脅情資，增強其惡意軟體威脅搜尋和分析引擎。同時，TeamT5 將取得 Threatray 獨特的 Binary 情資分析能力，提升自身研究和情資收集能力；TeamT5 也將與 Threatray 分享其網路間諜研究成果，同時利用 Threatray 的 Binary 情資平台增強其分析能力。

TeamT5 執行長蔡松廷表示：「對於 TeamT5 威脅情資團隊來說，此次合作旨在提高我們的研究能力、加速我們的分析流程並拓寬我們的研究視野。」

Threatray 執行長 Endre Bangerter 表示：「此次合作結合了獨特的數據和 Binary 分析功能，可提供無與倫比的網路威脅洞察。未來，我們將共同為威脅情資樹立新標準。」


##關於杜浦數位安全 TeamT5
TeamT5 為亞太威脅情資領導品牌，獲國際顧問公司 Frost & Sullivan 於 2023~2024 連續兩年肯定為臺灣最佳威脅情資公司。

我們立足臺灣，並善用地緣與文化優勢，透過以威脅情資為基底的產品，幫助企業和組織加強其資訊安全防禦。這使得其分析師能夠預見潛在的資安威脅和事件，並為決策者提供行動指引，以做出精確決策並降低風險。

了解更多：[https://teamt5.org/tw/](https://teamt5.org/tw/?utm_source=blog&utm_medium=website)

##關於 Threatray
Threatray 為深度 Binary 分析領域的領導者，挖掘出 Binary 的價值，以實現新一代惡意軟體偵測和 Binary 情資的可能性。 Threatray 的核心技術包括用於 Binary 分析的人工智慧/機器學習（AI/ML） 模型和高度可擴展的惡意軟體程式碼搜尋引擎，能夠在幾秒鐘內將未知樣本與豐富資料庫比對，該資料庫快速增長、Binary 已超過 1 億。這項先進的技術為 Threatray 的 Binary 情資平台奠立深厚基礎，且該平台專門為惡意軟體研究人員和情資分析師提供精確歸因、快速分類和情資產出之功能。

了解更多：https://www.threatray.com/

 
 

![](https://uploads.teamt5.org/upload/original/pic_uniting-for-discovery-teamt5-and-threatray-announce-joint-research-collaboration-to-unlock-new-frontiers.jpg)

TeamT5 與 Threatray 宣布戰略研究合作，提升情資威脅研究與網路防禦能量

![](https://uploads.teamt5.org/upload/original/pic_update_teamt5-s-threat-vision-integrated-into-cyware.jpg)

 

TeamT5, a leading provider of threat intelligence focusing on the Asia-Pacific region, is excited to announce the integration of its ThreatVision solution with Cyware’s platform. This integration empowers cybersecurity teams with invaluable insights into APAC threats, particularly from China, North Korea, and Vietnam.

##Unique Focus on Asia-Pacific Threat Intelligence
TeamT5, recognized as “Taiwan's Best Threat Intelligence Company” by the international consulting firm Frost & Sullivan in 2023 and 2024, has established itself as a prominent name in the realm of threat intelligence, with a primary emphasis on the Asia-Pacific region. Through long-term observation and study of various Chinese cyber operations, as well as extensive experience in intelligence collection and analysis, TeamT5’s ThreatVision offers an unique and diverse range of Asia-Pacific APT intelligence, including: 
-	**Insights into APAC Attack TTPs (Tactics, Techniques, and Procedures)**: TeamT5 provides comprehensive insights into APAC attack TTPs and significant cyber policies, helping organizations understand evolving threats originating from this region.
-	**Visibility of Asia-Pacific APT Adversaries**: In-depth research on Asia-Pacific APTs (Advanced Persistent Threats) adversaries and their campaigns is a core competency of TeamT5, enabling proactive threat mitigation.
- **Technical Analysis of Crucial Vulnerabilities**: TeamT5's technical analysis includes exploitation scenarios and impact assessments, equipping cybersecurity teams with actionable intelligence to fortify their defenses.

The intelligence provided by ThreatVision is presented in various formats, including reports, malicious actors, programs, samples, and connections, providing users with a comprehensive and enriched intelligence utilization experience.

##Improving Cybersecurity Operations with Cyware
Cyware’s Threat Intelligence Exchange platform seamlessly integrates various intelligence sources, significantly improving the efficiency of cybersecurity operations. The platform offers the following key features:
- **Strengthen threat intelligence sharing** 
Through Cyware, intelligence is seamlessly integrated into daily operations and workflows, enabling efficient intelligence sharing and collaboration, strengthening the ability of all parties in the industry to jointly respond to threats and enhancing overall defense effectiveness.

- **Automated threat response** 
Cybersecurity teams can focus on the most critical potential threats based on the company's unique risk profile and priorities, and improve the overall efficiency and responsiveness of cybersecurity operations.

- **Actionable intelligence utilization** 
TeamT5's intelligence, integrated into Cyware platform via API support, enhances the user experience to efficiently turn the intelligence into actions with existing cybersecurity tools. 


##Use Cases Supported by the Integration
The integration between TeamT5's ThreatVision and Cyware platform supports a variety of use cases, including:
- **APT IoCs**: Users can leverage APT IoCs (Indicators of Compromise) to prevent attacks and broaden their defense, facilitating rapid threat assessment.
- **Flash Reports**: These provide summaries and technical analyses of individual APT incidents, enabling quick upward reporting and leverage the technical analysis for executing cybersecurity deployments.
- **Vulnerability Reports**: These include technical analysis, exploitation scenarios, and impact assessments, which equip cybersecurity teams with actionable intelligence to fortify their defenses.


###About Cyware
[Cyware](https://www.cyware.com/) delivers an innovative approach to cybersecurity that unifies threat intelligence, automation, threat response, and vulnerability management with data insights gleaned from assets, users, malware, attackers, and vulnerabilities. Cyware’s Cyber Fusion platform integrates SOAR and TIP technology, enabling collaboration across siloed security teams.

###About TeamT5
[TeamT5](https://teamt5.org/en/?utm_source=blog&utm_medium=website) is comprised of top cyber threat analysts with an unparalleled understanding of cyber attackers in the Asia-Pacific region. Leveraging geographical and cultural advantages, we foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks. TeamT5 have delivered cyber threat intelligence reports and threat hunting tools to clients internationally and win tons of trust.

TeamT5's ThreatVision Integrated into Cyware

![](https://uploads.teamt5.org/upload/original/pic_update_teamt5-s-threat-vision-integrated-into-cyware.jpg)

 

杜浦數位安全（下稱 TeamT5）是專精於亞太地區威脅情資的領導廠商，在此很高興宣布旗下 ThreatVision 威脅情資平台與 Cyware 強強聯手，共同抵禦威脅。這項整合能讓資安團隊獲取寶貴情資，更深入掌握亞太威脅情勢，特別是來自中國、北韓和越南的威脅。

##亞太威脅情資唯一首選
TeamT5 於 2023 年和 2024 年連續或國際顧問公司 Frost & Sullivan 評選為「台灣最佳威脅情資公司」，是威脅情資領域首屈一指的領導品牌。TeamT5 專門聚焦於亞太地區，長期觀察和研究中國各種網路行動，積累豐富的情資收集和分析經驗，並以 ThreatVision 情資平台提供獨特多樣的亞太 APT（進階持續性威脅）情資，包括：

- **深入了解亞太地區攻擊 TTP（戰術、技巧和程序）**：TeamT5 全面洞悉亞太地區攻擊 TTP 和重大網路政策，協助各種組織了解地區不斷演變的威脅。
- **深入掌握亞太地區 APT 威脅族群**：對亞太地區 APT 威脅族群及其活動的深度研究，是 TeamT5 的核心競爭力，從而能主動採取緩解措施，有效因應威脅。
- **深入分析關鍵漏洞的技術細節**：TeamT5 的技術分析包括漏洞利用情境和影響範圍評估，為資安團隊提供可實際運用的情資，強化防禦能力。

ThreatVision 平台提供的情資以多樣化形式提供，包括情資報告、威脅族群、惡意程式、威脅樣本和關聯等，為使用者提供豐富情資和全方位的使用體驗。

##攜手 Cyware 強化資安營運作業 
Cyware 的 Threat Intelligence Exchange 平台順暢整合各種情資來源，顯著提升資安營運的效率。該平台提供下列主要功能：
- **強化威脅情資的共享** 
透過 Cyware 平台，情資能與日常營運和工作流程完全整合，提高情資共享和協同合作的效率，強化各種資安團隊共同應對威脅的能力，並提升整體防禦的有效性。

- **自動化的威脅應變** 
資安團隊可依據企業獨特的風險態勢和優先事項，專注於最關鍵的潛在威脅，並提高資安營運的整體效率和應變能力。

- **可供實際運用的情資** 
TeamT5 專業情資以 API 形式與 Cyware 平台相互整合，不僅提供更出色的使用者體驗，還能運用現有資安工具，快速將情資轉化為可採取的行動。

##整合適用的使用情境
TeamT5 ThreatVision 平台與 Cyware 平台的整合可運用在各種使用情境，包括：
- **APT 入侵指標（IoC）**：使用者可善用 APT IoC 來預防攻擊並擴大防禦範圍，有助於快速進行威脅評估。
- **每週重大威脅事件報告（Flash Report）**：提供個別 APT 事件的摘要和技術分析，協助資安人員快速向上彙報，同時運用技術分析執行資安部署作業。
- **漏洞情資暨應對緩解雙週報（Vulnerability Insights Report）**：提供技術分析、漏洞利用情境和影響範圍評估，為資安團隊提供可實際運用的情資，強化防禦能力。

 
 

###關於 Cyware
[Cyware](https://www.cyware.com/) 以創新方式將威脅情資、自動化、威脅應變和漏洞管理等資安各面向，結合從資產、使用者、惡意軟體、攻擊者和漏洞各種資料所彙總的深入洞察，並以整合 SOAR 和 TIP 技術的 Cyber Fusion 平台，讓各種資安團隊不再成為無援的孤島。

###關於 TeamT5
[TeamT5](https://teamt5.org/tw/?utm_source=blog&utm_medium=website) 由業界首屈一指的網路威脅分析師組成，對亞太地區威脅族群有著無與倫比的深入掌握。我們發揮所處位置的地理和文化優勢，準確預見潛在的威脅和事件，為決策者提供可實際運用的行動建議，協助其做出明智決策並降低風險。TeamT5 的網路威脅情資報告和威脅搜尋工具已廣獲國際客戶採用，並深受信任。

TeamT5 ThreatVision 情資平台與 Cyware 強強聯手抵禦威脅

CrazyHunter 近期宣稱已入侵的台灣企業，經查證，均非 TeamT5 客戶，也未部署 ThreatSonar Anti-Ransomware 端點防護產品。

TeamT5 MDR 服務團隊已於第一時間主動針對事件相關 IoC 展開巡檢，全面檢視客戶場域是否存在惡意程式活動，並檢視場域端點報告及活動紀錄，以確保無潛在威脅。目前 TeamT5 所維護場域皆未受影響，後續也將持續監控客戶場域安全。

事件樣本經 TeamT5 威脅情資團隊分析後發現，該勒索軟體為基於 Prince Ransomware 所開發之。進一步追蹤相關惡意程式，顯示其包含簡體中文開發資訊，可據此推測攻擊者來源。此外，勒索軟體利用群組原則物件（Group Policy Object, GPO）散播所使用之工具為 SharpGPOAbuse，攻擊者於內網滲透時常用此工具來對 AD 操作，進一步控制企業網路。

根據上述威脅分析結果，TeamT5 已主動通報潛在受影響企業和組織，並提供相關威脅情資與緊急應處措施，協助其強化防禦。

此次事件顯示，面對日益複雜的勒索攻擊，企業不僅須及早部署端點防禦機制，更應與資安專業團隊合作，持續檢視並優化整體資安環境。TeamT5 將持續提供即時情資與專業支援，協助企業更穩健應對威脅挑戰。

 

>了解更多應對方式：[如何應對 CrazyHunter 勒索軟體攻擊事件](https://teamt5.org/tw/posts/crazyhunter-ransomware-attack/?utm_source=blog&utm_medium=website)

【聲明】TeamT5 針對 CrazyHunter 近日攻擊事件說明

This year's events have come to a successful close. Stay tuned to the TeamT5 website for more event information and cybersecurity insights.


##Past
###2025/1/25 ~ 1/26 JSAC
- Country: Japan
- Venue: Ochanomizu Sora City Conference Center, Tokyo
- Our cyber threat intelligence researchers will give a speech at the venue.
- More info: [event website](https://jsac.jpcert.or.jp/)

###2025/1/22 ~ 1/23 Cybersec Asia 
- Country: Thailand
- Venue: Plenary Hall 1 - 2 and 4, QSNCC, Bangkok
- TeamT5 booth number: C07
- More info: [event website](https://cybersec-asia.net/)

###2025/4/15~4/17 CYBERSEC
- Country: Taiwan
- Venue: Hall 2 of Taipei Nangang Exhibition Center, Taipei
- More info: [event website](https://cybersec.ithome.com.tw/2025/en/)

###2025/4/23~4/25 IT Week Spring
- Country: Japan
- Venue: Tokyo Big Sight, Tokyo
- More info: [event website](https://www.japan-it.jp/spring/en-gb.html)


###2025/5/20~5/23 InnoVEX (COMPUTEX)
- Country: Taiwan
- Venue: Taipei Nangang Exhibition Center - Hall 2, Taiwan
- More info: [event website](https://innovex.computex.biz/show/registration-info.aspx)

###2025/6/22~6/27 FIRSTCON
- Country: Denmark 
- Venue: Bella Center Copenhagen, Copenhagen
- More info: [event website](https://www.first.org/conference/2025/)

###2025/8/27 Digital Government Summit
- Country: Taiwan
- City: Taipei
- More info: [event website](https://egov.ithome.com.tw/2025/index.html)

###2025/9/30~10/1 ECONOSEC
- Country: Japan
- More info: [event website](https://econosec.jp/)

###2025/10/17 Taiwan Healthcare CIO Summit
- Country: Taiwan
- City: Hsinchu
- More info: [event website](https://ciomedical.ithome.com.tw/2025/index.html)

###2025/11/18~11/19 CODE BLUE
- Country: Japan
- More info: [event website](https://codeblue.jp/)

###2025/12/3~12/4 Threat Analyst Summit
- Country: Taiwan
- Venue: ILLUME TAIPEI, Taipei
- More info: [event website](https://tas.teamt5.org/?utm_source=websitecalendar&utm_medium=website)

 
 

*The information of each event is subject to change by the organizer. 
*This article is updated from time to time.

【TeamT5 Event Calendar 2025】Come by to find suitable solutions and build cybersecurity resilience!

本年度各項活動已圓滿落幕，繼續鎖定 TeamT5 官網，掌握更多活動資訊與資安洞見。


##過去展會
###2025/1/21 ~ 1/22 JSAC
- 國家: 日本
- 地點: Akasaka Intercity Conference Center (東京)
- TeamT5 威脅情資研究員將會於本研討會發表演講
- 更多資訊: [官網](https://jsac.jpcert.or.jp/)
 
###2025/1/22 ~ 1/23 Cybersec Asia 
- 國家: 泰國
- 地點: Plenary Hall 1 - 2 and 4, QSNCC (曼谷)
- TeamT5 攤位編號: C07
- 更多資訊: [官網](https://cybersec-asia.net/)

###2025/4/15~4/17 臺灣資安大會
- 國家: 臺灣
- 地點: 南港展覽館2館，台北
- 更多資訊: [官網](https://cybersec.ithome.com.tw/2025/en/)

###2025/4/23~4/25 IT Week Spring
- 國家: 日本
- 地點: Tokyo Big Sight (東京)
- 更多資訊: [官網](https://www.japan-it.jp/spring/en-gb.html)

###2025/5/20~5/23 InnoVEX (COMPUTEX 台北國際電腦展)
- 國家: 臺灣
- 地點: 台北南港展覽館
- 攤位編號: 南港展覽館二館4樓 #S1025a
- 更多資訊: [活動官網](https://innovex.computex.biz/show/registration-info.aspx)

###2025/6/22~6/27 FIRSTCON
- 國家: 丹麥
- 活動地點: Bella Center Copenhagen, Copenhagen
- 更多資訊: [活動官網](https://www.first.org/conference/2025/)

###2025/8/27 數位政府高峰會
- 國家: 臺灣
- 地點: 台北富邦國際會議中心
- 更多資訊: [活動官網](https://egov.ithome.com.tw/2025/index.html)

###2025/9/30~10/1 ECONOSEC
- 國家: 日本
- 更多資訊: [官網](https://econosec.jp/)

###2025/10/17 臺灣醫院資訊主管會議
- 國家: 台灣
- 地點: 新竹
- 更多資訊: [官網](https://ciomedical.ithome.com.tw/2025/index.html) (參與10/17設攤展示)

###2025/11/18~11/19 CODE BLUE
- 國家: 日本
- 地點: 東京 
- 更多資訊: [官網](https://codeblue.jp/)

###2025/12/3~12/4 威脅分析師高峰會(Threat Analyst Summit)
- 國家: 台灣
- 地點: 台北茹曦酒店
- 更多資訊: [官網](https://tas.teamt5.org/?utm_source=websitecalendar&utm_medium=website)

 
 
*各項活動資訊依據主辦單位為準 
*本文章不定期更新

【TeamT5 杜浦數位安全 2025年參與展覽、研討會一覽表】歡迎參觀並了解情資驅動的頂尖解決方案

今年のイベントは大盛況のうちに終了しました。イベント情報やサイバーセキュリティに関する詳しい情報は、TeamT5のウェブサイトでご確認ください。


 
 

##終了したイベント
###2025/1/21~1/22 JSAC
- 国: 日本
- 会場: 東京、赤坂インターシティコンファレンス
- 会場では弊社のサイバー脅威インテリジェンス研究者が講演いたします。
- 詳細はこちら: [公式ウェブサイト](https://jsac.jpcert.or.jp/)

###2025/3/7~8 サイバーセキュリティシンポジウム道後2025
- 国: 日本
- 会場: 愛媛、愛媛大学 城北キャンパス
- 詳細はこちら: [公式ウェブサイト](https://www.sec-dogo.jp/)

###2025/4/15~4/17 CYBERSEC
- 国: 台湾
- 会場: 台北、台北南港展示センター ホール2
- 詳しくは: [公式ウェブサイト](https://cybersec.ithome.com.tw/2025/en/)

###2025/4/23~4/25 IT Week Spring
- 国: 日本
- 会場: 東京、東京ビッグサイト
- 詳細はこちら: [公式ウェブサイト](https://www.japan-it.jp/spring/en-gb.html)

###2025/5/20~5/23 InnoVEX (COMPUTEX)
- 国: 台湾
- 会場: Taipei Nangang Exhibition Center - Hall 2, Taiwan
- 詳しくは: [公式ウェブサイト](https://innovex.computex.biz/show/registration-info.aspx)

###2025/5/21~23 DSEI Japan 2025
- 国: 日本
- 会場: 千葉、幕張メッセ
- 詳しくは: [公式ウェブサイト](https://www.dsei-japan.com/jp)

###2025/5/28 TeamT5 Seminar 
- 国: 日本
- 会場: AP品川 Aルーム、Bルーム (108-0075 東京都港区港南1-6-31 品川東急ビル 8F)
- 詳しくは: [公式ウェブサイト](https://teamt5seminar.teamt5.jp/?utm_source=event&utm_medium=website) (_定員に達しましたため、受付を終了いたし_ました。)

###2025/6/21~22 サイバー防衛シンポジウム熱海2025
- 国: 日本
- 会場: 静岡、熱海後楽園ホテル
- 詳しくは: [公式ウェブサイト](https://5th-battlefield.com/)

###2025/6/22~6/27 FIRSTCON
- 国: Denmark 
- 会場: Bella Center Copenhagen, Copenhagen
- 詳しくは: [公式ウェブサイト](https://www.first.org/conference/2025/)

###2025/9/30~10/1 ECONOSEC
- 国: 日本
- 会場: 東京、池袋・サンシャインシティ
- 詳しくは: [公式ウェブサイト](https://econosec.jp/)

###2025/11/18～11/19 CODE BLUE
- 国: 日本
- 詳しくは: [公式ウェブサイト](https://codeblue.jp/)
 

###2025/12/3~12/4 Threat Analyst Summit
- 国: 台湾
- 会場: 台北
- 詳しくは: [公式ウェブサイト](https://tas.teamt5.org/?utm_source=websitecalendar&utm_medium=website)

※各イベント情報は主催者側が提供するものに依拠しています。 
※この記事は随時更新します。

【TeamT5】2025年参加予定イベント一覧 是非ご参加いただき、インテリジェンス主導のソリューションをご体感ください！

Due to its long-term efforts in the field of cybersecurity, TeamT5, a leading threat intelligence brand in Asia-Pacific, won the 2024 Cyber Security - Innovation Award for its intelligence-driven Managed Detection and Response Service (MDR service), which affirmed the company's commitment to providing expertise-level service.

This time, the "TeamT5 Managed Detection and Response Service (MDR service)", driven by professional intelligence, was recognized as innovative and worthy of trust. It turns passive cyber security defense into active defense. TeamT5 professional MDR team monitors the enterprise environment at all times, works with the enterprise to respond to incidents, and defends against continuously evolving attack techniques. Key features of TeamT5 MDR service include:

- **Asia-Pacific threat intelligence research**: Use localized intelligence to counter targeted attacks, ransomware, advanced persistent attacks (APT), etc.
- **Full-time endpoint monitoring**: By deploying ThreatSonar Anti-Ransomware, TeamT5’s internationally award-winning endpoint detection and response (EDR) platform, you can proactively defend against potential threats. Its industry-leading behavior analysis can strengthen the detection of the latest suspicious threats, provide real-time notifications and incident response suggestions, and reduce the risk of business interruption.
- **Professional expert team**: Frontline monitoring personnel, second-line analysts, and incident response team provide joint defense to comprehensively handle and investigate incidents. They aim to find out root cause of incidents and offer suggestions to enhance cybersecurity resilience to prevent similar attacks in the future.

 

Sung-ting Tsai, CEO of TeamT5, said: "This award is the best recognition of our team's efforts. We will continue to uphold innovation and professionalism, provide high-quality services to enterprises and organizations, and help them deal with the ever-changing cyber threats. Recently, we also expand the content of threat intelligence and launch dark web intelligence to help enterprises check whether sensitive information is leaked and used by criminals and strengthen enterprises’ defense."

 
##About TeamT5
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023-2024 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan. Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

>**Media Contact** 
>TeamT5 
>Cheryl Lin 
>pr@teamt5.org

TeamT5 Managed Detection and Response Service Wins 2024 Cyber Security Innovation Award for Helping Enterprises Respond to Cyber Threats

亞太威脅情資領導品牌杜浦數位安全TeamT5憑藉其長期於資安領域的耕耘，以其情資驅動的威脅偵測應變代管服務獲得「2024 資安精品獎-創新獎」，肯定其提供優質資安代管服務的卓越表現和創新能力。

TeamT5本次以「威脅偵測應變代管服務MDR （Managed Detection and Response）Service」獲得肯定，該情資驅動的專業服務，將資安防禦化被動為主動，可辨識與阻擋威脅，並由專業團隊全時監控企業環境，與企業一同應變資安事件，防禦持續演進的攻擊手法。重要特色包括：
- **專精亞太區威脅情資研究**：以在地化情資反制針對性惡意攻擊、勒索軟體、進階持續性攻擊(APT) 等。
- **先進威脅防禦技術全時監控**：藉由部署受國際獎項肯定的 TeamT5 端點監控與回應EDR平台 ThreatSonar Anti-Ransomware，達到主動防禦潛在威脅。其領先業界的駭客行為分析，可強化偵測最新可疑威脅，即時通報與提供處置建議，降低企業中斷營運的風險。
- **專業的專家團隊**：第一線監控、二線分析、事件應變團隊聯防，全面處置與調查事件，找出事件根因，並提供強化資安韌性建議，以防範未來類似攻擊。

 

TeamT5執行長蔡松廷表示：「此次獲獎是對我們團隊努力的最佳肯定。我們將繼續秉持創新與專業精神，為企業、組織提供優質資安服務，協助他們應對持續變化的網路威脅。近期也擴展威脅情資範圍至暗網威脅情資，為企業檢查機敏資料是否外洩、是否被罪犯利用，鞏固企業防禦面。」

 
##關於 TeamT5 杜浦數位安全
TeamT5 杜浦數位安全專精研究網路攻擊、資安威脅，並提供反制惡意程式之端點偵測與回應（EDR）資安解決方案。客戶來自美國、日本、臺灣，產業別涵蓋政府機關、金融、科技、電信、資安服務提供商，持續保護機密文件，阻斷網路攻擊。獲國際頂尖顧問公司 Frost & Sullivan 肯定為2023-2024年台灣最佳威脅情資公司（Taiwanese Threat Intelligence Company of the Year Award），自主研發之端點偵測與回應（EDR）解決方案獲國際大展 COMPUTEX - Best Choice Award 金獎肯定。 

團隊具備超過20年的惡意程式與進階持續性攻擊（APT）的研究經歷，基於地理位置和語言優勢，我們有效掌握亞太地區的駭客攻擊。更經常受邀參加世界級資安會議演講，包含臺灣 HITCON、美國 Black Hat、日本 Code Blue/ AVTokyo、德國 Troopers，及國際組織辦理的 Hack In The Box 與 FIRST 等。

>**媒體聯絡人資訊** 
>杜浦數位安全 TeamT5 
>Cheryl Lin 
>pr@teamt5.org

防禦交給專家 威脅精準應對：TeamT5 威脅偵測應變代管服務獲資安精品獎殊榮

We’ll be in Cybersec Asia 2025 (Thailand) and present our intelligence-driven cybersecurity solutions.

##Exhibiting Solutions 
###ThreatVision
>Used by 15+ national cybersecurity agencies, ministries of defense, financial institutions, and multinational enterprises

- **Real-Time Data Collection** : Gain daily insights into emerging advanced persistent threats from Asia.
- **Comprehensive Analytics** : Deep dive into threat patterns and vulnerabilities.
- **Actionable Intelligence** : Enable informed decision-making to fortify your defenses.


###ThreatSonar
>Trusted by Vietnam's top 3 banks

- **Proactive Detection** : Identify and neutralize threats before they impact your organization.
- **Customized Strategies** : Threat hunting for compromise assessment and incident response.
- **Expert Team** : Leverage our seasoned analysts with extensive industry experience.

 
 

##Event Info
- **Date**: January 22-23, 2025
- **Time**: 09:30 - 17:00
- **Venue**: Plenary Hall 1 - 2 and 4, QSNCC, Bangkok, Thailand
- **TeamT5 booth number**: C07
- **Event website**: https://cybersec-asia.net/

 
![](https://uploads.teamt5.org/upload/original/pic_update_teamt5-will-be-at-cybersec-asia-2025-thailand.png)

TeamT5 will be at Cybersec Asia 2025 (Thailand)

This year, Japan Security Analyst Conference 2025 (JSAC2025) will be held on Jan. 21-22 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis. 

TeamT5 will have one session during the event. Our CTI Researcher Yi-Chin Chuang and Yu-Tung Chang will give a speech on “Evolution of Huapi Malware: Growing Focus on Edge Devices '' at 13:30-14:10, Jan. 21.

### About Speech
Huapi (aka BlackTech) is a China-nexus APT group that has been active for over a decade. In line with their ongoing threat landscape, this presentation offers an in-depth analysis of the evolution of Huapi’s malware, focusing on their increasing emphasis on targeting edge devices. We will examine three specific malware used by Huapi: SSHTD (aka ELF_PLEAD), Mabackdoor (aka Hipid), and Bifrost, detailing their evolution and technical characteristics. The analysis will cover incidents from 2022 to 2024 that targeted Taiwan and Japan. We will discuss the infection chains, such as the exploitation of the F5 vulnerability, as well as the execution flows of the malware. Our analysis will highlight recent updates to the malware, illustrating how these changes reflect Huapi’s evolving tactics, particularly their growing focus on edge devices. Additionally, we will outline Huapi’s C&C communication chain and provide an overview of their C&C infrastructure. Finally, we will conclude with recommended countermeasures and mitigation strategies.



 
![](https://uploads.teamt5.org/upload/original/en_update_japan-security-analyst-conference-2025.jpg)
 


### About JSAC 2025
- **Time**: Jan. 21-22, 2025
- **Venue**: Akasaka Intercity Conference Center, Tokyo, Japan
- **Website**: https://jsac.jpcert.or.jp/en/index.html


Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.


 
*Image courtesy of JSAC

【Japan Security Analyst Conference 2025】TeamT5 Will Give Speech on the Chinese APT Group - Huapi

日本資安分析研討會 Japan Security Analyst Conference 2025 (JSAC2025) 將於1月21-22日舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件應變與分析的技術、知識。

本年度活動中，於1月21日16:30-17:10，TeamT5 威脅情資團隊成員 Yi-Chin Chuang (威脅情資研究員) 與 Yu-Tung Chang (威脅情資研究員)共同發表一場演講，分析中國威脅族群 Huapi 最新攻擊事件，探討其鎖定邊緣裝置(edge device)的攻擊與手法。

歡迎蒞臨、聆聽本次演講。

 
![](https://uploads.teamt5.org/upload/original/en_update_japan-security-analyst-conference-2025.jpg)
 

### 關於JSAC 2025
- **時間**: 2025/1/21-1/22
- **地點**: 日本東京 Akasaka Intercity Conference Center
- **官網**: https://jsac.jpcert.or.jp/en/index.html


日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。



 
*首圖來源: JSAC

日本資安分析師研討會 JSAC2025

JSAC2025が1月21日～22日に開催されます。JPCERTコーディネーションセンター(JPCERT/CC)が主催する当イベントは、セキュリティアナリストが一堂に会し、インシデント対応や分析に関する技術的知識の共有を目的としています。

今回は、TeamT5脅威インテリジェンスチームの研究員であるYi-Chin Chuang氏とYu-Tung Chang氏が登壇し、「Evolution of Huapi Malware: Growing Focus on Edge Devices」というタイトルで、中国の脅威グループ「Huapi」による最新の攻撃を分析し、エッジデバイスを標的とした攻撃と手法を探ることについて、講演を行います。

是非ご参加ください。

 
![](https://uploads.teamt5.org/upload/original/en_update_japan-security-analyst-conference-2025.jpg)
 

### JSAC2025について
- 日時：2025年1月21日〜1月22日
- 会場：日本 東京 赤坂インターシティコンファレンス
- 公式ウェブサイト：https://jsac.jpcert.or.jp/en/index.html


サイバー攻撃は日常的に発生しており、その手口も常に変化しています。それらを分析・対応するエンジニアは、日々変化するサイバー攻撃の手法に対応できるよう、スキルアップを求められています。しかし、日本ではインシデント分析・対応の技術や知識をエンジニア間で共有する場が多くありません。だからこそ、セキュリティアナリストが一堂に会し、インシデント対応に関する技術的なノウハウを交換する場を設けることで、個人的、全体的なサイバー攻撃に対する強さを向上させることが期待されています。

そのため、一般社団法人JPCERTコーディネーションセンター（JPCERT/CC）では、サイバーセキュリティのイベント分析・対応技術の交流の場として、JSAC（Japan Security Analyst Conference）を毎年開催しています。 当カンファレンスでは、日々セキュリティインシデントに対応しているセキュリティアナリストたちが、進化し続けるサイバー攻撃の現状と将来について情報交換を行います。


 
*画像提供：JSAC

【TeamT5】JSAC2025参加のお知らせ

Following the success of the first TAS Summit in 2023, which received overwhelming feedback, this annual conference has been expanded in scale and features a call-for-papers selection process for speakers. More than 150 top analysts from Japan, Korea, Vietnam, Indonesia, Thailand, Singapore, the Middle East, and other regions attended, making it a grand event.

We are so grateful to everyone who joined us for this year’s event. The insights shared and connections made were truly inspiring! A huge thanks to our co-organizer ITOCHU Cyber & Intelligence Inc. for their support!

Together, we’re shaping the future of cybersecurity.

 

![](https://uploads.teamt5.org/upload/original/pic1_threat-analyst-summit-tas-2024-retrospect.jpg)

![](https://uploads.teamt5.org/upload/original/pic2_threat-analyst-summit-tas-2024-retrospect.jpg)

![](https://uploads.teamt5.org/upload/original/pic3_threat-analyst-summit-tas-2024-retrospect.jpg)

Threat Analyst Summit (TAS) 2024 Retrospect

###亞太地區最大分析師年會，頂尖高手交流威脅情資研究、探討最新趨勢

【2024年12月11日，台北訊】網路攻擊加劇，手法持續演進，企業不再單靠裝置防毒軟體、架設網路程式防火牆或入侵防護系統，就能高枕無憂。威脅情資分析是資安防禦工作的一塊重要拼圖，資安專責團隊透過威脅情資了解網路攻擊的最新型態和趨勢，進而善用情資，檢視自身面臨的潛在威脅，以快速調整資安規劃，才能真正完善防禦，近年已有不少大企業重視並投入其中。

我國在威脅情資方面的研究起步很早，除了專業上擁有領先的技術，也注重與盟邦交流，共同提升區域聯防韌性。由台灣威脅情資專家團隊 TeamT5 主辦的「2024 TAS（Threat Analyst Summit）威脅分析師高峰會」今（11）日在台北茹曦酒店盛大登場。繼去年首屆TAS高峰會結束，迴響不斷，今年的年會擴大規模並採徵稿方式評選出講師，有來自日本、韓國、越南、印尼、泰國、新加坡、中東等國超過 150 位的頂尖分析師出席，場面十分浩大。

##台灣團隊大力推廣，促進研究交流
TeamT5 執行長TT蔡松廷表示：「今年有近八成是國外講師，除了講師費，我們也提供交通和住宿，可以說下了重本，無非是希望規模越來越大，能擴大影響力。這次也邀請到印尼的分析師，分享他們如何打擊金融及電信產業的網路威脅；還有一位來自中東的研究專家，談對抗能源產業攻擊的經驗，讓分析師切磋交流不同領域的網路威脅研究，正是TAS成立的初衷。另外，第二天下午，日本知名企業『ITOCHU 伊藤忠』的代表也將從不同的戰略視角，分享如何建立SOP做好事前準備，即便受到攻擊也能用閃電般的速度處理，消弭攻擊事件的影響。」

##網路攻擊手法改變，事件處理難度增
關於近年網路攻擊較大的變化，蔡松廷指出，越來越多駭客入侵VPN或Router類的網路設備，潛伏其中再利用跳板尋找攻擊目標，或進行DDoS分散式阻斷服務。現今攻擊者較少使用現成的惡意程式，大多以手動入侵網路設備，如此不會留下任何的足跡或後門，往往要改以觀察異常的活動為主。另外，過去攻擊者主要分為國家支持以偷竊機密資料為主的網路間諜或一般謀利的網路犯罪，現在兩者的界限越來越模糊，需要花更多時間做出判斷，這些都增加事件處理的難度。

##地緣政治影響，網路作戰暗潮洶湧
近年地緣政治造成網路攻擊的對抗更為明顯，烏克蘭與俄羅斯、以色列和哈瑪斯、黎巴嫩，實體戰爭背後的電子資訊戰未曾停歇。美國大選終於落幕，中美對抗又會有什麼變化？ 

蔡松廷進一步表示：「AI的普及使網路攻擊變得更加頻繁，假新聞或圖片都可能使用到AI。我們觀察到中國對美國大選有很多惡意的攻擊行為，他們操弄輿論，製造對美國政治人物的攻擊，從網路入侵、破壞，到假新聞的操作非常多。國際情勢牽動網路威脅的變化，相信各國將在網路作戰上投入越來越多能量，攻擊者也會開發出更多攻擊技術並持續演進。」


##善用威脅情資，考驗企業資安成熟度
蔡松廷強調，了解攻擊者的背景、慣用手法和最新的攻擊行為，再將資訊轉化成企業內部提升防禦的力量，至關重要，這也是威脅情資分析的意義所在。如何讀懂情資，有效應用在資安策略規劃和實際的防禦上，考驗一個企業的資安成熟度。這兩年有越來越多企業懂情資，自建情資團隊和平台，並有能力和專家團隊討論，是我們樂見的現象。期盼在我們用心推廣下，更多企業都能重視並善用威脅情資，將資安防禦工作做得更完備，讓網路威脅無所遁形。

###關於TeamT5 杜浦數位安全
成立於 2017 年，為亞太地區首屈一指的資安威脅情資與端點資安解決方案提供商。專精亞太地區網路威脅研究，包括進階持續性攻擊（APT）、勒索軟體，以精準的威脅情資與獨特的端點威脅狩獵技術，提供客戶反制網路間諜、勒索軟體之資安解決方案。

 
![](https://uploads.teamt5.org/upload/original/pic1_threat-analyst-summit-tas-2024-retrospect.jpg)

![](https://uploads.teamt5.org/upload/original/pic2_threat-analyst-summit-tas-2024-retrospect.jpg)

![](https://uploads.teamt5.org/upload/original/pic3_threat-analyst-summit-tas-2024-retrospect.jpg)

2024 TAS 威脅分析師高峰會 專家齊聚構築資安聯防戰線

![tw_teamt5-receives-international-recognition-as-taiwan-s-best-threat-intelligence-company-by-frost-and-sullivan.jpg](https://uploads.teamt5.org/upload/original/tw_teamt5-receives-international-recognition-as-taiwan-s-best-threat-intelligence-company-by-frost-and-sullivan.jpg)


亞太威脅情資領導品牌 杜浦數位安全 TeamT5 榮獲國際顧問公司 Frost & Sullivan 頒發的「2024 年度臺灣最佳威脅情資公司」，連續第二年獲得殊榮。TeamT5 致力於提供深度和廣度兼具的亞太威脅情資，及易於操作的威脅情資平台－ThreatVision，獲得來自高科技業、金融業、政府單位等長期肯定與使用。

##連續獲獎彰顯杜浦數位安全 TeamT5 的持續創新與成長
TeamT5 專注威脅情資分析、提供端點防禦解決方案積極拓展全球市場，為企業與組織提供最新、最具行動指引的威脅情資，提升營運效率、強化資安韌性。

Frost & Sullivan 顧問 Georgia Edell 表示，TeamT5 擅長提供亞太區域攻擊族群的最新消息，尤其是來自中國的攻擊；使用者更可高度靈活地使用其威脅情資平台，減少不必要的支出，同時獲得威脅情資分析團隊最有用的見解。TeamT5 的亮眼表現再次證明其在臺灣威脅情資的領導地位。

##持續引領資安防禦，堅定邁向未來
TeamT5 創辦人暨執行長蔡松廷表示：「我們很榮幸再度獲得此獎項，公司的核心理念為『情資驅動資安防禦』，透過提供深度且精準的即時威脅情資，協助客戶打造資安韌性。近期也持續擴展威脅情資內容，推出暗網情資，為企業檢查機敏資料是否外洩、是否被罪犯利用，鞏固企業防禦面。」

威脅情資為資安防禦之本，更為企業防禦時時變化之資安威脅的關鍵。據此，TeamT5 為提升企業與組織防禦能量，今年更將擴大舉辦**第二屆威脅分析師高峰會**，為資安領域提供更具前瞻性、戰略性和實務性的威脅情資指引。高峰會由 TeamT5 威脅情資分析師團隊提出新年度資安威脅趨勢，並特別邀請多位國際頂尖專家，分析資安事件處理要點、探討最新資安防禦案例，確保企業在日益嚴峻的資安威脅環境中，能夠做到更加主動、有效的防範與應對。

活動亮點包含：

- 國際專家見解：聆聽來自各國頂尖專家的分享，獲得最新的資安趨勢與分析。
- 進階持續性攻擊（APT）與網路犯罪的最新攻擊手段：深入了解當前的威脅形勢，並了解有效的防禦措施。
- 應變資安威脅事件的策略：獲得實用的資安事件應變策略，有效應對不斷變化、演進的資安威脅。

 

更多演講題目與活動售票連結請至活動專頁：https://tas2024.teamt5.org/

 

###關於 Frost & Sullivan 「年度最佳公司獎」

Frost & Sullivan 為國際頂尖顧問公司，「年度最佳公司獎」（Company of the Year Award）為其年度大獎，旨在表彰在各區域在領導力、技術創新、客戶服務等取得傑出成就和卓越表現的公司。該獎項的評選過程通過深度訪談、分析和廣泛的次級資料研究法來進行，以比較市場競爭者並衡量其績效，並選出產業領域的最佳實踐者。

###關於 TeamT5 杜浦數位安全
TeamT5 專精網路威脅研究，提供端點偵測與回應（EDR）解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。更獲得日本三大巨頭投資，包含日本最大創投 JAFCO 集富集團、日本最大跨國企業並在全球皆有商業投資的 ITOCHU 伊藤忠商事，與日本最大資安解决方案提供商 MACNICA。

團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。


 

> Frost & Sullivan - 得獎名單 : [連結](https://www.frost.com/analytics/best-practices-recognition/2024-award-recipients/)
> 
> 下載TeamT5獲得臺灣最佳威脅情資公司之Frost & Sullivan分析師報告：[連結](https://bit.ly/4fIlFr5)

TeamT5 再度獲得國際肯定，Frost & Sullivan 頒發臺灣最佳威脅情資公司

![en_teamt5-receives-international-recognition-as-taiwan-s-best-threat-intelligence-company-by-frost-and-sullivan.jpg](https://uploads.teamt5.org/upload/original/en_teamt5-receives-international-recognition-as-taiwan-s-best-threat-intelligence-company-by-frost-and-sullivan.jpg)

TeamT5, a leading provider of Asia-Pacific threat intelligence, has been recognized as the " 2024 Taiwanese Company of the Year Award in the Taiwanese Threat Intelligence Industry" by the international consulting firm Frost & Sullivan, marking its second consecutive year receiving this prestigious award. TeamT5 is dedicated to offering comprehensive and in-depth threat intelligence across the Asia-Pacific region, along with its user-friendly threat intelligence platform, ThreatVision. The company has earned long-standing recognition from key sectors, including the high-tech industry, financial institutions, and government agencies.

##Continuous Awards Reflect TeamT5’s Ongoing Innovation and Growth
TeamT5 continues to demonstrate its commitment to innovation and growth, earning recognition for its excellence in the field of threat intelligence. The company specializes in threat intelligence analysis, provides robust endpoint defense solutions, and is actively expanding into global markets. TeamT5 delivers actionable and up-to-date threat intelligence to enterprises and organizations, helping to improve operational efficiency and strengthen cybersecurity resilience.

##Expert Insights on TeamT5’s Leadership in Threat Intelligence
Georgia Edell, a consultant at Frost & Sullivan, highlighted TeamT5’s strength in providing timely and relevant intelligence on cyber threats, particularly from attack groups operating in the Asia-Pacific region, with a focus on Chinese adversaries. Edell also noted the high flexibility of TeamT5’s threat intelligence platform, which enables users to access the most pertinent insights while minimizing unnecessary costs. TeamT5’s continued success reinforces its position as a leader in Taiwan’s threat intelligence sector.

##Advancing Cybersecurity Defense for the Future
Tsai Sung-Ting, founder and CEO of TeamT5, expressed gratitude for the recognition, stating, “We are honored to receive this award once again. Our core philosophy is 'intelligence-driven security defense,' and we are committed to helping our clients build stronger security resilience through precise, real-time threat intelligence.” Tsai further emphasized the company’s recent expansion into dark web intelligence, enabling businesses to monitor for potential leaks of sensitive information and enhance their defenses against emerging threats.

Threat intelligence is the foundation of information security defense, and it is also the key to enterprises' defense against ever-changing information security threats. Accordingly, in order to enhance the defense capabilities of enterprises and organizations, TeamT5 will expand and host the second Threat Analyst Summit this year to provide more forward-looking, strategic and practical threat intelligence guidance for the cybersecurity field. At the summit, the TeamT5 threat intelligence analyst team proposed the new year's information security threat trends, and specially invited a number of top international experts to analyze the key points of cybersecurity incident handling and discuss the latest cybersecurity defense cases to ensure that enterprises are in the increasingly severe cybersecurity threats. environment, we can achieve more proactive and effective prevention and response.

Activities highlights include:

- International expert insights: Listen to sharing from top experts from various countries and obtain the latest cybersecurity trends and analysis.
- Advanced Persistent Attacks (APTs) and the latest attack methods of cybercrime: Get a deeper understanding of the current threat landscape and understand effective defense measures.
- Strategies for responding to cybersecurity threats: Obtain practical strategies for responding to cybersecurity incidents and effectively respond to changing and evolving cybersecurity threats.

 

For more speech topics and event ticketing links, please visit the event page: https://tas2024.teamt5.org/


###About Frost & Sullivan : Company of the Year Awards
Frost & Sullivan is a top international consulting firm. The "Company of the Year Award" is its annual award, aiming to recognize outstanding achievements and outstanding performance in leadership, technological innovation, customer service, etc. in various regions. company. The award's selection process uses in-depth interviews, analysis and extensive secondary research to compare market competitors and measure their performance, and to select the best practitioners in the industry.

###About TeamT5 
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan. Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

 

> Frost & Sullivan - Winners List : [Link](https://www.frost.com/analytics/best-practices-recognition/2024-award-recipients/)
> 
> Download “2024 Best Threat Intelligence Company in Taiwan - TeamT5” from Frost & Sullivan : [Link](https://bit.ly/4fIlFr5)

TeamT5 Receives International Recognition as Taiwan's Best Threat Intelligence Company by Frost & Sullivan

![en_teamt5-receives-international-recognition-as-taiwan-s-best-threat-intelligence-company-by-frost-and-sullivan.jpg](https://uploads.teamt5.org/upload/original/en_teamt5-receives-international-recognition-as-taiwan-s-best-threat-intelligence-company-by-frost-and-sullivan.jpg)

にてアジア太平洋の脅威インテリジェンスをリードするブランドであるTeamT5は、世界的に有名なコンサルティング会社であるフロスト＆サリバンから「2024年度台湾における最優秀脅威インテリジェンス企業」として、2年連続選出されました。TeamT5はアジア太平洋地域における、広範で深く掘り下げられた脅威インテリジェンスを提供するとともに、ハイテク、金融、政府機関などから長年愛用されている脅威インテリジェンス・プラットフォームThreatVisionを提供することに尽力しています。

##連続受賞として反映されたTeamT5の継続的な革新と成長
脅威インテリジェンス分析とエンドポイント防御ソリューションに重点を置くTeamT5は、グローバル市場に積極的に進出しており、最新かつ実用的な脅威情報を提供することで、企業や組織の業務効率向上とサイバーレジリエンスの強化をサポートしています。

フロスト＆サリバンのコンサルタント、ジョージア・エデル氏は、「TeamT5は、アジア太平洋地域の攻撃グループ、特に中国を発とする攻撃グループに関する最新情報の提供に特化しており、脅威インテリジェンスプラットフォームの使用において、高い柔軟性をユーザーに提供することで、脅威インテリジェンス分析チームから最も有用な知見を得ながら、不必要な支出の削減している。 TeamT5の素晴らしい実績は、台湾の脅威インテリジェンスにおけるリーダー的地位であることを改めて証明している。」と述べました。

##未来のための、サイバー防御の推進
TeamT5の創設者兼CEOであるTsai Sung-Tingは、次のように語っています。「当社の基本理念は『インテリジェンスによるサイバーセキュリティの牽引』であり、詳細かつ正確な脅威インテリジェンスをリアルタイムで提供することで、お客様のサイバーセキュリティの強靭性構築を支援しています。 最近では、ダークウェブインテリジェンスを開始し、脅威インテリジェンスのコンテンツを拡大し続けています。これは、企業が機密情報が漏えいしていないか、または犯罪者に利用されていないかをチェックし、サイバー防御を強化するのに役立ちます。」

###フロスト＆サリバンの「年間最優秀企業賞」について
フロスト＆サリバンは国際的な大手コンサルティング会社であり、リーダーシップ、技術革新、顧客サービスにおいて、全地域で傑出した成功を収め、卓越した実績を残した企業に対し、「年間最優秀企業賞」（Company of the Year Award）を毎年授与しています。 この賞の選定は、綿密な取材、分析、広範な二次調査を用いて行われ、市場における競合他社のパフォーマンスを比較・測定し、業界最高の実務家を選出します。

###TeamT5について 
TeamT5は、サイバー脅威の調査を専門とし、EDR（Endpoint Detection and Response）ソリューションを提供しており、米国、日本、台湾の大企業がサイバー攻撃から機密文書や業務を効果的に保護できるようサポートしています。 また、日本最大のベンチャーキャピタルであるジャフコ、世界中に事業投資を行う日本最大の多国籍企業である伊藤忠商事、日本最大の情報セキュリティソリューションプロバイダーであるマクニカなど、日本の大手3社から投資を受けています。

また、20年以上にも及ぶアジア太平洋地域における脅威インテリジェンスの研究経験と言語的優位性を持っており、極東アジアのAPT攻撃者グループの攻撃の詳細やテクニックなどに関する広範な知識が評価され、世界的なセキュリティカンファレンスから招待を受け、最新の研究結果を発表しています。

> Frost & Sullivan - 受賞リスト : [連結](https://www.frost.com/analytics/best-practices-recognition/2024-award-recipients/)
> 
>フロスト＆サリバン「2024年台湾における最優秀脅威インテリジェンス企業TeamT5」のダウンロードは，[此連結](https://pse.is/6rkmjf)をクリック。





フロスト＆サリバン、TeamT5を再び台湾における最優秀脅威インテリジェンス企業に選出

We’ll be in VNISA Vietnam Cyber Security Day and present our intelligence-driven cybersecurity solutions.

##Exhibiting Solutions 
###ThreatVision
>Used by 15+ national cybersecurity agencies, ministries of defense, financial institutions, and multinational enterprises

- **Real-Time Data Collection** : Gain daily insights into emerging advanced persistent threats from Asia.
- **Comprehensive Analytics** : Deep dive into threat patterns and vulnerabilities.
- **Actionable Intelligence** : Enable informed decision-making to fortify your defenses.


###ThreatSonar
>Used by 3 of the top banks in Vietnam

- **Proactive Detection** : Identify and neutralize threats before they impact your organization.
- **Customized Strategies** : Threat hunting for compromise assessment and incident response.
- **Expert Team** : Leverage our seasoned analysts with extensive industry experience.

 
 

##Event Info
- Date : November 21, 2024 (Thursday)
- Time: 7:30 - 17:30
- Venue: Hotel Melia Hanoi Hotel Melia Hanoi (44 Ly Thuong Kiet St, Hanoi, Vietnam)
- Event website: https://securityday.vn/en/

TeamT5 will be at VNISA Vietnam Cyber Security Day 2024

>TeamT5がNHKにインタビューを実施。インタビューは情報操作について。これはインタビューの抜粋です。[全文はここからお読みいただけます](https://www3.nhk.or.jp/news/html/20240920/k10014585911000.html)。

リサーチャーのひとりが、旧ツイッター、Xに不思議な投稿を見つけた。投稿にはURL。その先に飛ぶと、ある文書がダウンロードできるようになっていた。

中国の企業から流出したとみられることは、すぐにわかった。

上海に本社を置くサイバーセキュリティー企業「i-SOON」だった。中国当局と連携して世界でサイバー攻撃を展開しているのではないかと、T5がかねてからマークしていた企業のひとつだった。

文書は大量にあり、その内容は驚くべきものだった。

ハッキングなどのサイバー攻撃に使えるセキュリティー製品の技術書や取引先とみられる一覧表。海外の組織などから盗み取ったと見られるデータのリスト。そして、3年に及ぶ社内チャットの記録など、合わせて577点に上った。

TEAM T5 張哲誠さん：「中国のサイバーセキュリティー企業からこれほど多くの内部資料が流出したのは初めてです。中国政府と民間企業の関係を理解する上で、近年で最も重要な文書です」

 
 
>TeamT5 は、20 年以上の実績を持つ世界クラスのサイバーセキュリティアナリストで構成されています。 地理的・文化的利点を活用し、当社はアジア太平洋地域のサイバー攻撃者について最もよく理解しています。
>
>精確な脅威インテリジェンスと独自のエンドポイント脅威ハンティング技術により、サイバースパイ活動やランサムウェア対策のサイバーセキュリティソリューションを提供します。米国、日本、台湾の政府機関、金融、テクノロジー、電気通信、情報セキュリティサービスプロバイダーなど、各業界のお客様にご利用頂いており、機密文書の保護やサイバー攻撃の遮断を継続的に行っています。
>[会社概要](https://teamt5.org/jp/about-us/?utm_source=news&utm_medium=website)

TeamT5がNHKのインタビューを受ける

> 本公司杜浦數位安全(TeamT5)接受[NHK採訪](https://www3.nhk.or.jp/news/html/20240920/k10014585911000.html)，該次採訪獲得台灣媒體進一步報導，本篇節錄中央廣播電台，完整報導請見[此連結](https://www.rti.org.tw/news/view/id/2224778)。

NHK採訪了發現外流文件的台灣情資研究機構杜浦數位安全(TeamT5)。他們在社群媒體X上發現了一個神秘的URL，認為是攻擊者或者洩露的人額外創造出來的一個帳號，打開後發現的577份文件，包含了大量用於網路攻擊的技術訊息，像是能入侵微軟和谷歌電子郵件信箱的工具，以及能遠程操控智慧型手機的技術等。......

 
 

>TeamT5 杜浦數位安全專精於亞太地區網路威脅研究，長期研究網路攻擊，追蹤攻擊者，專精類別如進階持續性攻擊(APT)、勒索軟體。我們以精準的威脅情資與獨特的端點威脅狩獵技術，提供反制網路間諜、勒索軟體之資安解決方案。客戶來自美國、日本、臺灣，產業別涵蓋政府機關、金融、科技、電信、資安服務提供商，持續保護機密文件，阻斷網路攻擊。
>更多公司介紹請參考[關於我們](https://teamt5.org/tw/about-us/?utm_source=news&utm_medium=website)

【中央廣播電台】NHK追溯安洵外洩文件 探討中國認知戰真相

Japan NHK's documentary reveals the shady story of China's "cognitive warfare". And TeamT5, APAC threat intelligence leading brand from Taiwan, discover this information. It noticed the anomaly as early as 2021 and continued to monitor and reveal the truth.

- In February this year, i-Soon leaked information. This Shanghai-based cybersecurity company has long been labeled by TeamT5 as one of the organizations that may cooperate with the Chinese government and participate in global cyber attacks. The TeamT5 threat intelligence team traced a mysterious URL on social media.

- NHK’s documentary "Tracking China's Leaked Documents" took the reporter half a year to visit 7 countries and conduct in-depth tracking and analysis of these 577 leaked documents. They reveal the shocking story of the Chinese government, military and civilians working together to carry out cyber attacks and "cognitive warfare".

 

👉NHK’s report: https://www3.nhk.or.jp/news/html/20240920/k10014585911000.html

TeamT5 conducts an interview with NHK

The biggest information security conference in Japan, [CODE BLUE 2024](https://codeblue.jp/), will be held in Tokyo on November 14-15. TeamT5, with its Taiwan headquarter & Japan subsidiary, is proud to sponsor and participate in this Asia top international cybersecurity event.

This year, our cyber threat analysts will share their latest study - “China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations”.

See below for highlights of our events at CODE BLUE 2024.

 

##China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations
- **Time** : 11 / 15 (Wed.) 11:30 – 12:10
- **Presented by** : Li-an, Huang (Security Researcher) & Chih-yun, Huang (Security Researcher)

As we approach the largest election year in history, 2024 is already shadowed by China’s influence operations (IO) aiming to destabilize the democratic systems. Since 2023, Chinese threat actors have launched multiple IO campaigns targeting elections, including an evolving tactic that merges the hack-and-leak with IO campaigns.
In the first part of the presentation, we will introduce Chinese threat actors’ newly developed tactics, specifically the combination of hack-and-leak tactics with IO campaigns. We will elaborate on how China learned and advanced Russia’s playbook to influence the election with asserted leaked documents within our real-world case study from the 2024 Taiwan presidential election.

At the same time, the proliferation of generative artificial intelligence (AI) technology has enhanced threat actors’ capability. In the second part of the presentation, we will demonstrate how Chinese threat actors apply AI for such hack-and-leak and IO campaigns. The integration of AI, hack-and-leak, and IO allows the threat actors to create disinformation that targets broader audiences with ease.

As billions of people are heading to vote in the rest of 2024, including the critical U.S. presidential election in November, the stakes have never been higher. Alarmingly, with the enhanced capability, Chinese threat actors have expanded their target scope from presidential candidates to include legislators. The expansion serves as a dire warning as individual legislators often lack the resources to defend against influence operations. We will conclude the presentation by providing mitigation strategies and policy recommendations aiming to counter the threat at an early stage.

 

##What is CODE BLUE?
CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on [CODE BLUE Official Website](https://codeblue.jp/2024/en/).

 

*Image courtesy of CODE BLUE.

【TeamT5 x CODE BLUE 2024】Because Security Matters

日本最大的資訊安全會議 [CODE BLUE 2024](https://codeblue.jp/) 將於 11 月 14 日至 15 日在日本東京舉辦。 TeamT5 台灣總部和日本子公司很榮幸能夠贊助和參與這一亞洲頂級國際資安盛會。

今年，我們的資安威脅分析師將分享他們的最新研究 – 「中國持續演進的攻擊策略：結合駭侵-洩密與資訊戰的手法（China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations）」。

請參閱下文，了解我們將於 CODE BLUE 2024 帶來的研究分享。

 

##中國持續演進的攻擊策略：結合駭侵-洩密與資訊戰的手法(China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations)
- **時間** : 11月15(週三) 11:30 - 12:10
- **講者** : Li-an, Huang（威脅情資分析師）& Chih-yun, Huang（威脅情資分析師）

隨著史上規模最大的選舉年度來臨，2024 年已被中國旨在破壞民主制度穩定的影響力行動所籠罩。自 2023 年以來，中國威脅行為者發起了多次針對選舉的資訊戰（Influence Operations），其中包括一種將駭侵-洩密與資訊戰相結合並不斷發展的策略。

在演講的第一部分，我們將介紹中國威脅行為者新開發的策略，特別是駭客洩漏策略與資訊戰的結合。我們將在 2024 年台灣總統選舉的真實案例研究中，詳細闡述中國如何學習和推動俄羅斯的策略，利用所謂的洩漏文件來影響選舉。

同時，生成式人工智慧（AI）技術的擴散增強了威脅行為者的能力。因此在演講的第二部分，我們將展示中國威脅行為者如何將人工智慧應用於此類駭客攻擊和資訊戰活動。人工智慧、駭客攻擊和資訊輸入的結合使威脅行為者能夠輕鬆地製造針對更廣泛受眾的虛假資訊。

隨著數十億人將在 2024 年餘下時間投票，包括 11 月至關重要的美國總統選舉，賭注從未如此之高。令人擔憂的是，隨著能力的增強，中國威脅行為者已將目標範圍從總統候選人擴大到國會議員。這種擴張是一個可怕的警告，因為個別國會議員往往缺乏抵禦資訊戰的資源。

演講結尾，我們將提供早期應對威脅的緩解策略和政策建議。

 

##資安會議 Code Blue 介紹
CODE BLUE 是日本最大的國際資安研討會，旨在通過 CODE（技術）跨越 BLUE（海洋）將人們聯繫起來，為更美好的網路世界做出貢獻。 每年，世界頂級專家和研究人員齊聚一堂，分享最新發現並進行技術演講。 它是所有參與者交流資訊、合作資安事件應變和解決資訊安全問題的殿堂。

更多資訊，請參考 [CODE BLUE 官網](https://codeblue.jp/2024/en/)。

 

*圖片來源: CODE BLUE

TeamT5 參與 CODE BLUE 2024

アジア太平洋地域でトップクラスのサイバー脅威インテリジェンスとエンドポイント検出応答 (EDR) ソリューションを提供する TeamT5 は、11月14日(木)から15日(金)に開催される[CODE BLUE 2024](https://codeblue.jp/)に参加いたします。


また、今年度は弊社のサイバー脅威アナリスト2名が登壇し、最新の研究結果を発表いたします。

## タイトル：「進化する中国の戦術：ハック・アンド・リークと影響力工作とのコンビネーション」
- 時間：11月15日(金)11:30 - 12:10
- 会場：Track1(HALL B)
- 講演者： 
TeamT5サイバー脅威アナリスト 
リアン・ホアン- Li-an Huang、チーユン・ホアン- Chih-yun Huang 

- 概要：

2024年は史上最大の選挙の年を迎えようとしており、すでに中国の影響力工作（IO：Infulence Operations）が民主主義システムを不安定化させようとしている影を落としている。2023年以降、中国の脅威アクターは複数のIOキャンペーンを選挙を標的にして展開しており、その中でも進化した手法として、ハック・アンド・リーク、そしてIOキャンペーンを組み合わせた戦術が見られるようになった。

講演の前半では、中国の脅威アクターが開発した新しい戦術、特にハック・アンド・リークとIOキャンペーンの統合について紹介する。2024年の台湾大統領選挙における実際の事例を基に、中国がいかにしてロシアの戦術を学び、流出したとされる文書を利用して選挙に影響を与える技術を発展させたかを詳しく説明する。
同時に、生成AI技術の急速な普及が脅威アクターの能力を強化している。

講演の後半では、中国の脅威アクターがどのようにAIを活用して、ハック・アンド・リーク、そしてIOキャンペーンを展開しているかを実演する。AI、ハック・アンド・リーク、そしてIOを統合することで、脅威アクターはより幅広い対象に対して容易に偽情報（ディスインフォメーション）を流布できるようになっている。

2024年の残りの期間で、数十億の人々が投票に向かう中、特に11月に行われる米国大統領選挙が控えているため、その影響は非常に大きい。驚くべきことに、強化された能力を持つ中国の脅威アクターは、標的を大統領候補者から議員にまで拡大している。この拡大は、特に個々の議員が影響工作に対抗するための資源を欠く場合に、重大な警告となる。講演の最後には、この脅威に早期に対処するための緩和策や政策提言を提示し、結論とする。

 

TeamT5は、脅威インテリジェンスこそがサイバー防御の要であると考え、企業がサイバー攻撃を予測し、事前に防御戦略を展開できるよう、行動指向でローカライズされたインテリジェンスを提供します。

是非、この機会に弊社と脅威インテリジェンスについの理解を深めていただければ幸いです！

 

##CODE BLUE 2024 概要
世界トップクラスのサイバーセキュリティ専門家による国際会議です。本会議はベンダー中立の立場から、欧米の著名な研究者による最新の研究成果を共有するとともに、日本をはじめとするアジア各国の優れた若手研究者を発掘し、その研究成果を世界へと発信しています。2013年度の開催以来、こうした取組みを積み重ねることで国内外のサイバー・セキュリティ・コミュニティから厚い信頼を得てきました。

 

- 会期：2024年11月14日(木)～11月15日(金)
- 主催：CODE BLUE実行委員会
- 会場：ベルサール高田馬場（住友不動産新宿ガーデンタワーB2・1F）
- 詳細はこちら：https://codeblue.jp/2024/