In today's digital age, which is full of threats, enterprises should actively look for the best endpoint security solutions to ensure that their systems are protected from attacks and data theft.

EDR (Endpoint Detection and Response) solution is a powerful tool that can help enterprises detect and respond to endpoint threats early. However, when selecting and purchasing EDR solutions, enterprises need to pay attention to some key points to ensure that the chosen solution meets their cybersecurity needs and can help the information system operate stably in the long term.

 

### 1. Complete threat detection capabilities:
It is important to choose an EDR solution with high accuracy and instant threat detection capabilities. Solutions should be able to identify various types of threats, both known and unknown, and provide immediate warning and response mechanisms.

### 2. Efficient threat response and blocking capabilities:
A good EDR solution should have rapid threat response and blocking capabilities. This includes automated response mechanisms that take action as soon as a threat is identified to minimize damage and speed up recovery time.

### 3. High visibility and reporting capabilities:
Choose an EDR solution that provides detailed reporting and analysis, which is key to understanding threat trends, conducting investigations, and responding to future attacks. Visibility information should be real-time and provide a comprehensive visual picture of endpoint and network activity.

### 4. Refer to the international cybersecurity defense framework MITRE ATT&CK
The American non-profit organization MITRE proposed the ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) cybersecurity defense framework that is widely used internationally. It aims to help enterprise organizations have a common language and structure, understand and analyze network attack methods, and then plan cybersecurity. Countermeasures.

### 5. Easy integration and scalability
EDR solutions should be easy to integrate with existing cybersecurity solutions and infrastructure, such as SIEM (Security Information and Event Management) solutions; they should also avoid conflicts with existing solutions, such as anti-virus software. At the same time, the EDR solution should be scalable and able to cope with the continuous expansion of the enterprise's future business and the continuous increase in the number of endpoints.

### 6. Security and compliance
The EDR solution an enterprise chooses must comply with relevant security standards and regulatory requirements. This includes data encryption, user rights control and other functions to ensure compliance with the legal requirements of the country where the enterprise is located.


 

## Conclusion

When selecting and purchasing an EDR solution, businesses should consider the above factors and select a solution that meets their specific needs. This not only improves enterprise security, but also protects business operations and gains the trust of customers and partners. Ultimately, a good EDR solution will become an important foundation for an enterprise's security strategy.

TeamT5 provides an EDR solution "[ThreatSonar Anti-ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)", which meets the above characteristics. Our team members have more than 20 years of experience in cybersecurity threat investigation and analysis, and have assisted a wide range of customer groups such as the government, financial industry, technology industry, and manufacturing industry to achieve cybersecurity defense goals.

>Contact us to learn how your enterprises can optimize your security defense.
[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Endpoint Detection and Response (EDR) Solution: Key Considerations for Procurement

在當今充滿威脅的數位時代，企業宜積極尋找最佳的端點安全解決方案，以確保企業的系統免受攻擊、數據失竊。

**EDR（Endpoint Detection and Response）**解決方案是一種強大的工具，可以幫助企業及早檢測和應對端點威脅。然而，在挑選和採購 EDR 解決方案時，企業需要注意一些關鍵重點，以確保所選擇的解決方案符合其資訊安全需求，更能協助資訊系統能長期穩定運作。

 

### 1. 完整的威脅偵測能力
選擇一個具有高精確度和即時威脅偵測能力的 EDR 解決方案，十分重要。解決方案應該能夠識別各種類型的威脅，包括已知和未知的威脅，並提供即時的警告和反應機制。

 

### 2. 高效的威脅回應和阻斷能力
一個優秀的 EDR 解決方案應該具有快速的威脅回應和阻斷功能。這包括自動化的應對機制，能夠在識別到威脅後立即採取行動，以最小化損失並加快恢復時間。

 

### 3. 高度的可視性和報告功能
選擇一個提供詳細報告和分析的 EDR 解決方案，這對於了解威脅趨勢、進行調查和應對未來攻擊非常關鍵。可視性資訊應該是即時的，並且能夠提供端點和網路活動的全方位視覺畫圖表。

 

### 4. 參考國際通用資安防禦框架 MITRE ATT&CK
美國非營利組織 MITRE 提出廣為國際使用的 ATT&CK (Adversarial Tactics, Techniques & Common Knowledge)資安防禦框架，旨在協助企業組織有共通的語言與架構，了解與分析網路攻擊手法，進而規劃資安對策。

EDR 解決方案宜具備攻擊事件與此資安防禦框架的對照資訊，使用者方可有具體、清晰的概念，理解攻擊事件的手法，採取正確的應對措施。

 

### 5. 容易整合和擴展性
EDR 解決方案應該易於與現有的資訊安全解決方案、基礎設施整合，如SIEM（Security Information and Event Management）解決方案；也避免與現有解決方案衝突，如防毒軟體。同時，EDR 解決方案應該具有擴展性，能夠應對企業未來業務持續擴展，端點數持續增加。

 

### 6. 安全性和合規性
企業所選擇的 EDR 解決方案必須符合相關的安全性標準和法規要求。這包括數據加密、使用者權限控制等功能，確保符合企業所在國家的法律規定。

 

## 結論

在挑選和採購 EDR 解決方案時，企業應該綜合考慮上述因素，並選擇一個符合其特定需求的解決方案。這不僅能夠提高企業的安全性，還能夠保護業務營運，獲得客戶和合作夥伴的信任。最終，一個優秀的 EDR 解決方案將成為企業資安策略的重要基底。

 

TeamT5 杜浦數位安全提供 EDR 解決方案「[ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」，符合上述特點。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶群，達成資安防禦目標。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

 

*首圖來源: Unsplash

端點檢測和回應解決方案（EDR） 評估與採購重點

Products & Services

脅威インテリジェンスは情報セキュリティ防御の基礎であると主張し、アクション指向のローカル インテリジェンスの提供に重点を置いています。 クライアントが攻撃を予測し、事前に防御戦略を展開し、損失のリスクを軽減するのを支援します。

##ThreatVision

全世界のAPT脅威情報を掌握し、リアルタイムに脅威リスク状態を予測し、事前に部門を防衛します。
全世界で猛威を振るう最新の悪意あるプログラムの分析と追跡結果に対し、早期警告、悪意ある侵入指標、公開情報分析とハッカーグループの研究を提供し、企業が最新のネットワーク脅威の趨勢を掌握し、既知かつ潜在的な脅威を正確に判断するお手伝いをいたします。

**企業支援**
- 当社はあなた自身の診断、また専門家によるコンサルティングサービスを円滑にするインタラクティブなプラットフォームを提供します。
- 脅威インテリジェンスとサンプルに関連するキーワード検索により、企業の脅威リスク調査を満たすことができます。

 
もっと詳しく知る: https://teamt5.org/jp/products/threatvision/

 
 

##ThreatSonar

**事前防御のための脅威ハンティング**

企業において最高水準のサイバーセキュリティの事前防御策である、APT（Advanced Persistent Threat）の脅威ハンティングソリューションは、 自動展開・簡単な操作・異常の正確な検出・更に悪意ある脅威を迅速に検出、することで攻撃が発生した場合の防御としても、速やかに対策を講じることができるように設計されています。

**迅速な侵入脅威の検知**

デジタルフォレンジックとビヘイビア・モデルテクノロジーにより異常な動作をすばやく検出、封鎖し企業の情報セキュリティの状態を即座に把握します。

**情報セキュリティ脅威の自動調査**

インテリジェンス主導型の機能と自動調査機能により、アクティブ検出は、ハッカーが脅威を隠すために一般的に使用するTTP（戦術、技術、手順）に準拠しており、情報セキュリティインシデントの調査効率の向上を促進します。

 
もっと詳しく知る: https://teamt5.org/jp/products/threatsonar/

インテリジェンスがサイバー防御を推進

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance.

##ThreatVision: Threat Intelligence Platform

Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 10+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

- Learn more: https://teamt5.org/en/products/threatvision/

##ThreatSonar Anti-Ransomware: Endpoint detection and response platform

ThreatSonar Anti-Ransomware aims to protect enterprises from Advanced Persistent Threat (APT). With real-time threat detection & hunting, it can also prevent targeted ransomware.

Once ThreatSonar Anti-Ransomware discovers suspicious behaviors - files are encrypted or systems are damaged, it’ll isolate the threat source and prevent other systems being infected. ThreatSonar EDR can also easily restore encrypted files in order to protect enterprises’ valuable assets.

ThreatSonar Anti-Ransomware can be customized based on clients’ needs. It has been widely used by many enterprises from various industries to monitor cyber threats and manage cyber incidents.

- Learn more: https://teamt5.org/en/products/threatsonar-anti-ransomware/

##ThreatSonar: Rapid Test for Enterprise Cybersecurity’s Health Status

ThreatSonar is an easy-to-use tool to hunt cyber threats. Combining digital forensics and behavior-modeling techniques, ThreatSonar can do fast triage and hunt for anomalies.

Driven by cyber threat intelligence and run with automatic mode, it finds hidden infections with similar TTPs - Tactics, Techniques, and Procedures. Regular cybersecurity check-ups also help enterprises to better protect endpoints.

ThreatSonar offers both online and offline mode to protect endpoints in various situations. In short, ThreatSonar is an effective tool designed for assisting incident response.

- Learn more: https://teamt5.org/en/products/threatsonar/


Intelligence-driven Cyber Defense

我們堅持威脅情資是資安防禦的基石，為企業提供行動取向的在地情資，協助企業預見攻擊，提前部署防禦策略，降低損失風險。

##ThreatVision威脅情資整合平台: 預知攻擊

TeamT5 創立於台灣、深耕亞太區域，威脅情資團隊具備逾10年的威脅情資研究資歷、逾1,000件資安事件應變與處理經驗，提供最在地化、最專業威脅情資，提升企業面對資安威脅、網路攻擊的防禦能量。

- 了解更多: https://teamt5.org/tw/products/threatvision/

##ThreatSonar Anti-Ransomware 端點威脅與回應平台: 即時防禦

不論是傳統大型企業或高科技廠商，皆頻傳受到勒索軟體攻擊，導致重要資訊外流、面臨需支付鉅額贖金的壓力。

ThreatSonar Anti-Ransomware 基於人工智慧引擎，監控程式的可疑行為(如: 加密檔案、破壞系統)，及時阻擋勒索軟體，避免惡意程式擴散。
      本解決方案具備防護客製化功能，企業可依據產業特性、營運需求等，自行定義風險追蹤項目、調整風險等級，以便簡化事件調查、加速風險告警。

- 了解更多: https://teamt5.org/tw/products/threatsonar-anti-ransomware/

##威脅鑑識分析平台 ThreatSonar

網路攻擊手法持續演進，當企業發現攻擊事件時，往往機敏資料已落入駭客手中。
        ThreatSonar 基於 TeamT5 團隊對全球惡意程式研究的成果，內建超過100種惡意行為指標、超過1,000種軟體後門特徵，並結合智慧鑑識分析技術與風險模型，發掘潛藏在企業內部的未知威脅，提前預防網路攻擊。

- 了解更多: https://teamt5.org/tw/products/threatsonar/


情資驅動資安防禦 量身訂製企業策略

In today's digital age, security incidents and data leaks are becoming more and more common, so enterprises need to have strong incident response (IR) strategies and service providers to deal with potential threats.

IR services are designed to assist enterprises with immediate response and investigation of cybersecurity incidents and accidents to help them reduce damage. However, when selecting and procuring IR services, businesses need to carefully consider the following key factors.

### 1. Response time
A key IR provider selection criterion is its response time. Suppliers should be able to provide immediate response services to minimize the damage to the enterprise from potential threats and reduce the negative impact of data loss and system outages.

### 2. Professional knowledge and practical experience
The service provider's team members should have extensive security expertise and practical experience to ensure that they can effectively investigate and respond to various security incidents.

### 3. Use specialized detection tools
Cybersecurity incidents are often caused by endpoint intrusions. Therefore, service providers scan endpoint security status and detect the scope of damage for enterprises, which is the primary key to respond to cybersecurity incidents. Moreover, service providers can use specialized endpoint detection tools to get twice the result with half the effort, accurately confirm the scope of the damage, and take corresponding countermeasures.


### 4. Investigation and evidence protection
Suppliers should have professional investigation and digital evidence protection procedures in place to ensure that the incident investigation process is compliant and can be used in legal proceedings. This includes compliance reporting and evidence preservation measures.

### 5. Provide cybersecurity strengthening suggestions and cybersecurity awareness training
IR service providers should be able to provide cybersecurity enhancement suggestions to avoid encountering the same hacking incidents in the future, so as to help enterprises prevent future security incidents. This is a high-value add-on service that helps companies address root causes and improve overall security.



## Conclusion
IR services are an integral part of an enterprise's security resilience strategy, so choosing the right IR service provider is crucial. Businesses should carefully consider the above factors to ensure that the vendor they choose can provide efficient incident response and investigation services and help protect their data and systems.

The choice of IR services will directly impact an organization's ability to respond to security incidents, so it is an important decision that deserves careful consideration.

 

TeamT5 provides professional IR services. The self-developed threat identification and analysis platform ThreatSonar can accurately identify the victim scope of cybersecurity incidents for customers. Our team has more than 20 years of experience in security threat investigation and analysis, and is a member of FIRST, the largest international security incident response organization.

It has now assisted a wide range of customer groups such as the government, financial industry, technology industry, and manufacturing industry to quickly and effectively respond to cybersecurity threats or hacker attacks to protect key information assets with minimized losses; and provides cybersecurity enhancement suggestions and incidents related Threat intelligence, based on the core concept of "Know the enemy and know yourself; in a hundred battles you will never be in peril.", effectively helps enterprises improve their response capabilities in the face of cybersecurity incidents, reduce the interruption time of information systems and network services, maintain the continuity of various services, and ensure business working normally.

Welcome to contact us to learn how your company can optimize its security defense.
[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Incident Response(IR): Key Considerations for Procurement

在當今的數位時代，安全事件和數據洩漏變得越來越普遍，因此企業需要擁有強大的資安事件應變（Incident Response，IR）策略和服務供應商來應對潛在的威脅。

IR 服務旨在協助企業，針對資訊安全事件、事故，進行即時回應和調查，以幫助企業降低損害。然而，在挑選和採購 IR 服務時，企業需要謹慎考慮以下關鍵因素。

### 1. 應變時間
一個關鍵的 IR 服務商的選擇標準是其應變時間。供應商應該能提供即時的應變服務，以最小化潛在威脅對企業的損害，降低數據丟失和系統中斷帶來的負面影響。

 

### 2. 專業知識和實務經驗
服務商的團隊成員應具備豐富的安全專業知識和實務經驗，以確保他們能夠有效地調查和應對各種安全事件。

 

### 3. 使用專門的檢測工具
資安事件的起因常是端點遭到侵入，因此服務商為企業進行端點安全狀況掃描、偵測受害範圍，是進行資安事件應變的首要關鍵。且服務商採取專門的端點檢測工具，更可收到事半功倍之效，精準確認受害範圍，採取相應對策。

 

### 4. 調查和證據保護
供應商應該具有專業的調查和數位證據保護程序，以確保事件的調查過程合規，並可以用於法律程序。這包括合規性報告和證據保全措施。

 

### 5. 提供資安強化建議和資安意識訓練
IR 服務供應商應可以提供資安強化建議，避免未來遭遇相同的駭客入侵事件，以幫助企業預防未來的安全事件。這是一個高價值的附加服務，有助於企業治本、提高整體安全性。

 

## 結論
IR 服務是企業資安韌性策略中，不可或缺的一部分，因此挑選適合的 IR 服務供應商至關重要。企業應該謹慎考慮上述因素，以確保所選擇的供應商能夠提供高效的資安事件回應和調查服務，並幫助保護其數據和系統。

IR 服務的選擇將直接影響企業對安全事件的應對能力，因此這是一個重要的決策，值得深思熟慮。

 

TeamT5 杜浦數位安全提供[資安事件應變服務](https://teamt5.org/tw/service/ir/?utm_source=blogs&utm_medium=website)，自主研發之[威脅鑑識分析平台 ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blogs&utm_medium=website) 可為客戶精準鎖定資安事件受害範圍。我們的團隊具備超過 20 年的資安威脅調查、分析的經驗， 並為[國際最大資安事件應變組織 FIRST](https://www.first.org/?utm_source=blogs&utm_medium=website) 的成員。

現已協助政府、金融業、科技業、製造業等廣大客戶群，迅速且有效應對資安威脅或駭客攻擊，以最小化的損失來保護關鍵資訊資產；並提供資安強化建議與事件相關威脅情資，以「知己知彼，百戰百勝」的核心概念，有效協助企業提升面對資安事件的應處能力，減少資訊系統與網路服務中斷時間，維持各項服務連續性，確保業務正常運作。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 

*首圖來源: Unsplash

資安事件應變服務 評估與採購重點

The APAC region is a hotbed for cyber threats, with countries like China, North Korea, and Vietnam continuously evolving their tactics to infiltrate organizations and governments. Recognizing the importance of staying ahead of these threats, at TeamT5 we have integrated our [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website) solution with ThreatQuotient's ThreatQ platform. This integration not only enriches the ThreatQ experience but also empowers security teams with invaluable insights into APAC threats. In this article, we will explore how ThreatVision enhances the ThreatQ experience and the use cases it supports.

![how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg](https://uploads.teamt5.org/upload/original/how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg)

 

## A Unique Focus on Asia-Pacific Threat Intelligence
TeamT5 has made a name for itself in the world of threat intelligence with a unique emphasis on protecting worldwide customers from Asia-Pacific adversaries. Our expertise includes:

1. **Insights into APAC Attack TTPs**: TeamT5 offers comprehensive insights into APAC attack tactics, techniques, and procedures, providing organizations with a deep understanding of evolving APAC threats.

2. **Visibility of Asia-Pacific APT Adversaries**: In-depth research on Asia-Pacific APTs (Advanced Persistent Threats) adversaries and their campaigns is a core competency of TeamT5. This information enables customers to perform effective threat mitigation.

3. **Technical Analysis of Crucial Vulnerabilities**: TeamT5's technical analysis includes exploitation scenarios and impact assessments. This equips security teams with actionable intelligence to fortify their defenses and respond effectively to threats.

## Enhancing Security Operations with ThreatQ
ThreatQuotient's ThreatQ platform has been a game-changer for security operations, offering:

**1. Integration of Disparate Security Technologies**: ThreatQ seamlessly integrates various security technologies into a single, unified infrastructure. This integration enhances collaboration and automates actions and workflows, making security operations more efficient, especially with TeamT5’s ThreatVision intelligence.

**2. Continuous Prioritization**: Security teams benefit from continuous prioritization based on their organization's risk profile. This capability enables them to focus resources on the most pertinent threats, reducing response times and improving security posture.

**3. Comprehensive Intelligence Utilization**: TeamT5's threat intelligence, accessible through ThreatQ, enriches the user experience with various formats such as reports, malicious actors, programs, samples, and connections. This wealth of information empowers security teams to make well-informed decisions.

## Enhancing Security Operations with ThreatQ
ThreatQuotient's ThreatQ platform has been a game-changer for security operations, offering:

**1. Integration of Disparate Security Technologies**: ThreatQ seamlessly integrates various security technologies into a single, unified infrastructure. This integration enhances collaboration and automates actions and workflows, making security operations more efficient, especially with TeamT5’s ThreatVision intelligence.

**2. Continuous Prioritization**: Security teams benefit from continuous prioritization based on their organization's risk profile. This capability enables them to focus resources on the most pertinent threats, reducing response times and improving security posture.

**3. Comprehensive Intelligence Utilization**: TeamT5's threat intelligence, accessible through ThreatQ, enriches the user experience with various formats such as reports, malicious actors, programs, samples, and connections. This wealth of information empowers security teams to make well-informed decisions.

## Use Cases Supported by the Integration
The integration between TeamT5's ThreatVision and ThreatQ supports a range of use cases.

1. ** APT IOCs**: Users can leverage APT IOCs to prevent attacks and broaden their defense strategies. This capability facilitates rapid threat assessment and aids in proactive threat mitigation.

2. **Flash Reports**: These reports provide quick summaries and technical analyses of individual APT incidents, enabling rapid reporting and informed security deployments.

3. **Vulnerability Reports**: These reports include technical analysis, exploitation scenarios, and impact assessments, which equip security teams with actionable intelligence to strengthen their defenses. 

## In Summary
The integration of TeamT5's ThreatVision with ThreatQuotient's ThreatQ platform brings an unprecedented level of threat intelligence, focusing on the Asia-Pacific region, into the hands of security professionals. By providing insights into evolving threats, actionable intelligence, and seamless integration of security technologies, this collaboration enhances the overall ThreatQ experience and empowers security teams to proactively protect their organizations. 

![how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg](https://uploads.teamt5.org/upload/original/how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg)

 

To learn more about TeamT5's integration with ThreatQuotient's ThreatQ platform and the latest updates, visit [ThreatVision's page on the ThreatQ Marketplace](https://marketplace.threatq.com/details/teamt5-threatvision-cdf). Stay ahead of the evolving threat landscape and bolster your organization's security with this powerful integration.

How TeamT5’s ThreatVision Enriches the ThreatQ Experience

Vulnerabilities refer to weaknesses in information systems and information equipment that may be exploited by attackers, causing unexpected behavior in the execution of system programs. If a high-risk vulnerability is exploited, if the vulnerability is maliciously exploited, the enterprise organization may suffer losses, such as: important data being stolen and daily operations stopped.

*keywords: vulnerability research, vulnerability analysis, system vulnerability, CVE

 
 

>TeamT5 specializes in cyber threat research and provides an endpoint detection and response (EDR) solution - ThreatSonar, which effectively detects and prevents enterprise system vulnerabilities from being abused by malicious parties and encountering cybersecurity attacks.
 
 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. 
 
 
>For vulnerability research and endpoint protection inquiries, please contact us at [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)


 
 
*Banner source: Pexels

What is Vulnerability? What is the Classification of Vulnerabilities?

資安漏洞(vulnerability)指的是資訊系統、資訊設備中，可能被攻擊者利用的弱點，使系統程式的執行過程出現非預期行為。若高危險漏洞遭受利用，，可能使企業組織蒙受損失，如: 重要資料遭竊取、無法正常營運。

 
 

*本篇關鍵字: 漏洞、資安漏洞、系統漏洞、漏洞分級、CVE

 
 

>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案 - ThreatSonar，有效偵測，避免企業系統漏洞遭到有心人士濫用、遭遇資安攻擊。
 
 
>團隊具備超過10年的惡意程式與進階持續性威脅(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
 
 
>若您有資安防護的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 
 
*首圖來源: Pexels

什麼是資安漏洞? 資安漏洞有分級嗎?

TeamT5 released mitigation and response guidelines to two vulnerabilities in Zyxel ZyWall USG 20/50, the firewall service. Both vulnerabilities were exploited in the wild and detected by the TeamT5 vulnerability research team. We temporarily tracked the two vulnerabilities as T5-VUL-11705 and T5-VUL-12195. **The threat actors can compromise the Zyxel ZyWall USG with T5-VUL-11705 and T5-VUL-12195. Our investigation suggests that the threat actors exploited the compromised Zyxel Zywall USG devices as botnet.**

For more detail, users of [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) can check our Vulnerability Insights Report (aka VIR), VIR 2023 September H1: T5-VUL-11705. VIR provides technical detail about critical and highly exploitable vulnerabilities. Users can use VIR to mitigate the threat posed by these critical and highly exploitable vulnerabilities.

## Executive Summary
T5-VUL-11705 is a server-side request forgery (SSRF) vulnerability that allows threat actors to bypass authentication and steal credential. T5-VUL-12195 is an authenticated command injection vulnerability. When combined the use of T5-VUL-11705 and T5-VUL-12195, the threat actors can use unauthenticated users to achieve remote code execution (RCE).

We assess the severity level of T5-VUL-11705 and T5-VUL-12195 as critical and urge our customers to use this report to mitigate the effects. Zyxel ZyWall USG is a firewall service with VPN functionality. Public research suggests that over 20,000 devices are vulnerable to both vulnerabilities, including over 1,500 devices in Taiwan. Furthermore, both vulnerabilities were fully weaponized. Chinese threat actors have exploited both vulnerabilities, targeting entities in Taiwan and deploying the compromised devices as botnets since July 2023. We detailed the information in **Exploitation Status**.

Based on the current exploitation status of T5-VUL-11705 and T5-VUL-12195, we have depicted the **Possible Attack Scenario** in this report. Moreover, we identified that the threat actors have deployed botnet malware, which we dubbed EmergeBot, after exploiting the vulnerabilities in Zyxel ZyWall. We concluded the malware introduction and IoCs in **Appendix II: Malware Table** and **Appendix III: Indicators of Compromise (IoC)**. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation Advisory includes:

Official Patch Information
- Threat Hunting Tools, including:
- A Vulnerability Scanner
 - Two Snort Rules
 - The first rule will detect potential attack attempts of T5-VUL-11705.
 - The second rule will detect potential connection of EmergeBot.

## Exploitation Status
The vulnerabilities have affected a board version of Zyxel ZyWall USG models.

- Public research suggests that over 20,000 Zyxel ZyWall USG devices worldwide are affected, including over 1,500 devices in Taiwan.
- Since July 2023, Chinese threat actors have exploited the vulnerabilities in the Zyxel ZyWall USG-20/50 series targeting entities in Taiwan.
- According to our analysis, the threat actors deployed at least two malware, Microsocks and EmergeBot, for botnet attacks.

## Patch Status
The latest version [1] of the Zyxel ZyWall USG 20/50 series has patched T5-VUL-11705, while the latest version of model USG20 and USG50 are still vulnerable to T5-VUL-12195. Moreover, the USG 20 series are already End-of-Life (EOL) products: Zyxel will not provide updates for the product line in the future. [2]

|| USG20 (3.30 BDS)| USG50 (3.30 BDQ) | USG60 (V4.73(AAKY.2)C0) |
|:---: |:---: | :---: | :---: |
|T5-VUL-11705|Patched|Patched|Patched|
|T5-VUL-12195|Vulnerable|Vulnerable|Patched|

## Mitigation and Response Advisory

### 1. Official Patch Information

To mitigate the impact of the vulnerabilities, we highly recommend our customers follow the instructions below:
- Upgrade your Zyxel USG 20/50 series to latest versions.
 - Download the Patch at https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released
- Restrict the WEB administration interface of your ZyXel USG devices to trusted source IP and domain only.

### 2. Threat Hunting Tools

We have prepared a vulnerability scanner and two SNORT rule for our customer. Contact us for the tools if you have subscribed to our ThreatVision.

##### Vulnerability Scanner
Zyxel ZyWall USG has different models and product lines with different patch status. We have prepare a vulnerability scanner for our customers to check if your Zyxel ZyWall USG device is vulenrabile to T5-VUL-11705. 

##### SNORT Rules
As the vulnerabilities have been actively exploited by the threat actors, TeamT5 prepared two SNORT rules for our customers to detect the attack attempts. 

Zyxel ZyWall USG is a relatively close platform, making it difficult for Incident Response. Deploy the following two SNORT rules to detect if your Zyxel ZyWall USG devices were under potential attack attempts. 
- The first rule will detect potential attack attempts exploiting T5-VUL-11705. 
- The second rule will detect potential connection to EmergeBot. 

## Possible Attack Scenario

Chinese threat actors have actively exploited the vulnerabilities in attacks against entities in Taiwan since July 2023, even though the two vulnerabilities (T5-VUL-11705 and T5-VUL-12195) have not been disclosed publicly. The threat actors deployed malware to the targeted devices and exploited the compromised ZyXel USG devices as botnet.

Specifically, we identified two types of malware in the attack: the open-source hacking tool Microsocks and a newly discovered RAT, EmergeBot. 

-	The Microsocks [3] is an open-source and lightweight SOCKS5 proxy tool that can be ported on IoT devices in MIPS or ARM architecture. Once exploited by T5-VUL-11705 and T5-VUL-12195, the launcher [4] will execute the Microsocks on ZyXel USG devices. The Microsocks we found in the attack is designed for the MIPS architecture.
-	The EmergeBot [5] is a RAT we first identified in the July 2023 attack. EmergeBot is designed for the MIPS architecture and will only be executed when the first 15-byte in the payload is consistent with ` 3rg3c-27s9-hrl0`. We dubbed the RAT EmergeBot based on its feature to build botnet.

Notably, we also found that the actors disabled the firewall via CLI command: `no firewall activate`. We recommend our customer check your Zyxel firewall policy and restore the original firewall policy if it was modified. Additionally, we also found that plain text administrator credentials of Zyxel firewalls were leaked though T5-VUL-11705. We recommend our customer change the administator passwords of Zyxel firewalls.

## Appendix I: More about T5-VUL-11705 and T5-VUL-12195

_Below table is an excerpt of another upcoming new series, **Patch Management Report (PMR)**_. _Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information._

### T5-VUL-11705 and T5-VUL-12195

|CVE|Vendor|CVSS|Description|Threat Level|Date|Patch|Reference|
|---|---|---|---|---|---|---|---|
|T5-VUL-11705| <details><summary>ZyXel</summary>ZyWALL USG Series </details>| <details><summary>9.8</summary>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG series have SSRF (Server-side request forgery) vulnerability that allows threat actors to bypass authenticaton and leak credential.|HIGH| 2023-07-31 2023-09-18 | <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|
|T5-VUL-12195| <details><summary>ZyXel</summary>Zywall USG Series </details>| <details><summary>7.2</summary>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG Series Authenticated Command Injection Vulnerability|HIGH|2023-07-31 2023-09-18| <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/ZyWALL-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|

## Appendix II: Malware Table

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Microsocks</td>
 <td>Hacking Tool</td>
 <td>Microsocks is an open-source SOCKS5 proxy tools, and it is lightweight to port on IoT devices in MIPS and ARM architecture, and it has been ported to ZyXel firewall massively in Taiwan by Chinese actors since July 2023.</td>
 <td>Open-source</td>
 <td>2023.07</td>
 </tr>
 <tr>
 <td>EmergeBot</td>
 <td>RAT</td>
 <td>EmergeBot has been deployed by a Chinese actor on IoT devices such as firewall, WIFI router, etc, and it has been exploited to build botnet in Taiwan since July 2023. </td>
 <td>Unknown</td>
 <td>2023.07</td>
 </tr>
</table>
 
## Appendix III: Indicators of Compromise (IoC)

**SHA-256**
 
```
3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79
4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061
9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358
```



##### Note
1. [https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released](https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released)

2. [https://www.zyxelguard.com/ZyXEL-EOL.asp](https://www.zyxelguard.com/ZyXEL-EOL.asp)

3. SHA-256: 4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061

4. SHA-256: 9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358 

5. SHA-256: 3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79


 
 
*Banner source: pixabay

Alerts of Exploiting Zyxel ZyWall USG 20/50 (T5-VUL-11705 & T5-VUL-12195)

>本篇文章中，TeamT5 杜浦數位安全針對 Zyxel ZyWall USG 20/50 防火牆服務的兩個漏洞，釋出緩解與回應指南。這兩個漏洞已被開採、流傳，並被 TeamT5 漏洞研究團隊偵測到。我們現以編號「T5-VUL-11705」、「T5-VUL-12195」稱之，並進行追蹤。**經我們的調查，威脅行動者可利用「T5-VUL-11705」、「T5-VUL-12195」入侵 Zyxel ZyWall，且濫用該設備為殭屍網路（botnet）。**

 

>若為 TeamT5 威脅情資平台 – [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 的用戶，現可閱讀漏洞情資報告（Vulnerability Insights Report）之「VIR 2023 September H1: T5-VUL-11705」，該報告提供詳細說明，協助使用者減輕這些關鍵且高度可利用的漏洞所造成的威脅。**本文則摘錄前述報告的基本說明與緩解方式，初步協助使用者應對漏洞威脅。**

## Executive Summary
T5-VUL-11705 is a server-side request forgery (SSRF) vulnerability that allows threat actors to bypass authentication and steal credential. T5-VUL-12195 is an authenticated command injection vulnerability. When combined the use of T5-VUL-11705 and T5-VUL-12195, the threat actors can use unauthenticated users to achieve remote code execution (RCE).

We assess the severity level of T5-VUL-11705 and T5-VUL-12195 as critical and urge our customers to use this report to mitigate the effects. Zyxel ZyWall USG is a firewall service with VPN functionality. Public research suggests that over 20,000 devices are vulnerable to both vulnerabilities, including over 1,500 devices in Taiwan. Furthermore, both vulnerabilities were fully weaponized. Chinese threat actors have exploited both vulnerabilities, targeting entities in Taiwan and deploying the compromised devices as botnets since July 2023. We detailed the information in **Exploitation Status**.

Based on the current exploitation status of T5-VUL-11705 and T5-VUL-12195, we have depicted the **Possible Attack Scenario** in this report. Moreover, we identified that the threat actors have deployed botnet malware, which we dubbed EmergeBot, after exploiting the vulnerabilities in Zyxel ZyWall. We concluded the malware introduction and IoCs in **Appendix II: Malware Table** and **Appendix III: Indicators of Compromise (IoC)**. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation Advisory includes:

Official Patch Information
- Threat Hunting Tools, including:
- A Vulnerability Scanner
 - Two Snort Rules
 - The first rule will detect potential attack attempts of T5-VUL-11705.
 - The second rule will detect potential connection of EmergeBot.

## Exploitation Status
The vulnerabilities have affected a board version of Zyxel ZyWall USG models.

- Public research suggests that over 20,000 Zyxel ZyWall USG devices worldwide are affected, including over 1,500 devices in Taiwan.
- Since July 2023, Chinese threat actors have exploited the vulnerabilities in the Zyxel ZyWall USG-20/50 series targeting entities in Taiwan.
- According to our analysis, the threat actors deployed at least two malware, Microsocks and EmergeBot, for botnet attacks.

## Patch Status
The latest version [1] of the Zyxel ZyWall USG 20/50 series has patched T5-VUL-11705, while the latest version of model USG20 and USG50 are still vulnerable to T5-VUL-12195. Moreover, the USG 20 series are already End-of-Life (EOL) products: Zyxel will not provide updates for the product line in the future. [2]

|| USG20 (3.30 BDS)| USG50 (3.30 BDQ) | USG60 (V4.73(AAKY.2)C0) |
|:---: |:---: | :---: | :---: |
|T5-VUL-11705|Patched|Patched|Patched|
|T5-VUL-12195|Vulnerable|Vulnerable|Patched|

## Mitigation and Response Advisory

### 1. Official Patch Information

To mitigate the impact of the vulnerabilities, we highly recommend our customers follow the instructions below:
- Upgrade your Zyxel USG 20/50 series to latest versions.
 - Download the Patch at https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released
- Restrict the WEB administration interface of your ZyXel USG devices to trusted source IP and domain only.

### 2. Threat Hunting Tools

We have prepared a vulnerability scanner and two SNORT rule for our customer. Contact us for the tools if you have subscribed to our ThreatVision.

##### Vulnerability Scanner
Zyxel ZyWall USG has different models and product lines with different patch status. We have prepare a vulnerability scanner for our customers to check if your Zyxel ZyWall USG device is vulenrabile to T5-VUL-11705. 

##### SNORT Rules
As the vulnerabilities have been actively exploited by the threat actors, TeamT5 prepared two SNORT rules for our customers to detect the attack attempts. 

Zyxel ZyWall USG is a relatively close platform, making it difficult for Incident Response. Deploy the following two SNORT rules to detect if your Zyxel ZyWall USG devices were under potential attack attempts. 
- The first rule will detect potential attack attempts exploiting T5-VUL-11705. 
- The second rule will detect potential connection to EmergeBot. 

## Possible Attack Scenario

Chinese threat actors have actively exploited the vulnerabilities in attacks against entities in Taiwan since July 2023, even though the two vulnerabilities (T5-VUL-11705 and T5-VUL-12195) have not been disclosed publicly. The threat actors deployed malware to the targeted devices and exploited the compromised ZyXel USG devices as botnet.

Specifically, we identified two types of malware in the attack: the open-source hacking tool Microsocks and a newly discovered RAT, EmergeBot. 

-	The Microsocks [3] is an open-source and lightweight SOCKS5 proxy tool that can be ported on IoT devices in MIPS or ARM architecture. Once exploited by T5-VUL-11705 and T5-VUL-12195, the launcher [4] will execute the Microsocks on ZyXel USG devices. The Microsocks we found in the attack is designed for the MIPS architecture.
-	The EmergeBot [5] is a RAT we first identified in the July 2023 attack. EmergeBot is designed for the MIPS architecture and will only be executed when the first 15-byte in the payload is consistent with ` 3rg3c-27s9-hrl0`. We dubbed the RAT EmergeBot based on its feature to build botnet.

Notably, we also found that the actors disabled the firewall via CLI command: `no firewall activate`. We recommend our customer check your Zyxel firewall policy and restore the original firewall policy if it was modified. Additionally, we also found that plain text administrator credentials of Zyxel firewalls were leaked though T5-VUL-11705. We recommend our customer change the administator passwords of Zyxel firewalls.

## Appendix I: More about T5-VUL-11705 and T5-VUL-12195

_Below table is an excerpt of another upcoming new series, **Patch Management Report (PMR)**_. _Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information._

### T5-VUL-11705 and T5-VUL-12195

|CVE|Vendor|CVSS|Description|Threat Level|Date|Patch|Reference|
|---|---|---|---|---|---|---|---|
|T5-VUL-11705| <details><summary>ZyXel</summary>ZyWALL USG Series </details>| <details><summary>9.8</summary>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG series have SSRF (Server-side request forgery) vulnerability that allows threat actors to bypass authenticaton and leak credential.|HIGH| 2023-07-31 2023-09-18 | <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|
|T5-VUL-12195| <details><summary>ZyXel</summary>Zywall USG Series </details>| <details><summary>7.2</summary>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG Series Authenticated Command Injection Vulnerability|HIGH|2023-07-31 2023-09-18| <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/ZyWALL-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|

## Appendix II: Malware Table

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Microsocks</td>
 <td>Hacking Tool</td>
 <td>Microsocks is an open-source SOCKS5 proxy tools, and it is lightweight to port on IoT devices in MIPS and ARM architecture, and it has been ported to ZyXel firewall massively in Taiwan by Chinese actors since July 2023.</td>
 <td>Open-source</td>
 <td>2023.07</td>
 </tr>
 <tr>
 <td>EmergeBot</td>
 <td>RAT</td>
 <td>EmergeBot has been deployed by a Chinese actor on IoT devices such as firewall, WIFI router, etc, and it has been exploited to build botnet in Taiwan since July 2023. </td>
 <td>Unknown</td>
 <td>2023.07</td>
 </tr>
</table>
 
## Appendix III: Indicators of Compromise (IoC)

**SHA-256**
 
```
3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79
4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061
9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358
```



##### Note
1. [https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released](https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released)

2. [https://www.zyxelguard.com/ZyXEL-EOL.asp](https://www.zyxelguard.com/ZyXEL-EOL.asp)

3. SHA-256: 4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061

4. SHA-256: 9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358 

5. SHA-256: 3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79


 
 
*首圖來源: pixabay

【漏洞揭露】Zyxel ZyWall USG 20/50 防火牆服務(T5-VUL-11705 & T5-VUL-12195)

Technical Analysis

Vulnerability research is an analysis of the integrity of information systems and equipment to discover unexpected behaviors that may exist in equipment or services. For example, unauthorized access vulnerability can be entered without an account or password. This type of vulnerability can let hackers access the administrator interface.

Usually, vulnerability researchers will conduct black-box testing or white-box testing, combined with dynamic and static analysis techniques to reveal potential vulnerabilities. Finally, a vulnerability research report will be written to detail the complete research process and provide vulnerability exploits. Methods and repair suggestions.

*keywords: vulnerability research, vulnerability analysis, system vulnerability

 
 

>TeamT5 specializes in cyber threat research and provides an endpoint detection and response (EDR) solution - ThreatSonar, which effectively detects and prevents enterprise system vulnerabilities from being abused by malicious parties and encountering cybersecurity attacks.
 
 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. 
 
 
>For vulnerability research and endpoint protection inquiries, please contact us at [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)


 
 
*Banner source: Pexels

What is Vulnerability Research?

漏洞研究(vulnerability research)為針對資訊系統、設備進行完整性的分析，以發現可能尋存在於設備或服務中的非預期行為，例如，未經授權的訪問，不需帳號和密碼，即可進入管理者介面等安全漏洞。

通常，漏洞研究人員會透過黑箱測試或白箱測試來進行，並搭配動態和靜態分析技術，來揭示潛在的漏洞，最後，將撰寫漏洞研究報告，詳述完整的研究過程，並提供漏洞利用方式及修補建議。

 
 
*本篇關鍵字: 漏洞研究、漏洞分析、漏洞、資安漏洞、系統漏洞
 
 

>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案 - ThreatSonar，有效偵測，避免企業系統漏洞遭到有心人士濫用、遭遇資安攻擊。
 
 
>團隊具備超過10年的惡意程式與進階持續性威脅(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響；更經常受邀參加世界級資安會議、發表研究成果。
 
 
>若您有資安防護的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 
 
*首圖來源: Pexels

什麼是漏洞研究? 

It’s Cyber Security Awareness Month. 

As we enter the digital age, it's crucial to stay vigilant against cyber threats. And with the rise of remote work and increasing reliance on technology, the risk of cyber attacks has never been greater. 

So stay ahead of the game by learning the latest cyber threats - and take these 5 actionable steps to ensure your organization is protected. 

## 1.Invest in Security Framework
Implement a multi-layered security framework, including firewalls, antivirus software, encryption and regular updates.

## 2.Educate Your Employees
Ensure that your team understands the danger of cyber threats and the importance of good cyber hygiene. Conduct regular training sessions to keep them up-to-date.

## 3.Use Strong Passwords
The first line of defense against cyber attacks, it’s always important to use strong, unique passwords. Also, enable multi-factor authentication wherever possible.

## 4. Backup Your Data
Make sure you have a robust data backup and recovery plan. Regularly back up your data to protect against data loss in case of an attack or system failure.

## 5.Regularly Test Your Systems
Conduct regular vulnerability and penetration testing to identify and address any weaknesses in your security framework.


 
 
By following these tips, you can ensure your organization is well-protected against cyber threats.
Stay safe & secure!

Cybersecurity Awareness Month 2023: Take 5 Actions Today and Achieve Cybersecurity Resilience

>資安意識月 (Cybersecurity Awareness Month) 由美國國家網路安全聯盟 (NCA)、美國網路安全暨基礎設施安全局 (CISA) 發起，為每年10月舉辦，至今已邁入第20年，透過宣導活動，提升大眾的資安意識。

隨著數位時代，遠端工作的興起、對數位技術的日益依賴，使得網路攻擊的風險比以往都具破壞力，而對資安威脅保持警惕，更顯重要

我們建議企業組織了解最新的資安威脅，並採取下列 5 個步驟，確保所屬的企業組織受到保護。

## 1.部署多層次資訊安全機制
導入、部署多層次的資訊安全防禦機制，包括防火牆、防病毒軟體、加密和定期更新。

## 2.企業員工接受教育訓練
確保企業組織的員工了解網路威脅的危險及良好網路使用原則的重要性。企業組織也應定期舉辦培訓課程，讓員工了解最新資安守則。

## 3.使用高強度密碼
作為抵禦網路攻擊的第一道防線，使用高強度而獨特的密碼十分重要。 此外，盡可能啟用多重身份驗證(multi-factor authentication)。

## 4. 備份資料
確保企業組織有可行、有效的資料備份和恢復計劃，也應定期備份資料，以防止企業組織在遭受攻擊或系統故障時，損失資料。

## 5.定期測試系統
定期進行漏洞和滲透測試，以偵測、處理安全框架與部署中的任何弱點。


 
 
依據以上步驟進行資安超前部署，您可以確保您的企業組織受到良好的保護，免受網路威脅，達到資安韌性!

2023 資安意識月: 5步驟保護企業數位資產、為資安韌性打底

## Executive Summary
A critical vulnerability in WinRAR's ZIP file processing has been discovered, enabling attackers to distribute malware, with a focus on the cryptocurrency industry. Users are urged to update to WinRAR version 6.23, as numerous weaponized PoCs have emerged.

## CVE-2023-38831 Details
Threat actors can exploit CVE-2023-38831 with a crafted RAR file to deploy malware to the targets’ devices. Such RAR files are created with spoofing extensions, disguising as standard file formats such as .txt and .jpg to lure the target into execution. User interaction is required to exploit the vulnerability, but as users believe they are opening a standard file, user action is easy to prompt, resulting in a wide range of tactics attackers can implement.

WinRar is a highly popular piece of software, having been on the market for 28 years and available in over 50 languages. WinRar claims to have [over 500 million users worldwide](https://www.win-rar.com/start.html?&L=0#:~:text=With%20over%20500%20million%20users,efficient%20and%20secure%20file%20transfer.), and since WinRar does not update automatically, the impact of this vulnerability is very severe.

Till now, CVE-2023-38831 has primarily been used to target the cryptocurrency industry, and a large number of weaponized PoCs have been released making use of the vulnerability.

## Protection
### Patching
The vulnerability has been resolved in the latest version of WinRAR 6.23. TeamT5 strongly recommends that all WinRar users update to the latest version to protect their systems. For more information, please refer to the [official WinRAR announcement](https://www.win-rar.com/singlenewsview.html?&L=0).

### Detection
We are pleased to report that [ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website), TeamT5’s endpoint detection and response solution can already detect this vulnerability. ThreatSonar Anti-Ransomware users are already equipped to identify and mitigate this threat and need not worry.

![cve-2023-38831-winrar-vulnerability_pic.jpg](https://uploads.teamt5.org/upload/original/cve-2023-38831-winrar-vulnerability_pic.jpg)

### Intelligence
For those interested in a detailed analysis, TeamT5’s intelligence platform, ThreatVision will soon release a comprehensive Vulnerability Insights Report (VIR) on CVE-2023-38831. This report will provide in-depth information and insights to help you understand the nature of this vulnerability and how to best protect your systems. Data regarding the CVE-2023-38831 vulnerability can also be found on 2023-Aug-2’s Patch Management Report(PMR). 

Learn more about [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)!


【TeamT5 Flash Alert】CVE-2023-38831 WinRAR Vulnerability

## 重點摘要

攻擊者利用 WinRAR 在處理 ZIP 格式文件時的重大漏洞，傳播惡意程式，針對加密貨幣業攻擊。此概念用於實際攻擊的概念驗證（POC）已被大量發布，我們強烈建議使用者更新到 WinRAR 版本 6.23。

## CVE-2023-38831 具體細節 
攻擊者可以藉由精心設計的 RAR 文件來利用 CVE-2023-38831，將惡意程式部署到目標設備。此類 RAR 文件的副檔名偽裝成標準文件格式（例如 .txt 和 .jpg），以誘使目標執行。要利用此漏洞，需藉由使用者的互動。當使用者相信自己開啟的是一般檔案時，就很容易執行指令，結果導致攻擊者能執行多種攻擊戰術。

WinRar 是一款非常普遍的軟體，已上市 28 年，[在全球擁有超過 5 億位使用者](https://www.win-rar.com/start.html?&L=0#:~:text=With%20over%20500%20million%20users,efficient%20and%20secure%20file%20transfer.)，提供 50 多種語言版本。但由於 WinRar 不會自動更新，該漏洞的影響會非常嚴重。

到目前為止，CVE-2023-38831 主要被利用在針對加密貨幣業的攻擊，此概念用於實際攻擊的概念驗證（POC）已被大量發布。

## 防禦方式
### 修補
該漏洞已在最新版本的 WinRAR 6.23 中解決。我們強烈建議您更新 WinRAR 到最新版本，以保護您的系統。更多相關訊息，可以參考 [WinRAR 官方公告](https://www.win-rar.com/singlenewsview.html?&L=0)。

### 偵測
TeamT5 的端點威脅鑑識分析與回應平台 [ThreatSonar Anti-Ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website) 已可檢測到此漏洞攻擊行為。ThreatSonar Anti-Ransomware 的使用者只要啟用 Defense 模組，即可持續受到保護，無須擔心此威脅。

![cve-2023-38831-winrar-vulnerability_pic.jpg](https://uploads.teamt5.org/upload/original/cve-2023-38831-winrar-vulnerability_pic.jpg)
<center>圖 1：顯示 ThreatSonar Anti-Ransomware 檢測到 CVE-2023-38831 漏洞畫面。</center>


### 情資

想進一步了解詳細分析，TeamT5 的 ThreatVision 威脅情資平台將很快在全方位漏洞情資暨應對緩解雙週報（Vulnerability Insights Report，VIR）中，發布有關 CVE-2023-38831 的資訊。該報告將提供深入的資訊和洞察，幫助您了解此漏洞特性以及如何最好地保護您的系統。

CVE-2023-38831 漏洞的相關資料，也分享在 2023/8/2 的漏洞修補管理雙週報（Patch Management Report，PMR）中。

了解更多 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 資訊!

【資安即時快訊】CVE-2023-38831 WinRAR 漏洞通報

Security Alerts

ThreatVisionはサイバーセキュリティ態勢を強化し、中国、北朝鮮、韓国、パキスタン、ベトナム、インド等、APAC諸国の主な敵対国に対する防御態勢を改善しようと試みる 一連のAPAC諸国政府部門によって利用されています。

## ThreatVisionとは? 
 
ThreatVisionとは、 APAC(アジア太平洋地域)を中心としたサイバー脅威インテリジェンスの提供に特化した、包括的なインテリジェンスプラットフォームです。 APACにおける悪意のあるコード、APT（Advanced Persistent Threat）グループ、サイバー脅威の調査において10年以上の実績を持つThreatVisionは、組織に豊富なインテリジェンスリソースを提供しています。このプラットフォームは、戦略的、運用的、戦術的な脅威インテリジェンスを提供することで、意思決定者、リスクマネージャーやインシデント対応者など、サイバーセキュリティ環境内のさまざまな役割に対応しています。 Cレベルの経営幹部、リスクマネージャー、インシデント対応者が脅威ランドスケープを理解し、悪意のある攻撃者を特定およびサイバー脅威に対する効果的な防御を展開するのに役立ちます。 ThreatVisionのカスタマイズ可能なインテリジェンス調査とコンサルティングサービスは、ユーザーフレンドリーなインターフェースと精選されたレポートとともに、組織が情報に基づいた意思決定を行えるよう支援し、セキュリティリソースを効果的に割り当て、サイバーセキュリティの強化をお手伝いします。


## APAC諸国政府のインテリジェンス要件 
当社のAPAC諸国政府の顧客は通常、脅威インテリジェンス・プラットフォームを必要としていますが、データを自力でフィルタリングし、分析するための十分なリソースがありません。 攻撃者の活動を理解し、攻撃の背後に誰がいるのかを調査およびAPACで誰が攻撃されているかを把握する必要があります。このようなインテリジェンスがない場合、攻撃を受ける危険性が高くなります。 

## APAC諸国政府にとってのThreatVisionの利点 
これらのインテリジェンス要件を満たすために、APAC 諸国政府の顧客は、詳細なレポートと技術ツールを提供する ThreatVision を利用しています。 ThreatVisionを使用することで、敵の活動、戦術、技術、手順に関する貴重な洞察を得ることができ、プロアクティブな防御手段を強化し、進化するサイバー脅威の一歩先を行くことができます。パートナー企業への侵害指標リストの提供や、経営幹部への詳細なプレゼンテーションに加え、分析用サンプルの提出や、自社環境で発見された疑わしいサンプルのカスタム分析を注文することもできます。

## APAC諸国政府によるThreatVisionの利用方法
![how-threatvision-supports-apac-governments-threat-intelligence-jp_pic1.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-jp_pic1.png)

脅威の検出に関して、APAC諸国政府の顧客は通常、侵害を検出するためにThreatVisionの侵害指標リストと脅威ハンティングツールを使用しています。また、EDR/XDRを開始した後、ThreatVisionの脅威ランドスケープ、敵対者、マルウェア、サンプル管理機能を通じて脅威の調査を開始します。最終的にはマルウェアを検出し、脅威をより深く理解および敵対者のTTPを学習し、今後の攻撃を阻止することができます。

 

![how-threatvision-supports-apac-governments-threat-intelligence-jp_pic2.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-jp_pic2.png)

脅威インテリジェンスの観点から、顧客はThreatVisionの様々なレポートを読むことでインテリジェンスに関する知見を得ることができます。その後、調査結果を上層部に報告し、リスクを軽減するための予防措置を実行します。最終的な結果として、情報セキュリティポリシーが最適化され、予算の意思決定が容易になり、情報セキュリティ環境が強化されるとともに、
脅威ランドスケープについて非常に豊富な知見が得られます。


## ThreatVisionの利用について 
TeamT5の担当者にご連絡の上、14日間のThreatVisionトライアルアカウントをお申し込み頂くか、弊社製品を初めてご利用になるお客様で詳細をお知りになりたい場合は、 sales@teamt5.org まで電子メールをお送りください。 

お客様の組織をサイバー脅威から守るため、協力させていただきます。

- 使用事例: [ダウンロード](https://uploads.teamt5.org/upload/files/Successful_Story_How-ThreatVision-Supports-APAC-Governments-Threat-Intelligence_jp.pdf)

ThreatVisionによるAPAC諸国政府の脅威インテリジェンスのサポート

ThreatVision is utilized by a series of APAC government departments who are looking to enhance their cybersecurity posture and improve their defensive stance against key APAC adversaries including China, North Korea, South Korea, Pakistan, Vietnam and India.

## What is ThreatVision?
ThreatVision is a comprehensive intelligence platform that specializes in providing Asia-Pacific-centered cyber threat intelligence. With over a decade of experience in researching malicious code, APT (Advanced Persistent Threat) groups, and cyber threats in the Asia-Pacific region, ThreatVision offers a wealth of intelligence resources for organizations. The platform caters to different roles within the cybersecurity landscape, including decision-makers, risk managers, and incident responders, by offering strategic, operational, and tactical threat intelligence. It aids C-level executives, risk managers, and incident responders in understanding the threat landscape, identifying malicious actors, and deploying effective defenses against cyber threats. ThreatVision's customizable intelligence investigation and consulting services, along with its user-friendly interface and curated reports, empower organizations to make informed decisions, allocate security resources effectively, and enhance their cybersecurity.

## APAC Governments’ Intelligence Requirements
Our APAC government customers typically are in need of a threat intelligence platform, but they don’t have enough resources to filter and analyze data by themselves. They need to be able to understand adversaries’ activities, be able to study who is behind attacks, and know who is being attacked in the APAC region. Without this intelligence, they are at high risk of an attack.

## ThreatVision’s Benefits for APAC Governments’
To meet these intelligence requirements, our APAC government customers utilize ThreatVision, which provides detailed reports and technical tools. ThreatVision enables them to gain valuable insights into their adversaries' activities, tactics, techniques, and procedures, and strengthen their proactive defense measures, staying one step ahead of evolving cyber threats. In addition to being able to give indicators of compromise lists to partner entities, and give detailed presentations to executives, they are also able to submit samples for analysis and order customized analysis of suspicious samples found in their environment.

## How APAC Governments Use ThreatVision
![how-threatvision-supports-apac-governments-threat-intelligence-en_pic2.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-en_pic2.png)

In terms of threat detection, APAC government customers usually use ThreatVision’s indicators of compromise lists, and threat hunting tools to detect breaches. After initiating EDR/XDR, they also initiate research on the threat through ThreatVision’s threat landscape, adversaries, malware and sample management features. In the end they are able to detect malware, better understand the threat, learn their adversary’s TTPs, and thwart future attacks.

 

![how-threatvision-supports-apac-governments-threat-intelligence-en_pic1.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-en_pic1.png)

In terms of threat intelligence, these customers gain intelligence insights by reading ThreatVision’s many different reports. After that they report their findings to higher ups, and execute preventative measures to reduce their risk. The final result is that their infosec policies are optimized, their budget decision making is eased, their infosec environment strengthened, and they also gain highly rich insights into their threat landscape.


## Getting Started with ThreatVision
To get started, contact your TeamT5 representative and apply for a 14 day ThreatVision trial account, or email us at sales@teamt5.org if you are new to our products and wish to learn more. We look forward to working with you to keep your organization safe from cyber threats.


- Successful Story: [Download](https://uploads.teamt5.org/upload/files/Successful_Story_How-ThreatVision-Supports-APAC-Governments-Threat-Intelligence_en.pdf)

How ThreatVision Supports APAC Governments’ Threat Intelligence

許多亞太地區政府部門採用 ThreatVision，希望藉其增強網路安全態勢，並改善對亞太地區主要攻擊者如中國、北韓、南韓、巴基斯坦、越南和印度等地的防禦。

## 什麼是 ThreatVision?
憑藉針對亞太地區惡意程式、APT（進階持續性威脅）族群和網路威脅的十多年研究經驗，ThreatVision威脅情資平台專為組織，提供以亞太地區為中心的豐富網路威脅情資。平台透過提供戰略、營運和戰術威脅情資，來滿足網路安全領域的不同角色，包括決策者、風險管理者和事件應變人員，協助 C 層級高階經理人、風險經理和事件處理人員了解威脅形勢、識別惡意行為者並部署有效的網路威脅防禦。ThreatVision 提供可客製情資調查與諮詢服務，以及其易於使用的介面和精選報告，協助組織能做出明智的決策，有效地分配資安資源，並增強網路安全。

## 亞太地區政府的情資需求
一般來說，我們的亞太地區政府客戶需要威脅情資平台，但他們沒有足夠的資源來自行過濾和分析數據。他們期望能夠了解對手的活動、研究誰是攻擊背後的攻擊者，並知道誰在亞太地區受到攻擊。如果沒有這類情資，就會面臨很高的被攻擊風險。

## ThreatVision對亞太地區政府的效益
ThreatVision 所提供詳細的報告和技術工具，可滿足亞太地區政府客戶的情資需求。ThreatVision 能讓亞太地區政府深入了解對手的活動、戰術、技術和程序，並加強主動防禦措施，面對不斷變化的網路威脅保持領先。除了為合作夥伴提供威脅入侵指標（IoC）、為管理階層提供詳細簡報外，能夠進行樣本分析，以及客製化分析環境中發現的可疑樣本。

## 亞太地區政府如何使用 ThreatVision
![how-threatvision-supports-apac-governments-threat-intelligence-tw_pic1.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-tw_pic1.png)

在威脅偵測方面，亞太地區政府客戶通常使用 ThreatVision 的威脅入侵指標（IoC）和威脅狩獵工具來偵測入侵。在啟動 EDR / XDR 後，透過 ThreatVision 提供的威脅態勢、攻擊者族群、惡意程式和樣本管理功能，啟動威脅研究。最終達成能夠偵測惡意程式、更了解威脅與攻擊者的 TTPs，並阻絕未來的攻擊。

 

![how-threatvision-supports-apac-governments-threat-intelligence-tw_pic2.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-tw_pic2.png)


在威脅情報方面，客戶可從 ThreatVision 的許多不同報告中獲得情資洞見。協助他們隨後向上級報告調查結果，並採取預防措施，以降低風險。最終達到資安政策優化、預算決策變得更加輕鬆、強化資安環境，並且獲得高豐富的威脅形勢洞察。

## 如何開始使用 ThreatVision
請聯繫您的 TeamT5 代表並申請 14 天的 ThreatVision 試用帳戶。
若您希望了解此產品更多細節，請發送電子郵件至 sales@teamt5.org。我們期待與您合作，確保您的組織免受網路威脅。

- 成功案例: [下載](https://uploads.teamt5.org/upload/files/Successful_Story_How-ThreatVision-Supports-APAC-Governments-Threat-Intelligence_tw.pdf)

ThreatVision 如何協助亞太地區政府應用威脅情資

ThreatVision Resources

In the rapidly evolving digital landscape of the Asia-Pacific region, the need for localized cyber threat intelligence is paramount. While Europe and America have well-established cyber threat intelligence infrastructures, the Asia-Pacific region lags behind, with limited local resources. Enter TeamT5, a beacon of expertise in the Asia-Pacific cyber threat intelligence domain.

## The Asia-Pacific Edge
The Asia-Pacific region is a hotbed of geopolitical dynamics. Yet, there's a scarcity of intelligence firms that truly specialize in this region. TeamT5 stands out with its Asia-Pacific-centered intelligence professional team. With over a decade of dedication to researching Asia-Pacific cyber threat intelligence, our team's proficiency in the Chinese language, combined with their in-depth understanding of APT hacker groups in the region, especially those originating from China, places us in a unique position. Our extensive knowledge of attack details and techniques has made us a sought-after participant in world-class conferences like Code Blue, AVTokyo, Troopers, Hack In The Box, and FIRST.

## The Imperative of Threat Intelligence

Threat intelligence is not just a buzzword; it's a necessity. From decision-makers to risk managers and incident responders, everyone in the corporate information security team faces unique challenges. To address these challenges, intelligence information can be categorized into:

1. **Strategic Threat Intelligence**: Tailored for C-level executives, it offers insights into trends, the organization's threat landscape, and potential malicious actors.

2. **Operational Threat Intelligence**: Essential for SOC leaders and analysts, it delves into hacker techniques and proactive threat prevention.

3. **Tactical Threat Intelligence**: Vital for rapid incident response teams, it provides precise threat indicators for swift assessment and mitigation.

## ThreatVision: The Ultimate Solution
So, where does ThreatVision fit into this landscape? Unlike many platforms that merely redistribute open-source intelligence, ThreatVision stands out by researching and analyzing intelligence in-house. This ensures that the intelligence provided is not only up-to-date but also more accurate. The clear presentation of data makes it accessible even for non-technical users, bridging the gap between complex cybersecurity threats and business decision-makers.

ThreatVision offers:

- **A Rich Library**: From Indicators of Compromise (IOCs) for swift threat identification to Threat Hunting Tools for direct detection, and Intelligence Reports for a multi-dimensional analysis of hacker behavior.

- **Customized Services**: Request For Information(RFI) Service offers tailored reports and customized analysis.

- **Integration Capabilities**: With its API Service, ThreatVision facilitates automation and enhances threat response efficiency.

For C-level executives, Risk Managers, and event responders, ThreatVision provides tailored solutions. From CTI reports that consolidate event motives to comprehensive technical information for proactive risk mitigation and an API for rapid integration of situational information, ThreatVision ensures that every cybersecurity team member is equipped with the right tools and intelligence.

## Summary
In an era where both human resources and technology are limited, the right intelligence can make or break an organization's cybersecurity strategy. ThreatVision, with its comprehensive offerings and in-house research, ensures that businesses are not just reactive but proactive in their defense strategies. By understanding the behavior and objectives of attackers, organizations can craft effective security policies, enhancing overall response efficiency. With [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website), you're not just securing your organization; you're future-proofing it.


Why ThreatVision - Threat Intelligence Platform Empowering Organizations to Make Informed Decisions

CVE-2023-2868: Barracuda Email Security Gateway Vulnerability

CVE-2023-2868: Barracuda 電子郵件安全閘道漏洞

Threat Intelligence

In today's digital landscape, cybersecurity has become one of the most critical concerns for governments and companies worldwide. With the rise of sophisticated cyber threats, such as Advanced Persistent Threats (APTs), organizations need robust and specialized tools to combat these evolving dangers effectively. This is where TeamT5's ThreatVision comes in, offering unparalleled expertise and intelligence to help governments and enterprises in the Asia-Pacific.

 

## The Power of TeamT5 and ThreatVision
TeamT5, renowned for its Asia-Pacific-centered intelligence professional team, has been at the forefront of researching cyber threat intelligence in the region for over a decade. Our Chinese language proficiency and geopolitical knowledge, coupled with ten years of experience in malicious code and APT research, have granted us a deep understanding and research capabilities of APT hacker groups, particularly those originating from China. Our expertise has earned us invitations to world-class conferences, further solidifying our reputation as the top choice for Asia-Pacific APT intelligence, especially for those looking to defend against China.

## The Importance of Threat Intelligence
Threat intelligence plays a pivotal role in a company's cybersecurity strategy. It serves three key roles: assisting decision-makers, enabling risk managers, and supporting incident responders. TeamT5 recognizes the significance of each type of intelligence, including:

### Strategic Threat Intelligence
Vital for C-level executives responsible for decision-making, strategic threat intelligence provides insights into an organization's threat landscape, identifies malicious actors targeting the organization, and sheds light on their objectives.

### Operational Threat Intelligence
Crucial for SOC leaders and analysts, operational threat intelligence focuses on understanding hacker techniques and actively preventing potential threats.

### Tactical Threat Intelligence
Essential for rapid incident response teams, tactical threat intelligence provides precise threat indicators to assess the current situation and take appropriate measures to mitigate the impact and resolve the situation at hand.

 

## What Does ThreatVision Offer?
ThreatVision offers a comprehensive library of threat intelligence features to cater to various cybersecurity team members, enhancing internal collaboration and response efficiency.

- **Indicators of Compromise (IOCs)**: IOCs provide rapid threat identification and serve as essential clues for tracing attack sources within an enterprise.
- **Threat Hunting Tools**: These tools offer direct detection capabilities to quickly understand the current environment and identify potential issues.
- **Intelligence Reports**: TeamT5's most renowned resource, intelligence reports offer multi-dimensional analysis of hacker behavior, providing a deeper understanding of incidents and the motives behind hackers' actions.
- **Adversary and Malware Gallery**: Contains a comprehensive library of first-hand files on malicious groups and programs, enabling organizations to understand threat sources.
- **RFI Service**: Analysts provide customized reports and tool services to customers.
- **API Service**: Allows for quick integration of platform resources to facilitate automation.

 

##Meeting Customer Needs with Actionable Intel
ThreatVision addresses various customer needs through its diverse offerings:

### Threat Identification and Technical Details
ThreatVision quickly identifies malware and adversaries and provides technical details, backgrounds, and attack methods commonly used by them. It serves as a one-stop intelligence platform for enterprise security teams, helping them allocate security budgets more effectively.

### Auto-Analysis Sandbox Service
This service offers fast automated analysis, allowing users to choose specific samples for further manual analysis by TeamT5's expert analysts.

### Customized Intelligence Investigation and Consulting Services
TeamT5 offers tailored services to meet intelligence investigation and consulting requirements.

### Threat Hunting Tools and API Integration
ThreatVision's Threat Hunting Tools enable users to proactively confirm their own situation and ensure environmental security. The API service provides convenient access to intelligence, reducing the burden on personnel and facilitating integration into automated processes.

 

## Actionable Intelligence Through Reports
ThreatVision's intelligence reports fall under three categories: APT in Asia, Vulnerability, and Cyber Affairs. These reports provide invaluable insights for decision-making and response.

 
![pic_how-threat-vision-helps-fight-against-apts-through-cyber-threat-intelligence.jpg](https://uploads.teamt5.org/upload/original/pic_how-threat-vision-helps-fight-against-apts-through-cyber-threat-intelligence.jpg)
 

### APT in Asia Flash Reports
TeamT5’s APT in Asia Flash (aka Flash Report) provides timely, accurate, and actionable intelligence. Users can use Flash Reports to get just-in-time alerts of the latest APT intrusions. Flash Reports are published twice a week. Each Flash Report details a specific targeted attack and provides all essential IOCs.

### APT Campaign Tracking Reports
APT Campaign Tracking Report (aka CTR) provides TeamT5’s comprehensive understanding of significant threat groups and campaigns. Users can use CTR to enhance their knowledge of trends and challenges in the APAC region with a broader perspective. TeamT5 publishes two CTRs at the end of every quarter. Each CTR provides an in-depth analysis on a particular threat group/campaign, covering its TTPs, target scope, etc., over the past 2-3 years. Moreover, at the end of Q2 and Q4, CTRs provide an APT Threat Landscape report covering major incidents, popular TTPs, most targeted industries, and top malwares/APTs over the past two quarters.

### APT in Asia Monthly Reports
TeamT5’s APT in Asia Monthly (aka Monthly Report) provides strategic and actionable intelligence in the Asia Pacific region. Monthly Reports connect the dots between cyberattacks and recent political events, policies, and foreign affairs. Users can use Monthly Reports to understand the latest trends and the current threat landscape. Monthly Reports are published every month. Each Monthly Report summarizes 13-16 APT attack cases in the Asia Pacific region over the past month.

### Cyber Affairs Biweekly Reports
TeamT5’s Cyber Affairs Biweekly Report (aka Biweekly Report) provides strategic cyber intelligence about the Chinese-speaking cyber world. Users of the Biweekly Report can understand the cyber capabilities of the emerging superpower, China. The Biweekly Report is published every two weeks. Each Biweekly Report provides a quick recap of cybersecurity news in the Chinese-speaking cyber world, covering the latest policies, regulations, and cyber incidents.

### Vulnerability Insights Reports
TeamT5’s Vulnerability Insights Report (aka VIR) provides technical details about critical and highly exploitable vulnerabilities. Users can use VIRs to mitigate the threat posed by these critical and highly exploitable vulnerabilities. VIR is published every two weeks. Each VIR focuses on one critical and highly exploitable vulnerability. Moreover, VIRs depict the possible attacking scenarios and provide detection tools.

### Patch Management Reports
TeamT5’s Patch Management Report (aka PMR) provides all the relevant information on all critical and highly exploitable vulnerabilities. Users can use PMRs to prioritize their patch management. PMRs are updated every two weeks. Each PMR summarizes around 100 of the most critical vulnerabilities during the period in a table, and lists all the essential information about these vulnerabilities, such as the affected products, patching details, and even publicly available PoC codes.

 

## Summary
ThreatVision, developed by TeamT5, is a game-changer in the fight against Advanced Persistent Threats. With our unparalleled expertise in the Asia-Pacific region, ThreatVision provides actionable threat intelligence that empowers governments and companies to make informed decisions, proactively manage risks, and swiftly respond to cyber incidents. As the cyber threat landscape continues to evolve, ThreatVision stands ready to protect organizations and secure the digital world against APTs. 

To get started, contact your TeamT5 representative and apply for a 14 day ThreatVision trial account, or email us at sales@teamt5.org if you are new to our products and wish to learn more. We look forward to keeping your organization safe.

How ThreatVision Helps Fight Against APTs Through Cyber Threat Intelligence

脅威インテリジェンスは情報セキュリティ防御の基礎であると主張し、アクション指向のローカル インテリジェンスの提供に重点を置いています。 クライアントが攻撃を予測し、事前に防御戦略を展開し、損失のリスクを軽減するのを支援します。

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/xbK3-oQVaJs?si=EP1DqSbNQuBSkffK" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

ThreatVision は、リアルタイム警告、技術データ、OSINT 分析、精密 APT 調査を提供する、顧客参加型の脅威情報のプラットホームです。当社のプラットフォームは、作戦行動から戦略計画まで、脅威情報を適用するための多段階のアプローチを用意しており、既知のサイバー脅威や潜在的なサイバー脅威を正確に判断することができます。

インテリジェンスがサイバー防御を推進: ThreatVision

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance.

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/KB_U_oJIi2Q?si=e_VvRIP7W9vp86eW" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

ThreatVision is TeamT5's customer-engaged threat intelligence platform that provides early warnings, technical data, OSINT analysis, and in-depth APT investigation. Our platform possesses multi-level approaches to apply intelligence, from operational actions to strategic planning, which allows implementing precise measures to occurred or hidden threat.

Intelligence-Driven Cyber Defense: ThreatVision

TeamT5 威脅情資團隊創立於台灣，深耕亞太區域，具備逾20年的威脅情資研究資歷、逾1,000件資安事件應變與處理經驗，提供來自亞太區域、與臺灣企業最切身相關的深度威脅情資。

ThreatVision 威脅情資平台適用於需要資安風險預測與預防之企業，及希望優化資安決策、透過入侵指標快速應變的企業。

了解更多: [https://teamt5.org/tw/products/threatvision/](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/1kaL4WqOG38" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

情資驅動資安防禦: ThreatVision 威脅情資平台

NIST 資安框架由美國國家標準與技術研究所提出，透過有系統、有架構的標準，協助企業檢視自身資安防禦的不足，並針對特定項目進行補強。基本介紹可參考[此文](https://teamt5.org/tw/posts/what-is-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website)。

本文依據 NIST 資安框架的5大框架核心，提供檢查企業資安防禦狀況的訣竅，希望協助企業增強資安防禦力，達成高度資安韌性目標。

##Identify 辨識
首先需列出企業資訊資產清單，釐清哪些是重要資訊資產，需要保護；也需列出軟體清單，以便掌握哪些軟體可能存在漏洞，需參考原廠資訊、進行更新。

企業也應建立資料管理政策、系統特權帳號管理清單等，掌握內部資安全貌。其他可以進行的具體事項還包含：遵循321原則，進行資料備份；準備外部服務合作對象 (資安團隊、法務團隊、公關團隊)、採購資安險、進行教育訓練、進行資安演習。


##Protect 保護
企業宜堵住攻擊者入侵的管道，在所有可能攻擊途徑加上防護，進行完整權限控，並採取最低權限原則。

具體措施包含：
 
 
**設定層次：**
- 網段規劃政策與落實
- 安全設定政策與持續維護與確認: 系統帳號、防火牆、對外服務

**帳號層次：**
- 帳號安全政策與持續確認
- 帳號管理、密碼規範、權限申請與停用、特權帳號規範與管理
- 外部可存取帳號政策與管理: MFA、最低權限

**漏洞管理層次：**
- 漏洞管理與更新流程、權責，和確保機制

**防禦層次：**
- 針對各種入侵管道建立防禦措施: IPS, WAF, EPP 等
- 確保防禦機制的更新
- 入侵管道限制與管理: 例如停用隨身碟


##Detect 偵測
建議企業完整收集紀錄 (log)，部署可疑流量或行為監控機制，並主動找尋任何可疑流量、行為。

針對資安解決方案發出的告警(alert)，也應區別出重要的告警，並從中了解攻擊態勢，才能部署適當的資源，進行資安應變。

##Respond 應變
框架核心「應變」之目標為極小化損失、快速解決狀況、找到入侵原因。

上述步驟若能有按步驟實施，有助降低企業損失，因此企業平時即應制定事件應變計畫，具體列出遭遇資安事件時，團隊成員該如何應對，才能避免資安事件實際發生時，未能妥善應對處理。

具體可執行的措施包含：
 
**控制層次**
- 確認損害、影響範圍，控制狀況，降低損失

**紀錄層次**
- 保留證據，確保各種系統 log 收集機制、集中與備份

**調查層次**
- 追查入侵原因與損害評估

**聯繫層次**
- 對內對外聯繫、回報窗口與權責、協調、對內外說明
- 外部團隊協助、報案
- 尋求法務、公關、保險公司協助

**團隊層次**
- 尋求資安事件應變團隊協助 ( 詳細可參考[本文](https://teamt5.org/tw/posts/how-to-collaborate-with-incident-response-team/?utm_source=blog&utm_medium=website) )

**政策層次**
- 資安事件應變(incident response)流程
- 標準化通報流程
- 法規遵循

##Recovery 復原
框架核心「復原」的目標為資料備份與復原機制，企業應按標準流程進行系統復原、服務復原，因此事先制定災害復原計畫(disaster recovery plan)、營運持續計畫(business continuity plan)，並執行演習，十分關鍵。

此外，若是遭勒索軟體(ransomware)攻擊，攻擊者要求為資料支付贖金，企業也須規劃談判、贖金付款準備。( 防患於未然，防禦勒索軟體攻擊的詳細作法可參考[此文](https://teamt5.org/tw/posts/how-enterprise-can-do-to-protect-from-ransomware-attack/?utm_source=blog&utm_medium=website) )

 
關鍵字: NIST 網路資安框架、NIST CSF
 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

如何依據 NIST 資安框架，檢查企業資安防禦狀況?

The NIST Cybersecurity Framework is proposed by the U.S. National Institute of Standards and Technology. Through systematic and structured standards, it helps companies examine the deficiencies of their own cybersecurity defenses and make enhancements for specific projects. For a basic introduction, please refer to [this article](https://teamt5.org/en/posts/what-is-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website).

Based on the five areas of the NIST Cybersecurity Framework, this article provides tips for checking the status of enterprise cybersecurity defenses, aiming to help enterprises & organizations enhance their cybersecurity defense capabilities and achieve high-level cybersecurity resilience goals.

## Identify
First, you need to make a list of corporate digital assets to clarify which are important digital assets and need to be protected. You also need to make a list of software to understand which software may have vulnerabilities. You need to refer to the original manufacturer information and update it.

Enterprises should also establish data management policies, system privileged account management lists, etc., to understand the internal cybersecurity situation. Other specific matters that can be carried out include: following the 321 principle and backing up data; preparing external service partners (cybersecurity team, legal team, public relations team), purchasing cybersecurity insurance, conducting education and training, and conducting cybersecurity drills.


## Protect
Enterprises should block the channels for attackers to invade, add protection to all possible attack channels, conduct complete permission control, and adopt the principle of least privilege.

Specific measures include:

 
**Setting:**
- Network segment planning policies and implementation
- Security setting policy and ongoing maintenance and confirmation: system accounts, firewalls, external services

 
**Account:**
- Account Security Policy and Continuous Verification
- Account management, password specifications, permission application and deactivation, privileged account specifications and management
- Externally accessible account policy and management: MFA, least privilege

 
**Vulnerability management:**
- Vulnerability management and update process, rights and responsibilities, and assurance mechanism

 
**Defense:**
- Establish defense measures against various intrusion channels: IPS, WAF, EPP, etc.
- Ensure defense mechanisms are updated
- Intrusion pipeline restriction and management: for example: disabling flash drives

## Detect
It is recommended that enterprises collect complete records (logs), deploy suspicious traffic or behavior monitoring mechanisms, and proactively look for any suspicious traffic or behavior.

Regarding the alerts issued by the cybersecurity solution, important alarms should also be distinguished, and the attack situation should be understood from them, so that appropriate resources can be deployed for the cybersecurity response.

## Respond
The goal of "response" is to minimize losses, quickly resolve situations, and find the cause of the intrusion.

If the above steps can be implemented in a step-by-step manner, it will help reduce corporate losses. Therefore, companies should formulate incident contingency plans at ordinary times, specifically listing how team members should respond when encountering a security incident, so as to avoid the actual occurrence of security incidents. Failure to respond appropriately.

Specific executable measures include:
 
 
**Control hierarchy**
- Confirm the damage and scope of impact, control the situation, and reduce losses

 
**Record **
- Retain evidence and ensure various system log collection mechanisms, centralization and backup

 
**Investigation**
- Tracing the cause of the intrusion and assessing the damage

 
**Contact**
- Internal and external contact, reporting window and rights and responsibilities, coordination, internal and external explanations
- External team assistance and reporting
- Seek assistance from legal affairs, public relations, and insurance companies

 
**Team**
- Seek assistance from the security incident response team (please refer to this article for details)

 
**Policy**
- Cybersecurity incident response (incident response) process
- Standardized notification process
- Compliance

## Recovery 
The goal of "recovery" at the core of the framework is the data backup and recovery mechanism. Enterprises should do system recovery and service recovery according to standard procedures. And it’s crucial for enterprises to formulate a disaster recovery plan and business continuity plan in advance, and execute drills.

 

In addition, if you are attacked by ransomware and the attacker demands a ransom for your data, companies must also plan for negotiations and prepare for ransom payments. 

 
 

>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
 
>Contact us and start cyber defense plan: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

How to check the status of enterprise cybersecurity defense according to the NIST Cybersecurity Framework?

## What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework is proposed by the U.S. National Institute of Standards and Technology. Through a systematic and complete framework of standards, it helps enterprises examine the deficiencies of their own security defenses and strengthen them for specific projects.

The NIST Cybersecurity Framework consists of three aspects, including Framework Core, Implementation Tiers, and Framework Profiles, so that members from various departments of the enterprise can discuss cybersecurity defense measures based on the same set of documents.

## What are the Core Concepts of the NIST Cybersecurity Framework?

This article specifically explains the core of the NIST Cybersecurity Framework, which is divided into 5 aspects, including:

**1. Identify**

Enterprises should understand the scope of cybersecurity defense and understand the cybersecurity threats they may encounter.


**2. Protect**

Enterprises should control authority and establish basic cybersecurity defenses.


**3. Detect**

Enterprises should comprehensively monitor the information technology environment and the operating status of endpoint devices to detect suspicious software behavior in a timely manner and also keep complete records. Tools available include endpoint detection strain solutions.


**4. Respond**

If an enterprise detects suspicious software behavior, it should respond quickly and investigate thoroughly to avoid operating losses.


**5. Recovery **

If suspicious software behavior causes actual damage to the system, data leakage, etc., you should seek cybersecurity experts to handle and restore the system. A review record of the recovery process will also be made to avoid similar data security damage incidents in the future.

 
 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan. 
>
> Contact us and start cyber defence plan: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

What is the NIST Cybersecurity Framework? What are the Core Concepts?

##什麼是 NIST 資安框架?

NIST 資安框架全稱為 NIST Cybersecurity Framework，是由美國國家標準與技術研究所提出，透過系統性、完整架構的標準，協助企業檢視自身資安防禦的不足，並針對特定項目進行補強。

 資安框架由3種元素組成，包含框架核心(Framework Core)、框架層級(Implementation Tiers)、框架輪廓(Profiles)，以利企業各部門成員可基於同一套文件，詳細討論資安防禦的措施。

##NIST 資安框架的核心是什麼?

![what-is-nist-cybersecurity-framework_pic.jpg](https://uploads.teamt5.org/upload/original/what-is-nist-cybersecurity-framework_pic.jpg)

本文特別說明 NIST 資安框架的核心，其分為5個項目，包含：
 
 
**1. Identify 辨識**
 
企業應了解資安防禦面涵括的範圍，了解可能遭遇的資安威脅。

**2. Protect 保護**
 
企業應做好權限控管，建立基本資安防禦。

**3. Detect 偵測**
 
企業應全面監控資訊環境、端點設備的營運狀況，以便及時測知軟體可疑行為，同時也進行完整紀錄。可採用的工具如端點偵測應變解決方案。

**4. Respond 應變**
 
若企業偵查到可疑軟體行為，宜快速應變，詳盡調查，避免造成營運損失。

**5. Recover 復原**
 
倘若可疑軟體行為造成系統實際損害、資料外洩等問題，應尋找資安專家處理，進行復原。也將復原過程做成檢討紀錄，避免未來遭遇類似資安損害事件。

 
關鍵字: NIST 網路資安框架、NIST CSF
 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

什麼是 NIST 資安框架? 核心概念是什麼?

TeamT5 は、包括的なサイバー脅威インテリジェンスを提供します。 私たちは、企業がインテリジェンスを活用してサイバー攻撃を防御できるよう支援することを目指しています。


フォームにご記入いただくと、日本向けにカスタマイズされたインテリジェンス レポートをお受け取りいただけます。

![resource-japan-threat-intelligence-reports_pic1.jpg](https://uploads.teamt5.org/upload/original/resource-japan-threat-intelligence-reports_pic1.jpg)


【リソース】TeamT5 が特定したG7関連のAPT攻撃 + TeamT5 の攻撃者分析 レポート

セキュリティは、情報、資産、システム、ネットワーク、および人々を不正なアクセスや危害から保護することを含む重要な概念です。 組織のセキュリティを確保するには、悪意のある攻撃や悪用の恐れなく、すべての従業員が安全に作業できる安全な環境を構築することが含まれます。


組織はサイバー攻撃だけでなく、盗難や破壊行為などの物理的な脅威からも身を守る必要があります。 サイバーセキュリティは、ハッカーによる機密データの盗難や漏洩を防ぐため、今日のデジタル世界では特に重要です。

## 組織を保護するためのツールと実践方法
セキュリティに関しては、組織の安全を確保するために役立つツールや実践方法が数多くあります。 組織には、ファイアウォール、ウイルス対策ソフトウェア、VPNなどの技術的ソリューションから、アクセス制御システムや監視カメラなどの物理的なセキュリティ対策まで、資産を保護するためのさまざまなツールがあります。 組織を保護するために使用できるベストプラクティスをいくつか見てみましょう。

### 1.オンプレミスのセキュリティ
オンプレミスセキュリティとは、組織の物理インフラストラクチャ内にインストールおよび運用されるセキュリティツールとプラクティスを使用することを指します。 このセキュリティへのアプローチにより、組織にセキュリティ対策の制御と監視を強化し、組織固有のニーズに合わせて対策を調整する力を提供します。

組織がオンプレミス環境を保護するために使用できるツールの一部を次に示します。
- ファイアウォールは、送受信されるネットワークトラフィックを監視し、組織のネットワークへの不正アクセスをブロックするセキュリティツールです。 これらはハードウェアベースまたはソフトウェアベースであり、特定の種類のトラフィックをブロックしたり、信頼できる送信元からのトラフィックのみを許可したりするように構成できます。
侵入検知および防御システム（IDPS）は、ネットワークトラフィックを監視して、脆弱性を悪用しようとする試みや異常なトラフィックパターンなど、悪意のある活動の兆候がないか確認します。 IDPSは、特定の送信元からのトラフィックをブロックするなど、攻撃を防ぐためのアクションを実行するように構成することもできます。
- アクセス制御は、機密情報やリソースへのアクセスを許可されたユーザーのみに制限するセキュリティ対策です。 オンプレミスのアクセス制御には、パスワードポリシー、2要素認証、ロールベースのアクセス制御などの対策を含めることができます。
- パッチ管理ツールは、組織がネットワーク上のすべてのデバイスにパッチを特定して展開するプロセスを自動化するのに役立ちます。 最新のセキュリティパッチを適用してソフトウェアを最新の状態に保つことは、あらゆるセキュリティ戦略にとって不可欠です。

オンプレミス セキュリティのトピックへの追加点として、一部の企業 (当社のような) は、高レベルのセキュリティとデータの制御を必要とする組織の特定のニーズを満たすために、オンプレミス セキュリティ ソリューションを提供しています。 オンプレミスモードでは、組織はすべてのデータを独自のサーバーに保持しながら、ファイアウォール、侵入検知システム、マルウェア対策ソフトウェアなどのセキュリティ対策を完全に制御できます。 これは、厳格なデータセキュリティ要件と規制が遵守されている軍事部隊や銀行などの組織にとって特に重要です。

## 2.認証と承認のプロセス
認証プロセスは、組織のデジタル資産を保護し、不正アクセスを防止するために不可欠なツールです。 認証はユーザーまたはデバイスの身元を確認するプロセスであり、承認はユーザーまたはデバイスがシステム内で実行できるアクションを決定するプロセスです。 次のようないくつかの認証方法を使用できます。

- パスワードベースの認証は、最も一般的に使用される認証方法であり、ユーザーはシステムにアクセスするためにユーザー名とパスワードを入力する必要があります。 セキュリティを強化するには、強力なパスワードを推奨し、パスワードの有効期限や2要素認証などのポリシーを実装することが不可欠です。

- 生体認証は、指紋、顔認識、音声認識などのユーザー固有の身体的特徴を使用して身元を認証します。

- 多要素認証では、ユーザーは、パスワードと、モバイルデバイスによって生成されたワンタイムコード、または指紋とスマートカードなど、2つ以上の認証形式を提供する必要があります。

ユーザーが認証されると、承認プロセスが開始され、システム内でユーザーが実行できるアクションが決定されます。 承認は、役割、権限、または場所、時刻、デバイスの種類などの属性に基づいて行うことができます。


アクセス制御リスト（ACL）およびロールベースのアクセス制御（RBAC）を実装すると、機密データやリソースへのアクセスを必要な権限を持つユーザーのみに制限することで、承認プロセスの管理に役立ちます。

### 3. APTとランサムウェア防御

APT（Advanced Persistent Th特定）とランサムウェア攻撃は、今日の組織が直面している最も一般的で壊滅的なタイプのサイバー攻撃の2つです。 APT は、長期間にわたって機密データへの不正アクセスを取得することを目的とした、高度に標的を絞った攻撃です。一方、ランサムウェア攻撃には、データの暗号化と、復号化キーと引き換えに支払いの要求が伴います。 APTやランサムウェアから防御するには、予防策と対応策を含む包括的なセキュリティ戦略を採用する必要があります。

- セキュリティ情報とイベント管理（SIEM）ツールは、組織がネットワークを監視し、APTまたはランサムウェア攻撃を示す可能性のある異常なアクティビティを検出するのに役立ちます。 これらのツールは、組織がインシデントを調査し、セキュリティ問題の根本原因を特定するのにも役立ちます。
- エンドポイントの検出と対応（EDR）ソリューションは、従来のウイルス対策ソフトウェアを回避する可能性のある高度な脅威を検出し、対応するように設計されています。 これらのソリューションは、組織がエンドポイントでAPTとランサムウェアを検出し、発生した損害を封じ込めて修復するのに役立ちます。
- 重要なデータの定期的なデータバックアップは、暗号化されたデータを以前の暗号化されていない状態に復元することで、組織がランサムウェア攻撃から回復するのに役立ちます。 組織は、攻撃が発生した場合にバックアップが侵害されるのを防ぐために、安全なオフサイトの場所にバックアップを保存する必要があります。
- インシデント対応計画：組織は、APTまたはランサムウェア攻撃が発生した場合に取るべき手順を概説した包括的なインシデント対応計画を作成する必要があります。 この計画には、影響を受けるシステムの隔離、利害関係者への通知、法執行機関やその他の第三者の専門家との連携の手順を含める必要があります。

当社のサービスはAIと複数のルールに基づいており、クライアントがサイバー攻撃、特にAPTやランサムウェアと戦うのを支援します。 当社と協力することで、お客様の特定のニーズに合わせた包括的なセキュリティを実装するThreatSonarアンチランサムウェア対策ソリューションの恩恵を受けることができます。

### 4.従業員のトレーニングと意識向上
技術的なツールとソリューションは組織の安全を確保するために不可欠ですが、従業員のトレーニングと意識への投資も重要です。 多くのサイバー攻撃は人為的ミスや過失の結果であるため、従業員は組織のセキュリティチェーンの中で最も弱い部分になることが
あります。

フィッシングメール、ソーシャルエンジニアリング詐欺、パスワード攻撃などの一般的なセキュリティ脅威を認識して回避できるように従業員をトレーニングすることは、攻撃の成功を防ぐのに大いに役立ちます。 さらに、従業員にサイバーセキュリティの最新トレンドを知らせ、セキュリティ意識の文化を醸成することで、従業員がセキュリティを真剣に受け止め、不審なアクティビティを組織の IT チームまたはセキュリティ チームに報告するよう促すことができます。

また、サイバーセキュリティ担当者を継続的にトレーニングして、最新の脅威に備えることも重要です。 たとえば、サイバー レンジ トレーニングでは、IT および OT/ICS 攻撃のシミュレーション、実際のセキュリティ ツール、詳細な指標と分析を使用してセキュリティ オペレーション センターとインシデント対応チームが次の攻撃に備える事を確実にするために行われます。

模擬フィッシング演習やその他の形態のサイバーセキュリティトレーニングを含む定期的なセキュリティ意識向上トレーニングは、従業員が最新のセキュリティ脅威とベストプラクティスについて最新の情報を入手できるようにするのに役立ちます。

## 結論
安全な環境を確保することは、組織の成功にとって非常に重要です。 信頼の向上、法的責任の軽減、効率の向上、評判の向上などのメリットが得られるため、価値ある投資となります。

サイバー脅威が進化し、より高度になるにつれて、組織の保護を支援するために、私たちのような信頼できるパートナー、TeamT5を持つことが重要です。 当社の専門アナリストとThreatSonar アンチランサムウェアテクノロジーにより、お客様のビジネスの安全性は、安心して任せて頂けます。

 
 
※この記事はサイバーニュースとの連携によるものです。
 
※画像提供：Pexels

組織のセキュリティを確保する：ベストツールとプラクティス

Security is an important concept that encompasses the protection of information, assets, systems, networks, and people from unauthorized access or harm. Securing an organization involves creating a secure environment in which all personnel can safely conduct their work without fear of malicious attack or exploitation.

Organizations need to protect themselves against cyber-attacks as well as physical threats such as theft or vandalism. Cybersecurity is especially important in today's digital world, as it can prevent hackers from stealing or compromising sensitive data. 

## Tools and Practices to Secure Your Organization 
When it comes to security, there are many tools and practices that can help organizations stay safe. Organizations have various tools to protect their assets, from technical solutions such as firewalls, anti-virus software, and [VPNs](https://cybernews.com/best-vpn/vpn-for-mac/) to physical security measures like access control systems and surveillance cameras. 
Let's look at some of the best practices you can use to secure your organization.


###1. On-Premise Security
On-premise security refers to using security tools and practices installed and operated within an organization's physical infrastructure. This approach to security provides organizations with more control and oversight over their security measures and the ability to tailor those measures to their organization's specific needs. 

Here are some of the tools that organizations can use to secure their on-premises environments:

- **Firewalls** are security tools that monitor incoming and outgoing network traffic and block unauthorized access to an organization's network. They can be hardware-based or software-based and can be configured to block specific types of traffic or to allow traffic from trusted sources only.
- **Intrusion detection and prevention systems (IDPS)** monitor network traffic for signs of malicious activity, such as attempts to exploit vulnerabilities or unusual traffic patterns. An IDPS can also be configured to take action to prevent attacks, such as blocking traffic from a particular source.
- **Access controls** are security measures that limit access to sensitive information or resources to authorized users only. On-premise access controls can include measures such as password policies, two-factor authentication, and role-based access controls.
- **Patch management tools** can help organizations automate the process of identifying and deploying patches to all devices on their network. Keeping software up-to-date with the latest security patches is essential to any security strategy. 

As an additional point to the topic of on-premise security, some companies (like [ours](https://teamt5.org/en/about-us/?utm_source=blogs&utm_medium=website)) offer on-premise security solutions to meet the specific needs of organizations that require high levels of security and control over their data.
Their on-premise mode allows organizations to have complete control over their security measures, including firewalls, intrusion detection systems, and anti-malware software, while keeping all data on their own servers. This is particularly important for organizations such as military units and banks, which have strict data security requirements and regulations to adhere to.

###2. Authentication and Authorization Processes 
Authorization processes are essential tools to secure an organization's digital assets and prevent unauthorized access. Authentication is the process of verifying the identity of a user or device, while authorization is the process of determining what actions a user or device is allowed to perform within the system.
There are several authentication methods available, including:
- **Password-based authentication** is the most commonly used authentication method, where users are required to enter a username and password to access the system. It’s essential to encourage strong passwords and implement policies such as password expiration and two-factor authentication to enhance security.
- **Biometric authentication** uses unique physical characteristics of the user, such as fingerprints, facial recognition, or voice recognition, to authenticate their identity.
- **Multi-factor authentication** requires users to provide two or more forms of authentication, such as a password and a one-time code generated by a mobile device or a fingerprint and a smart card.

Once a user is authenticated, authorization processes come into play to determine what actions they are allowed to perform within the system. Authorization can be based on roles, permissions, or attributes such as location, time of day, and device type.

Implementing access control lists (ACLs) and role-based access control (RBAC) can help manage authorization processes by restricting access to sensitive data and resources to only users with the necessary permissions.

### 3. APT and Ransomware Defense
APTs (Advanced Persistent Threats) and ransomware attacks are two of the most common and devastating types of cyberattacks that organizations face today. APTs are highly targeted and sophisticated attacks designed to gain unauthorized access to sensitive data over an extended period, while ransomware attacks involve the encryption of data and a demand for payment in exchange for the decryption key.
To defend against APTs and ransomware, organizations must adopt a comprehensive security strategy that includes preventative and responsive measures. 

- **Security Information and Event Management (SIEM)** Tools can help organizations monitor their networks and detect unusual activity that may be indicative of an APT or ransomware attack. These tools can also help organizations investigate incidents and identify the root cause of any security issues.
- **Endpoint Detection and Response (EDR) Solutions** are designed to detect and respond to advanced threats that may evade traditional antivirus software. These solutions can help organizations detect APTs and ransomware at the endpoint, as well as contain and remediate any damage that has been done.
- **Regular Data Backups** of critical data can help organizations recover from a ransomware attack by restoring the encrypted data to a previous, unencrypted state. Organizations should store backups in a secure, off-site location to prevent them from being compromised in the event of an attack.
- **Incident Response Planning**: Organizations should develop a comprehensive incident response plan that outlines the steps to take in the event of an APT or ransomware attack. This plan should include procedures for isolating affected systems, notifying stakeholders, and engaging with law enforcement and other third-party experts.

Our services are based on AI and multiple rules to help clients fight against cyber attacks, especially APT and ransomware. By working with us, you can benefit from our [ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/) Solution, through which we implement comprehensive security tailored to your specific needs.

##4. Employee Training and Awareness
While technical tools and solutions are essential to securing an organization, investing in employee training and awareness is also important. Employees are often the weakest link in an organization's security chain, with many cyber-attacks being the result of human error or negligence.

Training employees to recognize and avoid common security threats such as phishing emails, social engineering scams, and password attacks can go a long way in preventing successful attacks. Additionally, informing employees about the latest cybersecurity trends and creating a culture of security awareness can encourage employees to take security seriously and report any suspicious activity to the organization's IT or security team. 

It’s also critical to continuously train cybersecurity practitioners so they are prepared for the latest threats. For example, [cyber range training](https://cybersecurityguide.org/resources/cyber-ranges/) prepares security operations center and incident response teams with simulated IT and OT/ICS attacks, real security tools, and detailed metrics and analysis to ensure they are ready for the next attack.

Regular security awareness training, including simulated phishing exercises and other forms of cybersecurity training, can help keep employees up-to-date on the latest security threats and best practices.

##Bottom Line
Having a secure environment is crucial for the success of any organization. The benefits of increased trust, reduced legal liability, improved efficiency, and enhanced reputation make it a worthwhile investment. 

As cyber threats continue to evolve and become more sophisticated, it's important to have a reliable partner like us – [TeamT5](https://teamt5.org/) – to help protect your organization. With our expert analysts and [ThreatSonar Anti-ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website) technology, you can rest assured that your business is in good hands. 
 
 
 
*The article is in collaboration with [Cybernews](https://cybernews.com/).
 
*Image courtesy: Pexels

Securing Your Organization: Best Tools And Practices

安全是一個重要的概念，包括保護資訊、資產、系統、網路和人員免受未經授權的訪問或傷害。 確保組織安全的關鍵在於創建一個安全的環境，使所有人員都可以安全地開展工作，而無需擔心惡意攻擊或手邊數位資產遭到濫用。

組織需要保護自己免受網路攻擊以及盜竊或破壞等物理威脅。 網路安全在當今的數位世界中尤其重要，因為它可以防止駭客竊取或洩露敏感數據。

## 確保組織安全的工具和實務做法

在安全方面，有許多工具和實務做法可以幫助組織達到安全營運的目標。 組織擁有各種工具來保護其資產，從防火牆、防毒軟體和 VPN 等技術解決方案，到權限控制系統、監控攝影機等物理安全措施。以下是可用於保護組織安全的實務做法、建議。

### 1. 地端安全
地端安全是指使用在組織的物理基礎設施內，所安裝、運行的安全工具和實務。 這種安全方法使組織能夠更好地控制和監督其安全措施，也可根據組織的特定需求，客製化這些措施。

- 防火牆(firewall)是一種安全軟體，用於監視傳入和傳出的網路流量並阻止對組織網路未經授權之訪問。 它們可以基於硬體或基於軟體，並且可以配置為阻止特定類型的流量或僅允許來自可信來源的流量。
- 入侵檢測和防禦系統 (intrusion detection and prevention systems) 監視網路流量是否存在惡意活動跡象，例如嘗試利用漏洞或異常流量模式。 IDPS 還可以配置特定措施，防止攻擊，例如阻止來自特定來源的流量。
- 權限控制(access control)是一種安全措施，僅允許授權用戶訪問敏感資訊或資源。 地端訪問控制可以包括密碼策略、雙因素身份驗證和基於角色的權限控制等措施。
- 補丁管理工具(patch management tool)可以幫助組織自動化識別補丁，並協助將其部署到網路上所有設備的過程。 讓軟體保持最新的安全補丁對於任何安全策略都是至關重要。

作為地端安全主題的另一個要點，一些公司（例如[我們公司](https://teamt5.org/tw/about-us/?utm_source=blogs&utm_medium=website)）提供端點安全解決方案，以滿足需要高安全性和資料控制的組織之特定需求。 它們的地端模式允許組織完全控制其安全措施，包括防火牆、入侵檢測系統和反惡意軟體，同時將所有資料保留在自己的服務器上。 這對於軍事單位和銀行等組織尤其重要，因為它們有嚴格的資料安全要求和法規遵循需求。

### 2. 認證和授權流程
授權流程是保護組織數位資產，並防止未經授權的訪問的重要工具。 身份驗證是驗證用戶或設備身份的過程，而授權是確定允許用戶或設備在系統內執行哪些操作的過程。 有多種身份驗證方法可用，包括：

- 基於密碼的身份驗證是最常用的身份驗證方法，用戶需要輸入用戶名和密碼才能訪問系統。 鼓勵使用強密碼並實施密碼過期和雙因素身份驗證等策略，來增強安全性，是十分重要的做法。
- 生物辨識身份驗證使用用戶獨特的身體特徵（例如指紋、面部辨識或語音辨識）來驗證其身份。
- 多重身份驗證要求用戶提供兩種或多種形式的身份驗證，例如密碼和移動設備生成的一次性代碼、指紋、智慧卡片。

一旦用戶通過身份驗證，授權過程就會開始發揮作用，以允許他們在系統內執行哪些操作。 授權可以基於角色、權限或屬性，例如位置、一天中的特定時段和設備類型。

實施權限控制列表 (implementing access control list) 和基於角色的權限控制 (role-based access control) 可以通過將對敏感資訊和資源的訪問限制為「僅具有必要權限」的用戶，以協助組織管理授權流程。

### 3. APT和勒索軟體防禦

APT（進階持續性威脅）和勒索軟體攻擊是組織當今面臨的兩種最常見、最具破壞性的網路攻擊類型。 APT 是具有高度針對性和複雜性的攻擊，旨在在較長時間內獲得對敏感資料之未經授權的訪問，而勒索軟體攻擊涉及數據加密和要求付款以換取解密密鑰。

為了防禦 APT 和勒索軟體，組織必須採用包括預防和回應措施等全面安全策略。

- 安全資訊和事件管理 (security information and event M\management , SIEM) 工具可以幫助組織監控其網路並檢測可能表明 APT 或勒索軟體攻擊的異常活動。這些工具還可以幫助組織調查事件，並確定任何安全問題的根本原因。
- 端點檢測和回應 (endpoint detection and response, EDR) 解決方案旨在檢測和回應可能逃避傳統防毒軟體的高階威脅。 這些解決方案可以幫助組織在端點檢測 APT 和勒索軟體，並遏制和修復已造成的任何損害。
- 關鍵數據進行定期備份，可以通過將被加密數據恢復到之前的未加密狀態，來幫助組織從勒索軟體攻擊中恢復。 組織應將備份存儲在安全的異地位置，以防止它們在發生攻擊時受到損害。
- 事件應變計劃：組織應制定全面的事件應變計劃，概述發生 APT 或勒索軟體攻擊時應採取的步驟。 該計劃應包括隔離受影響系統、通知利益相關者以及與執法部門和其他第三方專家合作的程序。

我們的服務基於人工智慧和多種規則，幫助客戶抵禦網路攻擊，特別是 APT 和勒索軟體。 通過與我們合作，您可以從我們的 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應解決方案中受益，通過該解決方案，我們可以根據您的特定需求，實施全面的安全保護。

### 4. 員工培訓和意識
雖然技術工具和解決方案對於保護組織至關重要，但對員工培訓和意識的投資也很重要。 員工往往是組織安全鏈中最薄弱的環節，許多網路攻擊是人為錯誤或疏忽造成。

培訓員工識別和避免常見的安全威脅（例如網路釣魚電子郵件、社會工程詐騙和密碼攻擊）可以大大有助於防止成功的攻擊。 此外，向員工通報最新的網路安全趨勢，並營造資訊安全意識文化可以鼓勵員工認真對待資訊安全，並向組織的 IT 或資安團隊報告任何可疑活動。

持續培訓資訊安全從業人員也很重要，以便他們為最新的威脅做好準備。 例如，數位攻防靶場培訓為安全運營中心（SOC）和事件應變團隊提供模擬 IT 和 OT/ICS 攻擊、真正的安全工具以及詳細的指標和分析，以確保他們為下一次攻擊做好準備。

定期的安全意識培訓，包括模擬網路釣魚練習和其他形式的網路安全培訓，可以幫助員工了解最新的安全威脅和最佳實踐。

## 總結
擁有安全的環境對於任何組織的成功都至關重要。 增加信任、減少法律責任、提高效率和提高聲譽的好處使其成為一項值得的投資。

隨著網路威脅不斷演變、複雜化，擁有像我們這樣可靠的合作夥伴 - TeamT5 杜浦數位安全 - 來幫助保護您的組織非常重要。 透過我們的專業威脅情資分析團隊和 [ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website) 解決方案，您可以放心，您的業務將得到妥善保護。



*本文與 [Cybernews](https://cybernews.com/) 合作。
*圖片提供：Pexels



保護您的組織：最佳工具和實務做法

IoC (侵害指標) の利用は効果的な企業のサイバーセキュリティオペレーションにとって重要です。サイバーセキュリティソリューションプロバイダーが長年に渡り蓄積した侵入の手がかりと広範な探索を通じて、IoCは企業が侵入を特定して防御することを可能にし、それにより損失を最小限に抑えることができます。

一般企業がIOCを利用する場合、IOCをさまざまなネットワーク機器やソフトウェアツールに取り込み、環境のあらゆる場所に監視を設定し、担当者がこれを検知し、遮断、隔離、削除などの対策を講じることができます。

一般的な脅威防御メカニズムに加えて、APT IoCはサイバー攻撃を防止し、企業が情報に基づいてサイバーセキュリティの決定を事前に行う事を可能にする上で重要な役割を果たします。

APT IoC は、サイバーセキュリティ アナリストとマルウェア研究者が実施した複雑なインシデント調査を通じて洗練された重要な指標を指します。 

各 IoC の出力は、特定の悪意のあるグループとその敵が採用した手法を表します。

 

**脅威インテリジェンス プラットフォームである ThreatVision の IoC を例に挙げると、IoC の背後には、次の 3 種類の豊富なデータがプラットフォームに組み込まれています。**

1. 悪意のあるグループのデータベース: 企業は、悪意のあるグループのデータを通じて、悪意のあるグループの背景と動機を理解し、特定のデジタル資産 (特定のサーバー、VM、データベースなど) に対する防御的な展開を事前に実行できます。
2. 悪意のあるプログラム データベース: 悪意のあるプログラム データベースは、企業の技術者が正しく効果的な防御ツールを選択し、適切に展開するのに役立つ、より多くの技術的な詳細を提供します。
3. 脅威インテリジェンス レポート: 
企業は、脅威インテリジェンス レポートを参照して、自社の状況がレポートの内容と一致しているかどうかを確認することができます。また企業はサイバー防御の展開により最新のサイバー脅威を確実に防御できるようになります。

 

**APT IoC の正しい使用プロセスには、次の手順が含まれている必要があります。**
1. 環境内のネットワーク機器および情報セキュリティ ソフトウェアに APT IoC を適切に導入します。 導入は、完全性と一貫性を確保するために自動ツールを使用して行うのが最適です。
2. アラートが発生した場合は、マルウェアのブロック、隔離、削除など、直ちに対処する必要があります。 タイムリーな行動により、被害とリスクを軽減できます。
3. 処理が完了したら、事件の詳細な調査が必要になります。 インテリジェンスプラットフォームを通じてIoCの発生源と原因を収集し、攻撃者の身元と目的を特定すると同時に、当該インシデントが自身と同質性の高い業界でどのように発生したのかを確認します。 これにより、企業はこの悪意のあるグループの攻撃手法と攻撃ツールをより深く理解し、対象を絞った防御を実行できるようになります。
4. 情報セキュリティツールの正しい選択と設定、より完全な企業情報セキュリティシステムの構築など、的を絞った防御措置を講じます。 これは、企業のセキュリティを強化し、重要なデータの機密性を保護するのに役立ちます。
5. 持続的標的型攻撃(APT攻撃)はターゲット企業の特定の脆弱性を突く攻撃をする特徴があります。したがって、企業は正しい防御措置を講じるために、攻撃者/悪意のあるグループをより包括的に理解する必要があります。

 

TeamT5は、アジア太平洋地域の攻撃者関する広範なデータベースを提供する強力な脅威インテリジェンスプラットフォームである[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blogs&utm_medium=website)を提供します。 

このプラットフォームは包括的且つ完全な詳細情報を含むナラティブ形式および段落形式で表示される脅威インテリジェンスレポートを提供するため、企業は脅威イベントを迅速に理解し、そうしたイベントの対処を通して貴重な経験を得ることができます。


ThreatVision脅威インテリジェンスプラットフォームは、APT IoCを含む広範なコンテンツをカバーしており、これはThreatVisionの膨大なアドバーサリ（攻撃者)、マルウェア、およびその他の脅威インテリジェンスレポートと関連付けることができ、企業がサイバーセキュリティの脅威を包括的に理解し高度な展開戦略を実装するのに役立ちます。 

敵を知り己を知れば百戦危うからず。
情報セキュリティの分野において、TeamT5 はあなたのベストパートナーです。

積極的な情報セキュリティ防御のために APT 侵入インジケーターを正しく使用するには?

The use of Indicators of Compromise (IoC) is critical for effective enterprise cybersecurity operations. With the help of cybersecurity solution providers' extensive search for intrusion clues, IoC enables enterprises to identify and block intrusions, thereby minimizing losses.

Enterprises utilize IoC import into various network devices and software tools to establish monitoring across their entire environment. When an IoC is detected by a device or software, it triggers an alarm, allowing cybersecurity personnel to detect and deal with the threat by blocking, isolating, and clearing it.

In addition to general threat defense mechanisms, APT IoCs play a crucial role in preventing cyber attacks and enabling enterprises to make informed cybersecurity decisions in advance. APT IoCs are key indicators refined through complex incident investigations conducted by cybersecurity analysts and malware researchers. The output of each IoC represents a specific adversary and the methods employed by the adversary, providing valuable intelligence to strengthen cybersecurity posture.

APT IoC refers to the key indicators refined through complex incident investigations conducted by cybersecurity analysts and malware researchers. The output of each IoC represents a specific adversary and intrusion methods. 

Take the IoC from ThreatVision(a powerful threat intelligence platform) as an example. Users can link IoC to three types of rich data built in the platform:
1. Adversary database: Through adversary data, enterprises can understand the background and motivation of adversaries, and carry out defensive deployments for specific digital assets (such as specific servers, VMs, or databases) in advance.

2. Malicious program database: The malicious program database can provide more technical details to help enterprise technicians choose correct and effective defense tools and deploy them properly.

3. Threat intelligence report: Enterprises can also refer to the threat intelligence reports to confirm whether their own situation matches the description in the report. Also, enterprises can ensure their cyber defense deployment can defend recent cyber threats.


The correct APT IoC usage process should include the following steps:
1. Properly deploy APT IoC in network equipment and cybersecurity software in the environment. Deployment is best done using automated tools to ensure completeness and consistency.

2. When an alert occurs, it should be dealt with immediately, including blocking, quarantining, and removing malware. Timely action can reduce damage and risk.

3. Once disposition is complete, a detailed investigation of the incident will be required. Collect the source and cause of IoC through the intelligence platform, and determine the identity and purpose of the attacker, and at the same time confirm how the relevant incident occurred in an industry with high homogeneity with itself. This helps enterprises better understand the attack methods and attack tools of adversaries, so that they can carry out targeted defense.

4. Take targeted defense measures, including the correct selection and setting of cybersecurity tools, and the establishment of a more complete enterprise cybersecurity system. This helps to increase the security of the enterprise and protect the confidentiality of important data.

 
 
 

In Advanced Persistent Threat (APT) attacks, adversaries often target specific vulnerabilities in their target companies. To effectively defend against these attacks, enterprises need to have a comprehensive understanding of the adversaries and attackers behind them.

TeamT5 provides ThreatVision, a powerful threat intelligence platform, which offers an extensive database of adversaries in the Asia-Pacific region. This platform provides detailed and comprehensive threat intelligence reports in a narrative and paragraph style, enabling enterprises to quickly understand threat events and gain valuable experience in handling such events. Furthermore, the readability of these reports can improve the reporting efficiency of cybersecurity teams when communicating across teams.

The ThreatVision threat intelligence platform covers a wide range of content, including APT IoC which can link to ThreatVision's vast databases of adversaries, malware, and other threat intelligence reports to help enterprises gain a comprehensive understanding of cybersecurity threats and implement advanced deployment strategies. By leveraging ThreatVision's powerful features, enterprises can enhance their cybersecurity posture and protect themselves against the ever-evolving threat landscape.

 
 

Know yourself and the enemy, and you will never be imperiled in a hundred battles. On the road of cybersecurity, TeamT5 is your best partner.

How to Utilize APT IoC to Do Proactive Defense?

IOC (Indicator of Compromise) 中文稱「入侵指標」，在企業資安的營運中已是不可或缺的工具，經由資安廠商長期廣泛情蒐所累積的入侵線索，協助初步發現駭客入侵痕跡，即時阻擋駭客入侵行為，以最大化的降低資安事件發生時所造成的損失。

一般企業在使用 IOC 時，會將 IOC 匯入各種網路設備以及軟體工具中，以便在環境各處設置監控，經由設備或軟體偵測到 IOC 時，設備或軟體會進行報警，讓資安人員能夠察知，並且進行阻擋、隔離、清除等處置。

但除了一般的阻擋、隔離、清除等處置外，APT IOC —— 針對[進階持續性威脅(Advanced Persistent Threat)](https://teamt5.org/tw/posts/what-is-advanced-persistent-threat-apt/)的 IOC ——更扮演了重要的威脅防禦參考，可以幫助企業於駭客下手前，提前做出正確資安決策。

APT IOC 指的是透過資安分析師及惡意程式研究員進行複雜的事件調查，所精煉出的關鍵指標。每一個IOC的產出背後都代表著特定惡意族群及駭客手法。**以威脅情資平台 ThreatVision 的 IOC 為例，IOC 背後可連結平台內建的 3 類豐富資料**: 
1. 惡意族群資料庫: 透過惡意族群資料，企業可以了解惡意族群的背景、動機，並提前對特定數位資產(如特定伺服器、VM或是資料庫)進行防備部署。
2. 惡意程式資料庫: 惡意程式資料庫可提供更多技術細節，幫助企業技術人員選擇正確有效的防禦工具並妥善部署。
3. 威脅情資報告: 企業更可參考威脅情資報告，確認自身狀況是否與報告中的描述吻合，從而確保處置過程及事後防禦部署，萬無一失。

 

**正確的APT IOC使用流程應包含以下步驟**：
1. 將APT IOC妥善部署於環境中的網路設備與資安軟體中。最好使用自動化工具進行部署，以確保完整性和一致性。
2. 當警報發生時，應立即對其進行處置，包括阻擋、隔離和清除惡意軟體。及時採取行動可以減少損害和風險。
3. 處置完成後，需要對事件進行詳細調查。通過情報平台搜集IOC的來源和成因，並確定攻擊者的身份和目的，同時確認相關事件如何發生於與自身同質性高的產業。這有助於企業更好地了解該惡意族群的攻擊手法和攻擊工具，才能進行針對性的防禦。
4. 採取針對性防禦措施，包括正確的資安工具選擇和設置，以及更完善的企業資安制度建立。這有助於提高企業的安全性並保護重要資料的機密性。
5. 由於APT攻擊的特點是針對性強，攻擊者會根據目標企業的弱點進行攻擊。因此，企業端需要對攻擊者/惡意族群進行更全面的了解，以便採取正確的防禦措施。

 
 
 

ThreatVision 威脅情資平台提供了最完整且深入的亞太區域惡意族群資料庫。威脅情資報告以敘事形式、段落式呈現，細節豐富完整，有助您快速了解威脅事件，吸收更多有效的威脅事件處理經驗，並且易讀性也可提高您的資安團隊在向上報告和跨團隊溝通時的效率。

ThreatVision 威脅情資平台提供的內容即包含 APT IOC，並可進一步連結到 ThreatVision 豐富的惡意族群資料庫、惡意程式資料庫及威脅情資報告內容，協助企業掌握資安威脅全貌，進行超前部署。

知己知彼，百戰不殆。在資安的道路上，TeamT5 是您最佳的夥伴。

如何正確利用APT入侵指標，進行主動資安防禦?

企業や組織がサイバー攻撃を受けた際、適切なアクションを実行し、マイナス影響を軽減することが重要です。
インシデントレスポンスチームと協力することで、企業はより早く正しい方向性に戻ることができます。

さらに、私たちのインシデントレスポンスチームは攻撃の原因を見つけ、更なる損失や攻撃を避けるために問題の根本に対処する事ができます。

サイバー攻撃に対処する手順
TeaｍT5のインシデント対応のエキスパートはサイバー攻撃により適切に対処する為に以下のステップを講じることを提案いたします。

 

- **不完全なログから侵入コンテキストを見つける**

ほとんどの攻撃者は、侵入行為や侵入手順を隠蔽するためにログを削除します。 したがって、情報セキュリティ インシデント対応担当者は、攻撃者の侵入コンテキストを分析するために、不完全なログから削除されていないレコードを見つけるために全力を尽くす必要があります。

 

- **攻撃者の侵入時刻と経路を特定する**

情報セキュリティ インシデント対応担当者は、侵入時点、侵入方法、侵入プロセスなどのログ記録を通じて、侵入イベントの外観を徐々に復元し、確立します。

より具体的には、情報セキュリティインシデント対応担当者は、段階的な調査と分析を通じて、どのマシンからどの脆弱性を通じてシステムに侵入されたのか、どのくらいの期間にわたってシステムに侵入されたのか、どのデータが攻撃者によって盗まれたのかを企業が明らかにするのを支援します。詳細については。

 

- **通常業務の再開**

情報セキュリティインシデント対応担当者は、企業が攻撃者の侵入経路をブロックし、攻撃者によって埋められたバックドアを削除することで、攻撃者が同じバックドアを使用してシステムに再度侵入するのを防ぐのに役立つ完全な技術能力を備えている必要があります。 さらに、企業がシステムをオンラインに戻して通常の運用を再開できるよう支援します。

 

- **企業の情報セキュリティ ガバナンス全体に関する提案を提供する**

テクノロジーは日々変化し、攻撃手法も日々変化していますが、企業の情報セキュリティ計画を適切に実行し続けることによってのみ、企業の情報セキュリティのレジリエンスを高めることができます。
情報セキュリティインシデントへの対応と処理を完了するには、企業のサイバーセキュリティの計画と実行について総合的な提案を提供する経験豊富な専門家が必要です。

情報セキュリティ管理の提案には、ネットワークのセグメンテーション、リアルタイムで更新されないシステム パッケージ (攻撃者はゼロデイ脆弱性を介して直接侵入できる)、イントラネット防御の強化 (たとえば、多くの企業がイントラネット サービスに同じパスワード セットを使用しているなど) が含まれます。二段階認証メカニズム/2FA が採用されていない場合、攻撃者がパスワードの 1 つを習得すると、さらに各システムのパスワードと権限を習得することができ、攻撃者は企業のすべての情報を迅速に取得できます。

 

## まとめ
今日の商業活動や企業運営は情報システムに大きく依存しており、サイバー攻撃や重大な情報セキュリティインシデントが発生した場合、日常業務に大きな影響を及ぼします。 

企業は、インシデントの分析とシステムの回復の為に専門の情報セキュリティインシデント対応チームの支援を求めることを推奨いたします。

これにより、さらなる損失を効果的に回避し、迅速に正しい運用軌道に戻すことができます。

 
 

>TeamT5 チームは、長年にわたりハッカー グループの侵入行動の研究と分析を行っており、国内外の第一線の情報セキュリティ インシデントの処理において豊富な経験を持っています。
>攻撃者の侵入を検知した場合、インシデントのインパクトと技術的原因を調査し、お客様のインシデント処理のための解決策と回避策を提供し、情報の復元と改善を支援します。



情報セキュリティ インシデントの処理と対応が必要な場合は、相談フォームにご記入ください。
[https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blogs&utm_medium=website)

ネットワーク攻撃を受けた場合、どのような対処が適切でしょうか？

When enterprises face cyber attacks, it’s important for them to take proper actions and lower the negative impacts. By collaborating with our incident response team, the enterprise can get back on to the right track sooner. Furthermore, our incident response team can find out the cause of the attack and deal with root problems to avoid further losses & attacks.

##Steps to Respond to Cyber Attacks
Incident response experts from TeamT5 suggest enterprises to take the steps below in order to better deal with cyber attacks.

###1.Find the Cyber Attack’ Intrusion Path from (Incomplete) Log
Most attackers will delete the log to cover up their intrusion behaviors. Therefore, our incident response team must try their best to find undeleted records in a fragmented log environment to analyze the attacker's intrusion path.


###2. Investigate and Find the Cyber Attack’s Timeline & Path
Incident response experts can form a broader view of the incident by going through logs. To fully understand the cyber attack, it requires the expert to analyze and come up with a report on the timing, path, and process of the event.

To be more specific, incident response experts can help enterprises to get a clearer picture on which system is breaked by the certain device(s), what vulnerabilities are being used, how long the system has been compromised, what data has been stolen, etc.

###3. Bring Enterprise Operation back to Normal
Incident response experts should have technical abilities to help enterprises to block attackers’ intrusion. By deleting backdoors or C2 created by attackers, this can prevent attackers from using the same method in sneaking into the system again.

###4. Provide Comprehensive Cybersecurity Governance Suggestions to Enterprises
Technology is evolving everyday, so are the attack methods. Only by continuing to carry out good enterprise, can enterprises enhance their cybersecurity resilience. 

To complete the response and handling of cyber incidents, it is important to have well trained experts to provide comprehensive suggestions on cybersecurity planning & execution for the enterprise.

Suggestions include but not limited to network segmentation, update to the latest version of system (attackers can directly intrude through zero-day vulnerabilities), and strengthening intranet defenses (for example, many companies use the same set of passwords for intranet services while the two-stage authentication mechanism/2FA is not adopted. This will allow the attacker to get rapid access to all systems and grasp all the information of the enterprise).


##Conclusion

Today's commercial activities and enterprise operations heavily rely on information technology systems. If cyber attacks or major cybersecurity incidents occur, daily operations could be greatly affected. 

It is recommended that enterprises seek the assistance from a professional incident response team for analysis and investigation of cybersecurity incidents and system recovery operations. With the help of a professional cybersecurity incident response team, enterprises can effectively avoid further losses and quickly return to their normal operation.


 
 

>With solid technical backgrounds and frontline expertises, TeamT5 provides an in-depth investigation and responses to real-world cyber-attacks. We identify and research the intruder attacks, the impacts and technical causes of the incidents, and recommend solutions or workarounds to assist our clients in recovery and remediation.
 
>If you have needs for incident response, please contact us: https://teamt5.org/tw/request-information/

What To Do When Cyber Attacks Happened?

企業、組織遭受資安攻擊事件後，不宜慌張，建議聯絡專業的資安事件應變(incident response, IR)團隊，進行下列應變步驟，不僅協助企業恢復營運，更可找出資安事件發生原因、解決問題，避免往後遭受再次攻擊。

##資安事件應變步驟
TeamT5 杜浦數位安全專業團隊建議資安事件發生後的應變步驟：

###1.從殘缺的 log 中找到入侵脈絡
多數攻擊者會刪除 log，掩飾其入侵行為與步驟。因此資安事件應變人員須盡可能在殘缺的 log 中，尋找未被刪除的紀錄，以便分析出攻擊者的入侵脈絡。

###2. 找出攻擊者入侵的時間點、路徑
資安事件應變人員透過 log 紀錄，逐步還原、建立入侵事件的樣貌，包含入侵的時間點、入侵的手法、入侵的過程等。
具體來說，透過逐步的調查與分析，資安事件應變人員協助企業釐清系統是從哪台機器被侵入，是透過哪個漏洞被侵入，乃至系統被入侵多久時間、哪些資料被攻擊者偷走等細節。

###3. 恢復企業正常營運
資安事件應變人員宜具有完整的技術能力，協助企業封鎖攻擊者的入侵路徑，透過刪除攻擊者埋的後門，避免攻擊者使用同個後門、再次進入系統。更可進一步協助企業將系統重新上線，恢復正常營運。

###4. 提供整體企業資安治理建議
技術日新月異，攻擊手法千變萬化，唯有持續進行良好的企業資安規劃，才能增強企業資安韌性。
完成資安事件應變與處理，更宜有經驗豐富的頂尖專家針對企業資安治理層次，提供全方面的建議，減少下次發生入侵事件的機率。資安治理建議包含做好網路區隔、系統使用的套件未即時更新(攻擊者可透過零日漏洞，直接侵入)、增強內網防禦(如: 許多企業的內網服務使用同組密碼，且未採用二階段驗證機制/2FA，若攻擊者掌握其中一組密碼、進一步即可掌握各系統的密碼與權限，攻擊者藉此可快速獲取企業全部資料)。


##結語
現今商業活動、企業營運十分仰賴資訊系統，若遭受網路攻擊、發生重大資安事件，將大幅影響日常營運。建議企業組織可尋求專業的資安事件應變團隊協助，參與資安事件分析調查與系統恢復作業，能有效避免進一步的損失，快速回到營運正軌。

 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。

若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
*首圖來源: [Pexels](https://www.pexels.com/)

遭受網路攻擊怎麼辦? 

>The incident response team of TeamT5 discovered a worm virus named Win32.Parite during an incident investigation. In the incident, the executable file in the victim host was infected by Win32.Parite. The infected host could spread to other execution files and wait for the attacker to connect; if the connection succeeds, the attacker can perform various communication and data collection behaviors on the infected host, which will have a profound impact.

>In this blog, we provide a detailed analysis of the worm virus and develop a scanning program with instructions on how to remove it, to help companies improve their cybersecurity defenses. We also urge companies that are still using 32-bit operating systems (e.g. WinXP/2003/7) to use scanning programs to scan their internal network systems.


#Basic Information of Malware Win32.Parite 
![how-to-detect-and-recover-from-virus-win32-parite_pic1.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic1.png)
Image source: VirusTotal

#Malware Analysis
##Win32.Parite: Shellcode

TeamT5 obtained the malicious file. We use Stud_PE to observe. There is a section named .heb, and the program entry point is pointed to this section. The characteristic of the Win32.Parite virus is that it inserts itself in the last section whose name is a random combination of letters.

![how-to-detect-and-recover-from-virus-win32-parite_pic2.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic2.png)

 

The entry point is a small decoder. The edx in the temporary register is the operation value of xor decoding, while esi is the address of the encoded data, and edi is the size of the encoded data. 

When decoding, the operation is 4 bytes at a time, and the range of all addresses is 0x43502E+4~0x43502E+0x59C, because the method of [push/pop] dword ptr [esi+edi] is used, so the target address of xor here will be is [esp].

![how-to-detect-and-recover-from-virus-win32-parite_pic3.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic3.png)

 

After understanding the above, you can use 010 Editor to do the XOR operation. After unpacking, there is a piece of shellcode.

![how-to-detect-and-recover-from-virus-win32-parite_pic4.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic4.png)

![how-to-detect-and-recover-from-virus-win32-parite_pic5.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic5.png)


 

What is interesting is that this worm virus also has a deformation function . Observing the three infected files, we found that the shellcode commands are different, but the purpose is the same. They all aim to obtain the decoded value, encoded address, and size of encoded data.

![how-to-detect-and-recover-from-virus-win32-parite_pic6.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic6.png)

 

After decoding, continue to analyze the shellcode. The first group of instructions after unlocking is a call, followed by a Parite custom structure. The interesting thing is that the original entry point is protected by an encoded program.

![how-to-detect-and-recover-from-virus-win32-parite_pic7.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic7.png)

 

The main program of Shellcode has only a few functions:
- GetDeclareAPI: Obtain the API address when needed and store it in the Stack.
- RegQuery_PINF: Query whether the PINF code exists, and the content is stored in the path of the virus body.
- Call_DLL_Initiate: Call “Initiate” in the main program DLL, which contains the original entry point for unlocking the EXE.
- Drop_DLL_File: If the PINF doesn't exist, it will drop the virus body (DLL) and create the key value of a PINF login file.


![how-to-detect-and-recover-from-virus-win32-parite_pic8.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic8.png)


 

Shellcode obtains some necessary Windows APIs through GetDeclareAPI(sub_435254), and then queries the PINF key value located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer through RegQuery_PINF(sub_435360).

![how-to-detect-and-recover-from-virus-win32-parite_pic9.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic9.png)

 

In the infected host, it can be seen that the value of PINF is \x09\x00, where 9 is the virus version, separated by \x00, and then followed by the DLL path.

![how-to-detect-and-recover-from-virus-win32-parite_pic10.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic10.png)

 

If the key exists and the value of the first 2 bytes is greater than or equal to 9, the shellcode will load the DLL module of the virus body through Call_DLL_Initate (sub_4353C8), and use GetProcAddress to obtain the address of the Initiate function. Then, it passes in the configuration address of 000435032 and jumps into execution.

![how-to-detect-and-recover-from-virus-win32-parite_pic11.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic11.png)
 

If the key value does not exist, the shellcode will decode the virus body (DLL) at the back through Drop_DLL_File (sub_435400) and throw it out. Then, it executes Call_DLL_Initate (sub_4353C8) to load the DLL module of the virus body.

![how-to-detect-and-recover-from-virus-win32-parite_pic12.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic12.png)

 

The offset address and file size (Size) of the DLL, as well as the encoded XOR key, can be seen in the configuration.

![how-to-detect-and-recover-from-virus-win32-parite_pic13.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic13.png)

 

In the Drop_DLL_File(sub_435400) function, the Decoder_Content(sub_4355A0) function will be called, and the content is encoded and decoded using xor dword.

![how-to-detect-and-recover-from-virus-win32-parite_pic14.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic14.png)


#Win32.Parite: Virus Body
The decoded DLL is packed with UPX, and the main virus module itself is written in Delphi. Line 23 of the exported Initiate function has a function to decode the original entry point (OEP).

![how-to-detect-and-recover-from-virus-win32-parite_pic15.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic15.png)

 

The program code in the Decode_OEP(sub_4022BC) function mainly obtains the two array addresses of 43504D and 43506E in the configuration block. It performs calculations through the sub_40232C function to generate a value of 16 bytes, which is divided into 4 groups of DWORD values, and The encoded OEP is XORed four times. The final result is the original OEP. With OEP, the infected PE execution file can be successfully repaired.

![how-to-detect-and-recover-from-virus-win32-parite_pic16.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic16.png)

 

Then, use SetWindowsHookExA to set a global hook to inject the DLL into all handlers.

![how-to-detect-and-recover-from-virus-win32-parite_pic17.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic17.png)


 

When the injected handler is explorer.exe, Win32.Parite will start to execute the behavior of the worm.

![how-to-detect-and-recover-from-virus-win32-parite_pic18.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic18.png)

 

#Win32.Parite: Backdoor Functionality
In the program code in the virus main DLL, you can see a piece of interesting code. Win32.Parite supports backdoor function. The backdoor uses UDP protocol to send commands. The result of the report will be sent back to the UDP 30168 communication port of the controlling terminal. When uploading data, it is necessary to monitor the TCP 30169 communication port on the controlling terminal and wait for the controlled terminal to actively connect, and then the data content can be uploaded.

![how-to-detect-and-recover-from-virus-win32-parite_pic19.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic19.png)

 

##Report Information to the Host
The controlling terminal sends out the characters of "e" to the UDP 30167 communication port of the controlled end.

![how-to-detect-and-recover-from-virus-win32-parite_pic20.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic20.png)

 

The controlled terminal will report the host information to the UDP 30168 communication port of the control terminal.

![how-to-detect-and-recover-from-virus-win32-parite_pic21.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic21.png)

##Execute Commands
The controlling terminal will report the host information to the UDP 30168 communication port of the control terminal.


![how-to-detect-and-recover-from-virus-win32-parite_pic22.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic22.png)

 

When the command is successfully executed, the controlled end will return the character "g", followed by the string of Done.

![how-to-detect-and-recover-from-virus-win32-parite_pic23.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic23.png)


##Upload Files
The controlled terminal sends out the character z, followed by the file name, and finally ends with \x00, and the file will be stored in the %WINDIR% folder.

![how-to-detect-and-recover-from-virus-win32-parite_pic24.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic24.png)

 

The control terminal listens to the TCP 30169 communication port, and waits for the content of the data that can be sent after the successful connection of the controlled terminal. After the connection is terminated, the data will be written into the file.

![how-to-detect-and-recover-from-virus-win32-parite_pic25.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic25.png)

The control terminal listens to the TCP 30169 communication port, and waits for the content of the data that can be sent after the successful connection of the controlled terminal. After the connection is terminated, the data will be written into the file.

- Add 1 Section 
- The original entry point (OEP) is pointed to the Section where the last virus is located
- The image file (Image) loaded into the memory becomes larger
- Modified the properties of .rdata
- Added new virus section


![how-to-detect-and-recover-from-virus-win32-parite_pic26.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic26.png)

 

In the file comparison, there are two places that were last modified, namely C600 and E9F8.

![how-to-detect-and-recover-from-virus-win32-parite_pic27.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic27.png)

 

You can see that these two places are actually the first two functions of kernel32.dll in Import Tables. Because the infected file did not write its own Shellcode to fetch the API, it relies on inserting LoadLibraryA and GetProcAddress in the import table to ensure that it is included in the Shellcode. These two functions can be used normally to obtain the API to be used, and it will be restored when the Shellcode is executed.

![how-to-detect-and-recover-from-virus-win32-parite_pic28.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic28.png)


#Detox Program
After knowing what has changed in the infected file, we can write a detox program to repair the infected file. The detox program basically does the following:


Checks if the entry point falls on the last section with a section name of .<random 3 character>
Read the operation value of xor decoding, the address of the encoded data and the size of the encoded data
Decode and read the configuration of Parite
Decode original entry point
Number of sections minus 1
Size of image minus the virtual size of the last section
delete the last section header
Modify the attributes of the .rdata section
Repair introduction table


##Instructions

```Usage: fix.exe <file or directory>```
![how-to-detect-and-recover-from-virus-win32-parite_pic29.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic29.png)

 

##Test
```> fix.exe setupSrv.exe```

![how-to-detect-and-recover-from-virus-win32-parite_pic30.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic30.png)

 

The repaired archives will be in the same path, with the archive name ```_clean``` ending with . Looking at the repaired file, you can see that the last infected section and entry point (ep) have been fixed.

![how-to-detect-and-recover-from-virus-win32-parite_pic31.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic31.png)

#Check if the Host is Compromised

We understand that when the control end sends the character e to the UDP 30167 communication port of the controlled end, the controlled end will report the host information to the UDP 30168 communication port of the control end. 

Therefore, we can use this point to develop a scanning program to send e characters to the intranet host and monitor the UDP 30168 communication port on the sending end to wait for the return information.

#Scanner

##Instructions

```Usage: scan.exe iplist```

![how-to-detect-and-recover-from-virus-win32-parite_pic32.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic32.png)

##Test
```
> scan.exe 127.0.0.1
> scan.exe 192.168.0.0/16
```

![how-to-detect-and-recover-from-virus-win32-parite_pic33.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic33.png)

#Download the Scanner Tool
[Link of source zip file](https://bit.ly/3YShkZK)
 

#IoC

|** file name** | **md5** | **compiler-stamp (UTC) ** | **type** |
| ------------ | -------------------------------- | ----------------------- | ---- |
| setupSrv.exe | c5e7e7007b7ea6a3361fea7d4b029859 | 2009-12-04 13:35:59 UTC | EXE |
| cft3B18.tmp |fe763c2d71419352141c77c310e600d2 | 2001-10-11 12:01:58 UTC | DLL |


 
 
>Know more about us: https://teamt5.org/en/about-us/

 

###Reference
[BlackBerry Cylance vs. Parite Polymorphic File Infector](https://blogs.blackberry.com/en/2019/08/blackberry-cylance-vs-parite-polymorphic-file-infector)

In-Depth Analysis and Scanning Program of the Worm Malware Win32.Parite

>TeamT5 資安事件應變團隊(Incident Response Team) 在某次事件調查中，發現受害主機中的執行檔遭受一款名為 Win32.Parite 的蠕蟲惡意程式感染。
受到感染的主機，會散播至其他執行檔並等待攻擊者連線；若連線成功後，攻擊者可在受感染的主機上執行各種通訊和數據收集行為，影響甚深。

>我們於本文詳細分析該惡意程式，也開發掃描程式與說明解毒方式，協助企業提升資安防禦能量。
我們並呼籲尚在使用 WinXP/2003/7 等32位元作業系統的組織、企業，建議可以使用掃瞄程式來掃內網系統。

#惡意程式 Win32.Parite 基本資訊
![how-to-detect-and-recover-from-virus-win32-parite_pic1.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic1.png)
圖片來源: VirusTotal

#惡意程式分析
##Win32.Parite - Shellcode
TeamT5 取得惡意檔案，可以使用 Stud_PE 觀察，可以看到節區(Sections)裡面多了一個名稱為.heb節區，並且程式進入點(Entry Point)被指向該節區。Win32.Parite病毒的特徵，就是會將自己插入在最後一個節區，該節區名稱是隨機的字母組合。

![how-to-detect-and-recover-from-virus-win32-parite_pic2.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic2.png)

 

進入點是一段小小的解碼程式(Decoder)，暫存器中的edx為xor解碼的運算數值，而esi為編碼資料的位址，edi為編碼資料的大小。解碼時，運算一次為4 bytes，全部處裡的範圍是0x43502E+4~0x43502E+0x59C，因為使用[push/pop] dword ptr [esi+edi]的手法，所以這裡的xor的目標位址才會是[esp]。

![how-to-detect-and-recover-from-virus-win32-parite_pic3.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic3.png)

 

在理解了上述的組語後，可以使用010 Editor來做XOR的運算。解開後可以發現是一段shellcode的程式碼。
![how-to-detect-and-recover-from-virus-win32-parite_pic4.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic4.png)

![how-to-detect-and-recover-from-virus-win32-parite_pic5.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic5.png)


 

有趣的是此蠕蟲惡意程式也有變形的功能，觀察三個被感染的檔案，從中發現到shellcode的指令都不一樣，但目的都是相同的，都是要取得解碼的運算數值、編碼資料的位址與編碼資料的大小。
![how-to-detect-and-recover-from-virus-win32-parite_pic6.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic6.png)

 

解碼後，繼續分析shellcode程式碼，解開後的第一個組語的指令是一個call，下面緊接著是一個Parite自訂義的結構，裡面比較有趣的是原程式的進入點(OEP)是被編碼保護起來的。
![how-to-detect-and-recover-from-virus-win32-parite_pic7.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic7.png)

 

Shellcode的主程式的功能僅有幾項：

- GetDeclareAPI：取得要時用的API位址存於Stack
- RegQuery_PINF：查詢PINF機碼是否存在，內容存放病毒主體路徑
- Call_DLL_Initiate：呼叫主程式DLL中的Initiate，裡面包含解開EXE原始進入點
- Drop_DLL_File：如果PINF不存在時，會丟出病毒主體(DLL)及建立PINF登入檔機碼數值

![how-to-detect-and-recover-from-virus-win32-parite_pic8.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic8.png)


 

Shellcode透過GetDeclareAPI(sub_435254)取得一些必要的Windows API後，接著透過RegQuery_PINF(sub_435360)查詢位於HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer的PINF鍵值。

![how-to-detect-and-recover-from-virus-win32-parite_pic9.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic9.png)

 

在被感染的機器中可以看到PINF的數值內容是\x09\x00，這地方的9為病毒版本，以\x00分隔，後再接DLL路徑。

![how-to-detect-and-recover-from-virus-win32-parite_pic10.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic10.png)

 

若該鍵值存在並且前2 bytes的數值大於等於9，shellcode會透過Call_DLL_Initate(sub_4353C8)載入病毒主體的DLL模組，並使用GetProcAddress取得Initiate函數位址，傳入000435032的組態位址後並且跳入執行。

![how-to-detect-and-recover-from-virus-win32-parite_pic11.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic11.png)
 

若該鍵值不存在，shellcode則會透過Drop_DLL_File(sub_435400)將位在後方的病毒主體(DLL)解碼後丟出來，接著執行Call_DLL_Initate(sub_4353C8)載入病毒主體的DLL模組。
![how-to-detect-and-recover-from-virus-win32-parite_pic12.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic12.png)

 

而DLL的偏移位址(Offset)及檔案大小(Size)，還有編碼的XOR key，都可以在組態中看到。
![how-to-detect-and-recover-from-virus-win32-parite_pic13.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic13.png)

 

在Drop_DLL_File(sub_435400)函數裡面會呼叫Decoder_Content(sub_4355A0)函數，其內容是使用xor dword進行編解碼。
![how-to-detect-and-recover-from-virus-win32-parite_pic14.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic14.png)


#Win32.Parite - 病毒主體
解碼出來的DLL使用UPX加殼，病毒主體模組本身是使用Delphi所撰寫，所導出的Initiate函數第23行有一個解碼原始進入點(OEP)的函數。
![how-to-detect-and-recover-from-virus-win32-parite_pic15.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic15.png)

 

Decode_OEP(sub_4022BC)函數中的程式碼，主要是取得組態區塊中的43504D、43506E的二個陣列位址，經由sub_40232C函數進行運算，產生出16 bytes的數值，拆成4組DWORD值，與被編碼的OEP進行四次的XOR運算，最後的結果為原始OEP，有了OEP就能順利的修復被感染的PE執行檔。

![how-to-detect-and-recover-from-virus-win32-parite_pic16.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic16.png)

 

接著使用SetWindowsHookExA設置全局鉤子，將DLL注入所有處理程序中。
![how-to-detect-and-recover-from-virus-win32-parite_pic17.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic17.png)


 

當被注入的處理程序為explorer.exe時，Win32.Parite則會開始執行蠕蟲的行為。

![how-to-detect-and-recover-from-virus-win32-parite_pic18.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic18.png)

 

#Win32.Parite - 後門功能
在病毒主體DLL中的程式碼，可以看到一段有興趣的程式碼，Win32.Parite支援後門功能，後門利用UDP協議來發送指令，被控制端會監聽UDP 30167通訊埠等待接收指令，被控制端回報之結果會回傳到控制端的UDP 30168通訊埠，需要上傳資料時，則需要在控制端上監聽TCP 30169通訊埠，等待被控制端主動連線，此時就能上傳資料內容。

![how-to-detect-and-recover-from-virus-win32-parite_pic19.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic19.png)

 

##回報主機資訊
控制端發送出e的字元到被控制端的UDP 30167通訊埠。
![how-to-detect-and-recover-from-virus-win32-parite_pic20.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic20.png)

 

被控制端會回報主機資訊到控制端的UDP 30168通訊埠。
![how-to-detect-and-recover-from-virus-win32-parite_pic21.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic21.png)

##執行指令
控制端發送出y的字元，接著DWORD值，1是顯示在畫面中，0是隱藏在背景中執行，隨後跟著要下達的指令(可接參數)，最後以\x00結尾。

![how-to-detect-and-recover-from-virus-win32-parite_pic22.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic22.png)

 

當指令成功被執行後，被控制端會回傳g字元，後面接上Done的字串。
![how-to-detect-and-recover-from-virus-win32-parite_pic23.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic23.png)


##上傳檔案
控制端發送出z的字元，接著檔案名稱，最後以\x00結尾，該檔案會被存放在%WINDIR%資料夾下。
![how-to-detect-and-recover-from-virus-win32-parite_pic24.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic24.png)

 

控制端監聽TCP 30169通訊埠，等待被控制端連線成功後之後便可以傳送的資料內容，結束連線後，資料將被寫入到檔案裡面。
![how-to-detect-and-recover-from-virus-win32-parite_pic25.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic25.png)

#修復被感染的檔案
##被感染的檔案差異
這裡分析一下被感染後的執行檔有什麼變化：

- Section數多1
- 原始進入點(OEP)被指向最後一個病毒所在的Section
- 載入記憶體的映像檔(Image)變大
- 修改了.rdata的屬性
- 新增了新的病毒節區

![how-to-detect-and-recover-from-virus-win32-parite_pic26.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic26.png)

 

檔案比對中，還有最後被修改的二個地方，分別為C600、E9F8。
![how-to-detect-and-recover-from-virus-win32-parite_pic27.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic27.png)

 

可以看到這二個地方，其實是Import Tables中kernel32.dll的前二個函數，感染後的檔案因為沒寫自己取API的Shellcode，因此靠著在導入表中插入LoadLibraryA，GetProcAddress來確保Shellcode中能正常使用此二個函數取得要用的API，在執行Shellcode時會將其還原。

![how-to-detect-and-recover-from-virus-win32-parite_pic28.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic28.png)


#解毒程式
在了解被感染的檔案有什麼改變之後，我們便可以撰寫解毒程式來修復被感染的檔案。
解毒程式基本上做了以下的事情：

1. 檢查進入點是否落在最後一個節區，且節區名稱為 .<random 3 character>
2. 讀取xor解碼的運算數值、編碼資料的位址與編碼資料的大小
3. 解碼並讀取Parite的組態
4. 解碼原始進入點(oep)
5. NumberOfSections減1
6. SizeOfImage減最後一個節區的虛擬大小
7. 刪除最後一個節區頭
8. 修改.rdata節區的屬性
9. 修復導入表

##使用方法

```Usage: fix.exe <file or directory>```
![how-to-detect-and-recover-from-virus-win32-parite_pic29.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic29.png)

 

##測試
```> fix.exe setupSrv.exe```

![how-to-detect-and-recover-from-virus-win32-parite_pic30.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic30.png)

 

修復好的檔案會在同樣路徑，檔案名稱以```_clean```結尾。
查看修復的檔案，可以看到最後一個被感染的節區與進入點(ep)都已經修正。
![how-to-detect-and-recover-from-virus-win32-parite_pic31.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic31.png)

#檢查主機是否受害
我們了解當控制端發送出e的字元到被控制端的UDP 30167通訊埠後，被控制端會回報主機資訊到控制端的UDP 30168通訊埠。
因此我們可以利用這點開發一個掃描程式，對內網主機傳送e的字元並在發送端監聽UDP 30168通訊埠等待回傳資訊。

#掃描程式
##使用方法
```Usage: scan.exe iplist```

![how-to-detect-and-recover-from-virus-win32-parite_pic32.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic32.png)

##測試
```
> scan.exe 127.0.0.1
> scan.exe 192.168.0.0/16
```

![how-to-detect-and-recover-from-virus-win32-parite_pic33.png](https://uploads.teamt5.org/upload/original/how-to-detect-and-recover-from-virus-win32-parite_pic33.png)

#掃描程式工具下載點
[原始碼壓縮檔連結](https://bit.ly/3YShkZK)
 

#IoC

|** file name** | **md5** | **compiler-stamp (UTC) ** | **type** |
| ------------ | -------------------------------- | ----------------------- | ---- |
| setupSrv.exe | c5e7e7007b7ea6a3361fea7d4b029859 | 2009-12-04 13:35:59 UTC | EXE |
| cft3B18.tmp |fe763c2d71419352141c77c310e600d2 | 2001-10-11 12:01:58 UTC | DLL |


 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。

>若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: https://teamt5.org/tw/request-information/

 

###參考資料
[BlackBerry Cylance vs. Parite Polymorphic File Infector](https://blogs.blackberry.com/en/2019/08/blackberry-cylance-vs-parite-polymorphic-file-infector)

蠕蟲惡意程式 Win32.Parite 深度分析與掃描程式

Businesses, government organisations, and communities and societies, enter 2023 facing severe economic headwinds, conflict and rising geopolitical tensions, growing social polarisation and technology-enabled changes to the way people work, consume and socialise. This turbulence provides rich opportunities for attackers to exploit weaknesses in critical infrastructure, corporate and government networks and systems holding personally identifiable information (PII), account passwords and other sensitive data. Illicit access to systems and data enables these groups or individuals to disrupt water, power or other utilities; purloin intellectual property; empty bank accounts; steal personal identities; or conduct a range of other hostile activities. 

At TeamT5, we anticipate the following developments this year:

##The continued rise of state-sponsored APT groups
The Asia-Pacific region is experiencing increasing turbulence due largely to rising tensions between the United States and China. This friction means state-sponsored Advanced Persistent Threat (APT) groups present a potent threat to stability in the APAC region. Unlike cybercriminals who are typically incentivised by personal gain, state-sponsored APT groups are politically motivated and target intelligence that serves the interests of the governments or authorities that direct them. 

We are aware of a number of these groups operating in the Asia-Pacific, including one connected to the Chinese government that targets a range of sectors including telecommunications, pharmaceuticals and aviation, and another acting against government and military agencies across the Asia-Pacific. 
 
We expect to see these groups step up their activity as several important events–including the G7 Summit–take place this year. Our research team believes APT groups plan to launch more sophisticated attacks against Asia-Pacific countries. Apart from exploiting new and legacy vulnerabilities, APT groups also started to abuse legitimate cloud services (Dropbox, Google Drive) or third-party services to deploy malware.

The impact of these activities may be severe as businesses and government organisations remain reliant on cloud services to help execute remote- and hybrid-working strategies. While these strategies continue to improve productivity and employee satisfaction, a heightened focus from APT groups exacerbates the threats posed by practices such as use of unsecured personal devices or poorly protected networks. 

##Escalating software supply chain attacks
APT groups are also poised to step up projects to infiltrate code in third party products and services that access corporate or government networks. These software supply chain attacks are particularly insidious as they target trusted products, minimising the prospect of being detected and responded to by anti-malware products.

These attacks hit the spotlight in late 2020 when malicious parties–most likely a state-based APT group–breached SolarWinds’ Orion, a product used by large organisations and governments to manage their IT resources. Through compromised updates, the attackers were able to insert malware into the systems of clients including the United States Department of Homeland Security, Treasury and private companies such as Microsoft.

Due to the high risk and potentially severe consequences of such attacks, we also expect to see businesses, governments, vendors and security software providers escalate measures to detect and prevent these attacks. This may include more stringent requirements of third-party providers to limit the risk of infiltration before allowing their products and services to access sensitive corporate systems and data.

##Fill security gaps with cyber threat intelligence
To minimise the threat presented by APT groups and cyberattackers in 2023 and beyond, businesses and government organisations need to acknowledge a difficult reality–that the cyber threat landscape is becoming more complex and threat actors are evolving rapidly. 

In the past, traditional cyber defence mechanisms like antivirus software and firewalls might have been enough to protect sensitive data and systems. However, now businesses and organisations have to develop, execute and constantly update a comprehensive strategy to defend against sophisticated attacks. 

Cyber threat intelligence must inform and drive this strategy. Intelligence about threat actors and potential attacks can help businesses and government organisations better understand potential threats, and help them allocate resources to establish effective cyber defences.

 

To obtain the insights needed to combat sophisticated cyberattackers, businesses and government organisations should consider solutions such as the ThreatVision threat intelligence platform. ThreatVision provides a portal that enables clients to stay on top of the threat landscape, defend against APT attacks and understand the tactics, techniques and procedures of adversaries. 

[Click](https://teamt5.org/en/products/threatvision/) here to register for the free demo now.

Sophisticated cyberattacks from state groups to rise in 2023

サイバー攻撃の多発も人々の警戒を高めています。 企業組織が自社のシステムやマシンなどが攻撃され、侵入された可能性があると疑われる場合、TeamT5 チームは、情報セキュリティインシデント調査における長年の豊富な経験に基づいて、次のような検査指示を提供します。


###1. 異常な動作がないか確認する 

- 多数の異常なログ イベント (パスワード スプレー攻撃の可能性があります)
- イベントログID：4624、4625
- 高特権操作の異常な動作

 

###2. 新しい高特権アカウントまたは新しいマシンがドメインに追加されているかどうかを確認します

- その場合は、アカウントまたはマシンからソースを追跡できます。

 

###3. 異常なレジストリコード（レジストリ）がないか確認する

- マルウェアの永続性を削除するメカニズム

 

###4. 異常な帯域幅の使用状況を確認するkok

- どのエンドポイントから送信されたトラフィックかを確認して、どのデータが盗まれたかを推測する

 

###5. 異常にインストールされたアプリケーションやサービスがないか確認する

- PSEXEC、Anydesk

 

###6. 攻撃のタイムラインを把握する (タイムライン)

 

###7. 攻撃元を特定する

 

TeamT5は堅実なバックグラウンドと最前線での専門知識を基に、徹底した調査と現実世界のサイバー攻撃者に対しての対処を提供します。攻撃者の侵入の攻撃と、インシデントの影響と技術的原因を特定調査し、クライアントの復旧と修正・緩和を支えるための解決策や回避策を支援します。



情報セキュリティインシデントの処理と対応が必要な場合は、相談フォームにご記入ください: [https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blog&utm_medium=website)

システムが侵害されているかどうかを自分で確認するにはどうすればよいですか?

The frequent occurrence of cyber attacks has also raised people's vigilance. If the enterprise suspects that its own system, machines, etc. may be attacked and invaded, TeamT5 incident response team will provide the following inspection directions based on its long-term and rich information security incident investigation experience.


###1.Check for unusual behavior

- A large number of abnormal log events (which may possibly be a password spraying attack)
- Event log id : 4624, 4625
- Abnormal high-privileged operation behavior

###2.Check if there is a new high-privileged account or a new machine added to the domain

- If so, you can trace back to the source from the account or machine

###3.Check for abnormal registration code (registry)

- Use certain mechanisms to remove malware persistence

###4.Check for unusual bandwidth usage

- Confirm which endpoint which the traffic is coming from to guess what data was stolen

###5.Check for abnormally installed applications or services

- PSEXEC、Anydesk

###6.Figure out the attack timeline(Timeline)

###7.Find the source of the attack

 
 


>With solid technical background and frontline expertise, TeamT5 provides an in-depth investigation and responses to real-world cyber-attacks. We identify and research the intruder attacks, the impacts and technical causes of the incidents, and recommend solutions or workarounds to assist our clients in recovery and remediation.

>If you have needs for incident response, please contact us: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)

 
 
*Image Courtesy:[Pixabay](https://pixabay.com/)

How to check whether the system has been compromised by yourself?

網路攻擊事件頻傳，同時也提高人們的警戒心。若企業組織懷疑自身系統、機器等可能遭受攻擊入侵，TeamT5 杜浦數位安全團隊依據長期豐富的資安事件調查經驗，提供下列檢查方向。


###1.檢查是否有異常行為

- 大量登入異常Event log (可能為密碼噴灑攻擊 password spraying)
- Event log id : 4624, 4625
- 異常之高權限操作行為

###2.檢查是否有新增高權限的帳號或是新被加入 domain 的機器

- 如有，就可以從帳號或是機器著手回溯源頭

###3.檢查是否有異常的註冊機碼(registry)

- 清除惡意程式 persistence 的機制

###4.檢查是否有異常的頻寬用量

- 確認從哪台端點發出，以推測是什麼資料遭竊取

###5.檢查是否有安裝異常的應用程式或服務

- PSEXEC、Anydesk

###6.理出攻擊時間線(Timeline)

###7.找出攻擊源頭

 
 


>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。

若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
*首圖來源:[Pixabay](https://pixabay.com/)

如何自行檢查系統是否被入侵?

突然の情報セキュリティインシデントは企業組織を驚かせます。外部の専門チームに支援を求める場合は、コミュニケーション効率を高めるために以下の資料を準備することをお勧めします。外部の専門チームがその強みを最大限に発揮し、企業の業務再開を迅速に支援できるようにします。


## セキュリティインシデント対応チームと連携するための 5 つの鍵


#### 1. 被害範囲の確認
- 侵害されたコンピュータ、侵害されたドメイン、影響を受けたサービスの総数


#### 2. 主要なマシンのフォレンジック分析に使用するキーツール(Reg, Log, $MFT……)
- Windows
 - https://github.com/CyberDefenseInstitute/CDIR
 - Exchange IIS log/ mail log
- Linux
 - https://github.com/tclahr/uac


#### 3.コマンドラインプログラム監査を有効にする
- イベントログ 4688

#### 4. ファイアウォールログ

#### 5. トラフィックモニタリングログ

 
 

## 情報セキュリティ インシデント対応チームは、企業が影響を受ける状況を判断できるよう支援します。

まず、情報セキュリティ インシデント対応チームは、企業が次のような影響を受ける状況を明確にするのを支援します。

#### 1. 盗まれたデータ
- 最近追加された zip、tar、rar、その他のファイルを探し、それらが攻撃者によってパッケージ化されているかどうかを確認します。
- エンドポイントにトンネルまたはポート転送ツールがあるかどうかを確認します。
- Megatools、dropbox などのクラウド アプリケーション フォルダーを見つけます。
- 一部のハッカーは誤って設定ファイルを保存してしまうことがあります。どのような情報を盗んだのかを確認することができる可能性があります。

#### 2.侵害されたアカウント
イベント ログを通じて、どのアカウントがハッカーによって横方向の移動やファイルのインストールに使用されたかを確認します。


#### 3. 使用されるツール
- ハッキング ツール: mimikatz、Rubeus、Impacket、LOLBAS…
- バックドア: CobaltStrike、Metasploit、TrickBot…

 
 

さらに、インシデント対応チームは、企業が通常業務を再開し、将来同様の攻撃を回避するために適切な情報セキュリティ保護措置を講じられるよう支援します。

 
 

>堅実な技術的バックグラウンドと最前線での専門知識を基に、TeamT5のインシデントレスポンスチームは徹底した調査と現実世界のサイバー攻撃者に対しての対処を提供します。侵入者の攻撃、インシデントの影響と技術的要因を特定、調査し、クライアントが回復と修復するための解決策と回避策を提案します。
 
>情報セキュリティ インシデントの処理と対応が必要な場合は、相談フォームにご記入ください。
[https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blog&utm_medium=website)

セキュリティ インシデント対応チームとどのように連携すればよいですか? どのような支援が受けられますか?

Cyber incidents often happen out of the blue and catch enterprises by surprise. If you seek assistance from an external incident response team, it is recommended that you prepare the following materials to improve the efficiency of the discussion. This also allows external response teams to give full play to their strengths and quickly assist enterprises to resume operations.

## 5 keys to working with security incident investigation teams

1.Confirm the range of damage

- Total number of compromised computers, compromised domains, and affected services

 

2.Key tools we use for forensics analysis (Reg, Log, $MFT...)
- Windows
 - https://github.com/CyberDefenseInstitute/CDIR
 - Exchange IIS log/ mail log
- Linux
 - https://github.com/tclahr/uac
 

3.Enable command-line program auditing
 - Event log 4688

 

4.Firewall log

 

5.Traffic monitoring log

 

## Incident response team can assist enterprises to determine the affected situation

Initially, the information security incident team can help enterprises clarify the affected situation, including the following:

1.Stolen data
- Look for recently added .zip, .tar, .rar and other files, and check whether if they are packaged by attackers
- Check whether the endpoint has a tunnel or port-forwarding tool
- Find cloud application folders such as Megatools, dropbox, etc.
- Some hackers will accidentally keep some config files. If so, there is a chance you can look up information they might have stolen

 

2.The compromised account

Through the event log, we can determine the accounts hackers used for lateral movement and file installation

 

3.What tools are used
- Hacking tools: Mimikatz, Rubeus, Impacket, LOLBAS…
- Backdoors: CobaltStrike, Metasploit, TrickBot…

 

Furthermore, the incident response team can assist enterprises to resume normal operations and recommend appropriate protections to avoid similar attacks in the future.

 
 

>With our solid technical background and frontline expertise, TeamT5’s incident response team provides an in-depth investigation and response to real-world cyber-attacks. We identify and research the intruders’ attacks, the impact and technical cause of the incidents, and recommend solutions or workarounds to assist our clients in recovery and remediation.
 
>If you have needs for incident response, please contact us: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)

How to collaborate with the incident response team? What kind of assistance can I get?

突發的資安事件常使企業組織措手不及，若尋求外部專業團隊協助，建議可準備下列資料，提高溝通效率。讓外部專業團隊 - 資安事件應變團隊 (Incident response team) 更可發揮所長，快速協助企業恢復營運。

##與資安事件應變團隊合作的5個關鍵
1.確認受害範圍
 - 受害電腦總數、受害網域、受影響服務
 
 

2.重點機器取證(Reg, Log, $MFT……)
- Windows
 - https://github.com/CyberDefenseInstitute/CDIR
 - Exchange IIS log/ mail log
- Linux
 - https://github.com/tclahr/uac
 
 

3.啟用命令列程序稽核
- Event log 4688
 
 

4.防火牆log
 
 

5.流量監控log
 
 

##資安事件應變團隊可協助企業釐受影響的狀況
初步來說，資安事件應變團隊可協助企業釐清受影響的狀況，包含下列:

 
1.被竊取的資料
- 尋找近期新增之 zip, tar, rar 等檔案，過濾是否是攻擊者所打包
- 尋查端點是否有建立 tunnel 或是 port forward 的工具
- 尋查Megatools, dropbox 等雲端應用程式資料夾
- 有些駭客會不慎留存一些 config 檔案，可以上去看看他們偷了哪些資料

 
 
2.被compromised的帳號
- 透過 event log，確認駭客使用過哪些帳號進行橫向移動，或是安裝檔案

 
 
3.用了什麼工具
- 駭客工具: mimikatz, Rubeus, Impacket, LOLBAS……
- 後門程式: CobaltStrike, Metasploit, TrickBot……

 
 

進一步，資安事件應變團隊更可協助企業恢復正常營運，並採取適宜的資安防護措施，避免未來發生類似受攻擊事件。

 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件應變與處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
 
>若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
*首圖來源: [xFrame](https://xframe.i)

如何與資安事件應變團隊合作? 能夠獲得什麼協助?

突然の情報セキュリティインシデントは、企業や組織を驚かせます。司法捜査機関やインシデント対応チームの支援を容易にし、インシデントの全体像を明らかにし、企業の損失を軽減するために、専門家は以下の情報を冷静に収集する必要があると示唆しています。 

## 情報セキュリティインシデント/サイバー攻撃インシデントに対応するために必要な8つの重要情報

1. 復元された実行ファイル（exe）
2. 暗号化されたファイルとランサムノート
3. メモリダンプと感染したハードドライブのイメージ
4. 悪意あるプログラムのサンプル: ランサムウェア、バックドア、ハッキング ツールなど。
5. ログ (Windows イベント ログ、ファイアウォール ログ、Exchange ログなど)
6. システム上で実行されたPowershell スクリプト
7. 侵害時に AD に追加されたマシンまたはアカウント
8. 恐喝の詳細：攻撃者が使用した電子メール、恐喝金額、仮想通貨ウォレットのアドレス、攻撃者との交渉過程の記録など

 

堅実な技術的バックグラウンドと最前線での専門知識を基に、TeamT5は徹底した調査と現実世界のサイバー攻撃者に対しての対処を提供します。攻撃者の侵入攻撃と、インシデントの影響と技術的原因を特定調査し、クライアントの復旧と修正・緩和を支えるための解決策や回避策を支援します。


>情報セキュリティインシデントの処理と対応が必要な場合は、相談フォームにご記入ください:
https://teamt5.org/jp/request-information/

 
 

*画像のソース: [Pixabay](https://pixabay.com/)

情報セキュリティインシデント/サイバー攻撃インシデントに対応するために必要な8つの重要情報

Cyber incidents often happen suddenly and catch enterprises by surprise. 

Experts suggest that the following information should be collected calmly in order to let the assistance of judicial investigation units and incident response teams clarify the overall situation of the incident. By doing so, enterprises might be able to reduce losses after cyber incidents.


## 8 Key Info for Dealing with Cyber Attacks
1. Restored executable file (exe).
2. Encrypted file and ransom note.
3. Memory dump and infected hard drive Image.
4. Malicious program samples: such as: ransomware, backdoors, hacking tools, etc.
5. Log (Windows event log, firewall log, Exchange log…)
6. There is a Powershell script executed on the system.
7. Machines or accounts that were added to AD at the time of the breach.
8. Extortion details: such as the email used by the attacker, the amount of extortion, the address of the virtual currency wallet, and the record of the negotiation process with the attacker.

 

With solid technical background and frontline expertise, TeamT5 provides an in-depth investigation and response to real-world cyber-attacks. We identify and research the intruder attacks, the impact and technical cause of the incidents, and recommend solutions or workarounds to assist our clients in recovery and remediation.

 

>If you have needs for incident response, please contact us: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)

 
 
*Image courtesy: [Pixabay](https://pixabay.com/)

8 Key Info for Dealing with Cyber Attacks

突發的資安事件常使企組織措手不及，專家建議須冷靜收集下列資料，以利司法調查單位、事件處理團隊協助，釐清事件全貌，並降低企業損失。

## 處理資安事件/網路攻擊事件所需的8種關鍵資料
1. 還原的執行檔(exe)
2. 被加密的檔案與勒索說明文件(ransom note)
3. 記憶體傾印檔(memory dump) 與受感染的硬碟 Image
4. 惡意程式樣本: 如: 勒索軟體、後門、駭客工具等
5. Log (Windows event log, 防火牆 log, Exchange log……)
6. 有在系統執行過的 Powershell script
7. 在入侵時間被新增到 AD 的機器或帳號
8. 勒索細節: 如攻擊者使用的 email、勒索金額、虛擬貨幣錢包地址、與攻擊者的交涉過程紀錄

 
 


TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。

>若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
 

*首圖來源: [Pixabay](https://pixabay.com/)

處理資安事件/網路攻擊事件所需的8種關鍵資料 

ランサムウェアは、近年の主要なサイバー脅威の一つです。企業や様々な組織を標的にしています。多発する事件は日常業務に影響を与えるだけでなく、多大な損失をもたらします。


ランサムウェアインシデントは、企業や組織が損害を制御し、できるだけ早く通常の運用に戻ることを効果的に支援する正確かつ適切な対応手順を通じて対処する必要があります。

ランサムウェア インシデントへの対応における 9 つの主要な手順を以下に示します。

## ステップ 1: 迅速な隔離
- どのシステムがランサムウェアに感染しているかを特定し、直ちに隔離します。
- ネットワークから切断できないマシンがある場合は、一時的にシャットダウンしてください。
- グループ ポリシー オブジェクト (GPO) 設定では 拡散をブロックするために、[すべての接続をブロックする] を一時的に選択します。


## ステップ 2: トリアージ
- 事業継続計画に基づく復旧。
- さまざまな状況に応じて、対応する対処を実行します。
- もし最悪のシナリオ（デバイスの故障）があれば、可能な限り回復させます。
- 中等度から重度の場合：優先的回復。
- 軽度の場合：特別な対処は必要ありません。

## ステップ 3: 支援を求める
- まず状況を理解して文書化し、社内および社外のチームに連絡して正常な状態に早く戻るようにします。
- 企業組織の性質に応じて管轄当局に通知し、司法調査部門に連絡します。また企業組織が関連保険を購入している場合は、保険部門に連絡します。


## ステップ 4: 証拠の収集
- 主要なマシン (サーバーなど) のメモリ ダンプ、イメージ、ログを収集します。
- 疑わしいコマンドと IP をフィルタリングして収集する

##ステップ 5: レコードを検索する
- ウイルス対策ソフトウェア、エンドポイント保護ツール (EDR)、侵入防御ツール (IPS) などのインベントリを作成し、初期の攻撃の兆候を探します。

## ステップ 6: 汎用ホストの対応
- ランサムウェアによって暗号化されていないホスト、またはランサムウェアによって暗号化されていてもまだ暗号化されていないホストがまだある場合は、まずネットワークから切断します。 企業がランサムウェアの感染プロセスを解明し、悪意のあるプログラムを削除した後、ホストをインターネットに接続します。
- 元のウイルス対策スキャン ツールとは別のウイルス対策スキャン ツールを使用し、(例えば)Microsoft Safety Scanner などを使用してシステムの状態を再度確認します。

## ステップ 7: ドメインコントロールの対処
- すべてのドメイン管理者のパスワードを変更する。
- Krbtgt パスワードを 2 回変更します (変更間隔は 10 時間)
- ドメイン管理者およびその他の高い特権グループの下に不明なアカウントが追加されているかどうかを確認します。

## ステップ 8: バックアップと復元
- オフラインバックアップからデータを復元する。
- サービスの復旧には段階的なアプローチを採用し、重要なサービスから始めて完全な復旧まで継続します。
- 残りのデータをバックアップし、システムを再構築します。


##ステップ 9: ランサムウェアがどのファミリーに属しているかを調べる
- 暗号化されたファイルのファイル拡張子とランサムノートによって、どのランサムウェア ファミリが攻撃されているかを特定します。
-これを使用して、対応する復号化ツールを見つけます 。(ただし、ツールが見つかる可能性は低い)
- ランサムウェア ファミリの攻撃が他の部門によってレポートやニュースに記載されている場合、そのグループの通常の侵入方法とソースを知ることができます。


 
 
>TeamT5 チームは、長年にわたりハッカー グループの侵入行動の研究と分析を行っており、国内外の第一線の情報セキュリティ インシデントの処理において豊富な経験を持っています。 侵入者の攻撃、インシデントの影響と技術的要因を特定、調査し、クライアントが回復と修復するための解決策と回避策を提案します。
>
>情報セキュリティインシデントの処理と対応が必要な場合は、相談フォームにご記入ください: [https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blog&utm_medium=website)

ランサムウェア インシデントに対する対応を行うための重要な9つのステップ

Ransomware is one of the major cyber threats in recent years. Ransomware targets enterprises and various organizations. Frequent incidents not only affect the daily operations of enterprises, but also cause huge losses.

Ransomware incidents should be handled through precise and appropriate response steps that will effectively assist enterprises and organizations in controlling damage and recovering back to normal operations as soon as possible.

The 9 key steps in the response to ransomware incidents are listed below.

## Step 1: Quick Quarantine
- Determine which systems are infected with ransomware and quarantine them immediately.
- If there are machines that cannot be disconnected from the network, temporarily shut them down.
- In the Group Policy Object (GPO) setting, temporarily select "Block all connections" to block the spread

##Step 2: Triage
- Restoration according to the Business Continuity Plan
- According to different situations, carry out corresponding treatment:
 - If it is the worst scenario (dead device): recover as much as possible
 - If it is moderate to severe: Priority recovery
 - If it is mild: no special treatment

## Step 3: Ask for assistance
- Initially understand and document the situation, contact internal and external teams to expedite return to normalcy
- Notify the competent authority and contact the judicial investigation unit according to the nature of the enterprise organization.If the enterprise organization has purchased relevant insurance, contact the insurance unit

## Step 4: Evidence collection
- Collect memory dump, image, and logs for key machines (such as servers)
- Filter and collect suspicious commands and IP

##Step 5: Find records
- Inventory of anti-virus software, endpoint protection tools (EDR), intrusion prevention tools (IPS), etc., trying to find signs of early attacks

##Step 6: Handling general hosts
- If there are still hosts that have not been encrypted by ransomware, or hosts that have been encrypted by ransomware but have not yet been encrypted, disconnect it/them from the network immediately. After the company has clarified the infection process of the ransomware and removed the malicious programs, the host computer can be reconnected to the Internet.
- Use a different antivirus scan tool from the original one, and then check the system status again by using, e.g. Microsoft Safety Scanner, etc.

##Step 7: Handle Domain Control
- Change the passwords for all domain administrators
- Change the Krbtgt password twice (change it a second time in another 10 hours)
- Check whether there are unknown accounts added under Domain administrators and other high-privilege groups

##Step 8: Backup and Restore
- Restore data from offline backup
- Take a phased approach to service restoration, starting with essential services. Continue the process until data fully restored
- Back up the remaining data and rebuild the system

##Step 9: Find out which ransomware family it belongs to
- Find out which ransomware family it belongs to by checking the file extensions and the ransom note 
- Use this to find the corresponding decryption tool (but the chance of finding the tool is low)
- If the ransomware family has been mentioned before on reports or news by other units, we can get additional information on the intrusion methods and perhaps sources on relating attacker groups

 
 

>With solid technical background and frontline expertise, TeamT5 provides an in-depth investigation and response to real-world cyber-attacks. We identify and research the intruder attacks, the impacts and technical causes of the incidents, and recommend solutions or workarounds to assist our clients in recovery and remediation.
>
>If you have needs for incident response, please contact us: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)

 
 
*Image courtesy: [Unsplash](https://unsplash.com/)

9 Key Steps to Respond to the Ransomware Incident

勒索軟體(ransomware，又稱勒索病毒) 是近年來重大網路威脅之一，勒索軟體鎖定企業和各類組織進行攻擊，受害事件頻傳，不僅影響企業日常營運，更造成鉅額損失。

透過精準、合宜的應變步驟，以關鍵9步驟應變、處理勒索軟體事件，將可有效協助企業、組織有效控制損害，盡早恢復正常營運。

勒索軟體事件應變處理的關鍵9步驟，詳列如下。


##步驟1: 快速隔離
- 判定有那些系統被勒索軟體感染，並立刻進行隔離。
- 如果有不能施以斷網處置的機器，就將其暫時關機。
- 暫時透過 Group Policy Object(GPO) 設定，選擇 "Block all connections”，阻擋擴散

##步驟2: 檢傷分類
- 依據企業持續營運計畫(Business Continuity Plan)，進行復原
- 依據不同狀況，進行相對應的處置:
 - 若為死亡狀態: 盡可能復原
 - 若為中重症: 優先恢復
 - 若為輕症: 先不進行特別處理

##步驟3: 尋求協助
- 初步了解情況並記錄，聯繫內外部團隊，以加快恢復正常狀態
- 依企業組織的性質通報主管機關、聯繫司法調查單位；若企業組織有投保相關保險，則聯繫保險單位

##步驟4: 證據收集
- 針對重點機器(如: 伺服器)進行 Memory dump、Image、Log 的收集
- 過濾及收集可疑的指令、IP

##步驟5: 找尋紀錄
- 清查防毒軟體、端點防護工具(EDR)、入侵防護工具(IPS)等，試圖找到初期攻擊的跡象

##步驟6: 處理一般主機
- 若尚有未被勒索軟體加密的主機，或是勒索軟體進行加密、但尚未完成加密的主機，先進行斷網。待企業釐清勒索軟體的感染流程、移除惡意程式後，再-將主機連網。
- 使用不同於原始的防毒掃描工具，再清查一次系統狀況，如使用 Microsoft Safety Scanner。

##步驟7: 處理 Domain Control
- 將 Domain 管理員的密碼皆進行密碼更換
- 將 Krbtgt 密碼更改兩次 (兩次更改間隔10小時)
- 清查 Domain 管理員及其他高權限 Group 底下是否有被新增未知帳號

##步驟8: 備份還原
- 從離線備份，還原資料
- 採取分階段，進行服務復原，從必要服務開始進行恢復，直到全部恢復
- 備份剩餘資料，進行系統重建

##步驟9: 尋找勒索軟體所屬家族 
- 透過加密文件的副檔名、勒索文件，尋找遭受哪個勒索體家族攻擊
- 藉此尋找對應的解密工具 (但找到該工具的機率低)
- 如果該勒索軟體家族的攻擊，有經其他單位寫成報告或新聞，可以知道該族群慣用的入侵手法、來源

 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。

>若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
*首圖來源: [Unsplash](https://unsplash.com/)

遇到勒索軟體事件，關鍵應變 9 步驟

政府機関や、金融や製造などの注目度の高い分野の企業にとって、サイバー犯罪者がデータ、業務、従業員をターゲットにしているというメッセージは明らかです。

豊富なリソースを持つ個人やグループは、ますます洗練されたツールや専門知識を活用して、知的財産を盗み、インフラストラクチャやサービスを破壊し、企業に身代金を要求しています。

これらおよび関連分野における注目すべき侵害と開発には、次のようなものがあります。
- 2022年、ある報道機関は、タスマニアの年金基金「スピリットスーパー」のメンバー数千人の個人情報が漏洩したと報告しました。
- 地域的には、2022年にサイバー攻撃者が主要サプライヤーを侵害したため、トヨタは日本での製造業務の停止を余儀なくされました。
- メルボルンに本社を置く運輸・物流企業トール ホールディングスは、2020 年に 3 か月の間に Nefilim と MailTo として知られるグループからの 2 件の有害なランサムウェア攻撃に遭遇し、少なくとも 200GB の企業データが盗まれました。
- 近年、KeyBoyマルウェアに関与する中国のAPTグループGouSheは、オーストラリアを含むアジア太平洋地域の政府および軍事組織を標的にしています。 2015年9月、GouSheはマルウェアPoisonIvy RATでオーストラリア海軍関連機関を標的にしました。 さらに、2019年8月には、マルウェアQL_ASD_Shell RATを使用したオーストラリアに対する大規模な攻撃を傍受しました。
- Amoeba（APT41、Winnti Group、またはBariumとしても知られています）は、米国政府によって起訴された高度な持続的な脅威グループであり、このグループは中国の国家安全保障省と強いつながりを持っていることが指摘されており、オーストラリアの大規模な上場小売組織を標的にしています。
Amoeba独自のローダーであるChatloaderと、独自のテンプレートを備えたCobaltStrike Beaconの存在を特定しました。

## サイバー脅威に対する認識不足がもたらす結果

サイバー脅威がどこに現れるかを理解し、リスクを軽減するための戦略を導入できない場合、政府機関や企業にとって深刻な結果が生じる可能性があります。 セキュリティ事件を経験した組織や企業は、顧客や見込み客の意欲を失わせる深刻な風評被害を経験する可能性があるほか、財務上および運営上に深刻な影響を与える可能性のある懲罰的な規制措置を経験する可能性があります。

サイバーセキュリティ侵害に対する罰則強化の機運が高まる中、上院委員会は、最も重大な違反者に対する罰金を最大5,000万ドルに増加させる可能性のある既存のデータ侵害法案の修正案を提出しました。

## 脅威インテリジェンスを備えたサイバーセキュリティロードマップ

この文脈では当然のことながら、大多数の企業や組織は現在、サイバーセキュリティを主要なビジネスリスクとして評価しています。 Gartnerは、独自の調査と数千の企業とのやり取りに基づいて、このリスクの軽減に役立つ企業および組織向けのサイバーセキュリティに関するITロードマップを公開しました。 企業や組織は、リスク優先順位付けフレームワークを組み込んだ行動計画に取り組む前に、戦略を調整し、ビジネスケースを構築することから始めることを推奨しています。 この計画には、他の手順の中でも特に、脆弱性評価と侵入テストの実施、取締役会の支持の確保などが組み込まれている必要があります。


セキュリティ アーキテクチャ、ポリシーフレームワーク、及び、脅威インテリジェンスを組み込んだソリューションレイヤーを備えた、ビジネスまたは組織は特に、機能、ツール、テクノロジーを統合し、セキュリティチームの役割と責任を確立することにより、チーム構造を設計及び調整することを実行へ移すべきです。
 これには、スキルギャップを埋めるための重要なコンピテンシーの開発とトレーニング、および所有者間の説明責任を促進するための指標とインセンティブの使用も含まれる必要があります。

Gartner 社によると、次のステップは、重要なインシデント対応能力や侵害発生時の行動計画の開発などの取り組みを通じてプログラムを構築および成熟させ、高度な脅威を監視して対抗するためのプログラム構造を開発することです。 最後に、企業や組織は、サイバーセキュリティプログラムの価値を従業員や取締役会に伝え、指標を追跡し、改善を推進するためのフィードバックを得る計画を作成する必要があります。


TeamT5 では、サイバーセキュリティのロードマップには、企業や組織が攻撃する可能性のあるグループや個人を特定し、効果的な防御を実装する能力をどの程度備えているかを評価することが含まれるべきであると考えています。 アナリストからの詳細なレポートと、潜在的な攻撃者に対抗するためのさまざまな技術ツールを備えた脅威インテリジェンスプラットフォームは、強力な第一歩です。 TeamT5を使用すると、ユーザーは敵が誰であるか、どのような戦術、テクニック、手順に注意すべきかを特定できます。

[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website) を、感染リスクを最小限に抑えるためにランサムウェアを事前に阻止する脅威分析および対応プラットフォームである ThreatSonar Anti-Ransomware や、侵害された環境で脅威を追跡する ThreatSonar などのソリューションと組み合わせると、脅威が来る可能性が高い場所、それらを止める方法、成功した攻撃の影響を軽減する方法、を理解するのに役立ちます。

 
 

>[TeamT5 の Web](https://teamt5.org/jp/?utm_source=blog&utm_medium=website)サイトにアクセスして、従業員、システム、データが誰に狙われているかを企業がどのように理解して、包括的な防御策を開発できるかを学びましょう。

サイバー犯罪者はあなたのビジネスを狙っていますか？ それらを見つけて阻止する方法は次のとおりです

For government organisations and businesses in high-profile sectors such as finance or manufacturing, the message is clear: cyber criminals are targeting your data, your operations and your people. Well-resourced individuals and groups are applying increasingly sophisticated tools and expertise to steal intellectual property, disrupt infrastructure and services and hold businesses to ransom.
 
Notable breaches and developments in these and related sectors include:
- In 2022, a news outlet reported that the personal details of thousands of members of Tasmanian superannuation fund Spirit Super had been compromised
- Regionally, in 2022, Toyota was forced to suspend manufacturing operations in Japan after cyberattackers compromised a key supplier.
- In 2020, Melbourne-headquartered transport and logistics business Toll Holdings experienced two damaging ransomware attacks in the space of three months in 2020, from groups known as Nefilim and MailTo, and saw at least 200GB of corporate data stolen. 
- In recent years, Chinese APT group GouShe, responsible for the KeyBoy malware, has targeted government and military organisations across the Asia-Pacific, including Australia. In September 2015, GouShe targeted Australian Navy-related bodies with the malware PoisonIvy RAT. In addition, in August 2019, we intercepted a massive attack against Australia that used the malware QL_ASD_Shell RAT.
- Amoeba (also known as APT41, Winnti Group or Barium), an Advanced Persistent Threat group indicted by the United States Government, which pointed out the group has strong connections to China’s Ministry of State Security, has targeted a large listed retail organisation in Australia. We identified the presence of Amoeba’s proprietary loader, Chatloader, and a CobaltStrike Beacon with a unique template.

##Consequences of failing to understand cyber-threats

The consequences for government organisations and businesses of failing to understand where cyber threats may emerge, and implementing strategies to mitigate risk, may be severe. Organisations and businesses that experience breaches may experience serious reputational damage that dissuades customers and prospects, as well as punitive regulatory action that may have deep financial and operational consequences. 
 
Growing momentum for higher penalties for cyber security breaches has resulted in the Autralia senate committee tabling an amendment to existing data breach legislation that may increase penalties for the worst offenders to up to $50 million. 

##A cybersecurity roadmap that features threat intelligence
Unsurprisingly in this context, the vast majority of businesses and organisations now rate cybersecurity as a key business risk. Gartner has published an IT Roadmap for Cybersecurity for businesses and organisations to help mitigate this risk, based on its own research and interactions with thousands of companies. The firm recommends businesses and organisations should start by aligning strategies and building business cases before working on action plans that incorporate risk prioritisation frameworks. This plan should incorporate conducting a vulnerability assessment and penetration testing and securing board backing, among other steps.
 
With a security architecture, policy framework and solution layer incorporating threat intelligence deployed, the business or organisation should move to initiating execution–in particular designing and adjusting the team structure by integrating capabilities, tools, technologies and establishing security team roles and responsibilities. This should also include developing critical competencies and training to close skills gaps, and using metrics and incentives to drive accountability among owners. 
 
The next step, Gartner says, is to build and mature the program through initiatives such as developing a critical incident response capability and an action plan in case of breaches, and develop a program structure to monitor and combat advanced threats. Finally, the business or organisation should create a plan to communicate the value of the cybersecurity program to its people and the board, and track metrics and obtain feedback to drive improvement.         

At TeamT5, we believe any cybersecurity roadmap should include evaluating how well a business or organisation is equipped to  identify the groups or individuals who may attack them and implement effective defences. A threat intelligence platform that features detailed reports from analysts and a wide variety of technical tools to combat potential attackers is a robust first step. ThreatVision from TeamT5 enables users to identify who their adversaries are and what tactics, techniques and procedures to look out for. 
 
Combining [ThreatVision](https://teamt5.org/en/products/threatvision/) with solutions such as [ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/), a threat analysis and response platform that proactively contains ransomware to minimise infection risks, and ThreatSonar, which hunts down threats in a breached environment, can help an organisation understand where threats are likely to come from, how to stop them and how to mitigate the impact of any successful attack. 


>Visit [TeamT5 website](https://teamt5.org/en/) to learn how your business can understand who is targeting your employees, systems and data.


Do cyber criminals have your business in their sights? Here’s how to find out and stop them 

對於金融或製造業等知名行業的政府組織和企業來說，趨勢很明確：網路犯罪分子正在瞄準您的數據、您的日常營運和您的員工。

資源豐富的個人和團體正在使用日益複雜的工具和專業知識來竊取知識產權、破壞基礎設施和服務並勒索企業。

這些及相關領域的顯著入侵行為包括：
- 2022 年，一家新聞媒體報導稱，塔斯馬尼亞養老基金 Spirit Super 的數千名成員的個人資訊遭到洩露。
- 從地區來看，2022 年，網路攻擊者入侵了一家關鍵供應商後，豐田被迫暫停在日本的製造業務。
- 2020年，總部位於墨爾本的運輸和物流企業 Toll Holdings 在2020年的三個月內遭遇了兩次破壞性的勒索軟體攻擊，攻擊者分別是 Nefilim 和 MailTo，並導致至少 200GB 的企業數據被盜。
- 近年來，負責 KeyBoy 惡意軟體的中國 APT 組織 GouShe 已針對包括澳洲在內的亞太地區的政府和軍事組織。 2015 年 9 月，GouShe 使用惡意軟體 PoisonIvy RAT 將澳洲海軍相關機構作為目標。 此外，2019 年 8 月，我們攔截了一次針對澳大利亞的大規模攻擊，該攻擊使用了惡意軟體 QL_ASD_Shell RAT。
- Amoeba（也稱為 APT41、Winnti Group 或 Barium）是一個被美國政府起訴的高級持續威脅組織，並指出該組織與中國國家安全部有密切聯繫，其目標是澳洲一家大型上市零售組織。 我們發現了 Amoeba 專有的加載程序 Chatloader 和具有獨特模板的 CobaltStrike Beacon。

## 企業未深度了解資安威脅的可能後果

如果政府組織和企業無法了解網路威脅可能出現的地方，並實施降低風險的策略，後果可能會很嚴重。 遭受入侵的組織和企業可能會遭受嚴重的聲譽損害，令客戶和潛在客戶取消往來關係；組織和企業並會受到政府的懲罰、調查，這也可能會產生嚴重的財務和營運後果。

對網路安全違規行為加大處罰力度的趨勢不斷增強，澳洲參議院委員會提出了一項對現有數據洩露立法的修正案，該修正案可能將對最嚴重違規者的處罰提高至最高 5,000 萬美元。

## 以威脅情資為特色的網路安全路線圖

而在這種背景下，絕大多數企業和組織現在將網路安全視為關鍵的業務風險。 Gartner 根據自己的研究以及與數千家公司的互動，為企業和組織發布了網路安全 IT 路線圖，以幫助減輕這一風險。 該公司建議企業和組織應首先調整戰略並建構正常營運藍圖，然後再規劃包含風險優先級框架的行動計劃，而該計劃應包括進行漏洞評估、滲透測試以及確保董事會支持等步驟。

通過部署包含威脅情資的安全架構、策略框架和解決方案層，企業或組織應該開始執行，特別是整合功能、工具、技術以及建立安全團隊角色和職責等資訊，來設計和調整團隊結構。 這還應包括培養團隊成員的關鍵能力、進行教育訓練，以縮小技能差距，並使用指標和激勵措施來推動所有成員之間的當責態度。

Gartner 表示，下一步是掌握關鍵事件回應能力，和制訂發生入侵時的行動計劃，並開發一個具體措施來監控和應對進階威脅。 最後，企業或組織應制訂計劃，向其員工和董事會傳達網路安全計劃的價值，並追蹤各項指標、獲得回饋意見，以進一步推動資安措施改進、優化。

TeamT5 認為任何網路安全路線圖都應包括評估企業或組織是否有能力識別可能攻擊他們的團體或個人並實施有效的防禦。 我們推出的威脅情資平台  [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website) 包含分析師的詳細報告和各種技術工具來對抗潛在的攻擊者，這是踏出資安防禦關鍵的第一步； ThreatVision 更可協助用戶能夠識別他們面對的惡意攻擊對手是誰，及需要注意哪些攻擊策略、技術和程序(TTPs)。

將 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website) 與 [ThreatSonar Anti-Ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)（TeamT5 推出的端點威脅鑑識分析與回應平台，以最大程度地降低勒索軟體或惡意軟體的感染風險）和 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blogs&utm_medium=website)（在被入侵的環境中追捕威脅）等解決方案整合，可以幫助組織了解威脅可能來自何處，如何阻止它們及如何減輕任何成功攻擊的影響。

歡迎進一步瀏覽 [TeamT5 網站](https://teamt5.org/tw/?utm_source=blogs&utm_medium=website)，了解您的企業如何掌握誰在針對您的員工、系統和數據，以便進行周全的資安防禦。



網路犯罪分子會鎖定您的企業嗎？ 如何找出網路威脅並阻止?

ランサムウェアが企業をターゲットにすることにより多大な損害が発生しています。それは企業の通常業務を妨害するだけでなく、企業ブランドのにも損害を与えます。
TeamT5 のインシデント対応チームの専門的な経験によると、被害を効果的に制御し、できるだけ早く通常の業務を再開するには、2 つの主要なレベルの対応措置を採用することが推奨されます。

## レベル 1: 技術的側面
社内外の技術チームは、ランサムウェアインシデントに適切に対処するために次の措置を講じています。
1. 感染源を隔離し、被害のレベルを制御する。
2. チームは、インシデントに関連する包括的な情報を収集する必要があります。インシデントのプロセスを調査しシステムの脆弱性にパッチを当てるのに役立ちます。
3. チームはサイバーセキュリティの専門家を雇って効果的な回復措置を実施できます。これは企業と組織の運用が正しい軌道に戻るのに役立ちます。

## レベル 2: マネジメントレベル
当社経営陣（または協力チーム）は、ランサムウェア事件がもたらした目に見えない影響およびブランドへの影響に適切に対処するため、以下の措置を講じます。

1. インシデントによる被害を評価および計算する。
2. 身代金について交渉する。ただし同時に、一部の専門家は身代金の交渉や支払いを行わないことを提案する。
3. 対外関係を管理し、ブランドイメージへの悪影響を軽減する。

 
 
>TeamT5 チームは、長年にわたりハッカー グループの侵入行動の研究と分析を行っており、国内外の第一線の情報セキュリティ インシデントの処理において豊富な経験を持っています。 情報セキュリティインシデントが発生した場合、ハッキングされたサイトと過去の軌跡の包括的な分析を迅速に完了し、攻撃者の侵入プロセスと手法を発見し、インシデント処理のための詳細な分析と提案を提供し、情報の復元と改善を支援します。
>
>情報セキュリティインシデントの処理と対応が必要な場合は、相談フォームにご記入ください: 
[https://teamt5.org/jp/request-information](https://teamt5.org/jp/request-information/?utm_source=blog&utm_medium=website)

ランサムウェア攻撃にどう対処するか?

Ransomware targets enterprises can cause great damages. It not only interferes with enterprises’ daily operation, but also damages brands’ reputation.

Based on TeamT5 incident response team’s professional experience, we suggest enterprises can go by 2 levels of measurements. By doing so, you will be able to effectively control the damage and bring business back to normal soon.


##Technology Level
Enterprises’ internal team or vendors should take the following measures in order to lower the impacts of ransomware attacks.

1. Team should isolate the attack source in order to control damages.
2. Team should collect related comprehensive info of the attack / incident. It’ll help the team to investigate the process of the incident and patch the system vulnerabilities.
3. Team can hire cybersecurity experts to conduct effective recovery measures. It’ll help enterprises & organizations’ operations back on the right track. 


##Management Level
Enterprises’ management team (or partners) should take the following measures in order to better respond to invisible impacts (e.g. negative brand image).

1. To evaluate and calculate damages brought by the attack / incident.
2. To negotiate the ransom. However, some experts advise enterprises & organizations should neither contact the attackers nor pay the ransom.
3. To work on public relations in order to lower the negative impact on brand image.


 
 

>With solid technical background and frontline expertise, TeamT5 provides an in-depth investigation and responses to real-world cyber-attacks. We identify and research the intruder attacks, the impacts and technical causes of the incidents, and recommend solutions or workarounds to assist our clients in recovery and remediation.

>If you have needs for incident response, please contact us through: 
[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)

How to Deal with Ransomware Attacks?

勒索軟體(ransomware，又稱勒索病毒) 針對企業和各類組織的攻擊事件頻傳，不僅影響日常營運，更造成鉅額損失。

根據 TeamT5 杜浦數位安全的資安事件應變團隊(incident response team)的專業經驗，宜採取2大層面的應變措施，有效控制損害，盡早恢復正常營運。

##層面1: 技術面
由公司內、外的技術團隊進行下列措施，妥善處理勒索軟體事件:
1. 隔離感染來源，控制損害層面
2. 收集具體事件資料，詳細調查事件發生經過，堵住系統漏洞
3. 由專家進行有效復原措施，協助企業持續營運

##層面2: 管理面
由公司管理團隊(或與協力團隊)進行下列措施，妥善應對勒索軟體事件帶來的無形衝擊、品牌影響:
1. 評估與計算事件帶來的損害
2. 談判勒索贖金，雖然同時部分專家也會提出不談判、不支付贖金的建議
3. 經營對外關係，降低對品牌形象的負面衝擊
 
 
![how-to-response-ransomware-attacks_pic1.png](https://uploads.teamt5.org/upload/original/how-to-response-ransomware-attacks_pic1.png)
 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。

若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
首圖來源: [StockAI](https://www.stockai.com/)

如何應變勒索軟體攻擊?

COVID-19（新型コロナウイルス感染症）が世界中で広まりその対策が行われていく中で、感染の有無を確認するための検査キットが必要不可欠なツールになりました。同じように組織に対するサイバー攻撃においても、迅速に感染の有無を判断し、被害状況を把握して適切な対処に進める検査ツールの必要性が高まっています。

##台湾のサイバーセキュリティ事情
アメリカの下院議長ナンシー・ペロシ氏の台湾への電撃的な訪問は台湾を取り巻く政治情報に大きな影響を与え、台湾の公共機関・民間機関が多数のサイバー攻撃に見舞われることになりました。

サイバー攻撃が組織に侵入する手法は高度化しており、攻撃者は様々な標的に対して計画的かつ継続的に高度なサイバー攻撃(APT攻撃)を実行してきています。

今回のペロシ氏の訪問では、人々の耳目を集める街頭のディスプレイシステムへの侵入とコンテンツ改ざんだけでなく、システムの暗号化やそれに伴う恐喝などの被害が発生し、台湾の企業は金銭的被害・レピュテーション被害・機密情報の損壊や漏洩など様々な被害を受けました。

##日本におけるサイバー攻撃の近況
日本におけるサイバー攻撃として、北朝鮮のハッカー集団「ラザルス（Lazarus）」による継続的で高度なサイバー攻撃（APT）があります。これらのサイバー攻撃は、主に日本の組織を標的としています。

サイバー犯罪グループの攻撃手法は日々高度化しています。組織システムへの侵入に加え、データの暗号化や身代金の要求なども確認されており、組織は金銭的被害やレピュテーション被害、機密情報の破壊や漏えいによって多くの被害を受けています。

これらの攻撃被害は、攻撃の初期段階で組織の端末で検査キットにより感染の有無を把握することで、損失を大幅に減らすことが可能です。

##サイバー脅威検査ツール「ThreatSonar」
TeamT5は長年、APT攻撃を行うハッカー集団の追跡やサイバー脅威情報の収集を行い、その成果としてサイバー脅威検査ツール「ThreatSonar」を開発しました。台湾のマネージドセキュリティサービス業者（MSSP）の実に90%以上が「ThreatSonar」を使用し、顧客端末の定期的な検査をして状況を診断するとともに、異常が発見されたら迅速に顧客へ被害拡大防止措置を提供しています。

###異常発見時の詳細調査
サイバー攻撃による異常が発見された場合、「ThreatSonar」は即座に被害端末の検査を行い、インシデントの全体像を把握します。収集したデータに基づいてレポートが作成され、セキュリティ責任者による状況把握や対処の判断を支援します。

###定期的な検査で早期発見・早期対策を実現
従来のセキュリティ機器は単一的な検知ロジックに基づいているため、サイバー攻撃を行う攻撃者はすでにセキュリティ機器の検知を回避して侵入している可能性があります。「ThreatSonar」での定期的な検査によって、潜在するマルウェアを発見し迅速に対処することによって、APT攻撃の脅威を早期に阻止することができます。

###アジア地域における脅威インテリジェンスを把握し、サイバー攻撃の状況を把握する
刻一刻と変化するAPT攻撃を把握するには、適切に情報を得てその情報を使いこなすことがカギとなります。TeamT5の強力な分析・研究チームは、アジア地域におけるサイバーセキュリティインシデントに焦点を当て、ハッカー集団や攻撃手法について日々調査・研究をしています。TeamT5のインテリジェンスの活用とTeamT5の検査ツールの実施が、組織のサイバーセキュリティの確保に大きく貢献します。


![threatsonar-as-rapid-test_pic1](https://uploads.teamt5.org/upload/original/threatsonar-as-rapid-test_pic1.png)
<center>組織のサイバー攻撃対策も感染症対策と同様に多層防御が必要です</center>

組織のサイバー攻撃対策も感染症対策と同様に多層防御が必要です

經過幾年與COVID-19病毒共存的日子，快篩工具已經成為快速診斷的必備工具。
那麼當企業的電腦疑似受到攻擊或入侵，是否也有這樣的工具能夠快速了解入侵狀況，甚至評估受害程度，以進行最佳處置呢？

##台灣的資安近況
美國眾議院議長裴洛西旋風訪台，牽動政治情勢，台灣公私部門亦遭受大量駭客攻擊，讓網路戰問題浮出檯面，成全台熱議焦點。

網路犯罪集團對於企業發動的入侵攻擊手法日益進步，針對不同產業目標進行有計畫性的進階持續性滲透攻擊(APT)，除了本次高調竄改車站、超商顯示畫面，更甚者透過加密、勒索等行動，使企業蒙受金錢、名譽和機密技術的龐大損失。

如果能在攻擊發生的初期，及早對受害電腦進行快篩，我們將有機會大幅降低損失程度！


##ThreatSonar 威脅鑑識工具
TeamT5 杜浦數位安全長年追蹤及掌握 APT 駭客族群與威脅情資，並開發 ThreatSonar 威脅鑑識工具，在台灣有超過 90% 的 託管安全服務商(MSSP)業者使用 ThreatSonar 為企業電腦進行入侵後的快篩診斷，或是定期的掃描健診。

###事發第一時間深入排查
當企業電腦面臨駭客族群的入侵攻擊，ThreatSonar可以在第一時間對受害電腦進行全面掃描，還原事件全貌，藉由收集到的資料與紀錄提供快篩報告，讓資訊人員掌握受害狀況，並進行最佳處置。

###定期健診，提早發現及早制止
面對傳統資安設備單一、片面的偵測邏輯，APT 攻擊者或團體很可能早已繞過傳統資安防禦設備入侵環境並伺機而動，定期的完整掃描健診，讓我們有機會在威脅擴散前發現潛伏的惡意程式，及早出手制止，以阻擋 APT 威脅。

###掌握亞太情資，洞察敵情
在變化萬千的APT攻擊情境中，掌握情資是洞察敵人的關鍵！TeamT5 強大的分析研究團隊，專注於亞太地區資安事件、駭客族群及攻擊手法的研究。結合情資的優勢與快篩健診工具的全面診斷，是企業電腦的最佳守護者！
 
> TeamT5 ThreatSonar 企業威脅鑑識工具，歡迎企業、MSSP業者洽詢 
>
> 📧 諮詢表單: https://teamt5.org/tw/request-information/
 
 
 
- 關鍵字說明：進階持續性滲透攻擊(advanced persistent threat, APT)
 
進階持續性滲透攻擊(APT)又稱高級持續性威脅、先進持續性威脅等，是指隱匿而持久的電腦入侵過程。通常是精心策劃，針對特定的目標(出於商業或政治動機)，如特定組織或國家，並在長時間內保持自身行動的高隱蔽性。

- 參考資料
 
[台鐵、小7、公務機關 出現罵裴洛西簡體字// 廣告商用中國軟體 看板遇駭(自由時報)](https://news.ltn.com.tw/news/politics/paper/1532410)

防駭如防疫 企業電腦也應做快篩

高度標的型攻撃 (英：Advanced Persistent Threat) は、洗練されたレベルと重要なリソースを持つ攻撃者によって行われます。これらはビジネス又は、組織の情報技術インフラストラクチャ内においてその存在を確立し、拡大するという典型的な目的を達成するための機会を作りだします。

攻撃プロセス中、彼らは自分たちの行為を隠すために最善を尽くします。被害者は、最初に攻撃を見つけることができず、経済的または他の種類の損失に直面する可能性があります。


APT (Advanced Persistent Threat) 高度標的型攻撃とは何ですか?

Advanced Persistent Threat(APT) is conducted by adversaries with sophisticated levels of expertise and significant resources. They generate opportunities to achieve its business or political objectives which are typically to establish and extend its presence within the information technology infrastructure of organizations.

During the attacking process, they do their best to hide their acts. Victims might not be able to find the attacks at the beginning and face economic or other types of losses.


 
 
>TeamT5 consists of top cyber threat analysts. Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and cyber defense solutions to clients in the USA, Japan, and Taiwan. We help these enterprises and organizations be away of APT attacks and have smooth daily operation.
>
> Contact us for more information: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

What is Advanced Persistent Threat(APT)?

進階持續性威脅（advanced persistent threat, APT）， 又稱高級持續性威脅、先進持續性威脅等，是指隱匿而持久的電腦入侵過程。

通常是有心人士精心策劃，出於商業或政治動機，針對特定的目標，如特定組織或國家，進行長期攻擊，此類型攻擊特點之一是在長時間內保持自身行動的高隱蔽性，使受害者難以察覺。

 
 

>TeamT5 杜浦數位安全專精網路威脅研究，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>>
>歡迎與我們聯絡，展開防禦進階持續性威脅（APT）的第一步：[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

什麼是APT(advanced persistent threat) 進階持續性威脅?

##Introduction
Over the last few years, Network Attached Storage (NAS) has seen a dramatic increase in popularity, especially during the pandemic. It is now commonplace to see a NAS box in the office of most small or medium businesses. 
 
With the rise of these NAS servers, we have begun to see a huge increase in the number of DDNS domains associated with popular NAS providers such as Synology and QNAP. 
 
In fact, during our research, we were able to estimate that there were at least three million active NAS units from Synology available on the world wide web. QNAP, by contrast, had a much lower market share of only ten thousand. 


##More NAS Servers = More Attacks
Unsurprisingly, this increase in NAS servers has seen a corresponding increase in cyberattacks. Perhaps the most famous to date was the [Synolocke](www.synology.com/en-global/security/advisory/SynoLocker)r ransomware attack of 2014. 

And, in the last 12 months, we can see that QNAP has published at least 37 advisories marked with a severity level between Medium to Critical. Specifically, these mentioned several ransomware campaigns involving: -
 
[DeadBolt](https://www.qnap.com/en/security-advisory/qsa-22-24), [eCh0raix](https://www.qnap.com/go/security-advisory/qsa-21-18), [Checkmate](https://www.qnap.com/go/security-advisory/qsa-22-21). 
 
In addition, other types of malware or PUPs such as crypto miners and/or botnets were spotted on these systems.


 
![202210_CTI_blog_pic1.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic1.png)
 

Meanwhile, in the same timeframe, Synology had published around 18 advisories marked between Moderate to Critical. 

And, whilst it is clear that Synology NAS devices suffered from fewer security incidents than QNAP, they were still unfortunately targeted by ransomware gangs that abused the critical [Netatalk-related vulnerability](https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/).

 
![202210_CTI_blog_pic2.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic2.png)
 

##Xpenology AND QuickConnect
Unfortunately, Synology also had another issue to worry about - Xpenology, also known as 黑群暉 in the Taiwanese community. In a nutshell, this custom bootloader allows non-standard hardware to boot into Synology's Linux-based DSM (Disk Station Manager) system.

On top of Xpenology, Synology also had to worry about the emerging threat of QuickConnect abuse. 

QuickConnect allows the NAS to be opened to WAN without any additional port forwarding setup, and the NAS is assigned a custom subdomain under ```synology.me``` or other QuickConnect-related domains during this process. 

Normally, QuickConnect requires a matching combination between the NIC MAC address and the serial number in order to function. However, the community at large had figured out a way to generate the relevant credentials required to bypass this check a few years back, though most of them are likely patched by now.

 
![202210_CTI_blog_pic3.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic3.png)
 

##Suspicious Activity in NAS Servers
Why specifically does this matter, though? During our investigations against cases that were related to various Chinese adversaries, we found that some of the IP addresses related to the incidents were directly related to various Synology QuickConnect-related subdomains. 

For example, at some point in our investigation, we stumbled across the IP ```42.3.63[.]80```. This IP address was resolved to ```johndans[.]diskstation.me``` and ```ediskwang[.]synology.me``` shortly prior to the security incident. Both these subdomains had extremely suspicious DNS records, jumping in rapid succession between various IP addresses from China and Hong Kong. 

By following the relevant IP addresses, we realized some of the IP addresses resolved were previously discovered in other cases that were directly linked to various Chinese adversaries, such as Amoeba (APT41) and SLIME40 (FamousSparrow). Based on our internal research, we came to the conclusion that these subdomains were likely normal NAS servers taken hostage by the APTs.

 
![202210_CTI_blog_pic4_watermark.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic4_watermark.png)
 

The discovery we made above led us to speculate on other possibilities. What if a threat actor were to host their own Synology proxy stations using both of the attack vectors mentioned above? 

To validate our suspicion, we gathered around ~10,000 ```synology.me``` and ~5,000 ```myqnapcloud.com``` subdomains as our dataset and filtered them based on the following conditions,
- Is the NAS hosted on a known VPS ASN?
- Is the NAS subdomain seen traveling across various different country?
- Are multiple NAS subdomains resolving to the same IP addresses?

 
![202210_CTI_blog_pic5_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic5_watermark.jpg)
 

From the queries, we noticed there were indeed several suspicious-looking NAS DDNS subdomains. For instance, in the following example, the NAS was seen traveling between EU and the East Asian region for several years with the resolve record for each being as short as two days. The device was hosted between various cloud providers, such as xTom, Microsoft Azure, and DMIT Cloud.

 
![202210_CTI_blog_pic6_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic6_watermark.jpg)
 

In another instance, we noticed one of the NAS devices was traveling between Hong Kong, Singapore, Taiwan, and China at various IP addresses owned by cloud hosting providers such as Linode, AWS, Cloudflare, Microsoft Azure, and more. 

While we cannot conclusively attribute any of these NAS instances as necessarily “malicious” - as these instances could have simply be behind a network-wide VPN in some home solutions - we could at the very least mark them as relatively suspicious compared to the standard use cases of NAS DDNS.

 
![202210_CTI_blog_pic7_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic7_watermark.jpg)
 

##The Threat Landscape is Evolving. Makes sure you keep up.
To sum up this research, we have looked at the traditional threat landscape that is present in the NAS industry (e.g., ransomware, cryptominers, PUPs, etc.) and how it may evolve into another type of threat with the use of convenient features such as QuickConnect. 

One thing is clear.The threat landscape of NAS devices may still evolve over time. As such, we encourage our readers and our customers to regularly update their device firmware and to check if there are any irregularities with their home devices.

 
 

>本篇部落格首度發表於 HITCON PEACE 2022。
>本篇部落格為我們於 HITCON PEACE 2022 [「Your NAS is not my BOT」](https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/) 演講的精華摘要。
 - 觀賞完整演講影片(中文): [連結](https://youtu.be/joxEpQZDQhY)
 - 下載演講簡報(英文): [連結](https://hitcon.org/2022/slides/Your%20NAS%20is%20not%20my%20BOT.pdf)

 
 

*首圖來源: [Pexels](https://www.pexels.com/)

Protect Your NAS From Nasty Attacks (Your NAS is not my BOT)

##Introduction
Over the last few years, Network Attached Storage (NAS) has seen a dramatic increase in popularity, especially during the pandemic. It is now commonplace to see a NAS box in the office of most small or medium businesses. 
 
With the rise of these NAS servers, we have begun to see a huge increase in the number of DDNS domains associated with popular NAS providers such as Synology and QNAP. 
 
In fact, during our research, we were able to estimate that there were at least three million active NAS units from Synology available on the world wide web. QNAP, by contrast, had a much lower market share of only ten thousand. 


##More NAS Servers = More Attacks
Unsurprisingly, this increase in NAS servers has seen a corresponding increase in cyberattacks. Perhaps the most famous to date was the [Synolocker](www.synology.com/en-global/security/advisory/SynoLocker) ransomware attack of 2014. 

And, in the last 12 months, we can see that QNAP has published at least 37 advisories marked with a severity level between Medium to Critical. Specifically, these mentioned several ransomware campaigns involving: -
 
[DeadBolt](https://www.qnap.com/en/security-advisory/qsa-22-24), 
[eCh0raix](https://www.qnap.com/go/security-advisory/qsa-21-18), 
[Checkmate](https://www.qnap.com/go/security-advisory/qsa-22-21). 
 
In addition, other types of malware or PUPs such as crypto miners and/or botnets were spotted on these systems.


 
![202210_CTI_blog_pic1.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic1.png)
 

Meanwhile, in the same timeframe, Synology had published around 18 advisories marked between Moderate to Critical. 

And, whilst it is clear that Synology NAS devices suffered from fewer security incidents than QNAP, they were still unfortunately targeted by ransomware gangs that abused the critical [Netatalk-related vulnerability](https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/).

 
![202210_CTI_blog_pic2.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic2.png)
 

##Xpenology AND QuickConnect
Unfortunately, Synology also had another issue to worry about - Xpenology, also known as 黑群暉 in the Taiwanese community. In a nutshell, this custom bootloader allows non-standard hardware to boot into Synology's Linux-based DSM (Disk Station Manager) system.

On top of Xpenology, Synology also had to worry about the emerging threat of QuickConnect abuse. 

QuickConnect allows the NAS to be opened to WAN without any additional port forwarding setup, and the NAS is assigned a custom subdomain under ```synology.me``` or other QuickConnect-related domains during this process. 

Normally, QuickConnect requires a matching combination between the NIC MAC address and the serial number in order to function. However, the community at large had figured out a way to generate the relevant credentials required to bypass this check a few years back, though most of them are likely patched by now.

 
![202210_CTI_blog_pic3.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic3.png)
 

##Suspicious Activity in NAS Servers
Why specifically does this matter, though? During our investigations against cases that were related to various Chinese adversaries, we found that some of the IP addresses related to the incidents were directly related to various Synology QuickConnect-related subdomains. 

For example, at some point in our investigation, we stumbled across the IP ```42.3.63[.]80```. This IP address was resolved to ```johndans[.]diskstation.me``` and ```ediskwang[.]synology.me``` shortly prior to the security incident. Both these subdomains had extremely suspicious DNS records, jumping in rapid succession between various IP addresses from China and Hong Kong. 

By following the relevant IP addresses, we realized some of the IP addresses resolved were previously discovered in other cases that were directly linked to various Chinese adversaries, such as Amoeba (APT41) and SLIME40 (FamousSparrow). Based on our internal research, we came to the conclusion that these subdomains were likely normal NAS servers taken hostage by the APTs.

 
![202210_CTI_blog_pic4_watermark.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic4_watermark.png)
 

The discovery we made above led us to speculate on other possibilities. What if a threat actor were to host their own Synology proxy stations using both of the attack vectors mentioned above? 

To validate our suspicion, we gathered around ~10,000 ```synology.me``` and ~5,000 ```myqnapcloud.com``` subdomains as our dataset and filtered them based on the following conditions,
- Is the NAS hosted on a known VPS ASN?
- Is the NAS subdomain seen traveling across various different country?
- Are multiple NAS subdomains resolving to the same IP addresses?

 
![202210_CTI_blog_pic5_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic5_watermark.jpg)
 

From the queries, we noticed there were indeed several suspicious-looking NAS DDNS subdomains. For instance, in the following example, the NAS was seen traveling between EU and the East Asian region for several years with the resolve record for each being as short as two days. The device was hosted between various cloud providers, such as xTom, Microsoft Azure, and DMIT Cloud.

 
![202210_CTI_blog_pic6_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic6_watermark.jpg)
 

In another instance, we noticed one of the NAS devices was traveling between Hong Kong, Singapore, Taiwan, and China at various IP addresses owned by cloud hosting providers such as Linode, AWS, Cloudflare, Microsoft Azure, and more. 

While we cannot conclusively attribute any of these NAS instances as necessarily “malicious” - as these instances could have simply be behind a network-wide VPN in some home solutions - we could at the very least mark them as relatively suspicious compared to the standard use cases of NAS DDNS.

 
![202210_CTI_blog_pic7_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic7_watermark.jpg)
 

##The Threat Landscape is Evolving. Makes sure you keep up.
To sum up this research, we have looked at the traditional threat landscape that is present in the NAS industry (e.g., ransomware, cryptominers, PUPs, etc.) and how it may evolve into another type of threat with the use of convenient features such as QuickConnect. 

One thing is clear.The threat landscape of NAS devices may still evolve over time. As such, we encourage our readers and our customers to regularly update their device firmware and to check if there are any irregularities with their home devices.

 
 

>The research is first published in HITCON PEACE 2022.
>This blog is the key abstract of our speech in HITCON PEACE 2022, ["Your NAS is not my BOT"](https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/).
 - To watch the whole speech(in Mandarin): [link](https://youtu.be/joxEpQZDQhY)
 - To download the slide(in English): [link](https://hitcon.org/2022/slides/Your%20NAS%20is%20not%20my%20BOT.pdf)

 
 

*Image courtesy of [Pexels](https://www.pexels.com/)

##はじめに
過去数年間にわたり、ネットワークアタッチドストレージ（NAS）は、特にパンデミックの最中、急激に普及しました。今や、ほとんどの中小企業のオフィスで、NASボックスが見られるようになっています。 
 
NASサーバーが普及しつつあり、SynologyやQNAPなど、大手NASプロバイダーに関係するDDNSドメインの数が急激に伸びています。 
 
実際、今回の調査の結果、ワールドワイドウェブでは少なくとも300万台のSynology製NASユニットが稼働していると、当社は推定しています。一方、QNAPはわずか1万台と、極めて低い市場シェアに留まっています。


##NASサーバーの増加 = 攻撃の増加
当然のごとく、NASサーバーが増えるにつれ、サイバー攻撃も増加しています。これまでで最も有名な攻撃例は、2014年に起こった[Synolocker](www.synology.com/en-global/security/advisory/SynoLocker)ランサムウェア攻撃でしょう。 

また、過去12か月にわたり、QNAPは中程度から緊急までの深刻度レベルにマーキングされた警報を少なくとも37件、発しています。特に、以下の数種類のランサムウェア活動が報告されています。-
 
[DeadBolt](https://www.qnap.com/en/security-advisory/qsa-22-24)、
[eCh0raix](https://www.qnap.com/go/security-advisory/qsa-21-18)、
[Checkmate](https://www.qnap.com/go/security-advisory/qsa-22-21)。
 
加えて、仮想通貨のマイナーおよび/またはボットネットなど、他の種類のマルウェアやPUPも、これらシステムで報告されています。


 
![202210_CTI_blog_pic1.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic1.png)
 

Meanwhile, in the same timeframe, Synology had published around 18 advisories marked between Moderate to Critical. 

一方、同時期にSynologyは中程度から緊急までの深刻度レベルにマーキングされた警報を約18件、発しています。 
 
SynologyのNASデバイスはQNAPほどのセキュリティ侵害を受けていないことは明白ですが、それでも、重要な[Netatalk関連の脆弱性](https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/)を突いたランサムウェア集団の標的にされることは未だ免れていません。


 
![202210_CTI_blog_pic2.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic2.png)
 

##XpenologyとQuickConnect
残念なことに、Synologyはもう一つの問題を抱えていました。台湾のコミュニティでは黑群暉と呼ばれる、Xpenologyです。かいつまんで言えば、このカスタムブートローダーは規格外のハードウェアを使用して、SynologyのLinuxベースDSM（ディスクステーションマネージャー）システム内で起動できます。 
 
Xpenologyだけでなく、Synologyは新たなQuickConnect搾取にも対処しなければなりませんでした。 
 
QuickConnectはポートフォワーディング設定を追加せずにNASをWANへ開放します。この間に、NASは```synology.me```またはその他のQuickConnect関連のドメインへ割り当てられます。 
 
通常、QuickConnectが機能するにはNICのMACアドレスとシリアル番号の組み合わせが一致しなければなりません。しかし、コミュニティではこの検査をバイパスするために必要な認証の生成方法を数年前に見つけています。幸い、今ではそのほとんどにパッチが当てられたと考えられています。 



 
![202210_CTI_blog_pic3.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic3.png)
 

##NASサーバーでの疑わしい挙動
なぜ、これが特に問題になるのでしょう？中国発の様々な攻撃に関連した事例を調査した際、当社は攻撃に用いられるIPアドレスの一部は、Synology QuickConnect関連の様々なサブドメインと直接関係があることを発見しました。 
 
例えば、調査の過程で、当社はIPアドレス```42.3.63[.]80```を発見しています。このIPは、セキュリティ侵害が起こる直前に、```johndans[.]diskstation.me```と```ediskwang[.]synology.me```へ解決されています。どちらのサブドメインにも非常に疑わしいDNS記録があり、中国と香港における様々なIPアドレス間を素早く飛び交っています。 
 
関連のIPアドレスを追跡することで、解決されたIPアドレスの一部は、様々な中国発の攻撃に直接関わっていたことが判明した他の事例（Amoeba （APT41）やSLIME40（FamousSparrow）など）でも見つかっていたことを当社は突き止めました。社内調査に基づき、当社はこれらサブドメインがAPTによって人質に取られた通常のNASサーバーの可能性が高いと結論付けました。


 
![202210_CTI_blog_pic4_watermark.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic4_watermark.png)
 

この結論を元に、他の可能性についても検討しました。攻撃者が前述の攻撃方法の両方を用いて、自身でSynologyのプロキシステーションをホストした場合はどうなるのか？ 
 
この疑念を確かめるため、当社は約1万の```synology.me```サブドメインと約5千の```myqnapcloud.com```サブドメインをデータセットとして収集し、以下の条件に基づいてフィルタリングしました。
 
- NASは既知のVPS ASNでホストされているのか？
- NASサブドメインは様々な国にまたがって移動しているのか？
- 複数のNASサブドメインが同じIPアドレスを解決しているのか？

 
![202210_CTI_blog_pic5_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic5_watermark.jpg)
 

こうした問いを通じて、疑わしいNAS DDNSサブドメインが実際に数種類見つかっています。例えば、以下の例では、NASは欧州連合と東アジア地域の間を数年間にわたって移動しており、各地域での解決記録は最短で2日間でした。デバイスはxTom、Microsoft Azure、DMIT Cloudなど、様々なクラウドプロバイダーの間でホスティングされていました。

 
![202210_CTI_blog_pic6_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic6_watermark.jpg)
 

別の事例では、当社はNASデバイスの1台がLinode、AWS、Cloudflare、Microsoft Azureなどのクラウドホストプロバイダーが所有する様々なIPアドレスを利用し、香港、シンガポール、台湾、中国の間を移動していたことを突き止めています。 
 
これらは一部の家庭用ソリューションでネットワーク全体にかかるVPNの背後に存在していただけの可能性もあるため、こうしたNAS事例は必ずしも「悪意がある」と結論付けることはできませんが、NAS DDNSの標準的な利用方法と比べて、比較的疑いが高いとマーキングすることは可能です。


 
![202210_CTI_blog_pic7_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic7_watermark.jpg)
 

##脅威は今も拡大しています。遅れをとらないようにしてください。
本調査をまとめると、当社はNAS業界に存在する従来の脅威の種類（ランサムウェア、仮想通貨のマイナー、PUPなど）を調べ、QuickConnectなどの便利な機能を使用した別の種類の脅威へ発展する可能性を確認しました。 
 
1つ、確実に言えることがあります。NASデバイスに対する脅威の種類は広がり続けています。このため、読者や顧客の皆様には、デバイスのファームウェアを定期的にアップデートし、家庭内のデバイスに異常がないか、確認することを強く推奨いたします。


 
 

>本調査はHITCON PEACE 2022に初掲載されました。今回のブログ記事は、HITCON PEACE 2022での当社のスピーチ、[私のNASは他人のボットではない]（[https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/）を要約したものです。
- スピーチ全体（中国語）はこちらからご覧ください：[リンク](https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/)
- スライド（英語）はこちらからダウンロードください:[リンク](https://hitcon.org/2022/slides/Your%20NAS%20is%20not%20my%20BOT.pdf)


 
 

*画像のソース: [Pexels](https://www.pexels.com/)

NASを執拗な攻撃から保護（私のNASは他人のボットではない）

Every October, Cybersecurity Awareness Month is a big event for government and private sectors to raise awareness about digital security and empower everyone to protect their personal data from digital forms of crime.

Cybersecurity Awareness Month was first organized by the National Cybersecurity Alliance and the Cybersecurity and Infrastructure Agency (CISA) in the USA since 2004. 

In 2022, topics of Cybersecurity Awareness Month topics are: 

- Enable Multi-Factor Authentication
- Use Strong Passwords
- Recognize and Report Phishing
- Update Your Software

 
These are 4 essential actions for people to protect their valuable assets. **However, that’s just the beginning for enterprises.**

As advanced persistent threats (APTs) and ransomwares threaten enterprises more than ever, we suggest enterprises adopt threat intelligence in order to prevent threats in advance.

Cyber threat intelligence (CTI) is information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.

Cyber threat intelligence is an important part of enterprises’ cybersecurity plans. Enterprises can effectively deploy information security defenses and ensure smooth operations using the intelligence gathered and analyzed by the top threat intelligence research teams.

**Take actions today to protect your valuable assets TODAY.**
 
 
- [What is Cyber Threat Intelligence (CTI)? Why Does It Matter?](https://teamt5.org/en/posts/what-is-cyber-threat-intelligence-cti/)
- [What is the Diamond Model of Intrusion Analysis? Why Does It Matter?](https://teamt5.org/en/posts/what-is-diamond-model-of-intrusion-analysis/)

Cybersecurity Awareness Month 2022: Take 4+1 Actions Today

資安意識月 (Cybersecurity Awareness Month) 由美國 國家網路安全聯盟(NCA)、美國網路安全暨基礎設施安全局(CISA)發起，為每年10月舉辦，至今已邁入第19年。每年強調不同的主題，提升大眾的資安意識。

今年特別呼籲的資安防護觀念為:

- 帳戶啟用多因素認證(Multi-Factor Authentication)
- 使用高強度密碼
- 對疑似釣魚詐騙、手法保持警覺性，並即時回報給相關單位
- 軟體更新至新版

 
上述為資安防護的重要基本概念，然而企業進行資安防護、保護重要數位資產與商業機密，仍需要更積極的手段，如收集與駭客族群攻擊手法相關的威脅情資、安裝適當的端點防護工具；並與資安服務供應商緊密合作，時刻檢視系統脆弱處。

欲了解更多資安威脅情資分析關鍵、企業資安防護訣竅，請參考下列連結:
- [什麼是威脅情資? 對企業的重要性是什麼?](https://teamt5.org/tw/posts/what-is-cyber-threat-intelligence-cti/)
- [什麼是入侵分析鑽石模型? 對資安防禦的重要性是?](https://teamt5.org/tw/posts/what-is-diamond-model-of-intrusion-analysis/)

2022 資安意識月: 立即行動，保護企業資產

TeamT5 consists of world-class cyber threat analysts with more than 10-year experience. Leveraging geographic and cultural advantages, TeamT5 has the best understanding of cyber attackers in Asia Pacific. Derived from in-house research in malware & Advanced Persistent Threat (APT), TeamT5 provides cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan.  

Our clients include government agencies, financial institutions, telecom operators, high-tech enterprises, electronic manufacturing service companies, and managed security service providers (MSSP).

For **Australia exterprises & government units**, we publish this exclusive cyber threat intelligence report to remind them of adversaries who targeting Australia units. As the old saying "Know the enemy and know yourself; in a hundred battles you will never be in peril," we encourage all units to update their cyber threat intelligence in order to protect their valuable digital assets.

✨**Fill up the below form for receiving TeamT5's exclusive cyber threat intelligence report!**

TeamT5 's Cyber Threat Intelligence Report [Exclusive for Australia] 

TTPsは、Tactics、Techniques、Procedures（戦術・技術・手順）の略語です。攻撃者の攻撃パターンや特徴。

- 戦術：マクロレベルでのサイバー攻撃。
- テクニック：「戦術」よりも詳細で完全なコンテクストを提供。
- 手順：攻撃の全プロセス、「テクニック」よりも詳細な情報を提供。

 

詳細なTTPs解析により価値のある脅威レポートを提供します。レポートにより、攻撃をさらに理解できるようになり、正しい対策を講じるのに役立ちます。
 
 
 
 
 
*参考文献:
[tactics, techniques, and procedures (TTP) - nist.gov](https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures)
 
*画像のソース: Pixabay

TTPsとは？ サイバー攻撃の分析に関する重要な要素である理由

Tactics, Techniques, and Procedures (TTPs) is a comprehensive description of a cyber actor's behavior. 

- Tactic: the highest-level description of the cyber actor’s behavior. 
- Technique: gives a more detailed description of behavior in the context of a tactic.
- Procedure: an even lower-level, highly detailed description in the context of a technique.

A good threat intelligence will provide TTPs, so the reader has a detailed understanding of the cyber attack. Then, the reader will be able to take right defensive measures.
 
 

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. We are established in Taiwan and harness our geographical & cultural strengths to assist enterprises and organizations in fortifying their cybersecurity defenses through our intelligence-focused offerings, including intelligence with TTP. This allows analysts to foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks.
>Learn more: [https://teamt5.org/en/products/threatvision/](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website)

 
 
*Reference: 
[tactics, techniques, and procedures (TTP) - nist.gov](https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures)
 
*Image courtsey of Pixabay

What are Tactics, Techniques, and Procedures (TTPs)? Why do CTI analysts talk about them all the time?

TTPs 是 Tactics, Techniques, and Procedures 的縮寫，分別指戰術、技巧和程序。用以描述威脅行動者的攻擊模式或特徵。

- 戰術(tactic): 指的是以宏觀層次描述描述網路攻擊
- 技巧(technique): 比戰術的細節更多，提供完整的脈絡
- 程序(procedure): 說明完整的攻擊過程，較技巧所提供的資訊更詳細

一份有價值的威脅情資報告會提供詳盡的 TTPs 分析，協助讀者深入了解該次攻擊事件，從而採取正確的防禦措施。
 
 

>TeamT5 杜浦數位安全專精網路威脅研究，團隊具備超過20年的惡意程式與進階持續性攻擊（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，提供涵蓋 TTP 的威脅情資報告。
>了解更多：[威脅情資平台 ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website)

 
 
*參考資料: 
[tactics, techniques, and procedures (TTP) - nist.gov](https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures)
 
*首圖來源: Pixabay

什麼是 TTPs? 為什麼 TTPs 是網路攻擊分析的重要元素?

Cyber kill chain describes how cyber attackers break into companies’ systems. 

It contains 7 steps -

1. **Reconnaissance**: Attackers collect information about the staff from the target company e.g. email address, public info in social network platforms, etc. By using tools, attackers can scan websites or systems to find out which type and version is being used by the company.
2. **Weaponization**: Attackers look for tools or design their own tools to execute the cyber attacks, e.g. backdoor, trojan, etc.
3. **Delivery**: Attackers deliver weaponized packages to the victim via email, web, flash drive, etc.
4. **Exploitation**: Attackers exploits a vulnerability to execute code on the victim's system.
5. **Installation**: After the exploitation stage, malware will be installed on the victim’s system. This ensures attackers have long-term access and control of the victim’s system. 
6. **Command & Control**: This part is also called C2. It is a common channel for remote manipulation of the victim.
7. **Actions**: Take action to accomplish their original goals.

 
For various cyber attacks, the cyber kill chain can help the enterprise cybersecurity team studying system breaches or knowing and dealing with them. By doing so, the team can successfully achieve their cybersecurity defense goals.
 
 

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. We are established in Taiwan and harness our geographical & cultural strengths to assist enterprises and organizations in fortifying their cybersecurity defenses through our intelligence-focused offerings. This allows analysts to foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks.

>Learn more about our cybersecurity solution: [https://teamt5.org/en/products/threatvision/](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)

 
 
*Reference:
[Cyber Kill Chain® | Lockheed Martin](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html)
 
*Image courtsey of [Pixabay](https://pixabay.com/)

What is the Cyber Kill Chain? Why Does It Matter?

網路攻擊鏈(Cyber Kill Chain)以7個環節，描述網路攻擊者採取的攻擊步驟。

7個環節依序是:

1. **偵查 Reconnaissance**: 攻擊者收集目標對象的資料，如電子郵件信箱、社群平台的資料，以找到可以下手的弱點；或是透過工具，掃描目標對象的網站、系統，得知使用的系統種類、版本。
2. **武裝 Weaponization**: 攻擊者使用現成的開源工具或是自行開發專屬的惡意程式。
3. **遞送 Delivery**: 攻擊者將攻擊武器送入目標的系統內，如透過釣魚信件裡的連結、夾帶木馬的盜版軟體、隨身碟。
4. **漏洞利用 Exploitation**: 確保遞送的惡意軟體，藉由目標對象的系統漏洞，得以順利開啟，並使攻擊者獲得控制權。
5. **安裝 Installation**: 攻擊者確保自身可以長期控制目標的系統內，以有足夠的時間進行後續環節。
6. **發令與控制 Command & Control**: 本環節取兩個單字的字首，又可簡稱為 C2。攻擊者潛伏在目標的系統內，收集資料，探索環境，以便審慎規劃後續行動。
7. **行動 Actions**: 根據攻擊者的最終目標，採取行動，如破壞系統、竊取機密資料、勒索目標對象。

 
 
針對各類網路攻擊，以網路攻擊鏈進行深度分析，有助企業資安團隊找出系統破口，進行修補與處置，達成資安防禦目標。
 
 

>TeamT5 杜浦數位安全專精網路威脅研究，團隊具備超過20年的惡意程式與進階持續性攻擊（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

>認識我們的資安防禦相關解決方案: [https://teamt5.org/tw/products/threatsonar-anti-ransomware/](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)

 
 

*參考資料:
[Cyber Kill Chain® | Lockheed Martin](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html)
 
*首圖來源: [Pixabay](https://pixabay.com/)

什麼是網路攻擊鏈 (Cyber Kill Chain)? 對資安防禦的重要性是什麼?

サイバーキルチェーン（英：Cyber Kill Chain）は、サイバー攻撃を7ステップに分解したものです。

7ステップ： 

1. **偵察**: 攻撃者は悪用できる脆弱性を見つけるためにメールアドレス、SNSなどで攻撃対象の情報を集めます。またはツールで攻撃対象のWebサイト、システムをスキャンし、使用しているシステムの種類やバージョンなどの情報を得ます。
2. **武器化**: 攻撃者は既存のオープンソースツールまたは自身が開発した専用のマルウェアを使用します。
3. **配送**: 攻撃者はフィッシングメール内のリンク、トロイの木馬入り海賊版ソフトウェア、USBフラッシュドライブなどを介して武器をターゲットのシステム内に送り込みます。
4. **脆弱性の利用**: 攻撃者は攻撃対象のシステムの脆弱性を利用し、送り込んだマルウェアを開いてコントロール権を得ます。
5. **インストール**: 攻撃者はターゲットのシステムを長時間コントロールできるようにし、その後のプロセスを実行するための十分な時間を確保します。
6. **コマンド&コントロール**: 2つの英単語の頭文字をとってC2と略されることもあります。攻撃者は行動を慎重に計画するため、ターゲットのシステム内に潜伏して、資料を集めたり環境を探ったりします。
7. **行動**: 攻撃者は攻撃対象のシステムの破壊、機密情報の窃取、身代金の要求など、最終目標に向けた行動を起こします。


さまざまなサイバー攻撃をサイバーキルチェーンで詳細に分析することで、企業の情報セキュリティチームはシステムの脆弱性を見つけ、修正および対処することができ、情報セキュリティ保護を達成するのに役立ちます。
 
 
 
*参考文献
[Cyber Kill Chain® | Lockheed Martin](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html)
 
*画像のソース: [Pixabay](https://pixabay.com/)

サイバーキルチェーン（Cyber Kill Chain）とは？ 情報セキュリティ保護の重要性について

## 侵入分析のダイヤモンドモデルとは？

侵入分析のダイヤモンドモデル（英：diamond model of intrusion analysis）は、攻撃グループ（adversary）、攻撃基盤（infrastructure）、能力（capability）、ターゲット（target）の4つの要素からサイバー攻撃のパターンを分析する方法です。

4つの要素の詳細について： 
- 攻撃グループ(adversary): 攻撃グループは誰でどこから来たのか。背後の主導者や協力者は誰で攻撃の動機は何なのか。攻撃のスケジュールや計画。 
- 攻撃基盤(infrastructure): 感染したコンピュータ、C2サーバの名称、場所、タイプ、C2管理のメカニズムと構造、制御パス、データパス。
- 能力(capability): 攻撃者の検出技術、マルウェアの送信方法、悪用される可能性のある脆弱性、遠隔操作可能なマルウェア/バックドア、ラテラルムーブメントの技術と使用されるツール、データを盗む技術。
- ターゲット(target): どのような国/地域、産業、企業の部門、スキルを持った従業員が攻撃対象となっているか。盗もうとしているデータのタイプ。

## 情報セキュリティ保護の重要性について
さまざまなサイバー攻撃を侵入分析のダイヤモンドモデルで多角的に分析することで、企業の情報セキュリティチームはシステムの脆弱性を見つけ、修正および対処することができ、情報セキュリティ保護を達成するのに役立ちます。

 
![What_is_Diamond_Model_of_Intrusion_%20Analysis_pic_jp_update.jpg](https://uploads.teamt5.org/upload/original/What_is_Diamond_Model_of_Intrusion_%20Analysis_pic_jp_update.jpg)
<center>侵入分析のダイヤモンドモデル</center>

 
>もっと詳しく知る: [脅威インテリジェンス統合プラットフォーム ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)


 
*画像のソース: [Pixabay](https://pixabay.com/)

侵入分析のダイヤモンドモデルとは？ 情報セキュリティ保護の重要性について

## What is Diamond Model of Intrusion Analysis? 
The Diamond Model of Intrusion Analysis is a model to describe cyber attacks. It contains 4 parts - adversary, infrastructure, capability, and target. It gives analysts a comprehensive view of cyber attacks. 

- Adversary: Where are attackers from? Who are the attackers? Who is the sponsor? Why attack? What is the activity timeline and planning?
- Infrastructure: Infected computer(s), C2 domain names, location of C2 servers, C2 server types, mechanism and structure of C2, data management & control, and data leakage paths 
- Capability: What skills do the attackers have to do reconnaissance, deliver their attacks, attack exploits and vulnerabilities, deploy their remote-controlled malwares and backdoors, and develop their tools?
- Target: Who is their target country/region, industry sector, individual, or data?

## Why Does It Matter?
For various cyber attacks, the diamond model of intrusion analysis can help enterprise cybersecurity teams find system breaches and deal with them. By doing so, they can successfully achieve cybersecurity defense goals.

![What_is_Diamond_Model_of_Intrusion_%20Analysis_pic_en_update.jpg](https://uploads.teamt5.org/upload/original/What_is_Diamond_Model_of_Intrusion_%20Analysis_pic_en_update.jpg)
<center>Diamond Model of Intrusion Analysis</center>


>We, TeamT5, is a leading brand in delivering Asia Pacific intelligence. 
>
>We concretized the Diamond Model of Intrusion Analysis concept and spider web in our company logo. The diamond that exists in the middle symbolizes Diamond Model - a model often used to describe cyber attacks in threat intelligence research. The Diamond Model includes Adversary, Capability, Infrastructure, and Victim, which are all TeamT5’s research areas.

>Learn more about how we help enterprises via cyber threat intelligence: [https://teamt5.org/en/products/threatvision/](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)

 

*Image courtsey of [Pixabay](https://pixabay.com/)

What is the Diamond Model of Intrusion Analysis? Why Does It Matter?

## 什麼是入侵分析鑽石模型? 

入侵分析之鑽石模型(diamond model of intrusion analysis)是以4大元素分析網路攻擊的模型，4大元素包含敵人(adversary)、設施(infrastructure)、能力(capability)、目標(target)。

4大元素的細節包含: 
- 敵人(adversary): 敵人從哪邊來?敵人是誰? 幕後主導者/贊助者是誰? 攻擊的動機是什麼?攻擊的時間表和計劃是什麼? 
- 設施(infrastructure): 受感染的電腦、C2域名、C2服務器位置、C2服務器類型、C2管理的機制和結構、控制和資料搬運的路徑
- 能力(capability): 攻擊者具備的偵測技術、遞送惡意軟體的方式、會利用的漏洞、可以遠端控制的惡意軟體/後門程式、橫向移動的技巧與使用的工具、竊取資料的技術
- 目標(target): 意圖攻擊的目標、鎖定的目標國家/地區、鎖定的目標產業、鎖定企業哪個部門、鎖定哪種職能的員工、意圖竊取的資料類型

## 入侵分析鑽石模型對資安防禦的重要性是?
針對各類網路攻擊，以入侵分析之鑽石模型進行多角度分析，有助企業資安團隊找出系統破口，進行修補與處置，達成資安防禦目標。


![What_is_Diamond_Model_of_Intrusion_%20Analysis_pic_tw.jpg](https://uploads.teamt5.org/upload/original/What_is_Diamond_Model_of_Intrusion_%20Analysis_pic_tw.jpg)
<center>入侵分析鑽石模型</center>
 

>了解我們如何透過基於入侵分析鑽石模型提出的威脅情資解決方案: [https://teamt5.org/en/products/threatvision/](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)
 
 
*首圖來源: [Pixabay](https://pixabay.com/)

什麼是入侵分析鑽石模型? 對資安防禦的重要性是?

## 脅威インテリジェンスの定義
脅威インテリジェンス（英：threat intelligence）はサイバー脅威インテリジェンス（英：cyber threat intelligence, CTI）とも呼ばれ、サイバー攻撃に関する情報を指します。専門家のチームにより収集、変換、分析、解釈などの処理が行われ、情報セキュリティの意思決定プロセスに必要な基礎となります。

## 企業にとっての脅威インテリジェンスの重要性
孫子の兵法には「彼を知り己を知れば百戦殆うからず」という戦場における重要な原則がありますが、同じことが今日のサイバー戦争にも当てはまります。脅威インテリジェンスは、企業が情報セキュリティ保護を展開する際の重要なポイントとにもなります。

脅威インテリジェンスにより、企業は情報セキュリティの意識に関する従業員のトレーニング方法、導入する情報セキュリティソリューションへの理解、情報システムの設定および調整方法など、効果的に情報セキュリティ保護の計画を立てることができます。また、複数の情報セキュリティ保護に優先順位をつけて予算を割り当てることができます。

## 脅威インテリジェンスの3つのレベル
脅威インテリジェンスは内容によって3つのレベルに分けられ、それぞれのレベルが企業の情報セキュリティ計画にメリットをもたらします。
 
 
**1. 戦略的脅威インテリジェンス(Strategic Threat Intelligence): **技術的な背景を必要とせず、CXOレベルで使用されます。誰が何のために攻撃しようとしているのかを判断します。
 
 
**2. 運用的脅威インテリジェンス(Operational Threat Intelligence): ** 技術的な背景が必要で、SOCマネージャーや分析研究員などが使用します。攻撃者のTTP（戦術「Tactics」、技術「Techniques」、手順「Procedures」）を把握します。
 
 
**3. 戦術的脅威インテリジェンス(Tactical Threat Intelligence):** 技術的な背景が必要で、一般的にSOC担当者が使用します。 セキュリティ侵害インジケーター（indicator of compromise, IoC）で、特定のセキュリティインシデントを監視します。
 
 
## まとめ
脅威インテリジェンスは企業の情報セキュリティにおける重要な部分であるため、完全な脅威インテリジェンスデータベースを備えた業者と提携することで、効果的に情報セキュリティ保護を展開し、スムーズな経営を維持できます。

TeamT5は、サイバー脅威の研究を専門としており、マルウェアおよびAPT（高度で持続的な脅威）の研究に10年以上携わっています。当社は地理および言語の強みを活かして効果的にアジア太平洋地域のハッキング攻撃を把握しているほか、世界レベルの情報セキュリティカンファレンスにたびたび出席し、研究成果を発表しています。

ぜひ、今すぐ当社にご連絡いただき、企業の情報セキュリティの第一歩を踏み出してください。

👉 [https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blog&utm_medium=website)

 
 
 
*参考文献: 
[threat intelligence - nist.gov](https://csrc.nist.gov/glossary/term/threat_intelligence)
 
*画像のソース: [Pixabay](https://pixabay.com/)

脅威インテリジェンスとは？企業にとっての重要性について

## The definition of cyber threat intelligence
Cyber threat intelligence (CTI) is information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.

## Why does cyber threat intelligence matter to enterprises?
As the old saying “know the enemy, know yourself, and in every battle you will be victorious”, cyber threat intelligence plays the same important role in cyber war. It gives enterprises an overview of the threat landscape. Enterprise can make better cybersecurity defense plans to secure daily operation. 

## 3 levels of cyber threat intelligence
Cyber threat intelligence contains 3 levels - strategic, operational, and tactical threat intelligence.

**1. Strategic Threat Intelligence**
(Non-Technical, usually used by CXO users) :  Identifies the Who and Why. Uses high-level information (whitepapers, policy documents, publications, etc.)

**2. Operational Threat Intelligence**
(Mixed, usually used by Security Operations Center leaders, analysts, etc.):  Works on the How and Where. Uses information about threat actor tactics, techniques, procedures, etc.

**3. Tactical Threat Intelligence**
(Technical, usually used by Security Operations Center personnel):  Look at the What. Uses Indicators of Compromise (IoC) such as file names, hashes, domain names, IP addresses, etc.

## Summary
Threat intelligence is an important part of enterprises’ cybersecurity plans. Enterprises can effectively deploy information security defenses and ensure smooth operations using the intelligence gathered and analyzed by the top threat intelligence research teams.



We, TeamT5, are the top research team in malware & Advanced Persistent Threat (APT). We’re  frequently invited to share our insights in top cybersecurity conferences - Black Hat (USA), Code Blue/ AVTokyo (Japan), Troopers(Germany), and other events organized by global organizations such as Hack In The Box, and FIRST.

>
>Know more about our threat intelligence platform - [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).


What is Cyber Threat Intelligence (CTI)? Why Does It Matter?

## 威脅情資的定義
威脅情資(threat intelligence)或稱網路威脅情資、資安情資(cyber threat intelligence,CTI) ，指的是與網路攻擊相關的資訊，經由專業團隊收集、轉換、分析、解釋等處理過程，提供資安決策過程所需要的基礎。

## 威脅情資對企業的重要性
孫子兵法提及戰場上的重要原則「知己知彼，百戰不殆」，到如今的網路戰爭中，一樣適用，而威脅情資就是企業進行資安防禦布局的關鍵。

透過威脅情資，企業能夠有效規劃資安防禦計畫，包含如何為員工進行資安意識的教育訓練，了解需導入的資安解決方案，如何調整資訊系統的設定，並可在多個資安防禦目標中，區分輕重緩急，分配預算。

## 威脅情資的3大層次
威脅情資依其內涵，分為3個層次，每個層次都可為企業的資安計畫帶來效益。
 
**1. 戰略型威脅情資(Strategic Threat Intelligence): **無技術細節，由 CXO 層級使用；用於辨別誰會想攻擊? 為何想攻擊?

**2. 實戰型威脅情資(Operational Threat Intelligence): **需要技術背景，由SOC 主管、分析研究員等使用；用於理解攻擊者的TTP (戰術 Tactics 、技術 Techniques、流程 Procedures)

**3. 戰術型威脅情資(Tactical Threat Intelligence):** 需要技術背景，通常是 SOC 人員使用；以威脅指標(indicator of compromise, IoC)，監看特定攻擊事件

## 總結
威脅情資是企業資安重要的一環，與具備完整威脅情資資料庫的廠商合作，企業可有效進行資安防禦布局，確保營運順暢。

TeamT5 杜浦數位安全專精網路威脅研究，具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的研究經驗。基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

>我們的威脅情資平台 ThreatVision : [立刻了解](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

>今天就聯絡我們，展開企業資安的第一步!
>[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
 
*參考資料:
[threat intelligence - nist.gov](https://csrc.nist.gov/glossary/term/threat_intelligence)
 
*首圖來源: [Pixabay](https://pixabay.com/)

什麼是威脅情資? 對企業的重要性是什麼?

Cobalt Strike is a well-established red-teaming toolkit that was specifically designed to create feature-rich backdoors in the matter of seconds. However, ever since its inception, the tool has been heavily abused by threat actors all over the world (e.g., Polaris/MustangPanda, APT32/OceanLotus, cybercriminals, etc.) The popularity of Cobalt Strike is primarily due to how powerful its built-in payload generators are, its flexibility in deploying the Beacon to the target machine(s) - and most notably - its ability to disguise the payload traffic in the target network.

Over the last year or so, more and more beacons relying on third-party services as their proxy are being found in the wild. Since the use of these third-party CDNs can allow anonymized C2 and enhance its detection evasion, numerous APTs have also begun using these services. In the following sections, we will go through some of the techniques used by these threat actors to see how one could easily set up these misused configurations.

## Serverless Functions
Other techniques that threat groups have been employing also include the use of third-party services such as Cloudflare Workers. With the use of serverless services, it is possible to setup what is essentially a free reverse proxy to a Cobalt Strike endpoint. When set up properly, these services can provide an additional layer of protection, as looking up the domain will only yield the service’s IP instead of the origin server.

![202205_blog_pic1.png](https://uploads.teamt5.org/upload/original/202205_blog_pic1.png)
 

Since these services are often set up with sub-domains that the threat actor could freely set up without purchasing a real domain, they could also be set to a somewhat convincing fake domain. In this example, the C2 was set to ```route.moffice365.workers.dev``` to make the traffic look somewhat related to Microsoft services.

![202205_blog_pic2.png](https://uploads.teamt5.org/upload/original/202205_blog_pic2.png)
 

The nature of these serverless functions makes it extremely difficult to attribute the origins of or identify the threat actors. Since the serverless code is only stored on Cloudflare, and its execution is done on Cloudflare’s servers, there is not a feasible way to identify the C2 infrastructures.

## Domain Fronting via CDN


Domain fronting is a technique that attempts to disguise the traffic by smuggling data to a well-known service or domain. In other words, similar to the previous technique, domain fronting cannot be feasibly blocked without disrupting services and or examining the inner request. HelpSystems, the company behind Cobalt Strike, had actually done a write-up of Cobalt Strike domain fronting using CloudFront in 2017[1].

![202205_blog_pic3.png](https://uploads.teamt5.org/upload/original/202205_blog_pic3.png)
 

Essentially, certain websites employ CDNs like CloudFront to deliver assets on their websites. Under normal circumstances, the ```Host``` header determines where the request should go - and this header is assigned by the website. However, we can also abuse this “feature” and make our beacon visit a certain domain with a specified Host header that goes to our CDN instead of the standard CDN that the website uses. With HTTPS, this request would be extremely difficult or impossible for the IT admin to block, as the request itself is encrypted, and on the surface, it would look like the user is simply visiting a reputable site.

## Domain Fronting with a Non-existent Domain
The following technique, however, does something slightly different. Some time ago last year, we detected a rather peculiar looking Cobalt Strike payload where its C2 address was set to ```pypi.python.org```. Obviously the actor couldn’t have possibly obtained the rights to the domain owned by the Python Foundation, and the chance of them pwning the service is also little to none.

![202205_blog_pic4.png](https://uploads.teamt5.org/upload/original/202205_blog_pic4.png)
 

So what gives? It turns out the secret lies within the service that operates the sub-domain and the HTTP header specified in the beacon. The Python Foundation uses Fastly for most of its services. Fastly uses the ```Host``` header specified within the request to decide which service to redirect the request to internally. For example, if I were to create a service on Fastly named ```dl-python.org```, and the ```Host``` header is set to ```dl-python.org``` in the beacon, Fastly would then forward the request to the service named as such.

![202205_blog_pic5.png](https://uploads.teamt5.org/upload/original/202205_blog_pic5.png)
 

Note the difference between this methodology against the previous domain fronting technique - the ```Host``` header may give a false impression that the C2 is being pointed towards ```dl-python.org```. In reality, it is being resolved as ```dl-python.org.global.prod.fastly.net``` when going through Fastly’s services. The service then internally forwards the request to ```my-c2domain.com``` as configured by the threat actor. This trick may lure threat investigators into investigating a completely different domain that may or may not be relevant to the incident.

![202205_blog_pic6.png](https://uploads.teamt5.org/upload/original/202205_blog_pic6.png)
 

## Conclusion
In this post, we have covered three ways that threat actors can abuse Cobalt Strike’s flexibility in payload communication: misuse of serverless functions and various abuses of CDN domain fronting. The resilience of Cobalt Strike is something that is beloved (or despised) by many because of this very reason. It is clear that the red-teaming toolkit is not going anywhere anytime soon as more and more creative strategies are discovered and employed.

## References
[1] Mudge, R. (2017, February 6). High-reputation Redirectors and Domain Fronting—Cobalt Strike Research and Development. ➔ [link](https://www.cobaltstrike.com/blog/high-reputation-redirectors-and-domain-fronting/)

*Image courtesy of [Pexels](https://www.pexels.com/)

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Cobalt Strikeは、数秒で機能豊富なバックドアを作成することに特化して設計された、定評のあるレッドチーム向けツールキットです。しかしながら、その登場以来、このツールは世界中の脅威アクター（Polaris/MustangPanda、APT32/OceanLotus、サイバー犯罪者など）に多用されています。 Cobalt Strikeの人気の理由は、主に内蔵されている強力なペイロードジェネレータ、ターゲットマシンにビーコンを展開できる柔軟さ、そして最も注目すべきなのが、ターゲットネットワーク内のペイロードトラフィックを偽装できる点にあります。

ここ1年ほどは、サードパーティーのサービスをプロキシとして利用するビーコンが多く出回っています。これらのサードパーティーCDNを利用することで、C2の匿名化が可能となり、検知回避を強化できるため、多くのAPTがこういったサービスを利用し始めています。以下のセクションでは、これらの脅威アクターが使用するテクニックのいくつかを紹介すると共に、こういった悪用された設定を設定するのがいかに簡単かをお見せしようと思います。

## サーバーレス関数
脅威グループが採用しているもう1つのテクニックが、Cloudflare Workersなどのサードパーティサービスを利用する方法です。サーバーレスサービスを利用することで、Cobalt Strikeエンドポイントへのリバースプロキシとなる設定を、お金をかけずに行うことができます。適切に設定することで、これらのサービスを通してさらなる保護レイヤーを形成することができます。ドメインを検索しても、オリジンサーバーではなく、サービスのIPのみが取得されるからです。

![202205_blog_pic1.png](https://uploads.teamt5.org/upload/original/202205_blog_pic1.png)
 

これらのサービスはサブドメインを使って設定されることが多く、脅威アクターは本物のドメインを購入せずに自由に設定することができ、ある程度の説得力のある偽ドメインに設定することもできます。この例では、C2が ```route.moffice365.workers.dev``` に設定されており、トラフィックがMicrosoftサービスに多少関連しているように見せかけています。

![202205_blog_pic2.png](https://uploads.teamt5.org/upload/original/202205_blog_pic2.png)
 

これらのサーバーレス関数は性質上、攻撃の発生源をたどったり、脅威アクターを特定したりすることは極めて困難です。サーバーレスコードはCloudflare上にのみ保存され、Cloudflareサーバー上で実行されるため、C2インフラを特定することは現実的に不可能です。

## CDNを介したドメインフロンティング


ドメインフロンティングとは、よく認知されたサービスやドメインにデータを潜ませることでトラフィックを偽装しようとするテクニックです。つまり、先ほどのテクニックと同様に、サービスを停止させたり、内部のリクエストを調べたりすることなくドメインフロンティングをブロックすることは現実的に不可能です。実は、Cobalt Strikeを提供するHelpSystemsが、2017年にCloudFrontを使用したCobalt Strikeのドメインフロンティングに関する記事を書いています[1]。

![202205_blog_pic3.png](https://uploads.teamt5.org/upload/original/202205_blog_pic3.png)
 

原則的に、一部のウェブサイトは、CloudFrontなどのCDNを採用して、ウェブサイト上にアセットを配信しています。通常は、ホストヘッダーがリクエストの行き先を決定し、このヘッダーはウェブサイトによって割り当てられます。しかしながら、この「関数」を悪用することで、ビーコンが特定のドメインに行くようにして、そのドメインにウェブサイトが使用する標準のCDNではなく、こちらで用意したCDNへと行くように指定したホストヘッダーを持たせることができます。HTTPSの場合、リクエスト自体が暗号化されているため、IT管理者がこのリクエストをブロックすることは極めて困難または不可能であり、表面上は、ユーザーが単に信頼できるサイトを訪問しているように見えます。

## 存在しないドメインを使用したドメインフロンティング
しかしながら、次のテクニックでは、少し違う方法をとっています。昨年のある時期に、C2アドレスが ```pypi.python.org``` に設定された、かなり奇妙に見えるCobalt Strikeペイロードを検出しました。Python Foundationが所有するドメインの権利を脅威アクターが取得することは明らかに不可能であり、サービスを悪用できる可能性もほとんどありません。

![202205_blog_pic4.png](https://uploads.teamt5.org/upload/original/202205_blog_pic4.png)
 

では何が目的なのでしょうか？その秘密は、サブドメインを操作するサービスと、ビーコンで指定されているHTTPヘッダーにあることが判明しました。Python Foundationは、同社のサービスのほとんどでFastlyを使用しています。Fastlyでは、リクエスト内で指定されたホストヘッダーを使用して、内部のどのサービスにリクエストをリダイレクトするのかを指定します。例えば、Fastly上に ```dl-python.org``` という名のサービスを作成し、ビーコンのホストヘッダーを ```dl-python.org``` にした場合、Fastlyはその名前のサービスにリクエストを転送します。

![202205_blog_pic5.png](https://uploads.teamt5.org/upload/original/202205_blog_pic5.png)
 

この方法と前述のドメインフロンティングのテクニックとの違いは、C2が ```dl-python.org``` に向けられるという、ホストヘッダーに誤った印象を与える点にあります。実際には、Fastlyのサービスを通すとdl-```python.org.global.prod.fastly.net``` として解決されます。その後このサービスは、脅威アクターが行った設定に従って、内部でリクエストを ```my-c2domain.com``` に転送します。この手口は、脅威調査担当者がインシデントと関係があるかどうかもわからない、まったく別のドメインを調査するようにうまく誘い込む可能性があります。

![202205_blog_pic6.png](https://uploads.teamt5.org/upload/original/202205_blog_pic6.png)
 

## 結論
この記事では、脅威アクターがペイロード通信におけるCobalt Strikeの柔軟性を悪用する際の3つの方法を説明しました。サーバーレス関数の悪用と、CDNドメインフロンティングに対する様々な悪用です。Cobalt Strikeのレジリエンスは、まさにこういった理由から多くの人に気に入られて（あるいは嫌われて）います。ますます多くの創造性に富んだ戦略が発見され、採用される中、レッドチームのためのツールキットはしばらく利用されることになるでしょう。

## 参考文献
[1] Mudge, R. (2017, February 6). High-reputation Redirectors and Domain Fronting—Cobalt Strike Research and Development. （高信頼性リダイレクタとドメインフロンティング - Cobalt Strikeの研究および開発）➔ [リンク](https://www.cobaltstrike.com/blog/high-reputation-redirectors-and-domain-fronting/)

*画像のソース: [Pexels](https://www.pexels.com/)

見えるところに潜む攻撃：CDNサービスを悪用したC2の不明瞭化

>- March 30th, 2022 (GMT+8): This alert was published at 18:30 (GMT+8). We will update the alert as soon as we have more details.
- March 31st, 2022 Update: Add Proof Of Concept (PoC) & Self Test Advice
- April 6, 2022 Update: Add CVE number, Official patch


## Executive Summary
On March 29th, 2022, TeamT5’s Cyber Threat Intelligence team was alerted about a RCE 0-day vulnerability in the Spring Framework. While we are still investigating the vulnerability, **our current assessment is that the severity level of this Spring Core RCE 0-Day vulnerability is critical**.

1. Given that Spring is a widely used framework for developing Java applications, we believe this exploit will cause a great impact to many services.
2. The Spring Core RCE 0-day (aka Spring4Shell, SpringShell) exists in the JDK version equal or above 9.0.
3. No official patch was released at the time of our analysis. We strongly recommend all of our partners and clients to review your codebase and take mitigation measures below.

## Spring Core RCE 0-Day Vulnerability Details
![spring vulnerability_pic1.png](https://legacy-uploads.teamt5.org/spring_vulnerability_pic1_fa9c1e327b.png)


|Aspect|Description|
|---|---|
|CVE|No CVE id for this vulnerability at the time of writing. Some have referred the vulnerability as SpringShell.|
|Severity Level|Critical|
|Versions Affected|JDK version above or equal to 9 and derivative framework with ```spring-beans-*.jar``` or ```CachedIntrospectionResults.class``` exists.|
|Proof-of-Concept (PoC)|Proof-of-Concept (PoC) has been released publicly..|
|Patch|No official patch available at the time of writing.|

**From the information gathered, we assess that the impact of this vulnerability is very severe and the severity level is likely to be as high as Log4j vulnerabilities**. The Spring Framework is one of the most popular and lightweight application framework for the Java platform. It is widely used by lots of companies and organizations for their internet-facing services. This means that every Java-based product or web service is affected by the scope of the vulnerability.

The SpringShell 0-Day Vulnerability is a Remote Code Execution (RCE) vulnerability. According to public information, a successful exploitation would enable the threat actors to have Arbitrary File Upload privilege.

TeamT5 will keep our partners and clients updated on the information about this vulnerability. Our partners and clients can rely on TeamT5’s solutions, ThreatVision and ThreatSonar, for protection from future attacks.

## PoC
There are some POC (Proof of Concept) released. The execution is below.
 
Payload:
 
![/spring-rce-zeroday-vulnerability_PAYLOAD.png](https://uploads.teamt5.org/upload/original/spring-rce-zeroday-vulnerability_PAYLOAD.png)


Execution screenshot
![spring_update_pic1.jpg](https://legacy-uploads.teamt5.org/spring_update_pic1_84fa3ea5fb.jpg)

In a website using Spring framework, we can send certain payload to a path related to the Spring Framework (see below picture). This action allows us to write document with arbitrary path to achieve RCE (Remote Code Execution) attack. Picture above shows the result.
![spring_update_pic2.jpg](https://legacy-uploads.teamt5.org/spring_update_pic2_c9326dfbe2.jpg)

## How to Test Whether My Service is Affected?
In a website using Spring Framework, sending the following query to a Spring Framework related tests whether the website is vulnerable or not (see below picture).

Query for testing is below -
 
```curl -v host:port/path?class.module.classLoader.URLs%5B0%5D=0```

Picture below shows the result. If it responds with HTTP Status 400, the website might be vulnerable to this exploit.
![spring_update_pic3.jpg](https://legacy-uploads.teamt5.org/spring_update_pic3_24a8883e53.jpg)


## Mitigation
### **1. Check JDK version number**

To check JDK version number, run ```java -version``` command to check the running JDK version on the server of your organization system.

![spring vulnerability_pic2.png](https://legacy-uploads.teamt5.org/spring_vulnerability_pic2_e20563e16c.jpg)




- If the version number is below or equal to 8, it is not affected by the vulnerability.
- If the version number is above or equal to 9, the vulnerability exists. Please apply temporary measure for protection.

### **2. Temporary measure for protection: WAF protection**

There is no official patch available at the time of writing. We strongly suggest you use the temporary measure (WAF protection) and pay attention to the release of official patches.

**WAF protection**

On web application firewall (WAF), implement rule filtering for the following strings:

- ```class.*```, ```Class.*```, ```*.class.*```, ```*.Class.*```

## Reference
- Critical Exploit Alert: Spring RCE 0day 
漏洞情报 | Spring RCE 0day高危漏洞预警 
https://www.freebuf.com/vuls/326627.html

- SpringShell: Spring Core RCE 0-day Vulnerability 
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

- Randori Attack Team on Twitter: "The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE.
https://twitter.com/RandoriAttack/status/1509298490106593283

> Keywords: Spring4Shell, SpringShell, Spring, zeroday vulnerability, 0-day vulnerability, remote control execution vulnerability, JAVA

【TeamT5 Flash Alert】Spring Core RCE 0-Day Vulnerability

>- 2022 年 3 月 30 日 18:30（GMT+8）: 告警通知發佈
- 2022 年 3 月 31 日 更新： 新增 Proof Of Concept (POC) 及自我檢測方式
- 2022 年 4 月 6 日 更新：CVE 編號、官方 Patch 方式- 2022 年 3 月 31 日 更新： 新增 Proof Of Concept (POC) 及自我檢測方式
- 2022 年 4 月 6 日 更新：CVE 編號、官方 Patch 方式


## 重點摘要
2022 年 3 月 29 日，TeamT5 的網路情資團隊收到有關 Spring 框架的 RCE 零時漏洞告警通知。目前我們仍在持續調查該漏洞，依據現有的資訊來看，**我們評估此漏洞的危險級別為極度嚴峻**。

1. 基於 Spring 框架在開發 Java 應用上的泛用程度，此漏洞恐會對於許多服務造成危害。
2. Spring Core RCE 零日漏洞（或稱 SpringShell、Spring4Shell）存在於 JDK 9.0 或以上的版本。
3. 截至分析當下，官方仍未釋出正式的修補程式，我們強烈建議所有的合作夥伴與客戶務必檢視自己的程式碼庫並採取以下緩解措施。

## 具體細節
![spring vulnerability_pic1.png](https://legacy-uploads.teamt5.org/spring_vulnerability_pic1_fa9c1e327b.png)

|面向|描述|
|---|---|
|公共漏洞與暴露（CVE）|截至撰寫當下，此漏洞仍未取得 CVE 編號|
|危險級別|極度嚴峻|
|影響版本|JDK 9.0 或以上的版本以及有使用到衍生框架 ```spring-beans-*.jar```，或存在```CachedIntrospectionResults.class```|
|概念驗證（PoC）|概念驗證（PoC） 已有釋出|
|修補程式|截至撰寫當下，尚未有官方正式的修補程式|

**根據現有的資訊來觀察，我們評估此漏洞的衝擊程度將十分嚴重，而其危險級別很可能近似於 Log4j 漏洞**。Spring 框架是 Java 平台上最廣受歡迎的輕量應用框架，許多公司和組織皆有在其網際網路對向服務（internet-facing service）中採用此框架。這意謂所有應用 Java 的產品或網頁服務都可能受此漏洞影響。

SpringShell 是一個遠端執行程式碼（RCE）漏洞。根據公開資訊指出，威脅行動者一旦成功利用該漏洞，便能取得任意上傳檔案的權限。

TeamT5 會持續為我們的合作夥伴與客戶更新此漏洞的相關資訊。我們的合作夥伴與客戶可以倚靠 TeamT5 的解決方案 ThreatVision 和 ThreatSonar 以抵禦潛在的攻擊。

## PoC
網路上已有不少針對此漏洞利用方法釋出，實際執行結果如下：
 
Payload:
 
![/spring-rce-zeroday-vulnerability_PAYLOAD.png](https://uploads.teamt5.org/upload/original/spring-rce-zeroday-vulnerability_PAYLOAD.png)

 
實際執行結果圖：
![spring_update_pic1.jpg](https://legacy-uploads.teamt5.org/spring_update_pic1_84fa3ea5fb.jpg)


在 Spring 的網站程式，對 Spring 對應的路徑(參考下圖)，送入特定的 payload，能寫入任意路徑文件，可透過上傳 Webshell 來達到任意指令執行(RCE)，上圖是執行 payload 後，確實產生檔案。
![spring_update_pic2.jpg](https://legacy-uploads.teamt5.org/spring_update_pic2_c9326dfbe2.jpg)

## 如何檢測我的服務是否受到影響？ 
在 Spring 的網站程式，對 Spring 對應的路徑，送入特定的 Query，能測試網站是否存在弱點。

檢測 Query 如下：
 
```curl -v host:port/path?class.module.classLoader.URLs%5B0%5D=0```

下圖為執行 Query 後，如果回應 HTTP Status 400，很可能是有弱點的。
![spring_update_pic3.jpg](https://legacy-uploads.teamt5.org/spring_update_pic3_24a8883e53.jpg)



## 緩解措施
### **1.確認 JDK 版本代號**

如要確認 JDK 版本代號，請於貴組織系統的伺服器上執行 java -version 指令以確認運行中的版本代號。
![spring vulnerability_pic2.png](https://legacy-uploads.teamt5.org/spring_vulnerability_pic2_e20563e16c.jpg)



- 如果版本代號低於或等於 8，將不會受此漏洞影響。
- 如果版本代號高於或等於 9，則漏洞存在。請參照以下臨時方案抵禦潛在的攻擊。

### **2. 臨時方案：WAF 阻擋**

截至撰寫當下，官方並無發布正式的修補程式。我們強烈建議您採用臨時方案（WAF 防護）並留意官方修補程式釋出的通知。

**WAF 阻擋**

在網頁應用防火牆（WAF）中置入規則過濾以下字串

- ```class.*```, ```Class.*```, ```*.class.*```, ```*.Class.*```

## Reference
- Critical Exploit Alert: Spring RCE 0day 
漏洞情报 | Spring RCE 0day高危漏洞预警 
https://www.freebuf.com/vuls/326627.html

- SpringShell: Spring Core RCE 0-day Vulnerability 
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

- Randori Attack Team on Twitter: "The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE.
https://twitter.com/RandoriAttack/status/1509298490106593283

> 關鍵字: Spring4Shell, SpringShell, Spring, zeroday vulnerability, 0-day vulnerability, remote control execution vulnerability, JAVA

【TeamT5 資安即時快訊】Spring Core RCE 零日漏洞

>- 2022年3月30日 18:30（GMT+8）：アラート通知の発行
 - 2022年3月31日 更新：Proof Of Concept（POC）および自己検出方法を追加
 - 2022年4月6日 更新：CVE識別番号、公式Patchの方法- 2022年3月31日 更新：Proof Of Concept（POC）および自己検出方法を追加


## ポイントの概要
2022年3月29日、TeamT5のサイバーインテリジェンスチームは、SpringフレームワークのRCEに関するゼロデイ脆弱性のアラートを受信しました。現在も当社は脆弱性の調査を続けていますが、これまでの情報に基づき、**当社はこの脆弱性の危険性は非常に深刻であると評価しています**。

1. Springフレームワークは、Javaアプリケーションの開発において幅広く使用されていることから、この脆弱性はさまざまなサービスに危害を及ぼす可能性があります。
2. Spring Core RCEゼロデイ脆弱性（別名SpringShell、Spring4Shell）は、JDK 9.0以降のバージョンに存在しています。
3. これまでの解析時点で公式の修正パッチは公開されていません。当社は、すべての業務提携パートナーおよび顧客が自身のコードライブラリをチェックし、以下の緩和策を講じることを強くおすすめします。


## 具体的な内容
![spring vulnerability_pic1.png](https://legacy-uploads.teamt5.org/spring_vulnerability_pic1_fa9c1e327b.png)

|方向性|説明|
|---|---|
|一般的な脆弱性と露出（CVE）|本稿執筆時点でこの脆弱性はCVE識別番号を取得していない。|
|リスクレベル|非常に深刻|
|影響を受けるバージョン|JDK 9.0以降のバージョン、派生したフレームワーク```spring-beans-*.jar```を使用している、```CachedIntrospectionResults.class```が存在している場合|
|概念実証（PoC）|概念実証（PoC）は公開されている|
|修正パッチ|本稿執筆時点で公式の修正パッチは公開されていない|


**これまでの情報に基づいた観察で、当社はこの脆弱性はインパクトが非常に深刻であると評価しており、Log4jの脆弱性に近いリスクレベルになる可能性があります**。Springフレームワークは、Javaプラットフォームで最も人気がある軽量アプリケーションのフレームワークで、多くの企業や組織がインターネット向けのサービス（internet-facing service）で使用しています。これは、Javaを使用している製品やWebページサービスのすべてがこの脆弱性の影響を受ける可能性があることを意味しています。

SpringShellは、リモートコード実行（RCE）攻撃につながる脆弱性です。公開されている情報によると、攻撃者はこの脆弱性の利用を一度成功させるだけで、任意にファイルをアップロードする権限を得ることができます。

TeamT5は、業務提携パートナーおよび顧客向けに、この脆弱性に関する情報を引き続きアップデートしていきます。当社の業務提携パートナーおよび顧客は、TeamT5のソリューション「ThreatVision」と「ThreatSonar」で、潜在的な脅威に対抗することができます。


## PoC
インターネット上では、この脆弱性について多くの利用方法が公開されていますが、実際の実行結果は以下のとおりです：
 
Payload:
![/spring-rce-zeroday-vulnerability_PAYLOAD.png](https://uploads.teamt5.org/upload/original/spring-rce-zeroday-vulnerability_PAYLOAD.png)

 
実際の実行結果：
![spring_update_pic1.jpg](https://legacy-uploads.teamt5.org/spring_update_pic1_84fa3ea5fb.jpg)


SpringのWebアプリケーションで、Springに対応するパス（下図参照）に特定のpayloadが送信されることで、任意のパスのファイルに書き込みが可能となり、Webshellをアップロードすることで、リモートコード実行（RCE）が可能となります。上の図はpayloadを実行した後に生成されたファイルです。
![spring_update_pic2.jpg](https://legacy-uploads.teamt5.org/spring_update_pic2_c9326dfbe2.jpg)

## 利用中のサービスが影響を受けているかチェックする方法。
SpringのWebアプリケーションで、Springに対応するパスに、特定のQueryを送信することでWebサイトに脆弱性がないかテストできます。

テストするQueryは以下の通りです：
 
```curl -v host:port/path?class.module.classLoader.URLs%5B0%5D=0```

下図はQueryの実行後で、HTTP Status 400が返ってきた場合、脆弱性が存在する可能性が高いです。
![spring_update_pic3.jpg](https://legacy-uploads.teamt5.org/spring_update_pic3_24a8883e53.jpg)



## 緩和策
### **1.JDKのバージョン番号を確認します。**

JDKのバージョン番号を確認するには、組織のシステムのサーバでjava -versionのコマンドを実行し、使用中のバージョン番号を確認します。
![spring vulnerability_pic2.png](https://legacy-uploads.teamt5.org/spring_vulnerability_pic2_e20563e16c.jpg)



- バージョン番号が8以前の場合、この脆弱性の影響はありません。
- バージョン番号が9以降の場合、脆弱性が存在します。潜在的な攻撃を防ぐため、以下の一時的な処置をご参照ください。


### **2. 一時的な処置：WAFでブロック**

本稿執筆時点で公式の修正パッチは公開されていません。当社は一時的な処置（WAF保護）を行うほか、公式の修正パッチの公開に注意することを強くおすすめします。

**WAFでブロック**

WAF（Webアプリケーションファイアウォール）に以下の文字列をフィルタリングするルールを追加します。

- ```class.*```, ```Class.*```, ```*.class.*```, ```*.Class.*```

## キーワード
- Critical Exploit Alert: Spring RCE 0day 
漏洞情报 | Spring RCE 0day高危漏洞预警 
https://www.freebuf.com/vuls/326627.html

- SpringShell: Spring Core RCE 0-day Vulnerability 
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

- Randori Attack Team on Twitter: "The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE.
https://twitter.com/RandoriAttack/status/1509298490106593283

> キーワード: Spring4Shell, SpringShell, Spring, zeroday vulnerability, 0-day vulnerability, remote control execution vulnerability, JAVA

【TeamT5情報セキュリティ速報】Spring Core RCE ゼロデイ脆弱性

美國 CIO 雜誌於2021年度回顧中，點名勒索軟體(又稱勒索病毒)是年度最主要的資安威脅之一，若只統計銀行業遭受的勒索攻擊，2021的受攻擊次數就已達130倍的成長。

## 企業面臨的勒索軟體威脅

綜觀新聞報導，若企業受到勒索軟體攻擊，會有3大問題:
 
1.重要檔案被加密: 企業財務、研發等資料被鎖住，無法存取。
 
2.系統被破壞: 系統營運中斷，影響企業日常運作、客戶服務等。
 
3.勒索軟體擴散: 該類軟體執行後，可橫向擴散，進入各個保護機制不佳的系統，如從企業資源規劃管理系統 (ERP) ，跳到研發文件管理系統。

## 企業防勒索軟體工具的選擇重點

CIO 雜誌指出唯一可靠的預防方式為採用適當的工具，持續監控和評估電腦的承受度。

TeamT5 精心研發的 ThreatSonar Anti-Ransomware，即是針對勒索軟體攻擊的有效防護工具，避免前述3大問題，更有誘捕機制，使勒索軟體攻擊到假檔案，並同時中斷惡意程式運行、阻止檔案被加密。

>今天就聯絡我們，看產品 Demo: https://teamt5.org/tw/request-information/

 
 
 
*參考資料: [Looking back to look ahead: Anticipating the cybersecurity landscape in 2022 (cio.com)](https://www.cio.com/article/301513/looking-back-to-look-ahead-anticipating-the-cybersecurity-landscape-in-2022.html)


*圖片來源: [Pixabay](https://pixabay.com/photos/teamwork-cooperation-brainstorming-3213924/)

企業需要哪種防勒索軟體工具? 

米国の CIO 雑誌が2021年度を振り返る中で、ランサムウェアが当該年度における最も主要な情報セキュリティ脅威の一つとして挙げた。銀行業界が被害を受けたランサムウェア攻撃だけに絞って統計を見た場合、2021年の攻撃回数は130倍もの増加を遂げている。

## 企業が直面するランサムウェアの脅威

ニュース報道を総括すると、企業がランサムウェアの攻撃を受けた時、3つの問題がある。
1. 重要なファイルの暗号化：企業財務、研究開発等のデータがロックされ、アクセスできない。
2. システムの破壊：システム運用が中断され、企業の日常業務や顧客サービス等に影響する。
3. ランサムウェアの拡散：これらのソフトウェアが実行されるとラテラルムーブメントによって、企業のリソースプランニング管理システム（ERP）や、研究開発ドキュメントの管理システムに至るまで、保護体系が不十分なシステムに侵入する。

## 企業のランサムウェア防御ツール選択における重要点

CIO 雑誌は、これらを防ぐために唯一信頼できる方法は、適切なツールを使用して持続的に PC の許容度をモニタリングおよび評価することだと指摘している。

TeamT5 が開発した ThreatSonar Anti-Ransomware はランサムウェア攻撃に対する効果的な防御ツールであり、前述した3つの問題を回避し、おびき寄せシステムによってランサムウェアの攻撃を偽のファイルに対して行わせると同時に、悪意のあるプログラムの実行を中断してファイルの暗号化を阻止することができる。

>ぜひ当社にご連絡いただき、製品 Demo をご覧ください：[https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blog&utm_medium=website)

 
 
 
*参考資料: [Looking back to look ahead: Anticipating the cybersecurity landscape in 2022 (cio.com)](https://www.cio.com/article/301513/looking-back-to-look-ahead-anticipating-the-cybersecurity-landscape-in-2022.html)


*圖片來源: [Pixabay](https://pixabay.com/photos/teamwork-cooperation-brainstorming-3213924/)

企業にはどのようなランサムウェア防御ツールが必要か？

## Brief
In 2021, we discovered an open directory on Huapi’s C2. We found the source code contained an exploit aiming at Mikrotik routers. More specifically, our analysis found that the exploit would allow the attackers to send specially crafted payloads to achieve Remote Code Execution (RCE) via WAN without any authentications. The targeted RouterOS products include mikrotik-tile-6.46.8, mikrotik-vm-64.8, and mikrotik-vm-6.48.

TeamT5 alerted Mikrotik to patch this vulnerability upon discovery. The patch for this vulnerability was released on 2021/11/17 and can be downloaded from the official Mikrotik website. All affected organizations should update their RouterOS immediately to avoid actors’ exploitation.

HUAPI (aka BlackTech, Palmerworm, or PLEAD) has been active since 2007 and has been targeting Taiwan for over a decade. Huapi’s malwares are highly sophisticated, and some of them use unique anti-analysis packers. Some of Huapi’s malware utilized a modified RC4 algorithm to encrypt the malicious C2 communication. Huapi focused on governmental entities, technology or telecommunication industries, and think tanks. Our observation suggested that over half of the victims were governmental agencies in Taiwan, the United States, Japan, and South Korea.

### Attack vector
As a powerful and easy-to-use router, Mikrotik routerboard supports SCEP (Simple Certificate Enrollment Protocol), a service that was designed for simple certificate delivery. During transport, the binary data is encoded in Base64 via HTTP GET. Unfortunately, when processing the data from the payload, a miscalculation may occur if the payload is not properly formatted, potentially resulting in a Heap-based Buffer Overflow.

The open directory we had discovered contained exploit code that targeted ```mikrotik-tile-6.46.8```, ```mikrotik-vm-64.8``` and ```mikrotik-vm-6.48```, along with their corresponding shellcode snippets. In the following sections, we will be analyzing the exploit code that was designed for ```mikrotik-vm-6.46.8```.

#### Root cause analysis
By sending the following payload, we can cause the service ```www``` to crash and potentially trigger a Heap-based Buffer Overflow.

 ```GET /scep/{scep_server_name}?operation=PKIOperation&message={} HTTP/1.1\r\n```

The crash can be traced back to the function ```base64Decode```, located under ```ScepRequest::parseRequest``` from ```/nova/lib/www/scep.p```. When unpacking the Base64 request, the following code is used to calculate the output buffer size,

```output_buffer_length = 3 * (input_buffer_length >> 2)```

…which may cause a miscalculation of the output buffer, resulting in an insufficient memory allocation from ```malloc```, leading to a heap overflow.

![Mikrotik 1.png](https://legacy-uploads.teamt5.org/Mikrotik_1_3b141d6955.png)


#### What happened?

For instance, we assume that the our input data is ```xxxxxxxxxxxxxxxxhCE```, and the length of input buffer is 19. Based on the decompiled code, ```out_len = 3 * (input_len >> 2)``` which is ```out_len = 3 * (input_len // 4)``` (double slashes represent integer division), thereby allocating 12 bytes as decoded data buffer. However, the decoded data buffer should be 14 bytes instead of 12. This oversight allows the attacker to overwrite data in heap.

#### Overview of the exploit flow
According to the chunk-recycling mechanism, by overwriting the chunk size of a chunk in bins to a larger value (```0x4121```), the next ```malloc``` call will return a heap chunk overlapped with allocated chunks. This will lead to a heap overflow when writing to the chunk.

The part which will be overwritten is a vtable pointer in a destructor (```sub_8052E90```) function, and by setting the register ```edx``` to ```0x8061a74```, the instruction ```call [edx+4]``` will execute the gadget at ```0x8058e89``` ( ```xchg eax, ebp; ret;``` ) and execute the shellcode after pivoting the stack to the attacker-owned buffer.

![Mikrotik 2.png](https://legacy-uploads.teamt5.org/Mikrotik_2_ccf3d68d2e.png)


#### Heap spray
The attacker can begin heap spraying by requesting 64 concurrent connections, and close some of them in order to let the vtable pointer be overwriten by the heap overflow later.

![Mikrotik 3.png](https://legacy-uploads.teamt5.org/Mikrotik_3_fe1501df37.png)

The function ```aaaa``` assembles the ROP gadgets, and the variable ```sc``` contains the shellcode for execution.
![Mikrotik 4.png](https://legacy-uploads.teamt5.org/Mikrotik_4_a90ea7d1c9.png)

#### Trigger heap overflow
The function ```bbbb``` sends the payloads to the victim server in the aforementioned format.

![Mikrotik 5.png](https://legacy-uploads.teamt5.org/Mikrotik_5_7049e384ab.png)
![Mikrotik 6.png](https://legacy-uploads.teamt5.org/Mikrotik_6_17cf9a40dd.png)

The parameter message (```'x'*801*4+'hCE'```) in the function ```bbbb``` will overwrite the size of next chunk. Here in gdb , it shows that the parameter message has been decoded to ```c7 1c 71 84 21``` at ```0x80859f0```, and the last byte ```\x21``` has been written as the next chunk size at ```0x80859f4```.

![Mikrotik 7.png](https://legacy-uploads.teamt5.org/Mikrotik_7_d1f398ad3a.png)

#### Attempting to retrieve the oversized chunk on heap
![Mikrotik 8.png](https://legacy-uploads.teamt5.org/Mikrotik_8_69ec279783.png)

In order to retrieve the overflowed chunk, we need to send out more request. At some point, the register ```edx``` will be set to ```0x8061a74``` when the attempt reaches ```i=3```.

![Mikrotik 9.png](https://legacy-uploads.teamt5.org/Mikrotik_9_0ea232d0c5.png)

#### Trigger destructor
The final step of the exploit, set off destructor  ```call [edx+4]``` by closing connections.
![Mikrotik 10.png](https://legacy-uploads.teamt5.org/Mikrotik_10_3d19ac41ab.png)

#### Fingers crossed
Thanks to the heap spraying at the initial phase of the exploit, the data in the address ```0x8061a74``` will be modified, thus the instruction ```call [edx+4]``` will end up calling ```0x8058e89``` instead (the address of gadget ```xchg eax, ebp; ret;```) and start executing our gadgets.

![Mikrotik 11.png](https://legacy-uploads.teamt5.org/Mikrotik_11_936def75c5.png)

Once the gadgets have been hit, ```0x8058e89: xchg eax, ebp; ret``` and ```0x8052eb9: leave``` will allow us to pivot from the stack to the controllable buffer and start to execute our ROP chain from ```0x804fbfc```.

The ROP chain will try to increase the address of ```open``` to the address of ```mprotect```, and the ```0x804fc04: pop esp; ret;``` will set ```esp``` to ```0x8061a74+8``` to wrap up the ROP chain. Lastly, calling ```mprotect``` and jump right into the shellcode (```0x8061674```).

![Mikrotik 12.png](https://legacy-uploads.teamt5.org/Mikrotik_12_85dcd691f7.png)

In the exploit, the shellcode can be interpreted as ```unlink('/nova/store/user.data') + sync() + reboot()```, after the target device has finished rebooting. The attacker should then be able to login into web service as admin without a password.

### Conclusion
To wrap up, let’s go over the exploit code once again:

**1. Low stability**

- Since ```add()``` does not work in our favor and that ASLR is enabled by default, the exploit chain may fail on the first try.
- Occasionally, even though the ```/nova/store/user.dat``` file will be deleted, the device does not end up rebooting. The shellcode may require extra improvements to make it more stable.
- Even in best case scenario, the success rate is only about 5~6%.
- Thankfully, in the event where the attack attempt fails, the watchdog process will restart the ```www``` service for us. This ensures stability and allows the attacker to not cause noticeable disruption during the attack.

**2. Strict prerequisites**

- The attacker must be aware of the path name ```scep_server_name``` before being able to begin such attack.

**3. Disclosure Timeline**

```2021/07/11```: Acquire exploit codes from the open directory

```2021/10/04```: Responsible disclosure to Mikrotik and reserved CVE-2021-41987

```2021/11/17```: Official patch released

```2022/03/01```: Full disclosure released

**4. Affected versions of RouterOS**
- ```6.46.8```
- ```6.47.9```
- ```6.47.10```

### About TeamT5 D39
D39 is committed to the field of vulnerability security and vulnerability discovery. The research scope includes systems and devices that are connected to the Internet, such as mobile devices, IoT devices, Linux, and Windows. Our team has held a number of critical or important vulnerabilities and has conducted presentations across various major security conferences, such as Blackhat, HITCON, etc.

Exploit research has always been one of the most advanced fields in network attack and defense. TeamT5 expects to invest resources to cultivate more talents to enter this field, and expects to have more and more world-leading vulnerability research talents in Taiwan. We welcome those who dare to face unknown challenges, are committed to vulnerability research and discovery, and have independent research capabilities to join us. 🤝

### Reference
- https://wiki.mikrotik.com/wiki/Manual:System/Certificates
- https://en.wikipedia.org/wiki/Base64

*Image courtesy of Pixabay

Vulnerability Exposure & Notification on Mikrotik (CVE-2021-41987) 

## 前言
APT 駭客組織 Huapi 自 2007 年開始活躍至今，攻擊台灣超過 10 年的時間。TeamT5 觀察到 Huapi 所開發的惡意程式，有時會使用加殼來阻擋研究人員分析，且通常會使用修改後的 RC4 演算法來加密傳輸。Huapi 長期攻擊政府、高科技、電信或研究智庫單位，根據 TeamT5 的統計結果，超過 5 成的受害單位為政府機關，受害國家包含台灣、美國、日本及南韓，其中針對台灣政府機關進行入侵攻擊為多。

仰賴於長期的追蹤及觀察，我們在一台中繼站發現公開目錄，目錄中存在一組針對 Mikrotik SCEP 服務的 0day 攻擊程式碼。在確定弱點存在後，我們也將弱點的相關成因回報給 Mikrotik 官方，讓官方可以在第一時間內進行修補開發，以避免該弱點繼續被惡意攻擊者進行利用。

Mikrotik 官方於 2021/11/17 釋出了修正版本，請有使用到受影響版本的用戶盡速升級，以免遭受危害。這裡我們將完整揭露攻擊程式的利用細節及漏洞原理，讓我們一窺 APT 駭客組織都是怎麼為達目的、不擇手段。

### 攻擊程式包分析
作為一個功能強大且簡單易用的路由器，Mikrotik routerboard 也支援簡單憑證註冊通訊協定(Simple Certification Enrolling Protocol, SCEP)，來讓其他終端裝置可以簡便的取得所需之憑證。在協定交互的過程中，所有二進位資訊都會使用 base64 編碼之後再進行傳送，但由於 Mikrotik SCEP 服務在進行 base64 解碼的時候計算錯誤，會導致 Heap-based buffer overflow 的發生。

攻擊程式碼(以下簡稱 exploit)總共包含了針對三個不同版本的 exploit code 分別是 ```mikrotik-tile-6.46.8```、```mikrotik-vm-64.8```與```mikrotik-vm-6.48```，及其相對應版本的 shellcode 用以攻擊成功之後執行額外的惡意指令。

以下是我們針對版本 ```mikrotik-vm-6.46.8``` 進行的exploit分析。

### 弱點根因
透過一個簡單的 HTTP 請求:

```GET /scep/{scep_server_name}?operation=PKIOperation&message={} HTTP/1.1\r\n```

將可以很容易的讓 ```www``` 這個負責 HTTP 服務的 binary 崩潰，並被 watchdog 重新啟動。

經過一番逆向工程後可以發現，位於 ```/nova/lib/www/scep.p``` 中的 ```ScepRequest::parseRequest```，在解開 base64 編碼的 ```message``` 參數時，由於計算解編碼後的資料長度出現錯誤，導致 malloc 分配出來的大小不足，進而造成 heap overflow：
![Mikrotik 1.png](https://legacy-uploads.teamt5.org/Mikrotik_1_3b141d6955.png)

### 讓 Base64 變成漏洞，是不是搞錯了什麼 ?
舉例來說，假設我們的輸入資料是 ```xxxxxxxxxxxxxxxxhCE``` 長度為 19，依照逆向後的程式邏輯來看，SCEP 計算出解編碼後的長度是12 ``` out_len = 3 * (in_len // 4)``` (這邊的 ```//``` 為整數除法)。但實際上解編碼後的資料長度為 14，這就直接導致了 heap 上的資料被覆蓋的問題。

### 漏洞利用
透過分析 exploit code 我們可以發現，攻擊者使用上述漏洞將 bins 中的某個 chunk size 改大 (0x4121)，之後再次 malloc 將會拿到這個過大的 chunk 屆時便可以覆寫 heap 上的內容。

覆蓋某個 destructor 中會用到的 vtable pointer，將 ```edx``` 改成 ```0x8061a74``` 使得 ```call [edx+4]``` 執行位於 ```0x8058e89``` 的 gadget (```xchg eax, ebp; ret;```)。

![Mikrotik 2.png](https://legacy-uploads.teamt5.org/Mikrotik_2_ccf3d68d2e.png)

#### 堆噴灑
首先發起 64 個請求做 heap spray 將我們要的 gadget 與 shellcode 隨著連線請求灑到 heap 上，並將其中一些連線關閉來讓 heap chunk 可以被 overflow 覆蓋到 vtable pointer。

![Mikrotik 3.png](https://legacy-uploads.teamt5.org/Mikrotik_3_fe1501df37.png)

這裡用到的 function ```aaaa``` 會將後續所需要的 ROP gadgets 組合起來，function 中的變數 ```sc``` 表示後面會被執行到的 shellcode。

![Mikrotik 4.png](https://legacy-uploads.teamt5.org/Mikrotik_4_a90ea7d1c9.png)

#### 觸發堆溢出
透過呼叫 function ```bbbb``` 會將我們的 payload 使用前面提過的型式送出用以觸發 heap overflow。

![Mikrotik 5.png](https://legacy-uploads.teamt5.org/Mikrotik_5_7049e384ab.png)
![Mikrotik 6.png](https://legacy-uploads.teamt5.org/Mikrotik_6_17cf9a40dd.png)

在 function 中的參數 message ```'x'*801*4+'hCE'```，會在 base64 解編碼的同時由於前述的計算錯誤，將導致下一個 chunk 的 size 會剛好被覆蓋到。
![Mikrotik 7.png](https://legacy-uploads.teamt5.org/Mikrotik_7_d1f398ad3a.png)


#### 嘗試重新取得被覆蓋到 size 的 chunk
後續透過繼續新增請求的方式，嘗試取得被改大的 chunk，overflow 的內容可以改到在 vtable 裡的 pointer。

![Mikrotik 8.png](https://legacy-uploads.teamt5.org/Mikrotik_8_69ec279783.png)


在 ```i=3``` 時，會讓 ```edx``` 的值改成 ```0x8061a74```。
![Mikrotik 9.png](https://legacy-uploads.teamt5.org/Mikrotik_9_0ea232d0c5.png)


#### 觸發 destructor

最後透過關閉連線的方式，觸發 destructor ```call [edx+4]```
![Mikrotik 10.png](https://legacy-uploads.teamt5.org/Mikrotik_10_3d19ac41ab.png)


#### 幸運爆擊
由於一開始的 heap spray，```0x8061a74``` 會變成某個一連線時填入的內容，因此 ```call [edx+4]``` 會變成呼叫 ```0x8058e89```。

![Mikrotik 11.png](https://legacy-uploads.teamt5.org/Mikrotik_11_936def75c5.png)


一旦成功進到 ROP gadget，這個 ROP chain，會將 ```open@got``` 改成 ```mprotect```，使用 gadgets，嘗試把 ```open``` 變成 ```mprotect```。

![Mikrotik 12.png](https://legacy-uploads.teamt5.org/Mikrotik_12_85dcd691f7.png)



```0x804fc04: pop esp; ret;``` 會把 ```esp``` 改成 0x8061a74+8，接回完整 ROP chain。 最後呼叫 ```mprotect``` 使執行流進到 shellcode (```0x8061674```) 上執行。

該份 exploit 中 shellcode 的內容為，```unlink('/nova/store/user.dat') + sync() + reboot()```。 等待重新啟動之後可以發現 Web 介面可以不使用密碼直接登入。

### 結論
透過上面的分析可以發現這個攻擊程式碼(exploit)有幾個侷限性：

**1. 穩定性較低**
- 由於 ```add()``` 沒有處理進位，又有 ASLR 的緣故，運氣不好的話將直接導致攻擊失敗。
- 在嘗試重現的過程中我們也發現到，有時候 shellcode 已經正常執行 (```/nova/store/user.dat``` 已經被刪除)，卻未如預期般重新啟動，這部分需要改進 shellcode 來增加成功機率。
- 在嘗試重現的同時，我們也試圖透過修改 exploit 及 shellcode 來增加其穩定性，但最後成功率仍只有約略為 5~6%。
- 唯一值得慶幸的是，倘若攻擊失敗也只是會造成 ```www``` crash 後被 watchdog 重新啟動，並不會對使用上造成太大困擾或是引起使用者注意。

**2. 攻擊前提嚴格**

如根因所述，```scep_server_name``` 須為已知，若沒有這個 path 基本上也無法進行攻擊。

**3. 回報時間軸**

- ```2021/07/11```: 在 C2 發現 exploit code
- ```2021/10/04```: 回報給 Mikrotik 官方, 保留編號 CVE-2021-41987
- ```2021/11/17```: Mikrotik 官方釋出更新修正該弱點
- ```2022/03/01```: 公開 CVE-2021-41987 相關細節

**4. RouterOS 受影響版本**

- ```6.46.8```
- ```6.47.9```
- ```6.47.10```

### 關於 TeamT5 D39 漏洞研究團隊
D39 致力於弱點安全與漏洞挖掘領域，研究範圍包含 Mobile、IOT、Linux、Windows 等有機會連網的系統與裝置都是我們的目標（笑），團隊擁有多項重大（Critical）或重要（Important）之安全漏洞，並於 Blackhat、HITCON、POC 等國際會議擔任講者。

攻擊程式碼(exploit)研究一直是網路攻防裡面最高深的技術之一，TeamT5 期許投入資源來培養更多人才進入這個領域，期待台灣能有越來越多世界頂尖的弱點研究人才。歡迎勇於面對未知挑戰，致力於漏洞研究、挖掘為目標，並具有獨立研究能力者一同加入我們 🤝

### 參考
- https://wiki.mikrotik.com/wiki/Manual:System/Certificates
- https://en.wikipedia.org/wiki/Base64

*首圖來源: Pixabay

Mikrotik 漏洞揭露與通報 (CVE-2021-41987)

## はじめに
APTのハッカー組織Huapiは、2007年から活動を開始し、10年以上台湾に攻撃を仕掛けています。TeamT5は、Huapiが開発したマルウェアについて、研究員の解析を防ぐためにパッキングされていることがあり、通常は変更されたRC4のアルゴリズムで暗号化して送信されることを確認しました。Huapiは長期にわたり政府、ハイテク、電気通信、研究、シンクタンク機関を攻撃しており、TeamT5の統計では、被害者の50%以上が政府機関となっています。台湾、アメリカ、日本、韓国などが被害を受けており、多くの侵入や攻撃が台湾の政府機関を狙ったものであることが確認されました。

長期的な追跡と観察により、当社はC&Cサーバでの公開ディレクトリにMikrotik SCEPサービスを対象とした0dayエクスプロイト一式が含まれていることを発見しました。脆弱性の存在を確認した後、当社は脆弱性が発生する原因をMikrotikに報告しました。これにより、直ちに修正パッチを開発し、この脆弱性を利用した継続的なマルウェアの攻撃を防ぐことができました。

Mikrotikは、2021年11月17に公式の修正バージョンを公開しています。影響を受けるバージョンを使用しているユーザーは、被害を避けるためにできるだけ早くアップデートしてください。当社はここで攻撃プログラムの詳細と脆弱性が生まれる原理の詳細を明らかにします。目的のためなら手段を選ばないAPTハッカー組織のやり方を見てみましょう。

### 悪意のあるパッケージの解析
Mikrotik routerboardは、強力な機能性と簡易性を備えたルーターとして、他の端末装置が必要な証明書を簡単に取得できるよう、SCEP（Simple Certification Enrolling Protocol）をサポートしています。プロトコルの相互作用において、すべてのバイナリデータはbase64エンコード後に送信されますが、Mikrotik SCEPサービスによるbase64デコードの計算エラーが、Heap-based buffer overflowを引き起こします。

エクスプロイト（exploit）には、3つのバージョンを対象としたexploit code```mikrotik-tile-6.46.8```、```mikrotik-vm-64.8```、```mikrotik-vm-6.48```および攻撃成功後にコマンドインジェクションを追加するため、バージョンに応じたshellcodeが含まれています。

以下は、当社がバージョン```mikrotik-vm-6.46.8```に対して行ったexploitの解析です。

### 脆弱性の根本的な原因

シンプルなHTTPリクエスト：

 ```GET /scep/{scep_server_name}?operation=PKIOperation&message={} HTTP/1.1\r\n``` 

```www``` というHTTPサービスを担うbinaryを簡単に破壊し、watchdogで再起動することができます。

リバースエンジニアリングにより、 ```/nova/lib/www/scep.p``` の ```ScepRequest::parseRequest``` がbase64エンコードの ```message``` パラメータをデコードする時、データの長さの計算にエラーが発生することでmallocの割り当てが不足し、heap overflowが発生することを発見しました。
 
![Mikrotik 1.png](https://legacy-uploads.teamt5.org/Mikrotik_1_3b141d6955.png)
 

### Base64が脆弱性になるのは、何かの間違いではないか
例えば、 ```xxxxxxxxxxxxxxxxhCE``` という長さ19のデータを入力した場合、リバースエンジニアリング後のプログラミングロジックの観点から、SCEPはデコード後の長さを12として計算します。 ``` out_len = 3 *（in_len // 4）``` （ここでの```//```は整数の除法です）。しかし、実際のデコード後のデータの長さは14で、これがheapのデータが上書きされる問題につながります。

### 脆弱性の利用
当社は、exploit codeの解析により、攻撃者は上記の脆弱性を利用してbinsの特定のchunk sizeをより大きなサイズの（0x4121）に変更し、続いてmallocが大きくなったchunkを取得する時にheapの内容を上書きすることを発見しました。

特定のdestructorで使用されるvtable pointerを上書きして ```edx``` を ```0x8061a74``` に変更し、 ```call [edx+4]``` が ```0x8058e89``` のgadgetを実行するようにします（ ```xchg eax, ebp; ret;``` ）。
 
![Mikrotik 2.png](https://legacy-uploads.teamt5.org/Mikrotik_2_ccf3d68d2e.png)
 
#### ヒープスプレー
はじめに、64のheap sprayをリクエストし、接続リクエストと同時に必要なgadgetとshellcodeをheapにスプレーします。heap chunkのoverflowによってvtable pointerが上書きされるように一部の接続は閉じられます。
 
![Mikrotik 3.png](https://legacy-uploads.teamt5.org/Mikrotik_3_fe1501df37.png)
 
ここで使用されるfunction ```aaaa``` は、後で必要となるROP gadgetsを組み合わせます。functionの変数```sc```は、後で実行されるshellcodeを示しています。
 
![Mikrotik 4.png](https://legacy-uploads.teamt5.org/Mikrotik_4_a90ea7d1c9.png)
 
#### ヒープオーバーフローのトリガー
function ```bbbb``` を呼び出すと、前述のパターンでheap overflowをトリガーする当社のpayloadが送信されます。
 
![Mikrotik 5.png](https://legacy-uploads.teamt5.org/Mikrotik_5_7049e384ab.png)
![Mikrotik 6.png](https://legacy-uploads.teamt5.org/Mikrotik_6_17cf9a40dd.png)
 
functionのパラメータ message ```'x'*801*4+'hCE'``` は、base64デコードと同時に前述の計算エラーにより、次のchunkのsizeがちょうど上書きされます。
 
![Mikrotik 7.png](https://legacy-uploads.teamt5.org/Mikrotik_7_d1f398ad3a.png)
 

#### sizeが上書きされたchunkの再取得を試みる
続いて、リクエストを追加し続け、サイズを大きくされたchunkの取得を試みることで、overflowの内容をvtableのpointerに変更することができます。
 
![Mikrotik 8.png](https://legacy-uploads.teamt5.org/Mikrotik_8_69ec279783.png)
 

```i=3``` の時、 ```edx``` の値が ```0x8061a74``` になります。
 
![Mikrotik 9.png](https://legacy-uploads.teamt5.org/Mikrotik_9_0ea232d0c5.png)
 

#### destructorのトリガー 


最後に接続を閉じることで、destructor ```call [edx+4]```をトリガーします。
![Mikrotik 10.png](https://legacy-uploads.teamt5.org/Mikrotik_10_3d19ac41ab.png)


#### 幸運を祈る
最初のheap sprayにより、 ```0x8061a74``` のデータアドレスが変更されるため、 ```call [edx+4]``` が ```0x8058e89``` を呼び出すようになります。
 
![Mikrotik 11.png](https://legacy-uploads.teamt5.org/Mikrotik_11_936def75c5.png)
 

ROP gadgetへのアクセスが一度成功すると、このROP chainが ```open@got``` を ```mprotect``` に変更し、gadgetsを使用して ```open``` を ```mprotect``` に変更しようとします。

![Mikrotik 12.png](https://legacy-uploads.teamt5.org/Mikrotik_12_85dcd691f7.png)



```0x804fc04: pop esp; ret;``` は ```esp``` を0x8061a74+8に変更し、完全なROP chainに再接続します。 最後に ```mprotect``` を呼び出し、shellcode ( ```0x8061674``` )にジャンプして実行します。

このexploitのshellcodeの内容は、 ```unlink('/nova/store/user.dat') + sync() + reboot()``` です。 再起動後、Webインターフェースでパスワードを使わなくてもログインできることが確認できます。


### 結論
上記の解析により、このエクスプロイト（exploit）には、いくつかの制限があることを確認しました：

**1. 安定性が低い**
- ```add()``` は、けた上げ数を処理せず、ASLRがあることから、運が悪ければ攻撃の失敗に直接つながります。
- 再現を試みる過程で、当社もshellcodeが正常に実行されているにも関わらず（ ```/nova/store/user.dat``` が削除されている）、予想通りに再起動しないことがあることを発見しました。この部分については、shellcodeを改良して成功率を上げる必要があります。
- 再現を試みながら、当社もexploitとshellcodeの修正により安定性を高めようとしましたが、最終的な成功率は約5～6%にすぎませんでした。
- 唯一幸いだったのは、攻撃が失敗しても ```www``` がcrashしてwatchdogが再起動されるだけで、使用上に大きな問題はなく、ユーザーの目につくこともないという点です。


**2. 攻撃のための厳しい前提条件**

根本的な原因として述べたように、 ```scep_server_name``` を認識している必要があり、このpathがなければ、基本的に攻撃することはできません。

**3. 開示のタイムライン**

- ```2021/07/11``` : C2でexploit codeを発見
- ```2021/10/04``` : Mikrotikに報告、識別番号CVE-2021-41987を予約
- ```2021/11/17``` : Mikrotikがこの脆弱性を修正するアップデートを公開
- ```2022/03/01``` : CVE-2021-41987に関する詳細を開示

**4. 影響を受けるRouterOSのバージョン**

- ```6.46.8``` 
- ```6.47.9``` 
- ```6.47.10``` 

### TeamT5 D39脆弱性研究チームについて
D39は脆弱性のセキュリティと脆弱性の発掘に取り組んでおり、研究範囲には、Mobile、IOT、Linux、Windowsなど、インターネットに接続されるシステムやデバイスのすべてが含まれます。重大（Critical）または重要（Important）なセキュリティ脆弱性に関する豊富な経験を有し、Blackhat、HITCON、POCなど国際的なカンファレンスで講演を行っています。

エクスプロイト（exploit）の研究は常にインターネットの攻防における最先端技術の一つとなっており、TeamT5は、台湾において世界トップクラスの脆弱性研究者がますます多くなることを目指し、より多くの人材を育成するためにリソースを投入しています。当社は、勇気を持って未知の挑戦に立ち向かい、脆弱性の研究や発見という目標に向かって力を注ぐ独自の研究能力を備えた人々の参加をお待ちしています。 🤝

### 参考文献
- https://wiki.mikrotik.com/wiki/Manual:System/Certificates
- https://en.wikipedia.org/wiki/Base64

*画像のソース: Pixabay

Mikrotik 脆弱性の開示と届出（CVE-2021-41987）

エンドポイントでの検知とレスポンス（英：endpoint detection and response, EDR）ソリューションは、企業がランサムウェア、身代金要求ウイルスの脅威に抵抗するための重要な鍵となる。適切な EDR ソリューションを選択すれば、企業の重要なファイルがハッカーによってロックされ、暗号化されることから保護できる。

##	エンドポイントでの検知とレスポンス（EDR）ソリューションとは

国際的権威のあるコンサル企業 Gartner 社は、エンドポイントでの検知とレスポンス（Endpoint Detection and Response、EDR）ソリューションは、エンドポイントデバイスの行動を記録および保存するためのソフトウェアで、従業員のノート PC、重要なデータが保存されたサーバー等のエンドポイントデバイスに対してソフトウェアがデータ解析技術を運用し、異常な振る舞いを検知して影響を受けたデバイスの復旧を可能にするものであると述べている。

##	エンドポイントでの検知とレスポンス（EDR）ソリューションが備えるべき機能

ランサムウェアを阻止し、効果的に PC 等のエンドポイントを保護する EDR ソリューションには4つの機能が備わっている必要がある。
1.	情報セキュリティ関連インシデントの検知
2.	エンドポイントでのインシデントの阻止
3.	情報セキュリティインシデントの調査
4.	復旧のためのガイド提供

##	エンドポイントでの検知とレスポンス（EDR）ソリューションのおすすめ： ThreatSonar Anti-Ransomware

ThreatSonar Anti-Ransomware は TeamT5 が開発し、トップレベルの情報セキュリティ専門家チームが長年の情報セキュリティ脅威情報の解析に基づき、ハッカーが企業に侵入する手法を効果的に把握することで企業がこの EDR ソリューションによってエンドポイントデバイスを防御してランサムウェアによる攻撃を防ぐことができるソフトウェアである。このソリューションは国内外の政府機関、金融機関、企業等に採用されている。

ぜひ当社にご連絡いただき、製品 Demo をご覧ください：https://teamt5.org/jp/request-information/

 
 
*参考文献: [Gartner Endpoint Detection and Response (EDR) Solutions Reviews 2021](https://www.gartner.com/reviews/market/endpoint-detection-and-response-solutions)

*画像のソース: [Pixabay](https://pixabay.com/)

エンドポイントでの検知とレスポンス（EDR）ソリューションとは？

端點偵測與回應(EDR)解決方案是企業抵擋勒索軟體、勒索病毒威脅的重要關鍵，選用適合的 EDR 解決方案，更可保護企業的重要檔案不被駭客鎖住、加密! 

## 什麼是端點偵測與回應(EDR) 解決方案

 

國際權威顧問公司 Gartner 指出端點偵測與回應 (Endpoint Detection and Response, EDR) 解決方案，是專用於紀錄與儲存端點設備行為的軟體，針對端點設備如員工筆電、重要資料儲存的伺服器等，軟體運用資料分析技術，能夠偵測異常行為，並且恢復受到影響的設備。

 

## 端點偵測與回應(EDR) 解決方案應具備的功能

 

能夠阻擋勒索軟體、有效保護電腦等端點的 EDR 解決方案，應具備四大功能:

1. 偵測資安相關事件

2. 攔截端點事件

3. 調查資安事件

4. 提供恢復原狀的指引 

 

## 端點偵測與回應(EDR) 解決方案推薦: ThreatSonar Anti-Ransomware

 

ThreatSonar Anti-Ransomware 由 TeamT5 研發，頂尖資安專家團隊基於多年資安威脅情資分析，並有效掌握駭客入侵企業的手法，協助企業透過此款 EDR 解決方案，即達到防護企業端點設備的效果，防禦勒索軟體攻擊。解決方案更獲國內外各大政府單位、金融機構、企業採用。

 

今天就聯絡我們，看產品 Demo: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)


*參考資料: [Gartner Endpoint Detection and Response (EDR) Solutions Reviews 2021](https://www.gartner.com/reviews/market/endpoint-detection-and-response-solutions)


*圖片來源: [Pixabay](https://pixabay.com/)

什麼是端點偵測與回應(EDR)解決方案?

# Why should you read this article? 
China presents an enormous influence on the cyber threat landscape of the Asia-Pacific region. By analyzing China's cyberspace and regulatory state, one may catch a glimpse of the underlying shift of the cyber ecosystem and threat actors' TTPs and motivations. In this article, our analysts summarized the key incidents that shape China's cyberspace in 2021 and propose some outlooks for future development.
 

## Key Takeaways
1.	2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). In 2021, China had launched a sweeping tech crackdown and accelerated consolidation of power in reigning everything within the Great Firewall (GFW).
2.	The Chinese regulators had taken high-profile actions against major tech companies, especially those operating social media and commerce platforms. Firms like Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan have faced record fines and cybersecurity probes. In contrast, "hard tech" companies in strategically critical sectors like Huawei and SMIC have been mainly exempted from regulatory scrutiny.
3.	The Chinese regulators, led by the Cyberspace Administration of China (CAC), introduced and amended a series of regulations to tighten their control over the management and flow of data. The new rules range from privacy protection and data transfer to vulnerabilities disclosure.
4.	International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse, Signal, and Quran Majeed have been reportedly blocked in China. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing a challenging environment.
5.	With China's expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to their network and asset exposure to China's jurisdiction. Besides, we have observed that China's regulatory campaign were often followed by covert cyber operations. Indicators have shown that 2022 will undoubtedly be another challenging year for Chinese and international tech giants.

# Overview: A Year of Tech Crackdown

2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). One of the strategy’s ambitions is to tackle monopolies and review regulations related to the digital economy. Over the past year, the Chinese regulators had taken high-profile actions against major tech companies, especially those operate social media and commerce platforms. Prior to 2021, the relationships between the Chinese authorities and the country’s tech giants have been complex and in flux. For many years, the tech regulators had turned a blind eye to some illegal business practices, anti-competitive acts, and tax evasion of the tech giants, because these companies have brought China robust economic growth. However, in 2021, the Chinese regulators had taken high-profile actions against companies including Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan, levying record-high fines as well as imposing cybersecurity probes and a six-month rectification program. Companies in online gaming, private tutoring, and cryptocurrency were also among the casualties.

What is notable is that all the regulations and probes are directed at the consumer technology sector, rather than “hard tech” companies that are considered by China as strategically critical sectors, such as semiconductor, new materials, new energy, and aeronautics. Therefore, companies Huawei and Semiconductor Manufacturing International Corporation (SMIC) are largely exempted from regulatory scrutiny.

On the other hand, the Chinese regulators, led by the Cyberspace Administration of China (CAC), had introduced and amended a series of regulations to tighten their control over the management and flow of data. For instance, the CAC has implemented the Data Security Law that restricts cross-border data transfers as well as the Personal Information Protection Law which governs data privacy protection. The latter is also regarded as China’s version of the EU’s General Data Protection Regulation (GDPR). Meanwhile, the CAC also announced a new vulnerability disclosure regulation that requires vendors to share vulnerability reports with state agencies within two days. Because of the new law, Alibaba Cloud has faced punishment for not reporting the most serious vulnerability in recent years, Log4Shell, to the Chinese authorities in the first place.

# A More Difficult Environment for Domestic and International Tech Firms

International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse and Signal have been reportedly blocked in China, as these services allow the online users to exchange ideas without being censored by the Chinese government or Chinese social media platforms. Quran Majeed, a popular app among the Muslim community, was also banned in China, signaling more oppression against the Chinese Uyghurs. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing challenging environment. The abovementioned incidents have indicated that 2022 is very likely to be another difficult year for both domestic and international tech firms.

The following timeline have summed up China’s actions in reigning in the country’s cyberspace in 2021.

# Abbreviations

```
CCP: Chinese Communist Party

CAC: Cyberspace Administration of China

MIIT: Ministry of Industry and Information Technology

SAMR: State Administration for Market Regulation```


# Timeline
## 2021Q1
**January**

- SAMR launched antitrust investigation into Alibaba
- CAC issued a new law to regulate public accounts to combat disinformation and fake traffic



**February**

- SAMR finalized anti-monopoly guidelines
- MIIT drafted new regulations to combat excessive data collection by mobile apps
- US audio-chat app Clubhouse reportedly blocked in China



**March**

- CCP's Two Sessions 2021
- SAMR fined 10 big tech firms for failing to report acquisitions
- CAC issued new rules to tighten supervision over big tech’s collection of user data
- Encrypted messaging app Signal reportedly blocked in China


## 2021Q2
**April**

- SAMR imposed record US$2.8 Billion fine against Alibaba
- CAC launches hotline for netizens to report “illegal” history comments
- SAMR announced investigation into delivery giant Meituan
- CCP reviewed “Data Security Law” and “Personal Information Protection Law”
- CAC issue draft rules on users’ privacy protection of mobile apps



**May**

- CAC called out 84 apps Including Tencent, Alibaba, and Baidu for violating user privacy



**June**

- CCP Passed “Data Security Law” and “Anti- Foreign Sanctions Law”
- China widens cryptocurrency crackdown: mining projects shut down; banks ordered to step up clampdown


## 2021Q3
**July**

- CAC banned Didi Chuxing’s apps after its U.S. IPO
- CAC to amend “Cybersecurity Review Regulations,” tightening controls over foreign-listed firms
- CAC issued new vulnerability disclosure rules
- MIIT launched 6-month rectification program, ordering tech firms to fix anticompetitive, security issues
- 7 Chinese agencies sent officials to conduct on-site cybersecurity inspections at Didi Chuxing



**August**

- Chinese state media labeled online gaming “spiritual opium” and called out Tencent
- CAC drafted "Personal Information Protection Law"
- CAC launched regulations to protect critical information infrastructure
- China orders state firms to migrate to government cloud services



**September**

- CAC launched “Security Threat Information Sharing Platform” for reporting vulnerabilities
- CAC ruled all crypto-related transactions illegal


## 2021Q4
**October**

- LinkedIn shut down operation in China as compliance challenges increase
- CAC banned cross border transfer of core industrial and telecoms data
- China bans Quran Majeed, one of the most popular Quran apps in the world



**November**

- Personal Information Protection Law (PIPL) took effect
- Yahoo pulled out of China, citing 'challenging' environment
- China suspended Tencent apps update and limiting use in state-run firms
- China to ban business use of WeChat and Alipay personal payment QR codes
- China censored tennis star Peng Shuai over sexual assault claims against CCP high-ranking official



**December**

- CAC issued rules to block foreign religious content online
- MIIT suspended cooperation with Alibaba Cloud, citing delayed report of Log4j2 vulnerability
- Didi Global delisted from the NYSE
- CAC fined Weibo for publishing illegal information


# Outlook: China's Endless Pursuit of Cyber Power and Regulatory Control
So far, there is no indication that the Chinese government will loosen up its grip over the tech firms. With China’s expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to the exposure of their network and asset to China’s jurisdiction. On the other hand, we have observed that China's regulatory campaign were often followed by covert cyber operations. For instance, our telemetry had previously detected that China-nexus Advanced Persistent Threat (APT) groups targeted companies and organizations which were on the list of China's anti-corruption campaign.

The political landscape in China heavily influences the country's strategy in reigning its cyberspace. In August 2022, the Chinese Communist Party (CCP) will be hosting its 20th Party Congress, where the party’s leadership and policy agenda for the next five years will be announced. It is no surprise that the Chinese authorities will continue the enforcement actions, furthering tech crackdown under the name of “common prosperity” and consolidating the state’s position as the country’s most powerful cyber player.



*Image courtesy of [Pixabay](https://pixabay.com/)

China’s Cyber Power Intel Roundup 2021: Tech Crackdown, Regulatory Storm, and Power Expansion

> 中國對亞太地區的網路環境具有極高度影響力。透過分析中國的網路空間與監管作法，人們得以瞥見中國網路生態系的轉變，及網路攻擊行動者的動機與所使用之戰術、技術與流程（tactics, techniques, and procedures, TTP）。本文中，TeamT5 資安威脅情資分析師團隊總結形塑了2021年中國網路空間的關鍵事件，並提出對未來發展態勢的看法。

# Why should you read this article?
China presents an enormous influence on the cyber threat landscape of the Asia-Pacific region. By analyzing China's cyberspace and regulatory state, one may catch a glimpse of the underlying shift of the cyber ecosystem and threat actors' TTPs and motivations. In this article, our analysts summarized the key incidents that shape China's cyberspace in 2021 and propose some outlooks for future development.

## Key Takeaways
1.	2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). In 2021, China had launched a sweeping tech crackdown and accelerated consolidation of power in reigning everything within the Great Firewall (GFW).
2.	The Chinese regulators had taken high-profile actions against major tech companies, especially those operating social media and commerce platforms. Firms like Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan have faced record fines and cybersecurity probes. In contrast, "hard tech" companies in strategically critical sectors like Huawei and SMIC have been mainly exempted from regulatory scrutiny.
3.	The Chinese regulators, led by the Cyberspace Administration of China (CAC), introduced and amended a series of regulations to tighten their control over the management and flow of data. The new rules range from privacy protection and data transfer to vulnerabilities disclosure.
4.	International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse, Signal, and Quran Majeed have been reportedly blocked in China. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing a challenging environment.
5.	With China's expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to their network and asset exposure to China's jurisdiction. Besides, we have observed that China's regulatory campaign were often followed by covert cyber operations. Indicators have shown that 2022 will undoubtedly be another challenging year for Chinese and international tech giants.

# Overview: A Year of Tech Crackdown
2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). One of the strategy’s ambitions is to tackle monopolies and review regulations related to the digital economy. Over the past year, the Chinese regulators had taken high-profile actions against major tech companies, especially those operate social media and commerce platforms. Prior to 2021, the relationships between the Chinese authorities and the country’s tech giants have been complex and in flux. For many years, the tech regulators had turned a blind eye to some illegal business practices, anti-competitive acts, and tax evasion of the tech giants, because these companies have brought China robust economic growth. However, in 2021, the Chinese regulators had taken high-profile actions against companies including Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan, levying record-high fines as well as imposing cybersecurity probes and a six-month rectification program. Companies in online gaming, private tutoring, and cryptocurrency were also among the casualties.

What is notable is that all the regulations and probes are directed at the consumer technology sector, rather than “hard tech” companies that are considered by China as strategically critical sectors, such as semiconductor, new materials, new energy, and aeronautics. Therefore, companies Huawei and Semiconductor Manufacturing International Corporation (SMIC) are largely exempted from regulatory scrutiny.

On the other hand, the Chinese regulators, led by the Cyberspace Administration of China (CAC), had introduced and amended a series of regulations to tighten their control over the management and flow of data. For instance, the CAC has implemented the Data Security Law that restricts cross-border data transfers as well as the Personal Information Protection Law which governs data privacy protection. The latter is also regarded as China’s version of the EU’s General Data Protection Regulation (GDPR). Meanwhile, the CAC also announced a new vulnerability disclosure regulation that requires vendors to share vulnerability reports with state agencies within two days. Because of the new law, Alibaba Cloud has faced punishment for not reporting the most serious vulnerability in recent years, Log4Shell, to the Chinese authorities in the first place.

# A More Difficult Environment for Domestic and International Tech Firms

International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse and Signal have been reportedly blocked in China, as these services allow the online users to exchange ideas without being censored by the Chinese government or Chinese social media platforms. Quran Majeed, a popular app among the Muslim community, was also banned in China, signaling more oppression against the Chinese Uyghurs. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing challenging environment. The abovementioned incidents have indicated that 2022 is very likely to be another difficult year for both domestic and international tech firms.

The following timeline have summed up China’s actions in reigning in the country’s cyberspace in 2021.

# Abbreviations

```
CCP: Chinese Communist Party

CAC: Cyberspace Administration of China

MIIT: Ministry of Industry and Information Technology

SAMR: State Administration for Market Regulation```


# Timeline
## 2021Q1
**January**

- SAMR launched antitrust investigation into Alibaba
- CAC issued a new law to regulate public accounts to combat disinformation and fake traffic



**February**

- SAMR finalized anti-monopoly guidelines
- MIIT drafted new regulations to combat excessive data collection by mobile apps
- US audio-chat app Clubhouse reportedly blocked in China



**March**

- CCP's Two Sessions 2021
- SAMR fined 10 big tech firms for failing to report acquisitions
- CAC issued new rules to tighten supervision over big tech’s collection of user data
- Encrypted messaging app Signal reportedly blocked in China


## 2021Q2
**April**

- SAMR imposed record US$2.8 Billion fine against Alibaba
- CAC launches hotline for netizens to report “illegal” history comments
- SAMR announced investigation into delivery giant Meituan
- CCP reviewed “Data Security Law” and “Personal Information Protection Law”
- CAC issue draft rules on users’ privacy protection of mobile apps



**May**

- CAC called out 84 apps Including Tencent, Alibaba, and Baidu for violating user privacy



**June**

- CCP Passed “Data Security Law” and “Anti- Foreign Sanctions Law”
- China widens cryptocurrency crackdown: mining projects shut down; banks ordered to step up clampdown


## 2021Q3
**July**

- CAC banned Didi Chuxing’s apps after its U.S. IPO
- CAC to amend “Cybersecurity Review Regulations,” tightening controls over foreign-listed firms
- CAC issued new vulnerability disclosure rules
- MIIT launched 6-month rectification program, ordering tech firms to fix anticompetitive, security issues
- 7 Chinese agencies sent officials to conduct on-site cybersecurity inspections at Didi Chuxing



**August**

- Chinese state media labeled online gaming “spiritual opium” and called out Tencent
- CAC drafted "Personal Information Protection Law"
- CAC launched regulations to protect critical information infrastructure
- China orders state firms to migrate to government cloud services



**September**

- CAC launched “Security Threat Information Sharing Platform” for reporting vulnerabilities
- CAC ruled all crypto-related transactions illegal


## 2021Q4
**October**

- LinkedIn shut down operation in China as compliance challenges increase
- CAC banned cross border transfer of core industrial and telecoms data
- China bans Quran Majeed, one of the most popular Quran apps in the world



**November**

- Personal Information Protection Law (PIPL) took effect
- Yahoo pulled out of China, citing 'challenging' environment
- China suspended Tencent apps update and limiting use in state-run firms
- China to ban business use of WeChat and Alipay personal payment QR codes
- China censored tennis star Peng Shuai over sexual assault claims against CCP high-ranking official



**December**

- CAC issued rules to block foreign religious content online
- MIIT suspended cooperation with Alibaba Cloud, citing delayed report of Log4j2 vulnerability
- Didi Global delisted from the NYSE
- CAC fined Weibo for publishing illegal information


# Outlook: China's Endless Pursuit of Cyber Power and Regulatory Control
So far, there is no indication that the Chinese government will loosen up its grip over the tech firms. With China’s expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to the exposure of their network and asset to China’s jurisdiction. On the other hand, we have observed that China's regulatory campaign were often followed by covert cyber operations. For instance, our telemetry had previously detected that China-nexus Advanced Persistent Threat (APT) groups targeted companies and organizations which were on the list of China's anti-corruption campaign.

The political landscape in China heavily influences the country's strategy in reigning its cyberspace. In August 2022, the Chinese Communist Party (CCP) will be hosting its 20th Party Congress, where the party’s leadership and policy agenda for the next five years will be announced. It is no surprise that the Chinese authorities will continue the enforcement actions, furthering tech crackdown under the name of “common prosperity” and consolidating the state’s position as the country’s most powerful cyber player.


*圖片來源: [Pixabay](https://pixabay.com/)

