隨著數位時代的來臨，企業面臨著越來越複雜和隱匿的威脅。對於 Managed Security Service Providers (MSSP) 廠商而言，提供給客戶的解決方案不僅需要高效，更需要能夠應對不斷進化的威脅環境。在這個動蕩的資安領域，ThreatSonar 成為了新客戶敲門的磚頭，為 MSSP 帶來無窮的商業機會。


## 威脅鑑識分析平台 ThreatSonar 簡介
藉由部署 ThreatSonar 威脅鑑識分析平台，用戶能夠快速篩檢場域中可能的資安風險與威脅，並從事件中嚴重受駭的主機出發，全面盤點端點安全狀態。用戶更可同時藉由分析關鍵網路系統紀錄，調查駭客可能的入侵存取點，獲取駭侵根因（root cause）、掌握駭客移動路徑、盤點威脅損害。

## 潛在的商業機會
#### 客戶需求持續增長
隨著威脅的複雜性不斷提高，企業對於安全性的需求也與日俱增。ThreatSonar 提供的先進威脅情報和快速的應對能力使其成為 MSSP 廠商贏得客戶的利器。

#### 更多的合規性要求
在各個產業中，合規性要求變得越來越嚴格。ThreatSonar 幫助 MSSP 廠商確保客戶符合相應的法規，提升客戶在市場上的競爭力，也提升客戶對 MSSP 的倚重。

#### 帶來加值服務的機會
ThreatSonar 指出終端客戶面臨的資安威脅，有助 MSSP 為終端客戶提供提供更多加值服務，如更適合的資安解決方案、定期的資訊安全培訓等，擴大MSSP 的服務範疇，也帶來新商業機會。

## 結論

ThreatSonar 不僅是強大的威脅鑑識分析平台，更是 MSSP 創造商機的得力助手。隨著資安威脅不斷演變，選擇 ThreatSonar 將為 MSSP 帶來無窮的商業機會。

 

>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
我們研發的威脅狩獵工具 ThreatSonar 已獲許多資安代管服務廠商（MSSP）採用。
>
>如果您是資安代管服務廠商，請即刻[聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)，共同討論如何創造商機。

 
 
*首圖來源: pexel

新客戶的敲門磚: 為 MSSP 廠商帶來商業機會的威脅鑑識分析平台 ThreatSonar

Products & Services

在持續變化的資訊安全環境中，超前偵測威脅、部署適合的資安解決方案是防禦重點。

企業若要有效應對複雜的資安局勢，強大的盟友十分關鍵 —— 杜浦數位安全 TeamT5 推出的威脅鑑識分析平台 ThreatSonar 已獲日本、新加坡與台灣的許多資安託管服務廠商（MSSP）採用，為終端客戶進行入侵評估（compromise assessment），達成如同定期健康檢查的效益；更於資安事件發生當下，使用 ThreatSonar，進行事件應變（incident response），避免損害擴散。

本文將介紹 ThreatSonar 的強大功能、應用場景，以及如何藉此為資安託管服務廠商（MSSP）帶來新商機，期待有興趣的廠商與我們聯絡，共創未來。

## ThreatSonar 的強大功能

ThreatSonar 不只是一個工具，更是一個主動抵禦網路威脅的強大盾牌。

藉由部署 ThreatSonar 威脅鑑識分析平台，用戶能夠快速篩檢場域中可能的資安風險與威脅，並從事件中嚴重受駭的主機出發，全面盤點端點安全狀態。用戶更可同時藉由分析關鍵網路系統紀錄，調查駭客可能的入侵存取點，獲取駭侵根因（root cause）、掌握駭客移動路徑、盤點威脅損害。

強大功能包含：
- **情資導向的智慧威脅識別**

內建數千種 APT 後門特徵，將最新情資帶到每個端點鑑識。同時，可匯入 hash、IP、domain、Yara Rule 與 IoC 等外部情資，高精準度打擊針對性強的潛在威脅。

- **輕量佈署、背景執行，不影響日常作業**

ThreatSonar 執行程式可安裝到企業組織內上百千電腦中，背景運行，系統資源使用量少，人員可照常進行電腦工作，不受此程式運行的負擔。

- **資安健檢從事件全貌著手，縮短事件調查時程**

ThreatSonar 不只分析主機當下狀態，同時透過事件紀錄分析，調查過去的事件軌跡，以 Timeline 事件時間軸呈現先後，並藉由跨端點關聯，追蹤內網移動與資料外流路徑。
具備記憶體鑑識及行為分析能力，有效揪出未知惡意程式
辨識出隱匿於記憶體中的惡意程式、執行過以及將要執行的程式、攻擊者的駭客工具、攻擊後殘留於主機的紀錄，自動鑑定數百種動態行為異常。

- **主動威脅狩獵，可視化關聯潛在受害主機**

統計關聯分析找出未知攻擊手法，建立基準線鎖定異常行為，標示潛伏未知威脅，例如組織中稀有程式或目錄、合法系統工具遭到濫用，或是具數位簽章的惡意程式等。


## ThreatSonar 的應用場景：入侵評估（compromise assessment）、事件應變（incident response）

可應用於入侵評估（compromise assessment）與事件應變（incident response）兩種情境。

ThreatSonar 作為入侵評估工具，可快速掃描潛在威脅。

過去，MSSP 需仰賴人工作業，耗時耗成本，且不是一個可以擴張營運規模的商業模式。現在， MSSP 導入 ThreatSonar 至作業流程，可以由專業人員輕鬆省力地進行潛在威脅掃描，快速為客戶評估資安環境的健康程度，更可 ThreatSonar 產出的報告，進一步引導客戶採購適合的資安解決方案，進而達到完整採購引導過程，創造更大的商機。

ThreatSonar 作為事件應變工具，為事件應變團隊提供專業可靠的工具，進行威脅狩獵。

過去，事件應變人員每天僅能檢查 3 台電腦遭受資安威脅，更需耗費 1~4 週的時間，撰寫製作完整的威脅狩獵結果報告。而現在， MSSP 導入 ThreatSonar 至作業流程，1 小時內即可檢查 1,000 個以上的電腦（或終端裝置），1 天 ~ 1 週內即可提出詳盡的威脅狩獵結果報告，內容涵蓋前述 ThreatSonar 的偵測之威脅，能夠讓 MSSP 協助客戶排除威脅。

MSSP 借助 ThreatSonar，將可為客戶提供更優質、更完善的服務，並且獲得可觀的利潤。


## ThreatSonar 如何為資安託管服務廠商（MSSP）帶來新商機

ThreatSonar 威脅鑑識分析平台從部署、使用，至產出結果報告，流程簡易無負擔，MSSP 能夠輕易上手，降低團隊人員負擔；MSSP 為客戶進行入侵評估、事件應變等過程中，更可深度了解客戶的資安環境與切身需求，進而建議延伸的資安解決方案，帶來商機與利潤。


## 資安託管服務廠商（MSSP）採用 ThreatSonar 的效益 
- **簡化部署**：工具為輕量級，可與現有端點解決方案相容
- **專業支援**：由擁有 20 多年網路威脅研究經驗的 TeamT5 專家團隊支援
- **提高獲利能力**：TeamT5 提供靈活的付費機制，按報告收費，而不是按掃描的端點數量收費。MSSP 若從報告中初步判斷該端點有高風險資安威脅需進一步解讀，才需付費解鎖 ThreatSonar 報告；若未發現具重大資安威脅的端點，MSSP 則可省下解鎖所有端點掃描報告的成本。
- **拓展進階服務商機**：事件發生前的入侵評估與事件發生後的應變處置是企業的常見需求，也是企業亟需 MSSP 協助的關鍵時刻。MSSP 可藉由使用專業的 ThreatSonar 平台，作為提升給企業客戶資安服務品質的重要利器。


## 結論
ThreatSonar 是資安健康檢查的必備工具，由資安託管服務廠商（MSSP）主動為終端客戶進行定期檢查，能夠掌握資安健康度，協助達到全方位防禦。

 

>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多資安代管服務廠商（MSSP）採用。
>
>如果您是資安代管服務廠商，請即刻[聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)，共同討論如何創造商機。

 
 
*首圖來源: pexel

威脅狩獵工具 ThreatSonar 完整指南

Staying ahead of emerging threats is paramount. At TeamT5, our dedicated analysts work tirelessly to research and translate findings into comprehensive threat intelligence reports. However, there are instances where traditional reports are not what customers are looking for. This is where Raw Intel comes in, offering invaluable real-time insights for cyber threat analysts.

Raw Intel serves as a crucial tool in our arsenal, providing users with detailed information gleaned from ongoing research efforts. When conducting searches on [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), users may encounter Raw Intel objects associated with specific IP addresses, domains, or hashes. These objects represent a snapshot of our analysts' research within a certain timeframe, offering insights into targeted industries, employed malware, and adversary profiles.

Please note that Raw Intel is the preliminary results of TeamT5’s latest research. If you need further investigation and analysis to obtain the most accurate information, please [contact us]((https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website).

![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)

 

Raw Intel empowers [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) customers with three major advantages:

## Real-Time Response Capability
In the ever-evolving landscape of cyber threats, timing is critical. Threat intelligence reports, while valuable, may entail a delay due to human review processes. Raw Intel bridges this gap, empowering organizations to self-identify threats in near real-time. By leveraging Raw Intel, threat analysts can proactively respond to emerging threats, minimizing the risk of being caught off guard during attacks.

## Granular Threat Visibility
Raw Intel offers a granular view of potential threats, equipping security teams with detailed information about malicious IP addresses and samples. This level of insight enables precision in threat identification, facilitating the development of targeted defense strategies. With Raw Intel, organizations can mitigate the risk of false positives and enhance overall cybersecurity posture.

In conclusion, Raw Intel serves as a cornerstone in modern cyber threat analysis, offering real-time insights and granular visibility into emerging threats. By leveraging this invaluable resource, organizations can bolster their defenses and stay one step ahead in the ongoing battle against cyber adversaries.

## Access to Intel Regardless of Subscribed Items
Since ThreatVision’s Raw Intel is not dependent on the user being subscribed to any particular report, users are able to easily access snippets of intelligence that are important to them and their investigation even if they are not subscribed to the particular report that the intel is from.

 

>Learn more about how Raw Intel can help your organization by [contacting us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) today!

 
 
*image courtesy: Pixabay

Raw Intel’s Role in Modern Cyber Threat Intelligence

掌握先機對於應對新興威脅至關重要。在 TeamT5，我們的專業分析師努力不懈地進行研究，並將發現轉化為全面的威脅情資報告。然而，有時傳統報告並不見得符合客戶所需。此時就是原始情資（Raw Intel）發揮功能之際，為網路威脅分析師提供寶貴的及時見解。

原始情資是我們軍火庫中的一個關鍵工具，將持續進行的研究工作中所獲得的詳細資訊，提供給使用者。當使用者在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 上進行搜尋時，用戶可能會遇到與特定 IP 地址、域名或雜湊相關的原始情資標的。這些標的代表我們分析師在特定時間範圍內的研究概要，提供有關目標產業、使用的惡意軟體和攻擊族群檔案的見解。

![pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png](https://uploads.teamt5.org/upload/original/pic_raw-intel-s-role-in-modern-cyber-threat-intelligence.png)

 

提醒您，原始情資是 TeamT5 最新研究的初步結果。如果您需要進一步的調查和分析以獲得最準確的資訊，請[與我們聯繫]((https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) 。

原始情資為 ThreatVision 客戶提供了三個主要優勢：
## 及時應變能力
在網路威脅不斷演變的情況下，時機至關重要。儘管威脅情資報告很有價值，但由於人工審查流程需要時間，可能會有延遲。原始情資彌補了這一差距，使組織能夠近乎及時地自我識別威脅。透過利用原始情資，威脅分析師可以主動應對新興威脅，最大程度地減少在攻擊中措手不及的風險。

## 細化威脅的能見度
原始情資提供了對潛在威脅的細節化視角，為安全團隊提供了有關惡意 IP 地址和樣本的詳細資訊。這種洞察水準使威脅識別更加精準，有助於制定針對性的防禦策略。憑藉原始情資，組織可以降低誤報風險，增強整體網絡安全性。

## 無論訂閱的項目為何，都能獲得原始情資
不論訂閱項目為何，使用者都能輕鬆取得對他們重要的情資片段。即使未訂閱該情資來源的特定報告，也能對他們的調查有所幫助。

簡言之，原始情資在現代網路威脅分析中扮演著重要角色，提供及時見解和新興威脅的細節的能見度。透過利用這一寶貴資源，組織可以加強其防禦措施，在持續與網路威脅族群作戰中，保持領先地位。

 

>現在就[聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)，了解更多原始情資如何助您的組織一臂之力！

*首圖來源: Pixabay

原始情資（Raw Intel）在現今網路威脅情資中所扮演的角色為何？ 

Threat Intelligence

In the dynamic landscape of cybersecurity, enterprises face persistent and evolving threats that can compromise their systems and sensitive data. Compromise assessment and threat hunting play a crucial role in fortifying an enterprise's security posture. Here are five compelling reasons why these practices are essential:

### 1. Identify vulnerabilities: Enhancing Security Posture

Intrusion assessments assist organizations in identifying potential vulnerabilities in their systems. By identifying vulnerabilities in enterprise systems that may be exploited by attackers and taking further measures to repair these vulnerabilities, the overall security defense and resilience of the enterprise can be strengthened.

### 2. Protect Sensitive Data: Safeguarding Customer and Employee Information

One of the primary goals of intrusion assessment is to protect sensitive information. Whether it refers to customer data, employee details or business data, threat hunting helps prevent cybercriminals from stealing this sensitive information.

### 3. Ensure Compliance: Meeting Regulatory Requirements

In some industries, such as healthcare and finance, strict regulations require companies to conduct regular intrusion assessments to ensure compliance requirements are met.

Regular assessments using threat hunting tools not only ensure your company is compliant, but also build a complete cybersecurity strategy and resilience.

### 4. Improving Incident Response: Critical in the Face of Cyber Attacks

Compromise assessments contribute significantly to the development and improvement of incident response plans. In the event of a cyberattack, having a well-structured response plan is critical. Identifying compromises early on allows enterprises to refine and implement effective incident response strategies promptly.

### 5. Building Trust with Clients and Stakeholders: Demonstrating Proactive Security Measures

By conducting intrusion assessment and threat hunting, enterprises can send a positive message to customers and stakeholders, showing that the enterprise is actively taking measures to protect its systems and data, and build trust and confidence.

## Conclusion 

Compromise assessment and threat hunting are not just reactive measures but proactive strategies that enterprises must embrace in the face of evolving cyber threats. By identifying vulnerabilities, protecting sensitive data, ensuring compliance, improving incident response, and building trust, these practices become essential components of a comprehensive cybersecurity strategy. In a digital era where threats are constant, enterprises that prioritize these assessments are better equipped to navigate the complexities of the cyber landscape and safeguard their digital assets.

 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/request-information/


 

*Picture source: pixabay

5 Benefits of Threat Hunting Strategies for Enterprises

在千變萬化的網路與資訊安全環境中，企業面臨持續且不斷變化的威脅，這些威脅可能會損害其系統和敏感資料。入侵評估（compromise assessment ）和威脅狩獵（threat hunting）在加強企業的資安防禦方面，發揮著至關重要的作用。 

以下是企業採納威脅狩獵策略的 5 個好處：

### 1. 識別漏洞：增強資安韌性

入侵評估可協助企業識別其系統中的潛在漏洞。 藉由找出企業系統內可能被攻擊者利用的漏洞，並進一步採取措施、修復這些漏洞，方能加強企業整體安全防禦與韌性。

### 2. 保護敏感資料：保護客戶和員工資訊

入侵評估的主要目標之一是保護敏感資料。無論是客戶資訊、員工詳細資訊或商業數據等機敏資訊，威脅狩獵都有助於防止網路犯罪分子竊取此類關鍵資訊。

### 3. 確保遵循法規：滿足監管要求

在某些產業，例如醫療保健和金融，嚴格的法規要求企業定期進行入侵評估，以確保滿足合規性要求。 
使用威脅狩獵工具進行定期評估，不僅可以確保公司合規，還可以建立完整的資訊安全策略與韌性。

### 4. 優化資安事件應變：面對網路攻擊至關重要

入侵評估對事件應變計畫的制定和改進，扮演關鍵角色。 如果發生網路攻擊，制定良好嚴謹的應變計畫十分重要。 及早識別危害使企業能夠及時改善和實施有效的資安事件應變策略。

### 5. 與客戶和利害關係人建立信任：展示積極主動的安全措施

進行入侵評估和威脅狩獵，企業能向客戶和利害關係人發出了正向的訊息，顯示企業積極採取措施保護其系統和數據，建立信任與信心。

## 結論

入侵評估和威脅狩獵不僅僅是應變措施，也是企業面對不斷變化的網路威脅時必須採取的主動策略。 透過識別漏洞、保護敏感資料、確保遵循法規、改進資安事件應變和建立信任，這些是企業建立全面、完整的資訊安全策略之重要組成環節。 

在威脅不斷、攻擊不止的數位時代，優先考慮入侵評估和威脅狩獵作法的企業，能夠更好地應對複雜的網路環境並保護其數位資產。

 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/request-information/


 
 
*圖片來源: Pixabay

企業採納威脅狩獵策略的 5 個好處

The following blog post is based on our Jan H1 Vulnerability Insights Report. TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. [Contact us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information about our vulnerability intelligence.


## Alerts of Exploiting Adobe ColdFusion

TeamT5 released mitigation and response guidelines to CVE-2023-29300 in Adobe ColdFusion. CVE-2023-29300 is a JAVA deserialization vulnerability resulting in arbitrary code execution. Adobe ColdFusion is a commercial rapid web-application development computing platform. Unauthorized threat actors can exploit CVE-2023-29300 and deploy webshell to target's devices and establish persistence. 

### Executive Summary

We assess the severity level of CVE-2023-29300 is critical and urge our customers to use this report to mitigate the effects. First, Adobe ColdFusion is widely used by large companies and organizations, with more than 3000 devices in Japan. Even worse, our investigation revealed that at least 66 Adobe ColdFusion devices in Japan has been compromised. The victims are across different sectors, including healthcare, education, and manufacturing industry. Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-29300 has been circulating in the wild. Public reports also provide the root cause analysis on CVE-2023-29300.[1]

Threat actors, including cybercriminals and state-sponsored APT groups, has been actively exploiting CVE-2023-29300 in the attacks. Specifically, we have detected that threat actors exploited CVE-2023-29300 to deploy webshells such as Behinder. Aligned with our observation, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-29300 to known exploited vulnerabilities catalog on January 8, 2024.[2] We summarized the activities in the **Exploitation Status** subsection. 

Based on the exploitation status, we depicted the **Possible Attack Scenario** in this report. We also concluded the malware and IOCs in **Appendix II: Malware and Appendix III: Indicators of Compromise (IoC)**, respectively. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Open-source nuclei-based vulnerability scanner
- Threat Hunting Tools, including a SIGMA rule and a nuclei-based webshell scanner.
 - SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process via malicious webshell.
 - Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

### Exploitation Status

CVE-2023-29300 has been actively exploited by threat actors, including cybercriminals and state-sponsored threat actors. We concluded all the related C2 in the report IoC.[3]

- Cybercriminals have exploited CVE-2023-29300 to deploy webshell in attacks. We have detected attacks against healthcare entities and Thai real estate entities.
- China-nexus APT group SLIME13 (as known as Flax Typhoon) exploited CVE-2023-29300 in the attacks.
- Notably, Chinese actors exploited CVE-2023-29300[4] in the 2023 HuWang Operation, China’s state-led penetration testing for enterprises.[5] Previously, China-nexus APT groups such as Amoeba, SLIME28, and SLIME37 have joined the HuWang Operation.



### Affected Products

ColdFusion 2018 (Update 16 and earlier versions)
 
ColdFusion 2021 (Update 6 and earlier versions)
 
ColdFusion 2023 GA Release (2023.0.0.330468)

### Mitigation and Response Advisory

#### 1. Official Patch Information

Adobe has released the official patches for CVE-2023-29300. 
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

#### 2. Open-source Nuclei-based Vulnerability Scanner

Our customers can leverage the open-source nuclei-based vulnerability scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

#### 3. Threat Hunting Tools

Cybercriminals and state-sponsored threat actors have already actively exploited CVE-2023-29300. TeamT5 vulnerability intelligence team prepared a SIGMA rule and a nuclei-based webshell scanner for our customers to detect potential threats. 

The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) includes:

- SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process
- Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

<figure>

![pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png](https://uploads.teamt5.org/upload/original/pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png)

<figcaption> The Nuclei-based webshell scanner
</figcaption>
</figure> 
 
Our customers can download all tools from the **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

## Possible Attack Scenario

Threat actors have to first abuse the unauthenticated ColdFusion Component (CFC) endpoint to exploit CVE-2023-29300. Public proof of concepts has exposed a ColdFusion Component endpoint `/CFIDE/adminapi/accessmanager.cfc` that also been exploited in the wild. Our customers can check if your ColdFusion Component endpoint has been attacked with following IIS log. 

`C:\inetpub\logs\LogFiles\W3SVC1\u_ex240112.log:2024-01-12 08:12:12 172.17.0.1 POST /CFIDE/adminapi/accessmanager.cfc _cfclient=true&method=foo 443 - 172.17.0.2 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_10_1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/37.0.2062.124+Safari/537.36 - 404 0 2 1466`

Our customers can also leverage the open-source nuclei-based webshell scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

CVE-2023-29300 is a deserialization vulnerability originated from the Web Distributed Data eXchange (WDDX) library. Once exploited, the vulnerability will allows the threat actors to load the payload via JNDI injection, connecting to the C2 and execute arbitrary codes.

The threat actors can deploy webshell to ColdFusion after successfully exploited CVE-2023-29300. With such webshell exists, the threat actors can still access ColdFusion Component even after patching the vulnerability. Our analysis found that more than 1% of the ColdFusion Components in Japan has been compromised. The webshells contains following malicious URI:
- COLDFUSION_SERVER/cf_scripts/config.cfm
- COLDFUSION_SERVER/cf_scripts/123.cfm
- COLDFUSION_SERVER/cf_scripts/system.cfm
- COLDFUSION_SERVER/cf_scripts/classes/GetVars.cfm
- COLDFUSION_SERVER/cf_scripts/classes/ckeditor.cfm

Based on the research, we provide a nuclei-based webshell scanner and a SIGMA rule for our customers to check if your ColdFusion Component endpoint has been compromised, and the nuclei-based webshell scanner can identify implanted webshells as follows. Our customers can download the tools from The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

Notably, we also detected that Chinese threat actors developed webshell designed for ColdFusion Markup, PowerShell[5]. PowerShell will download the second stage webshell from C2 `http://113.141.91.61:63211/11.aspx`. The second-stage webshell is Behinder[6], a famous open-source webshell in Chinese threat actors.

### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Behinder</td>
 <td>Webshell</td>
 <td>Behinder is a webshell developed by Chinese actor. It has different platform versions, such as PHP, ASP and JSP. Behinder loads an AES-encrypted binary payload which is difficult to detect by general firewall.</td>
 <td>Open-source</td>
 <td>2020.06</td>
 </tr>
</table>
 
### Appendix II: Indicators of Compromise (IoC)

**SHA-256**
 
```
hash= webshell
cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52
d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

```

```c2-IP= IP
113.141.91.61
```

### Appendix III: Other critical CVEs

TeamT5 also provides analysis of other caitical CVEs in **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please [contact TeamT5](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information.

 
 

[1] https://blog.projectdiscovery.io/adobe-coldfusion-rce/

[2] https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog

[3] https://github.com/gobysec/Research/blob/main/Adobe_Coldfusion_remote_code_execution_vulnerability_Analysis_(CVE-2023-38204)_zh_CN.md

[4] The HuWang Operation is China’s state-led penetration testing or red teaming operation for state-owned enterprises and critical information infrastructure (CII) operators, hosted by the Ministry of Public Security every summer. We have previously discovered that several APT groups such as Amoeba, SLIME28, and SLIME37 have joined China’s HuWang Operation.

[5] SHA-256: cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52

[6] d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

CVE-2023-29300: Adobe ColdFusion Vulnerability

本文改寫自 2024 年 1 月第一期的漏洞情資報告（VIR 2024 June H1）。
TeamT5 漏洞研究團隊致力於針對重大漏洞提供即時的應對措施與緩解方案。如欲進一步了解 TeamT5 的漏洞情資報告，[請與我們聯繫](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website)。

>**CVE-2023-29300: Adobe ColdFusion 漏洞**
 
>CVE-2023-29300 是出現在 Adobe 旗下應用程式開發平台 ColdFusion 的 JAVA 反序列化漏洞。該漏洞將導致任意程式碼執行。未經授權的威脅行動者可利用 CVE-2023-29300 將 Webshell 部署到目標設備。


## Alerts of Exploiting Adobe ColdFusion

TeamT5 released mitigation and response guidelines to CVE-2023-29300 in Adobe ColdFusion. CVE-2023-29300 is a JAVA deserialization vulnerability resulting in arbitrary code execution. Adobe ColdFusion is a commercial rapid web-application development computing platform. Unauthorized threat actors can exploit CVE-2023-29300 and deploy webshell to target's devices and establish persistence. 

### Executive Summary

We assess the severity level of CVE-2023-29300 is critical and urge our customers to use this report to mitigate the effects. First, Adobe ColdFusion is widely used by large companies and organizations, with more than 3000 devices in Japan. Even worse, our investigation revealed that at least 66 Adobe ColdFusion devices in Japan has been compromised. The victims are across different sectors, including healthcare, education, and manufacturing industry. Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-29300 has been circulating in the wild. Public reports also provide the root cause analysis on CVE-2023-29300.[1]

Threat actors, including cybercriminals and state-sponsored APT groups, has been actively exploiting CVE-2023-29300 in the attacks. Specifically, we have detected that threat actors exploited CVE-2023-29300 to deploy webshells such as Behinder. Aligned with our observation, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-29300 to known exploited vulnerabilities catalog on January 8, 2024.[2] We summarized the activities in the **Exploitation Status** subsection. 

Based on the exploitation status, we depicted the **Possible Attack Scenario** in this report. We also concluded the malware and IOCs in **Appendix II: Malware and Appendix III: Indicators of Compromise (IoC)**, respectively. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation and Response Advisory includes:
- Mitigation Adversary
- Open-source nuclei-based vulnerability scanner
- Threat Hunting Tools, including a SIGMA rule and a nuclei-based webshell scanner.
 - SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process via malicious webshell.
 - Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

### Exploitation Status

CVE-2023-29300 has been actively exploited by threat actors, including cybercriminals and state-sponsored threat actors. We concluded all the related C2 in the report IoC.[3]

- Cybercriminals have exploited CVE-2023-29300 to deploy webshell in attacks. We have detected attacks against healthcare entities and Thai real estate entities.
- China-nexus APT group SLIME13 (as known as Flax Typhoon) exploited CVE-2023-29300 in the attacks.
- Notably, Chinese actors exploited CVE-2023-29300[4] in the 2023 HuWang Operation, China’s state-led penetration testing for enterprises.[5] Previously, China-nexus APT groups such as Amoeba, SLIME28, and SLIME37 have joined the HuWang Operation.



### Affected Products

ColdFusion 2018 (Update 16 and earlier versions)
 
ColdFusion 2021 (Update 6 and earlier versions)
 
ColdFusion 2023 GA Release (2023.0.0.330468)

### Mitigation and Response Advisory

#### 1. Official Patch Information

Adobe has released the official patches for CVE-2023-29300. 
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

#### 2. Open-source Nuclei-based Vulnerability Scanner

Our customers can leverage the open-source nuclei-based vulnerability scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

#### 3. Threat Hunting Tools

Cybercriminals and state-sponsored threat actors have already actively exploited CVE-2023-29300. TeamT5 vulnerability intelligence team prepared a SIGMA rule and a nuclei-based webshell scanner for our customers to detect potential threats. 

The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) includes:

- SIGMA rule to check if ColdFusion server `coldfusion.exe` launches suspicious process
- Nuclei-based webshell scanner to detect webshells deployed after exploiting CVE-2023-29300.

<figure>

![pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png](https://uploads.teamt5.org/upload/original/pic1_exploiting-adobe-cold-fusion-cve-2023-29300.png)

<figcaption> The Nuclei-based webshell scanner
</figcaption>
</figure> 
 
Our customers can download all tools from the **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

## Possible Attack Scenario

Threat actors have to first abuse the unauthenticated ColdFusion Component (CFC) endpoint to exploit CVE-2023-29300. Public proof of concepts has exposed a ColdFusion Component endpoint `/CFIDE/adminapi/accessmanager.cfc` that also been exploited in the wild. Our customers can check if your ColdFusion Component endpoint has been attacked with following IIS log. 

`C:\inetpub\logs\LogFiles\W3SVC1\u_ex240112.log:2024-01-12 08:12:12 172.17.0.1 POST /CFIDE/adminapi/accessmanager.cfc _cfclient=true&method=foo 443 - 172.17.0.2 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_10_1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/37.0.2062.124+Safari/537.36 - 404 0 2 1466`

Our customers can also leverage the open-source nuclei-based webshell scanner to detect if the vulnerability is in the ColdFusion Component. 
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29300.yaml

CVE-2023-29300 is a deserialization vulnerability originated from the Web Distributed Data eXchange (WDDX) library. Once exploited, the vulnerability will allows the threat actors to load the payload via JNDI injection, connecting to the C2 and execute arbitrary codes.

The threat actors can deploy webshell to ColdFusion after successfully exploited CVE-2023-29300. With such webshell exists, the threat actors can still access ColdFusion Component even after patching the vulnerability. Our analysis found that more than 1% of the ColdFusion Components in Japan has been compromised. The webshells contains following malicious URI:
- COLDFUSION_SERVER/cf_scripts/config.cfm
- COLDFUSION_SERVER/cf_scripts/123.cfm
- COLDFUSION_SERVER/cf_scripts/system.cfm
- COLDFUSION_SERVER/cf_scripts/classes/GetVars.cfm
- COLDFUSION_SERVER/cf_scripts/classes/ckeditor.cfm

Based on the research, we provide a nuclei-based webshell scanner and a SIGMA rule for our customers to check if your ColdFusion Component endpoint has been compromised, and the nuclei-based webshell scanner can identify implanted webshells as follows. Our customers can download the tools from The **Threat Hunting Tools** in [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website).

Notably, we also detected that Chinese threat actors developed webshell designed for ColdFusion Markup, PowerShell[5]. PowerShell will download the second stage webshell from C2 `http://113.141.91.61:63211/11.aspx`. The second-stage webshell is Behinder[6], a famous open-source webshell in Chinese threat actors.

### Appendix I: Malware Table

Below malware table summarize the malware used in attacks related to CVE-2023-26360.

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Behinder</td>
 <td>Webshell</td>
 <td>Behinder is a webshell developed by Chinese actor. It has different platform versions, such as PHP, ASP and JSP. Behinder loads an AES-encrypted binary payload which is difficult to detect by general firewall.</td>
 <td>Open-source</td>
 <td>2020.06</td>
 </tr>
</table>
 
### Appendix II: Indicators of Compromise (IoC)

**SHA-256**
 
```
hash= webshell
cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52
d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

```

```c2-IP= IP
113.141.91.61
```

### Appendix III: Other critical CVEs

TeamT5 also provides analysis of other caitical CVEs in **Patch Management Report (PMR)**. Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please [contact TeamT5](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information.

 
 

[1] https://blog.projectdiscovery.io/adobe-coldfusion-rce/

[2] https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog

[3] https://github.com/gobysec/Research/blob/main/Adobe_Coldfusion_remote_code_execution_vulnerability_Analysis_(CVE-2023-38204)_zh_CN.md

[4] The HuWang Operation is China’s state-led penetration testing or red teaming operation for state-owned enterprises and critical information infrastructure (CII) operators, hosted by the Ministry of Public Security every summer. We have previously discovered that several APT groups such as Amoeba, SLIME28, and SLIME37 have joined China’s HuWang Operation.

[5] SHA-256: cb493680d1a8ee7a70a2d339ece0b190db02fba4ba6af3b2c26a6b4841902d52

[6] d6910571564cc4c61b1277334701c612fd3a25b96b63b267d64fcf48a5998254

CVE-2023-29300: Adobe ColdFusion 漏洞

Today's enterprises continue to face increasingly complex security threats; in order to deal with these challenges, threat hunting is an indispensable strategy.

Enterprises cooperate with professional threat hunting teams and use threat hunting tools based on the latest threat intelligence to help enterprises take proactive defensive measures, strengthen the enterprise's cybersecurity resilience, and ensure uninterrupted business operations.

### 1. Proactively look for potential threats
Threat hunting is different from passive cybersecurity defense methods. It not only relies on known attack patterns, but also actively hunts unknown threats. Through proactive threat hunting, enterprises can take preventive measures before attacks occur, greatly improving their defense capabilities.

### 2. Reduce the attacker’s residence time
A successful attack often depends on how long the attacker remains on the corporate network. Threat hunting can significantly reduce the time attackers have to influence corporate networks, reduce the possibility of damage, and improve overall security.

### 3. Improve incident response efficiency
Rapid response after a security incident occurs is crucial. Threat hunting enhances an enterprise's incident response efficiency by providing more comprehensive and real-time threat intelligence. Security professionals can more quickly identify the source and method of attacks, take appropriate action, mitigate damage, and quickly restore normal operations.

###4. Adapt to the changing threat environment
Threat hunting is powered by the latest security intelligence, allowing enterprises to more flexibly adjust their security strategies to respond to emerging threats. This adaptability enables enterprises to better respond to the evolving threat environment, ensures that their security measures and strategies are future-proof, and strengthens the overall security resilience of the enterprise.


## Conclusion
The benefit of threat hunting is not only to help enterprises adapt to detect threats, but also to improve enterprises' ability to adapt to continuously evolving security challenges. This kind of proactiveness, immediacy and adaptability makes threat hunting an integral part of strengthening enterprise security resilience and helping to protect enterprises from emerging security threats.

 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/request-information/

 

*Picture source: pixabay

The benefits of threat hunting: The key to greater security resilience for Enterprise

當今企業持續面臨日漸複雜的資安威脅；為了應對這些挑戰，威脅狩獵是不可或缺的策略。

企業與專業的威脅狩獵團隊合作，採用基於最新威脅情資的威脅狩獵工具，協助企業採取主動積極的防禦措施，強化企業的資安韌性，確保業務營運不中斷。

### 1. 主動尋找潛在威脅
威脅狩獵有別於被動的資安防禦方式，不僅僅是依賴已知的攻擊模式，主動獵捕未知的威脅。透過主動威脅獵捕，企業能夠在攻擊發生前採取預防措施，大幅提升防禦能力。


### 2. 降低攻擊者的滯留時間
一個成功的攻擊往往取決於攻擊者在企業網路中的滯留時間。威脅狩獵可大幅縮減攻擊者影響企業網路的時長，減少損害的可能性，提高整體的安全性。

### 3. 提高資安事件應變效率
資安事件發生後的迅速應變至關重要。威脅狩獵透過提供更全面、即時的威脅情資，增強企業的事件應對效率。資安專業人員能夠更快速地識別攻擊的來源和方法，採取適當的措施，降低損害並快速恢復正常運作。

### 4. 適應不斷變化的威脅環境
威脅狩獵電機於最新的資安情資，使企業能夠更靈活地調整其資安策略以應對新興的威脅。這種適應性使企業能夠更好地應對不斷演變的威脅環境，確保其資安措施和策略不會過時，強化企業整體的資安韌性。

## 結論
威脅狩獵的好處不僅是協助企業應變發現威脅，更可提高企業適應持續演變的資安挑戰。這種主動性、即時性和適應性使得威脅狩獵成為強化企業資安韌性的不可或缺的一環，有助於保護企業免受新興的資安威脅。

 
 
 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/request-information/

 
 
*圖片來源: Pixabay

威脅狩獵對企業的好處：強化資安韌性的關鍵

2024 is a record-breaking year for elections around the globe, with over 60 countries home roughly half of the world’s population is set to hold national elections. On 13 January 2024, Taiwan kicked off this super-election year with its presidential and legislative elections.

At TeamT5, we are pleased to see that the election concluded smoothly, without any successful disruptions by cyber attackers. We believe this achievement is a result of the hard work and dedication of many individuals and organizations. Their collective efforts have ensured the election process remained secure and trustworthy.

**Despite the overall success, TeamT5 believes that we must not overlook the challenges posed by state-sponsored cyber threats.** Our team has worked tirelessly to identify and analyze numerous malicious activities and disinformation campaigns, particularly those associated with state-linked influence operation (IO) actors or Advanced Persistent Threat (APT) groups. This whitepaper will detail the specific tactics, techniques, and procedures (TTP) used by these actors, hoping to provide valuable insights into their operations.

The cyber threat landscape is ever-changing, with adversaries constantly improving their attacking methods. During this election cycle, we noticed that these threat actors have enhanced their capabilities, employing more sophisticated and innovative techniques to target a broader array of platforms. **This whitepaper not only shares our discoveries but also illustrates the importance of continuously updating our cyber defense strategies to stay ahead of potential threats.**

We are committed to evolve our threat intelligence to counteract these cyber threats. Through this whitepaper, we aim to share our strategic findings, hoping to equip other democracies, especially those facing upcoming elections, with better understanding of cyberattacks aiming to disrupt the democratic process. We hope it serves as a practical resource for cyber threat intelligence experts in democratic countries, helping them to anticipate and mitigate cyber threats effectively.

## Research Highlights
**1.** Prior to the 2024 elections, Taiwan has faced an array of sophisticated cyber threats, all aimed at destabilizing the democratic processes and undermining public trust in the electoral system. Overall, China-nexus actors accounted for a major part of the targeted attacks.

**2.** Chinese Advanced Persistent Threat (APT) groups have targeted multiple entities in Taiwan, especially the journalism and media industry. Notably, not only pro-democracy or pan-green media have fallen into prey. Our database suggests that domestic television operators and newspapers, some perceived as pro-unification or pro-China, have also been the primary targets.

**3.** On the other hand, China has also been weaponizing social media platforms to spread disinformation and propaganda against Taiwan. While we observed sparse suspicious activities attacking the ruling party since early 2023, it was not until November that we detected significant influence operations. We summarized three key trends of China’s influence operations during the elections:
 
(1) Expanded Target Scope
 
(2) AI-Enabled Campaigns across Various Platforms
 
(3) Fake News Sites and Whistleblower Sites

**4.** From late November 2023, we have detected China-nexus hack and leak incidents, corresponding with the following influence operations aimed at diminishing public trust toward Taiwan’s current ruling party, the Democratic Progressive Party (DPP). These campaigns mark a strategic adoption of “hack-and-leak” methods, a notable shift in hybrid warfare tactics. We highlight a significant campaign named “Operation ScoopSpy.” It is very likely that their goals are to sow chaos and discredit pro-democracy politicians regardless of which candidate or political party wins in the elections.

**5.** China’s approach to influencing Taiwan’s political landscape, particularly around the2024 elections, underscores a long-term strategy. Advanced Persistent Threat (APT) groups and influence operation (IO) actors linked to China have shown a deep understanding of their targets, indicating thorough preparation and research. This meticulous groundwork has led to a troubling synergy between cyber espionage efforts and influence operations.

 
**To receive the whole whitepaper, please fill up the form below.**

【Whitepaper】Cyber Threats against Taiwan’s 2024 Presidential Election

杜浦數位安全 TeamT5 發佈《臺灣 2024 總統大選資安威脅》白皮書（TeamT5 White Paper: Cyber Threats against Taiwan’s 2024 Presidential Election），透過「進階持續性威脅（advanced persistent threat）」與「資訊作戰（influence operation）」的雙重視角，全面剖析 2024 年臺灣大選所面臨的資安威脅。根據 TeamT5 長期以來的追查，我們持高度信心這些攻擊可能都是來自中國相關的威脅行動者。

作為網路威脅情資研究的專家， TeamT5 長期關注亞太地區駭客威脅，以協助我們的客戶掌握關鍵情資，抵禦從未間斷的網路攻擊。

**重點摘要：**
1. 中國相關威脅行動者的攻擊手法持續演進，於投票日前一週發動綿密的不實資訊攻擊，意圖動搖社會大眾對於民主選舉體制的信任。
2. 中國相關威脅行動者攻擊的目標包含不同產業，近期媒體業更是飽受攻擊。根據 TeamT5 的研究顯示，遭攻擊的媒體公司並無政治立場之分，泛綠與泛藍媒體皆有遭到攻擊。
3. 中國相關威脅行動者仍持續透過社群平台散布不實訊息。但和過去相比，其動員的社群資源更加廣泛，並進一步利用 AI 技術生成內容；同時還架設新聞通訊網站，撰寫原生內容，以大量散播不實資訊。
4. 中國相關威脅行動者還運用了「駭侵與外洩」（Hack and Leak）的手法。先竊取機密資訊後，再有計畫地透過特定管道向大眾披露，試圖操弄社會輿論風向，遭駭產業包含媒體、政府與電信。

綜合來看，中國相關威脅行動者確實能深入掌握台灣政經社會局勢的脈動，再透過進階持續性攻擊與資訊作戰的混合手法，瞄準民主社會可能的弱點。長期而言，網路攻擊的威脅，仍是台灣民主發展揮之不去的陰影。

請填寫以下表格，即可下載完整白皮書（英文）。


【白皮書】全面剖析臺灣 2024 總統大選面臨之資安威脅 

**Threat intelligence**, also known as cyber threat intelligence (CTI), is a critical aspect of cybersecurity, involving the collection, processing, and analysis of data about potential or current threats to an organization's security. This intelligence is not just raw data but contextual information that helps in understanding threat actors' motives, targets, and attack behaviors. It provides insights into the tactics, techniques, and procedures (TTPs) of adversaries, enabling organizations to prepare, prevent, and identify cyber threats that could exploit valuable resources.

**This whitepaper will give you overall understanding of threat intelligence and how threat intelligence points out the threat landscape**. It contains:
- Introduction to Threat Intelligence
- Challenges & the Role of Threat Intelligence
- Types of Threat Intelligence
- The Threat Intelligence Lifecycle
- Implementing Threat Intelligence
- Threat Intelligence in Action
- Future Trends & Developments

 

**Fill up the form and receive our whitepaer now!**

【Whitepaper】Understanding Threat Intelligence & The Threat Landscape with TeamT5

ThreatVision Resources

In today's digital landscape, organizations face an ever-evolving array of cybersecurity threats that challenge their resilience and operational integrity. From sophisticated phishing attacks to complex ransomware, the methods employed by cybercriminals grow increasingly advanced, demanding a proactive and comprehensive approach to defense. Enter External Attack Surface Management (EASM), a cutting-edge strategy designed to bolster organizational cybersecurity by identifying, analyzing, and mitigating threats posed to external digital assets. 

**This article dives into the intricacies of EASM, explaining how it functions as a critical cybersecurity framework for modern organizations by protecting against external threats and strengthening overall security posture.**

 

## What is EASM?
External Attack Surface Management (EASM) is a cybersecurity discipline focused on the continuous discovery, inventory, assessment, and management of an organization's digital assets accessible from the internet. These assets include servers, web applications, domains, cloud resources, and other components that organizations rely on to fulfill their missions and operations. The importance of External Attack Surface Management cannot be overstated, as it supplements an organization's internal defenses and ensures that vulnerabilities on the outside are identified and addressed before they can be exploited.

 
## How EASM Works
The digital assets comprising an organization's external attack surface represent the sum of all points from which an adversary may find access to internal networks and systems. While the scale and complexity of contemporary infrastructure mandates that these assets be publicly accessible - for instance, to enable service delivery, provide support, or facilitate communication - attackers leverage the same properties to gain unauthorized access, launch cyber-physical attacks, or damage the reputation or integrity of organizations. EASM plays a pivotal role in the protection of this far-reaching attack surface.

**EASM performs three foundational functions:**
### Discovery
EASM solution will identify an organization's points of exposure such as servers, IPs, applications or third-party services. Advanced discovery methods may incorporate the use of network scans, crawlers, passive listening to internet traffic and other techniques.

### Risk analysis
EASM continuously profiles and assesses every exposed asset, generating a comprehensive understanding of an organization's attack surface. Every asset is interrogated to extract detailed metadata, which is then contextualized, analyzed and interpreted, allowing it to be categorized according to function and risk.

### Threat mitigation
EASM is diagnostic and prescriptive, providing the insight and guidance that defenders need to triage and remediate the most urgent and exploitable threats. This process will typically involve correlating artifacts discovered across multiple assets to form attack structures, which are then analyzed to identify active and impending threat scenarios. It is this diagnostic approach that allows organizations to act on their various vulnerabilities in the most strategic and impactful manner.

 
## Key Components of EASM
### Inventory of External Digital Assets
The first component of EASM involves developing a comprehensive inventory of all digital assets that are remotely accessible from the internet. This inventory becomes the foundation for all later EASM activities.

### Continuous Monitoring and Risk Assessment
EASM dictates that the external attack surface be continuously monitored to identify new assets and associated vulnerabilities. Each asset is assessed for obvious, high-level risk for the purposes of prioritization.

### Integration with Threat Intelligence
EASM systems integrate with one or more threat intelligence feeds to provide enrichment of assets and vulnerabilities, including their risk factors.

 
## The Role of EASM in Cybersecurity
EASM extensions cybersecurity protections beyond traditional perimeters by proactively searching for threats and vulnerabilities that hackers would otherwise discover and exploit. As mentioned, hackers scan constantly for exposed assets to target.

Unlike reactive security measures that respond after an incident has occurred, EASM works by identifying potential security issues early. By continuously monitoring the external attack surface, these solutions can identify unexpected exposure points, misconfigurations, or vulnerabilities in real-time. This means that organizations can take remedial action to address security gaps immediately, significantly reducing the window of opportunity for an attack.

**What types of threats can EASM help to mitigate? It can be particularly effective for security teams to better defend against threats that target their external assets. For example:**

### Phishing Attacks
EASM solutions can be used to monitor for the unauthorized use of key brand names or domains, suppressing the ability for an adversary to stand-up a fraudulent site that exploits a company’s identity in a phishing campaign.

### Malware Distribution
Identifying compromised assets or malicious content delivery in real-time can greatly assist with thwarting attempts to distribute malware to customers and prospects of the company.

### Vulnerabilities in Public-Facing Applications
As was the case with many recent vulnerabilities, the term “public-facing web applications” often translates directly to “high profile targets.” EASM solutions that can identify vulnerabilities in web applications and ensure they get patched or mitigated in short order (before they can be exploited) are exceptionally valuable.

 
## Benefits of EASM
Implementing EASM have several benefits such as:

- Improved Security Posture
With the proactive detection and mitigation of vulnerabilities and threats, organizations can significantly improve their overall security posture. This proactive approach helps prevent data breaches and other security incidents, safeguarding sensitive information and maintaining customer trust.

- Compliance and Risk Reduction
EASM also plays a vital role in compliance and risk management. By ensuring that external assets adhere to security best practices and regulatory requirements, organizations can avoid costly penalties and reputational damage associated with non-compliance and security breaches.

 
## Conclusion
**External Attack Surface Management (EASM)** is an essential component of contemporary cybersecurity strategies. By enabling the proactive identification and remediation of threats, EASM empowers organizations to address an expansive array of cyber threats. While its implementation presents several challenges, the benefits of increased visibility, an improved security posture and a more compliant posture make EASM a critical technology for any organization looking to strengthen its defenses in the digital age. As the threat landscape continues to evolve, the importance of robust and proactive security technologies such as EASM will only grow, making it incumbent on the part of organizations to remain one step ahead of their cyber adversaries.

>[Contact us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) to know our EASM solution.

>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan. 
>
>Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

What is EASM and How Does it Help Protect Organizations?

在當今的數位環境中，企業面臨著一系列、持續變化的網路安全威脅，這些威脅挑戰著他們的韌性和營運完整性 從複雜的網路釣魚攻擊到複雜的勒索軟體，網路犯罪分子採用的方法變得越來越先進，需要採取主動且全面的防禦方法。

外部攻擊面管理 (EASM) 即是先進的解決方案，旨在透過識別、分析和減輕對外部數位資產的威脅，強化企業網路安全。 本文深入探討 EASM 的細節，說明它如何透過防禦外部威脅和加強整體安全態勢，作為企業的網路安全防禦關鍵。

 

## 什麼是 EASM？
外部攻擊面管理 (EASM) 專注於持續發現、清點、評估和管理企業可透過網路存取的數位資產。 這些資產包括伺服器、Web 應用程式、網域、雲端資源，及企業完成任務和營運所依賴的其他數位資產。 外部攻擊面管理十分重要，因為它強化企業的內部防禦，並確保外部漏洞在被利用之前被識別和解決。

 

## 外部攻擊面管理 (EASM) 如何運作
構成企業外部攻擊面的數位資產，代表對手可能找到對企業內部網路和系統的存取權限的所有點的總和。 

雖然基礎設施的規模和複雜性要求這些資產可公開存取（例如，為了提供服務或支援、提供資訊），但攻擊者也可利用相同的屬性來獲得未經授權的存取、發動網路實體攻擊或損壞企業的聲譽或誠信。 EASM 在保護此攻擊面，發揮關鍵作用。


**EASM 具備3項基本功能：**

### 發現
EASM 解決方案將識別企業的暴露點，例如伺服器、IP、應用程式或第三方服務。 進階發現方法更可結合網路掃描、爬蟲、被動監聽網路流量和其他技術。

### 風險分析
EASM 持續分析和評估每個暴露在外的資產，進而掌握企業的受攻擊面。 每項資產都會被詢問，以獲得詳細的數據，然後對其進行脈絡化、分析和解釋，從而根據功能和風險對其進行分類。


### 威脅緩解
EASM 具有診斷性和規範性，可為企業的資安團隊的防禦優先順序，進行指引，其提供分類和補救最緊急、可利用威脅所需的關鍵資訊。 此過程通常涉及多個資產的跨幅度關聯，以形成攻擊結構；進一步對攻擊結構進行分析以識別活動和即將發生的威脅情境。 

正是這種診斷方法，使企業能夠以最具策略性和影響力的方式，針對各種漏洞採取行動。

 

### 外部攻擊面管理 (EASM) 的關鍵


#### 外部數位資產盤點
EASM 首要功能是可透過網路遠端存取的所有數位資產的全面清單，此清單成為以後所有 EASM 管理的基礎。

#### 持續監控和風險評估
EASM 旨在持續監控外部攻擊面，以識別新資產和相關漏洞。為了確定優先級，EASM 對每項資產進行風險度評估。

#### 與威脅情資共同整合
EASM 系統與一個或多個威脅情資來源共同整合，以利擴展資產和漏洞的清單，也將風險因素考慮進此系統。

 

## 外部攻擊面管理 (EASM) 在資訊安全管理的效益

EASM 透過主動搜尋駭客可能發現和利用的威脅、漏洞，將網路安全保護擴展到傳統邊界之外。 如前所述，駭客不斷掃描攻擊目標暴露在外的資產，以利趁虛而入。

與事件發生後的應變形安全措施不同，EASM 的工作原理是儘早識別潛在的安全性問題。 透過持續監控外部攻擊面，這些解決方案可以即時識別意外暴露點、錯誤配置或漏洞。 這意味著企業可以採取補救措施，立即解決安全漏洞，從而顯著減少受攻擊的機會和時間。

EASM 可以幫助緩解哪些類型的威脅呢？ 對於資訊安全團隊來說，它有效防禦可能受駭客鎖定的外部數位資產。 例如：

### 網路釣魚攻擊
EASM 解決方案可用於監控關鍵品牌名稱或網域的未經授權使用，從而抑制攻擊者在網路釣魚活動中，建立利用公司身分的詐騙網站的能力。

### 惡意軟體派送
即時識別受損資產或惡意內容交付，可以極大地幫助阻止向公司客戶和潛在客戶派送惡意軟體的嘗試。

### 應用程式中的漏洞
與最近許多漏洞的情況一樣，「供大眾使用的 Web 應用程式」幾乎等同為「引人注目的目標」。 EASM 解決方案可以識別 Web 應用程式中的漏洞，並確保在短時間內（在它們被利用之前）對其進行修補或緩解，因此 EASM 解決方案非常有價值。

 

## 外部攻擊面管理 (EASM) 的好處
實施 EASM 有幾個好處，如：

- 改善安全狀況
透過主動偵測和緩解漏洞、威脅，企業可以顯著改善其整體安全狀況。 這種主動方法有助於防止資料外洩和其他安全事件，保護敏感資訊並維護客戶信任。

- 合規性和降低風險
EASM 在合規和風險管理方面也發揮著至關重要的作用。 透過確保外部資產遵守最佳資安實踐和監管要求，企業可以避免因不合規、漏洞遭利害等的高額罰金和聲譽損害。

 

## 結論
外部攻擊面管理 (EASM) 是當今資訊安全策略的重要組成。 透過主動識別和修復威脅，EASM 使企業能夠應對廣泛的網路威脅。 雖然其實施帶來了一些挑戰，但提高可見度、改善安全狀況和更合規性的好處使得 EASM 對於任何希望加強數位時代防禦的企業來說都是一項關鍵技術。


隨著威脅情勢的不斷發展，EASM 以其強大且主動防禦的特性，其於資安領域的重要性持續增強，這使得企業有責任採用，並領先網路攻擊者的攻擊活動。

>[立刻聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website) ，了解如何運用外部攻擊面管理 (EASM)解決方案 !

>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應（EDR）解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。獲國際頂尖顧問公司 Frost & Sullivan 肯定為台灣最佳威脅情資公司（2023 Taiwanese Threat Intelligence Company of the Year Award）。 
團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

什麼是外部攻擊面管理 (EASM)? 又是如何協助企業進行資安防禦?

## Challenges 
As hacker attack technology continues to evolve, advanced persistent threat (APT) techniques are becoming even more complex. More and more malicious programs are able to bypass EDR (Endpoint Detection and Response) and use legitimate tools to control endpoints. According to [TeamT5's latest "APT Threat Landscape in APAC 2023" report](https://teamt5.org/en/posts/apt-threat-landscape-in-apac-2023/?utm_source=blog&utm_medium=website), it is now common for hacker groups to use public or open source tools or exploit vulnerabilities of web servers to execute attacks.

The report also pointed out that in the entire Asia-Pacific region, Taiwan, South Korea and Japan are the countries most targeted by APT actors. In Taiwan, the government, IT industry, education and critical infrastructure sectors are the main targets of attacks. The reason why APT actors are so interested in the IT sector is that these IT companies possess good channels or privileges to access big companies or government entities through supply chain attacks.

To deal with endless APT attacks, how should enterprises or organizations effectively deal with them? The following case reveals how TeamT5 actually assists enterprise organizations to handle APT attacks. In this case, you may understand hacker attack techniques and how incident response measures reduce the losses to strengthen future cybersecurity defense.

##Through TeamT5 endpoint security solution, suspicious APT attacks were discovered and timely assistance was provided.
Since APT attacks are hidden and targeting specific enterprises, there are usually no obvious signs. Threats must be found through threat intelligence or EDR with APT detection capabilities.

In a real case, a client used ThreatSonar, a threat forensic analysis platform developed by TeamT5, to conduct a scan of critical endpoints and analyze the scan results to understand whether there are potential threats. After inspection, it was gradually discovered that the hosts were installed with APT backdoors and Webshells. After receiving the detection report, TeamT5 immediately made further plans for the client, expanded scanning scope and analysis of endpoints in the field, and initiated the cybersecurity incident investigation service stage.

TeamT5’s Cyber Security Incident Response Team (CSIRT) assists clients in accessing the situation and the attacker's possible intrusion methods, and provides clients with immediate suggestions to block the attacker's control and proliferation to avoid affecting other digital assets.

## Endpoint detection and analysis to understand the scope of attacks
In order to clarify the scope of attacks in the environment, TeamT5 helps clients take the following key actions:

- **Key forensic analysis**:
Based on the circumstances of the case, the TeamT5 team identified the major compromised host. Per its operating system, forensic analysis by professional tools, and analysis of the network equipment communication log at the time of the incident, TeamT5 conducted incident-related investigations.

- **Deploy endpoint scanning to identify the scope of attacks**:
By deploying ThreatSonar to perform endpoint scanning, it was found that the memory of a host hit the APT rule, triggering a high-risk (Level 5) threat alert. After analysis by TeamT5, it was confirmed that a backdoor program, a malicious threat, was placed into the memory along with threat information such as suspicious file paths and malicious C2 server lists. It is recommended that clients block malicious C2 servers and check whether the firewall has records of endpoints trying to connect to the servers.

## Uncover the root cause of the incident and investigate the trajectory of the attack
Based on the incident investigation report generated by ThreatSonar and network record analysis, the TeamT5 team performed correlation investigations of on-site incidents to understand the attackers’ path and root cause of the incident:

- **Analysis of critical endpoints’ scan results**: A malicious threat is found in the connection record of an executable file on the field host, and the malicious C2 domain of the threat information was hit.
- **Incident investigation to find out the root cause**: After identifying the risk host, investigation and analysis were initiated to find out the hacker control chain. From the correlation between the Web Log and the Event Log of the system with abnormal conditions, it was discovered that as early as half a year ago, the system had been implanted with a Webshell by attackers. After the attackers took advantage of the system vulnerability of the third-party service to gain control, they then used Softether and a set of Trojans to establish footholds. Further tracing back on the attack incident, we learned that the attacker abused PowerShell commands for execution by SQL permissions, and summarized the accounts that may have been controlled, as well as the IP information of attack source.
- **Comprehensive assessment of the endpoints’ security status**: In order to ensure the security status of endpoints in the site, the scanning scope was expanded. From the memory analysis, it was found that other on-site hosts were injected with the GhOst backdoor program.
- **Introducing professional cybersecurity monitoring services to strengthen cybersecurity protection**: TeamT5 Managed Detection and Response Services (MDR) provide clients with one-stop services such as threat monitoring, analysis, response, and investigation, reducing the burden of enterprise cybersecurity operations while achieving comprehensive risk control.

 
![en_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg](https://uploads.teamt5.org/upload/original/en_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg)
 

## Review cybersecurity strategies and strengthen cyber defenses
To prevent similar incidents from happening again, TeamT5 provides clients with the following cyber defense suggestions:
### Block the sources of hacker control
take complete review of the security status of digital assets, confirm VPN equipment and system vulnerability patching, strengthen access control of critical hosts, and improve personnel's security awareness of phishing emails or website downloaders.

### Strengthen monitoring and analysis measures
establish an endpoint security monitoring mechanism to provide real-time alerts and block malicious behaviors; confirm the settings of network communication rules or the settings of terminal connections.

### Establish an incident response mechanism
Develop incident response procedures for the high-risk incidents that may occur, including pre-compromise monitoring and analysis, mitigation during the incident, and subsequent recovery and improvement, etc., so that they can be followed when an incident occurs.

【Incident Response Case】When APT threats are lurking in the environment, how can you deal with them effectively?

## 企業面臨的挑戰
隨著駭客攻擊技術的持續進化，進階式持續威脅（Advanced Persistent Threat, APT）手法也日趨複雜，越來越多惡意程式能規避 EDR（端點偵測與回應），利用合法工具來控制受駭機器。根據 [TeamT5 最新《2023年威脅態勢回顧》](https://teamt5.org/tw/posts/apt-threat-landscape-in-apac-2023/?utm_source=blog&utm_medium=website)報告數據顯示，許多駭客組織採用公共或開源工具，或利用 Web 伺服器漏洞的攻擊更為普遍。

報告同時指出，在整個亞太地區，台灣、韓國和日本是 APT 組織攻擊最多的國家；在台灣，又以政府、IT、教育或關鍵基礎設施等產業為主要攻擊對象。而 APT 攻擊者之所以對 IT 產業如此感興趣，是可藉由 IT 產業做為跳板，從供應鏈攻擊來接觸大型企業或政府等組織。

面對層出不窮的 APT 攻擊，企業或組織該如何有效處置？以下藉由 TeamT5 實際協助企業組織處理 APT 攻擊的案例，了解駭客攻擊手法以及事件應變作為，降低事件造成的損失，並強化未來資安防禦。

## 透過 TeamT5 端點安全檢測，發現可疑 APT 攻擊，立即協助處置
有鑑於 APT 攻擊屬於隱密且具有針對性的駭侵活動，通常不會有明顯徵兆，必須要透過威脅情資或具備 APT 偵測功能的 EDR 才能找出威脅。

在真實案例中，客戶採用 TeamT5 自行研發的威脅鑑識分析平台 ThreatSonar 進行重要端點檢測分析，藉此了解是否有潛在威脅。經檢測後，陸續發現場域主機遭植入 APT 後門程式及 Webshell 狀況。TeamT5 收到檢測報告後，立即為客戶做進一步規劃，針對場域端點主機擴大掃描分析，並進入資安事件調查服務階段。

TeamT5 資安事件應變處理團隊（CSIRT）協助客戶判讀狀況，研判攻擊者可能的入侵方式，並第一時間提供客戶阻斷攻擊者控制與擴散的建議，避免影響其他數位資產。

## 端點偵測分析，掌握受駭範圍	
為釐清環境中受駭範圍，TeamT5 協助客戶採取以下重點行動：
- **重點取證分析**：

依據案況，TeamT5 團隊研判可能為重點事發的主機，依其系統作業環境、藉由專業工具取證分析、案發時網路設備通訊紀錄，進一步作事件關聯調查。

- **部署端點掃描，匡列受駭範圍**：

藉由部署 ThreatSonar 執行端點掃描，發現有一台主機其記憶體命中 APT 規則，觸發高風險（Level 5）威脅告警。經 TeamT5 分析後，確認記憶體遭注入後門程式，屬於惡意威脅。並找出可疑檔案路徑與惡意中繼站（C2）清單等威脅情資，建議客戶封鎖惡意中繼站，並檢查防火牆是否有端點嘗試連線中繼站的紀錄。

##抽絲剝繭事件根因，調查攻擊軌跡
根據 ThreatSonar 掃描端點後事件調查報告以及網路紀錄分析，TeamT5 團隊對於場域事件發生狀況執行關聯調查作業，以掌握攻擊路徑與駭侵根因：
- **重要端點掃描分析**：
發現場域主機上某一執行檔的連線紀錄中具有惡意威脅，命中威脅情資惡意 C2 domain。

- **事件調查找出駭侵根因**：
在鎖定風險主機之後，進入調查分析，找出駭客控制鏈。從有異常狀況的系統 Web Log 與 Event Log 關聯查出，早在半年前，系統就已被攻擊者植入 Webshell，攻擊者利用第三方服務的系統漏洞取得控制權後，再運用 Softether 及一句話木馬建立其他進入點。進一步回溯攻擊事件，了解攻擊者透過 SQL 權限、Powershell 指令下載執行，歸納出可能遭掌握利用的帳號，及攻擊來源 IP 資訊。

- **全面清查場域端點安全狀況**：
為確保場域內端點安全狀況，擴大掃描範圍，從記憶體分析中，發現其他現場主機遭注入 GhOst 後門程式。

- **導入資安監控專業服務，強化資安防護力**：
TeamT5 威脅偵測應變代管服務（MDR）為客戶提供威脅監控、分析、處置、調查等一站式服務，減輕企業資安營運負擔，同時達到全面風險控管。

 
![tw_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg](https://uploads.teamt5.org/upload/original/tw_pic_ir-use-case-how-to-respond-to-advanced-persistent-threat-apt.jpg)
 


##檢視資安策略、強化未來防禦
為防禦類似的事件再度發生，TeamT5 提供客戶以下防禦建議：
#### 1.阻斷駭客控制來源
盤點資訊資產安全狀態、確認 VPN 設備及系統漏洞修補、加強重要主機存取控制、提升人員對於釣魚郵件或網站下載程式具有安全意識。

#### 2.加強監控分析措施
建立終端安全監控機制，即時告警、阻擋惡意行為；確認網路通訊規則的設定，或終端開放連線的設定。

#### 3.建立事件應變機制
針對可能發生的高風險事件類型，訂定事件處理作業程序，包含事前監控分析、事中抑制消除、事後復原改善等，在事件發生時能有所依循。

 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件應變與處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
若您有資安事件處理、應變的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

【資安事件應變處理案例】當 APT 威脅埋伏於環境中，該如何有效處置？

IR Service Resources

> The following alert is based on our January H2 Vulnerability Insights Report on [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website). TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. Contact us for more information about our vulnerability intelligence.

TeamT5 released mitigation and response guidelines to CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure Gateways (PS).

## Exploitation Status
Threat actors can combine the exploits of CVE-2023-46805 and CVE-2024-21887 to bypass the authentication of Ivanti ICS and PS products, which allows the threat actors to deploy malware and further compromise the target’s networks.

- **CVE-2023-46805** is an authentication bypass vulnerability that allows remote attacker to access restricted resources by bypassing control checks.
- **CVE-2024-21887** is a command injection vulnerability allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Our analysis suggests that CVE-2023-46805 and CVE-2024-21887 has been actively exploited by China-nexus state-sponsored threat actors.

The targeted countries are across the globe, including Taiwan, Japan, Netherland, South Korea, Indonesia, Malaysia, and Hong Kong.

The targeted sectors are varied, including manufacturing, information technology, education, telecom, construction, critical infrastructure, conglomerate, hospital, financial, petrochemical, real estate development, semiconductor, government, energy, and retail.

Mandiant attributed the attacks to UNC5221 whereas Volexity attributed to China-nexus UTA0178.
TeamT5 assess the attacks are from China-nexus threat actors with medium confidence based on the C2 information.

## Executive Summary
We assess the severity level of CVE-2023-46805 and CVE-2024-21887 is critical and urge our customers to use this report to mitigate the effects. The two vulnerabilities have been exploited as zero-day since December 2023.[1] Ivanti ICS and PS products is popular around the world. Aligned with Mandiant’s January report, our further investigations revealed that entities across different sectors in Taiwan, Japan, Netherland, South Korea, Indonesia, Malaysia, and Hong Kong are all fell into prey.

Furthermore, the Proof of Concepts (PoC) exploiting CVE-2023-46805 and CVE-2024-21887 has been circulating in the wild.[2] Public reports also revealed possible state actors exploited both vulnerabilities in the attacks. In fact, U.S. Cybersecurity and Infrastructure Security Agency (CISA) now requires all Federal agencies to disconnect Ivanti products by February 2.[3]

Threat actors, especially state-sponsored APT groups, has been actively exploiting CVE-2023-46805 and CVE-2024-21887 in the attacks. Our research, aligned with public reports[1][4], suggest that threat actors would further deploy malware, such as GIFTEDVISITOR (aka WIREFIRE) webshell and IvantiJStealer infostealer, the target’s devices. In addition to the malware, Mandiant also reported ZIPLINE backdoor, LIGHTWIRE webshell and its dropper THINSPOOL.

## Affected Products
Ivanti Connect Secure (ICS) Version 9.x and 22.x

## Mitigation and Response Advisory
### 1. Official Patch Information
Ivanti provided the patch for CVE-2023-46805 and CVE-2024-21887 to temporarily block suspicious URIs (i.e. REST API.)

- https://forums.ivanti.com/s/article/Download-Links-Related-to-CVE-2023-46805-and-CVE-2024-21887
- https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways

 
Moreover, the threat actors already tampered the Integrity Checker Tools (ICT) in the Ivanti PCS. We recommend our intelligence users to download the Ivanti ICT from following URL to ensure the integrity.
- https://forums.ivanti.com/s/article/KB44755

### 2. TeamT5’s VIR 2024 January H2: CVE-2024-21887
Based on the exploitation status, TeamT5’s VIR 2024 January H2: CVE-2024-21887 depicted the Possible Attack Scenario and concluded the malware and IOCs respectively. Most importantly, we prepare a comprehensive Mitigation and Response Advisory for our intelligence users.

The Mitigation and Response Advisory includes:
- Mitigation Advisory
Threat Hunting Tools, including two nuclei-based malware scanners and a YARA rule.
Two nuclei-based malware scanners to check if your Ivanti device is compromised by the threat actors
- YARA rule to detect IvantiJStealer

[Contact us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) for more information about our vulnerability intelligence.

 
 

## Reference
[1] https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day 

[2] https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis?referrer=etrblog 

[3] https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure 

[4] https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/

【TeamT5 Flash Alert】Ivanti Connect Secure VPN Exploitation: CVE-2023-46805 & CVE-2024-21887

根據 TeamT5 漏洞研究團隊觀察研究發現，Ivanti VPN 近期具有嚴重高風險零時差漏洞，恐已造成大規模駭侵事件發生，鑑此彙整相關漏洞資訊、活動狀態及緩解應對措施提供資安防護運用，相關資訊說明如下：

## 漏洞利用資訊
攻擊者可結合 CVE-2023-46805 & CVE-2024-21887 漏洞繞過 Ivanti Connect Secure and Policy Secure Gateways 產品的驗證機制後執行指令，進而植入惡意程式及進入公司內部場域滲透活動。
- **CVE-2023-46805**：可讓攻擊者繞過驗證機制及存取確認取得受限制的資訊。
- **CVE-2024-21887**：可讓攻擊者透過經過驗證的管理者權限注入任意指令執行。

## 攻擊活動狀態
據觀察 CVE-2023-46805 及 CVE-2024-21887 漏洞已經被中國 APT 攻擊族群所使用，由 Mandiant 資安公司報告指出歸類為 UNC5221 攻擊族群，Volexity 資安公司則歸類為與中國 APT 組織相關的 UTA0178 攻擊族群；另 TeamT5 依據所掌握之中繼站 (C2) 資訊關聯結果研判，有中度信心，本次攻擊事件與中國 APT 組織活動有關。

此次事件攻擊的目標則包括台灣、日本、荷蘭、韓國、印尼、馬來西亞和香港，產業範圍涵蓋製造業、資訊科技、教育、電信、建築、關鍵基礎設施、企業集團、醫院、金融、石化、房地產開發、半導體、政府、能源和零售業。

## 攻擊事件摘要
根據相關報告指出 CVE-2023-46805 與 CVE-2024-21887 自 2023 年 12 月以來就一直被利用[1]，此外概念驗證 (Proof of Concepts, PoC) 也已公布於資安網站[2]，美國網路安全和基礎設施安全局 (CISA) 也發布警訊要求所有聯邦機構在2024年2月2日之前斷開Ivanti產品的連線，避免遭到攻擊者滲透利用[3]。

另由 TeamT5 研究或是公開報告中[1][4]，都一致發現攻擊者另外會進一步地部署 GIFTEDVISITOR（又名 WIREFIRE）Webshell網頁後門程式或是 IvantiJStealer infostealer 惡意程式，此外 Mandiant 也觀察到有ZIPLINE、LIGHTWIRE webshell 及 THINSPOOL 等惡意程式活動狀況。

## 受影響的產品
Ivanti 的 SSL VPN 系統 Connect Secure（ICS），版本 9.x 與 22.x
 
## 緩解與應變處置建議
### 1.官方修補資訊
Ivanti 提供 CVE-2023-46805 和 CVE-2024-21887 暫時阻擋可疑 URI 的修補資訊：
- https://forums.ivanti.com/s/article/Download-Links-Related-to-CVE-2023-46805-and-CVE-2024-21887
- https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways

 
並且，由於攻擊者已有竄改 Ivanti PCS Image 的狀況，所以 TeamT5 建議可自https://forums.ivanti.com/s/article/KB44755 下載 Ivanti Integrity Checker Tools 檢查 Image 的完整性。

### 2. TeamT5 建議
TeamT5 於威脅情資平台 ThreatVision〈VIR 2024 1月份 H2: CVE-2024-21887〉 報告中，已掌握可能的攻擊情境、攻擊手法及惡意程式相對應的入侵指標(IOCs)並提供威脅獵殺工具：
- 基於 nuclei 的漏洞掃描偵測：可用於檢查 Ivanti 設備是否有遭駭侵狀況。
- yara rule 檢測識別工具：可用於探測是否有遭植入IvantiJStealer惡意程式。 

欲獲得更多資訊，請[聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)，了解 ThreatVision 詳細資訊。

 
 


## 參考資料
[1] https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day 

[2] https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis?referrer=etrblog 

[3] https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure 

[4] https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/

【資安即時快訊】Ivanti VPN 零時差漏洞 (CVE-2023-46805 & CVE-2024-21887)

Security Alerts

In today's business world, it is more important than ever to secure your organization's data. Data breaches can have a devastating impact on businesses, leading to loss of customer trust, financial losses, and legal liabilities. Organizations must take steps to protect their data from unauthorized access, use, and disclosure. There are a number of tools and practices that organizations can use to secure their data.

## Tools
A number of tools are available to help organizations secure their data. These tools can be categorized into a few different types:

- **Access control**: Access control tools allow organizations to control who can access their data and systems. This includes tools such as firewalls, intrusion detection systems, and antivirus software.
- **Data encryption**: Data encryption tools protect data from unauthorized access. This includes tools such as encryption software and VPNs.
Data loss prevention: Data loss prevention tools help organizations prevent data from being lost or stolen. This includes tools such as data backup and recovery software.
- **Security awareness training**: Security awareness training helps employees learn about cybersecurity risks and how to protect themselves from them.
- **Vulnerability management**: Vulnerability management helps organizations identify and fix vulnerabilities in their systems. This includes tools such as vulnerability scanners and patch management software.
- **Threat intelligence**: Threat intelligence provides organizations with information about the latest cybersecurity threats. This can help organizations take steps to protect themselves from these threats.
- **Incident response plan**: Incident response plans help organizations respond to cybersecurity incidents. This includes steps such as containing the incident, investigating the cause, and recovering from the damage.
- **Security audits and assessments**: Security audits and assessments help organizations identify and address cybersecurity risks. This can be done by an internal or external team of security professionals.

## Practices
In addition to using tools, there are a number of practices that organizations can follow to improve their cybersecurity. These practices include:

- **Developing a cybersecurity policy**: A cybersecurity policy outlines the organization's approach to cybersecurity. This policy should include a statement of the organization's commitment to cybersecurity, as well as specific guidelines for employees to follow.
- **Implementing least privilege**: The principle of least privilege states that employees should only be given access to the data and systems that they need to do their job. This helps to reduce the risk of unauthorized access.
- **Educating employees**: Employees are often the weakest link in the cybersecurity chain. Organizations should educate their employees about cybersecurity risks and how to protect themselves from them. This can be done through training, awareness campaigns, and other methods.
- **Keeping software up to date**: Software vulnerabilities can be exploited by attackers to gain unauthorized access to systems. Organizations should keep their software up to date with the latest security patches.
- **Monitoring systems**: Organizations should monitor their systems for suspicious activity. This can be done using tools such as intrusion detection systems and security information and event management (SIEM) systems.
- **Testing and evaluating**: Organizations should regularly test and evaluate their cybersecurity controls to make sure that they are effective. This can be done through penetration testing and other methods.

By following these guidelines, organizations can take steps to protect their data and ensure that it remains secure.

## Conclusion
Securing your organization is an ongoing process that requires a commitment from all levels of the organization. By using the tools and practices described in this article, organizations can take steps to protect their data from unauthorized access, use, and disclosure.


>TeamT5 provides solutions you need to build holistic cyberdefense!
>
>With our threat intelligence platform, [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), you may foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks.
>
>With our threat hunting tool, [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website), you may hunt down cyber threats with capabilities in compromise assessment, auto-investigation, and orchestration. Equipped with over 100 built-in IoCs and thousands of backdoor indicators, ThreatSonar helps discover threats and execute incident responses remotely in a post-compromised environment.

 
 
*banner source: pexles

Navigating the Evolving Cybersecurity Landscape: Adapting to Emerging Threats and Maintaining a Resilient Defense

在當今的商業世界中，保護企業資料的安全比以往任何時候都更加重要。 資料外洩可能會對企業造成毀滅性影響，導致客戶失去信任、財務損失和面臨法律責任。 

企業必須採取措施保護其資料，免於未經授權的存取、使用和揭露，以下介紹適合的工具與實踐做法，期能提升企業資安韌性。

 
##工具
有許多工具可協助企業保護其資料。 這些工具可以分為幾種不同的類型：

- **存取控制**：存取控制工具允許企業控制誰可以存取其資料和系統。這包括防火牆、入侵偵測系統和防毒軟體等工具。
- **資料加密**：資料加密工具可保護資料免於未經授權的存取，這包括加密軟體和 VPN 等工具。
- **資料遺失防護**：資料遺失防護工具可協助企業防止資料遺失或被竊，這類工具如資料備份和復原軟體等工具。
- **資安意識培訓**：安全意識培訓幫助員工了解網路安全風險，及如何保護自己免受網路安全風險。
- **漏洞管理**：漏洞管理可協助企業辨識並修復系統中的漏洞。這包括漏洞掃描工具和修補程式管理軟體等工具。
- **威脅情資**：威脅情資為企業提供最切身、最新的網路安全威脅資訊，這可以幫助企業採取措施保護自己免受這些威脅。
- **資安事件應變計畫**：此類計畫可協助企業應對網路安全事件，其包括遏制事件、調查原因及從損害中恢復等步驟。
- **資安稽核和評估**：資安稽核和評估幫助企業識別和解決網路安全風險，此可以由內部或外部安全專業人員團隊來完成。


##實踐作法
除了使用工具之外，企業還可以遵循許多實踐作法，提高網路安全能量。 這些做法包括：

- **制定網路安全政策**：網路安全政策概述企業的網路安全方法指引。該政策應包括企業對網路安全的承諾的聲明，以及員工應遵循的具體準則。
- **實施最小權限**：最小權限原則規定，員工只能存取完成工作所需的資料和系統。這有助於降低未經授權存取的風險。
- **員工訓練**：員工往往是網路安全鏈中最薄弱的環節，企業應該對員工進行網路安全風險以及如何保護自己免受網路安全風險的教育。這可以透過培訓、宣傳活動和其他方法來完成。
- **保持軟體最新**：攻擊者可以利用軟體漏洞來獲得對系統的未經授權的存取，因此企業應該讓使用的軟體持續更新至最新版本。
- **監控系統**：企業應監控其系統是否有可疑活動。 這可以使用入侵偵測系統以及安全資訊和事件管理 (SIEM) 系統等工具來完成。
- **測試和評估**：企業應定期進行滲透測試和各類評估方式，檢查其網路安全控制措施，以確保其有效

 
透過遵循這些準則，企業可以採取措施保護其資料並確保其安全。

 
## 結論
維護企業安全是一個長期過程，需要企業各個層級的承諾與投入。 參考本文中所述的工具和實踐方法，企業可以規劃並採取適當措施，保護其資料免遭未經授權的存取、使用和洩漏。

 

>您建立全面資安防禦所需的解決方案時，TeamT5 提供您所需的威脅情資與威脅狩獵工具！
>
>透過我們的威脅情資平台 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)，您可以預見潛在的威脅和事件，並為決策者提供行動項目，以做出準確的決策並降低風險。
>
>透過我們的威脅搜尋工具 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website)，您可以精準捕網路威脅。 ThreatSonar 內建數千種 APT 後門特徵，將最新情資帶到每個端點，進行鑑識，有助於在受感染後的環境中遠端發現威脅，並採取應對措施。

應對持續變化的網路安全態勢：掌握新出現的威脅並保持彈性防禦

在經濟前景不明朗、新興技術快速發展的趨勢下，加上俄烏衝突開啟了網路戰的新時代，網路安全專業人員面臨著比以往更大的壓力。許多企業和組織採用美國國家標準技術研究院（NIST）的網路安全框架（Cybersecurity Framework, CSF），做為對網路攻擊與反應的網路安全策略，包含識別（ Identify ）、防護（Protect）、偵測（Detect）、回應（Response）與復原（Recover）五個功能。然而，資安團隊要能完全發揮效益，就得解決從這五面向衍生而來的議題！

但是，根據 2023 iThome CIO 與資安大調查結果，台灣大型企業 2023 年整體缺口達 79%，其中又以營運與維護類的資安人才缺口占比最高，超過 50%。 

 

**資安人力缺口和專業能力，為企業資安帶來以下的挑戰：**
- 挑戰一：如何部署與監控端點？
- 挑戰二：面對進階攻擊，該如何應變？
- 挑戰三：該如何緩解事件？

 

**為解決上述挑戰，企業組織應持續補強內部資安團隊的專業度與人力，並尋找外部資安解決方案供應商，強化資安防禦能力**，尤其是在政府、教育、製造、醫療保健、能源和公用事業等產業。


本份白皮書是基於 TeamT5 杜浦數位安全長期進行威脅偵測應變代管服務（Managed Detection and Response, MDR）的經驗，提出全面分析。並建議企業採購 MDR 服務的重要考量因素，包含 MDR 人員技術能力與專業程度、進階威脅偵測與獵捕能力、事件應變與抑制能力等。

 

**立刻填寫表格，獲得白皮書深度分析與洞見！**

【白皮書】企業面對 3 大資安挑戰，就交給 MDR 服務！

MDR Service Resources

>ISO 27001 近期改版，將控制措施由舊版14個控制領域整合成4大類別，包含組織控制（Organization Controls）、人員控制（People Controls）、實體控制（Physical Controls）、技術控制（Technological Controls）。此外，部分條款有額外新增要求、調整用語等。

>本文特針對** ISO 27001: 2022 **版本中，「組織控制」類別之「A.5.7 Threat intelligence 威脅情資」進行簡介，以期協助企業、組織提升資訊安全管理品質。

 

**威脅情資（threat intelligence）**指的是與網路攻擊相關的資訊，經由專業團隊收集、轉換、分析、解釋等處理過程，提供資安決策過程所需要的基礎。

ISO 27001: 2022 之「A.5.7 Threat intelligence」控制措施建議企業與組織應收集、分析資訊安全威脅相關之資訊，以產生威脅情資，並確定企業將可能面臨哪些威脅，與進一步採取防禦措施。

為了遵守此項要求，企業與組織應執行下列事項：
- 定期檢查企業所處的威脅環境（藉由查看政府機構和其他組織的報告達成）。
- 應確定威脅來源（如：內部人員、競爭對手、犯罪者、恐怖組織）。
- 根據當前事件和過去的事件，確定可能的新型攻擊面向和趨勢。
- 建立有助於減輕企業組織的資訊安全威脅之防禦措施。

 

進一步，企業與組織也應考慮3個層級的威脅情資，以妥善掌握攻擊者的攻擊手法。3個層級的威脅情資為：
1. **戰略型威脅情資(Strategic Threat Intelligence)**：無技術細節，由 CXO 層級使用；用於辨別誰會想攻擊? 為何想攻擊?
2. **實戰型威脅情資(Operational Threat Intelligence)**：需要技術背景，由SOC 主管、分析研究員等使用；用於理解攻擊者的TTP (戰術 Tactics 、技術 Techniques、流程 Procedures)
3. **戰術型威脅情資(Tactical Threat Intelligence)**：需要技術背景，通常是 SOC 人員使用；以入侵指標(indicator of compromise, IoC)，監看特定攻擊事件

 

企業與組織可以自行生成自己的威脅情資。但通常，善用他人提供的威脅情資是更好的選擇。

企業與組織導入他人已經分析淬鍊的威脅情資，可以節省時間、金錢與人力投入，更可廣泛地掌握其面臨的資安威脅，避免藏在暗處的駭客攻擊團隊與尚未獲得大眾關注的高深攻擊手法。

國際的威脅情資來源，例如美國非營利組織 MITRE 營運的 CVE 平台，其提供系統漏洞資訊與緩解措施；臺灣的威脅情資來源，例如台灣電腦網路危機處理暨協調中心，是國家級進行情資蒐集、整理與分享的單位。

 

企業與組織也可採納第三方供應商提供的威脅情資。TeamT5 杜浦數位安全即為提供亞太地區威脅情資的領導品牌。

TeamT5 杜浦數位安全成立於台灣，善用地理和文化優勢，研究並發布威脅情資報告。威脅情資類別涵蓋戰略型、實戰型與戰術型內容，利於資安團隊預見潛在的威脅和事件，並為決策者提供行動指引，進一步做出準確的資安防禦決策並降低風險。內容則涵蓋漏洞分析、進階持續性攻擊、勒索軟體等常見的資安威脅。

>更了解 TeamT5 杜浦數位安全的威脅情資內容與解決方案: [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

掌握威脅情資來源，面對 ISO 27001 改版稽核更輕鬆 

>TeamT5 杜浦數位安全專精於亞太地區網路威脅研究，並提供資安事件應變服務，團隊具備超過 20 年的資安威脅調查、分析的經驗。本次深度分享在 Linux 環境中，常見的惡意手法。

Linux 軟體及指令多數都是開源的，豐富程度遠超 Windows，因此攻擊者常常使用內建 (built-in) 功能或是相關套件 (package)，來持續維持存取權限。

## 權限提升

Windows 主機存取最常用的方式是 RDP(3389)，Linux 則是 SSH(22)。早期因為 Bot/Scanner 會在 Internet 上掃描，使用 root 當帳號進行猜測成功後登入，後來 sshd_config 裡面預設禁止 root 帳號登入。 

/etc/ssh/sshd_config
 
PermitRootLogin prohibit-password/no

| 參數 | 說明 |
| - | - |
| yes | 允許 |
| no | 不允許|
| prohibit-password | 禁止以輸入密碼的方式登入 |
| forced-commands-only | 只允許用公鑰授權登入 |

Windows 存取 RDP 時，該 User 必需在 Administrators 或 Remote Desktop Users 的群組裡，而 Linux 一般 User 也可以進行登入，只要 /etc/passwd 帳號裡面有設定執行 shell。

### /etc/passwd, /etc/shadow

攻擊者有時會修改檔案權限(File Permission)，這裡引用 [@sysxplore](https://twitter.com/sysxplore) 所整理的 [Linux file permissions cheatsheet](https://twitter.com/sysxplore/status/1700958206552580223/photo/1)。

可得知分別為 type | user | group | other 四個部份，可以檢視下面二種權限會存在什麼問題？個別需要怎麼利用？

```bash
┌──(kali㉿kali)-[~]
└─$ ll /etc/passwd
-rw-r--rw- 1 root root 3626 Jan 10 05:46 /etc/passwd
```
_*因為 other 設 w 所以大家都可以對它做寫入，所以可以建立帳號。_

```bash
┌──(kali㉿kali)-[~]
└─$ ll /etc/passwd
-rw-rw-r-- 1 root root 3626 Jan 10 05:46 /etc/passwd
```
_*因為 group 設 w 所以 root 群可以對它做寫入，所以只需要將 /etc/group 的 root 群多加帳號(root\:x:0:kali)，使用 kali 可以建立帳號。_

 
 

正常情況下 /etc/passwd 所設的檔案權限：

```bash
┌──(kali㉿kali)-[~]
└─$ ll /etc/passwd
-rw-r--r-- 1 root root 3235 Oct 6 11:05 /etc/passwd
```

再談 /etc/passwd 的檔案內容，可以看到內容的格式為：

| 格式 |
| --- |
| 使用者名稱 |
| 加密的密碼 |
| 使用者 ID 號碼 (uid) |
| 使用者的群組 ID 號碼 (gid) |
| 使用者的完整名稱 (gecos) | 
| 使用者起始目錄 |
| 登入 shell |

可以看到 root 的 uid=0，所以只要將帳號的 uid 改為 0，此帳號就會變成 root 了，而帳號後的密碼欄位，大多都是 x 是因為後來的密碼，都被移到 /etc/shadow 裡面，所以就都設為 x [(相關說明)](https://en.wikipedia.org/wiki/Don%27t-care_term)。

```bash
root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
systemd-coredump:x:993:993:systemd Core Dumper:/:/usr/sbin/nologin
openldap:x:132:142:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false
qoo:$1$SY5WcHLA$QCf.I6R2F2FPFa/9Ln2Es/:0:0:root:/root:/usr/bin/zsh
```

如果想自己產一組密碼，可以使用 openssl 產生密碼，填入 x 後，就不用再去 /etc/shadow 取密碼了。

```
┌──(kali㉿kali)-[~]
└─$ openssl passwd -6 -salt 'SaltQQ' '1234'
$6$SaltQQ$Q2SKpm12cbmN40aDpgEBhDoupRHqeBF4wtmOuHowNzxbNEYavqHp5bUxj.z5MO19syGO3R881h01UMMh66sAU0

┌──(kali㉿kali)-[~]
└─$ openssl passwd -1 '1234'
$1$zG9mHyJ8$QHFuEgbeBw5O8Ecc/a./O0
```

知道 UID 改為 0 可以變 root 後，就可以來檢查那些是危險帳號。

```bash
awk -F : '($3==0)' /etc/passwd
```

關於密碼這裡也可以看到 /etc/shadow 的格式：

| 格式 |
| --- |
| 登入名稱 (login name) | 
| 加密密碼 (encrypted password) | 
| 上次密碼變更日期 (date of last password change) | 
| 密碼最短使用期限 (minimum password age) | 
| 密碼最長使用期限 (maximum password age) | 
| 密碼過期警告期限 (password warning period) | 
| 密碼暫停使用期間 (password inactivity period) | 
| 帳號過期時間 (account expiration date) | 
| 保留欄位 (reserved field) | 

如果加密密碼欄位是空的(不是!或*)，那這個帳號就不需輸入密碼。

```bash
root:*:19500:0:99999:7:::
kali:$y$j9T$dl4ti9p1KPx6HrZ59TPMJ/$drMOLlRW8BZmsDQ0riDlPnUDsfyIvRL4qfgODnuZVz4:19500:0:99999:7:::
nobody:*:19500:0:99999:7:::
nopass::19500:0:99999:7:::
```

了解可以將帳號設為空密碼後，可以使用下列指令找出來。

```bash
sudo awk -F : '($2=="")' /etc/shadow
```

### Set UID / sudo

在 @sysxplore 的圖中，可以看到 chmod 為 4 個 8 進位(平常使用 3個)，最前面數字是設 user / group / other ，與權限 x 一樣用到 bit 0(LSB)，如果 bit 0 無設定，會以大寫方式呈現；如果被設定，會以小寫方式。

```
┌──(kali㉿kali)-[~]
└─$ cp /usr/bin/sh .

┌──(kali㉿kali)-[~]
└─$ sudo chown root:root sh

┌──(kali㉿kali)-[~]
└─$ sudo chmod 7000 sh

┌──(kali㉿kali)-[~]
└─$ ll sh
---S--S--T 1 root root 125640 Jan 11 03:27 sh

┌──(kali㉿kali)-[~]
└─$ sudo chmod 7111 sh

┌──(kali㉿kali)-[~]
└─$ ll sh
---s--s--t 1 root root 125640 Jan 11 03:27 sh
```

在執行 sh -p 後，可以看到會有 euid,egid=0，這表示執行的當下，是以 root 權限在執行。

```
┌──(kali㉿kali)-[~]
└─$ ./sh -p
# id
uid=1000(kali) gid=1000(kali) euid=0(root) egid=0(root) groups=0(root),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),111(bluetooth),114(scanner),137(wireshark),140(kaboxer),1000(kali)
```

假設今天被設 suid/sgid 的程式有弱點，又是以 root 身份執行，就能逹到提權的目的，可以使用 find 指令來查看 suid/sgid，執行時的權限，取決於 user/group 設定是什麼。

```
find / -perm -u=s -type f 
find / -perm -04000 -type f -ls 2>/dev/null 
find / -perm /4000 -ls
find . -perm /2000 -ls
```

早期 Linux 還沒有 sudo 的功能，所以做很多事都是以 root 身份執行，但有了 sudo 後，還是會遇到 sudo rm -fr / 天真浪漫的行為。

 
 

從這邊可以知道 sudo 也是一個群組，如果被加到該群組的使用者，可以使用 sudo 切換權限。

```bash
┌──(kali㉿kali)-[~]
└─$ cat /etc/group | grep sudo
sudo:x:27:kali
```

而 sudo 的相關設定是在下列路徑
/etc/sudoers
/etc/sudoers.d

可以看到 sudo 的格式

| 格式 |
| ------------ |
| 使用者或群組 |
| 主機 |
| 授權身分 |
| 執行指令清單 |

可以看到 /etc/sudoers 本身設定了一些使用者，像是 kali 可以不用輸入密碼以 root 的身份執行 docker、openvpn 指令，而最後還會 includedir /etc/sudoers.d 目錄下的檔案，可以看到如果被加到 kali-trusted 群組可以執行任何指令，並且不用輸入密碼。

```
┌──(kali㉿kali)-[/etc/sudoers.d]
└─$ sudo cat /etc/sudoers
...
# User privilege specification
root ALL=(ALL:ALL) ALL
kali ALL=(ALL) NOPASSWD:/usr/bin/docker, /usr/sbin/openvpn
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "@include" directives:

@includedir /etc/sudoers.d

┌──(kali㉿kali)-[/etc/sudoers.d]
└─$ sudo cat kali-grant-root
# Allow members of group kali-trusted to execute any command without a
# password prompt
%kali-trusted ALL=(ALL:ALL) NOPASSWD: ALL
```

使用者空間 (user space) 大多數都是 Set UID/GID 或是 sudoers ，又或是服務 (Apache, MySQL, etc.) 弱點。如果都沒使用上述服務，就只能往核心空間 (kernel space) 去找相關權提漏洞利用了。

## 遠端存取

### ~/.ssh/authorized_keys

可以使用 ssh-keygen 來產生 key pair，產生出來的檔案會在 .ssh 的目錄下。

```
┌─[✗]─[parrot@parrot]─[~]
└──╼ $ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/parrot/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/parrot/.ssh/id_rsa
Your public key has been saved in /home/parrot/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:1boh4rkgN+zbx7EudESHWEeoIZmrG5y6F4rxTQH9Bm4 parrot@parrot
The key's randomart image is:
+---[RSA 3072]----+
| . o o.+o |
| . * o +... |
| o = + .. . |
| E + .. . |
| . + o..S o |
|. *....oo. o |
|.=.*=.oo o. |
|+ ++.+..+ |
|.o o.o+. |
+----[SHA256]-----+

┌─[✗]─[parrot@parrot]─[~/.ssh]
└──╼ $ls -alt
total 12
drwx------ 1 parrot parrot 54 1月 14 14:03 .
-rw------- 1 parrot parrot 2602 1月 14 14:03 id_rsa
-rw-r--r-- 1 parrot parrot 567 1月 14 14:03 id_rsa.pub
drwxr-xr-x 1 parrot parrot 666 1月 14 13:55 ..
-rw-r--r-- 1 parrot parrot 222 1月 14 13:55 known_hosts
```

如果想使用 ssh-copy-id 複製到 root 目錄的話，需要 /etc/ssh/sshd_config 的 PermitRootLogin 設成 yes； 補充說明，預設是 prohibit-password，所以無法使用密碼輸入，所以在密碼錯誤後會出現錯誤。

```
┌─[✗]─[parrot@parrot]─[~]
└──╼ $ssh root@172.23.119.176
root@172.23.119.176's password:
Permission denied, please try again.
root@172.23.119.176's password:
Permission denied, please try again.
root@172.23.119.176's password:
root@172.23.119.176: Permission denied (publickey,password).
```

無法使用 root 密碼登入的情況，也可以使用 sudo cat /tmp/id_rsa.pub >> /root/.ssh/authorized_keys 將 public key 加到 authorized_keys 裡面。

![1_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/1_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

最後可以使用 ssh -i 進行登入。
![2_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/2_linux-attack-method-analysis-on-common-malicious-attack-methods.png)


### inetd
inetd(InterNET service Daemon) 又稱 Internet 超級伺服器 (super-server daemon)，是早期4.3BSD的產物，現在多數的systemd已不使用，所以需要另外安裝，裝完之後會有一個/etc/inetd.conf的設定檔，可以多加一筆記錄，這裡的daytime服務使用Port 13。

![3_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/3_linux-attack-method-analysis-on-common-malicious-attack-methods.png)


當連到該主機的 Port 13 將可以取得一個 root 身份的 shell。
![4_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/4_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

### xinetd
xinetd 為 Extended Internet Service Daemon，是 inetd 的擴展版本，一樣在 systemd 的環境下，已經不存在了，需要另行安裝。
這邊也可以發現原本 inetd 的設定是一個 /etc/inetd.conf 檔案，而 xinetd 的組態檔可以獨立組成每一個檔案。

![5_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/5_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

新增一個 xinetd 服務在 /etc/xinetd.d 目錄下。
![6_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/6_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

直接連線主機的 5900 可以取得一個 root 的 shell。
![7_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/7_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

### pam.d (auth pam_access.so)

/etc/pam.d/sshd 裡面會使用到 pam_access.so 的模組，而這個模組的組態會去讀取 /etc/security/access.conf 的設定。
![8_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/8_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

幾乎所有的服務都會載入 common-auth，在他之前多加一行 auth [success=done default=ignore] pam_access.so 之後再到 /etc/security/access.conf 多加一組帳號。
![9_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/9_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

使用免密碼登入，讓要將 /etc/ssh/sshd_config 裡面的 PermitEmptyPasswords 必需設為 yes (允許空密碼)。

之後登入 abc 帳號時，就可以不用輸入密碼。
![10_linux-attack-method-analysis-on-common-malicious-attack-methods.png](https://uploads.teamt5.org/upload/original/10_linux-attack-method-analysis-on-common-malicious-attack-methods.png)

## 結語
本文分享 Linux 攻擊場域的常見惡意手法「權限提升」、「遠端存取」的實務技巧，協助資安防禦方藉此洞悉攻擊者手法，增進防禦能量。
更多惡意手法分析、資安技術分析，歡迎訂閱我們的電子報。

 
 

>TeamT5 杜浦數位安全提供[資安事件應變服務](https://teamt5.org/tw/service/ir/?utm_source=blogs&utm_medium=website)，自主研發之[威脅鑑識分析平台 ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blogs&utm_medium=website) 可為客戶精準鎖定資安事件受害範圍。我們的團隊具備超過 20 年的資安威脅調查、分析的經驗， 並為[國際最大資安事件應變組織 FIRST](https://www.first.org/?utm_source=blogs&utm_medium=website) 的成員。

>現已協助政府、金融業、科技業、製造業等廣大客戶群，迅速且有效應對資安威脅或駭客攻擊，以最小化的損失來保護關鍵資訊資產；並提供資安強化建議與事件相關威脅情資，以「知己知彼，百戰百勝」的核心概念，有效協助企業提升面對資安事件的應處能力，減少資訊系統與網路服務中斷時間，維持各項服務連續性，確保業務正常運作。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
>[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

Linux 攻擊場域：常見惡意手法

Technical Analysis

In an era where digital transformation is driving business operations, the risk of cyber threats has never been higher. Cybercriminals are becoming more sophisticated, targeting organizations of all sizes. As a cybersecurity professional, you should recognize the importance of adopting a proactive approach to safeguarding sensitive information.

This article will delve into the best tools and practices to fortify your organization against cyber threats effectively.

 
## I. Threat Intelligence Platform: A Strategic Foundation

A robust threat intelligence platform forms the bedrock of any effective cybersecurity strategy. This tool enables your organization to gather, analyze, and act upon relevant threat data in real-time. By integrating threat intelligence into your security infrastructure, you empower your team to identify potential risks before they escalate.

### Understanding Threat Intelligence:

- Threat feeds and sources: Leveraging a diverse range of threat feeds enhances the comprehensiveness of your threat intelligence.

- Indicators of compromise (IoCs): Identifying IoCs allows for the early detection of potential security incidents.

### Operationalizing Threat Intelligence:

- Integration with security tools: Seamless integration with endpoint detection and response (EDR) solutions enhances the ability to respond rapidly to emerging threats.

- Automated response mechanisms: Implementing automated responses based on threat intelligence minimizes manual intervention and accelerates incident response.

 
## II. Endpoint Detection and Response (EDR): Safeguarding the Perimeter

Endpoint Detection and Response (EDR) solutions play a pivotal role in detecting and responding to threats at the endpoint level.

### Key Features of EDR:

- Real-time monitoring: EDR tools continuously monitor endpoint activities, providing real-time visibility into potential threats.

- Behavioral analysis: By analyzing endpoint behavior, these solutions can identify anomalies indicative of malicious activities.

### Effective Implementation Strategies:

- Customized policies: Tailoring EDR policies to your organization's specific needs ensures a more targeted and efficient security approach.

- Regular updates and training: Keeping endpoint security measures up-to-date and providing ongoing training to employees are essential components of a comprehensive cybersecurity strategy.

 
## III. Best Practices for Cybersecurity: A Holistic Approach

Beyond specific tools, adopting best practices is crucial for creating a holistic cybersecurity framework. 

### Employee Awareness and Training:

- Phishing awareness programs: Educating employees about phishing threats and implementing simulated phishing exercises strengthens their ability to recognize and report potential attacks.

- Regular training sessions: Conducting periodic cybersecurity training sessions ensures that employees stay informed about the latest threats and security protocols.

### Incident Response Planning:

- Clearly defined response roles: Establishing well-defined roles and responsibilities within the incident response team streamlines the reaction to security incidents.

- Tabletop exercises: Regularly conducting simulated exercises prepares your team for real-world scenarios, enhancing their response capabilities.

### Continuous Monitoring and Evaluation:

- Regular security assessments: Periodic evaluations of your cybersecurity measures help identify potential vulnerabilities and areas for improvement.

- Incident post-mortems: Analyzing past incidents allows your organization to learn from experiences and refine security protocols.

 
## Conclusion: Elevating Your Cybersecurity Posture

In the ever-evolving landscape of cybersecurity, a proactive and multi-faceted approach is essential. The importance of a robust threat intelligence platform, effective endpoint detection and response, and adherence to best practices, position your company as a trusted partner in the business world will help you build trust from clients.

Remember, in the dynamic realm of cybersecurity, the key lies not only in the tools you employ but also in the practices you instill across your organization. Through clear and professional communication, you can effectively convey the gravity of the cybersecurity landscape and the pivotal role your organization plays in securing the digital future.


>TeamT5 provides solutions you need to build holistic cyberdefense!
>
>With our threat intelligence platform, [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website), you may foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks.
>
>With our threat hunting tool, [ThreatSonar](https://teamt5.org/en/products/threatsonar/?utm_source=blog&utm_medium=website), you may hunt down cyber threats with capabilities in compromise assessment, auto-investigation, and orchestration. Equipped with over 100 built-in IoCs and thousands of backdoor indicators, ThreatSonar helps discover threats and execute incident responses remotely in a post-compromised environment.

 
 
*banner source: pexles

Cybersecurity Best Practices: Beyond Tools to a Holistic Approach

在數位轉型推動業務營運的時代，網路威脅的風險急遽升高。 網路攻擊手法變得越來越複雜，更針對各種規模的企業進行攻擊。

本文將介紹防禦網路威脅的最佳工具和實踐方法。
 
## 一、威脅情資平台：資安策略的重要基礎

強大的威脅情資平台是任何有效網路安全策略的基石。該工具使企業能夠即時收集、分析相關威脅資料並採取行動 透過將威脅情資整合到資訊安全基礎設施中，企業的資安團隊能更有效地在潛藏的資安風險影響企業前，識別出威脅。


###了解威脅情資：
- 威脅來源與來源：利用各種威脅來源可以增強威脅情資的全面性。

- 入侵指標 (IoC)：識別 IoC 可以及早發現潛在的安全事件。


###導入威脅情資：
- 與資訊安全解決方案整合：導入威脅情資，並與端點偵測和回應 (EDR) 解決方案整合，有助企業提升快速回應新興資安威脅的能力。

- 自動化反應機制：基於威脅情資實施自動化應便，盡量減少人工干預，加快事件回應速度。

 
## 二、端點偵測與回應(EDR) 解決方案：保護端點環境

端點偵測和回應 (EDR) 解決方案在偵測和回應端點層級的威脅方面，發揮關鍵作用。

###EDR 的主要特點：
- 即時監控：EDR 工具持續監控端點活動，提供潛在威脅的即時可見度。

- 行為分析：透過分析端點行為，這些解決方案可以識別出顯示惡意活動的異常情況。


### 有效的實施策略：
- 客製化策略：根據企業的特定需求客製化 EDR 策略，確保採取更有針對性、更有效率的安全方法。

- 定期更新和培訓：保持端點採取最新安全措施，並為員工提供持續培訓，是全面網路安全策略的重要作法。

 
## 三、網路安全最佳實踐：整體方法

除了特定工具之外，採用最佳實踐對於創建整體網路安全框架十分重要。

#### 員工意識和培訓：
- 網路釣魚意識計畫：對員工進行網路釣魚威脅教育並實施模擬網路釣魚練習，增強他們識別和報告潛在攻擊的能力。
- 定期培訓課程：定期舉辦網路安全培訓課程，可確保員工隨時了解最新的威脅和安全協議。


#### 事件應變計劃：
- 明確定義的應變角色：在事件應變團隊內建立明確定義的角色和職責可以簡化對安全事件的反應。
- 模擬演習：定期進行模擬演習可以讓企業團隊為現實場景做好準備，增強他們的回應能力。


#### 持續監測和評估：
- 定期安全評估：定期評估網路安全措施有助於識別潛在的漏洞和需要改進的領域。
- 事件事後分析：分析過去的事件可以讓企業從經驗中學習，並完善安全計畫。

 
##結論：提升企業資安防禦能量

在不斷演變的網路安全威脅態勢中，採用主動防禦、多元化的方法十分重要。 強大的威脅情資平台、有效的端點偵測和回應以及遵守最佳實踐的重要性，將協助企業打造資安韌性，成為商業界值得信賴的合作夥伴。

資安防禦關鍵不僅在於企業使用的工具，整個企業中執行的實踐做法也相當重要。 

>TeamT5 提供您建立整體網路防禦所需的解決方案！
>
>透過我們的威脅情資平台 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)，您可以預見潛在的威脅和事件，並為決策者提供行動項目，以做出準確的決策並降低風險。
>
>透過我們的威脅搜尋工具 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website)，您可以精準捕網路威脅。 ThreatSonar 內建數千種 APT 後門特徵，將最新情資帶到每個端點，進行鑑識，有助於在受感染後的環境中遠端發現威脅，並採取應對措施。

網路安全最佳實踐：從工具導入到全面防禦策略

TeamT5 is a leading brand in delivering Asia Pacific intelligence. In this article, we summarize the threat landscape of advanced persistent threats (APT) in the Asia-Pacific region in 2023, not only provide annual observations, but also point out the cyber threats worth paying attention to in 2024.

>**This article is an excerpt version which summarizes key statistics. To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2023” report. **
>
>This article is adapted from "2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia". To discover similar cyber threat intelligence which is focused in Asia-Pacific region, please sign up for the trial of our threat intelligence platform ThreatVision. 
>Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website) that you would like to apply for trial.

## Preface
TeamT5’s cyber threat intelligence research based on well-built data collection and analysis flow. We collect data from multiple sources - malware databases, sandboxes, crawlers, and our threat forensic analysis platform ThreatSonar etc. With careful and rigorous analysis, we come up with intelligence reports for clients and the public to notify potential threats.

**For 2023, based on TeamT5 data collection and analysis, we found:**
- 411 attack operations in 39 countries
- 60 known adversary groups tracked
- 210 malware / hacking tools used

 
![01_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/01_apt-threat-landscape-in-apac-2023.jpg)
 

## Closer Look at Exploits
In 2023, we have observed at least 37 CVE exploits that were abused in the wild by threat actors. We see a tendency that more and more exploits targeting edge devices appear, which we marked with color yellow in the right table. These edge devices have no security products to monitor them so threat actors could effectively intrude their target network environments. 

There are still lots of attacks achieved spear phishing emails but the corresponding tricks are old fashioned, such as:
- Template Injection
- Microsoft LNK 
- CHM
- Macro documents
- Phishing
- CVE-2018-0798, CVE-2022-30190, CVE-2023-38831

 
![02_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/02_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Malwares
We listed the malware distribution in all attacks. Below is the ranking of **Top 10 Malwares in 2023 H1** and **Top 15 Malwares in 2023 H2**.

 
![03_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/03_apt-threat-landscape-in-apac-2023.jpg)
 

We compare these two ranks with 4 aspects - Shared tools, Webshell, Cross platform RAT, Shared Quartermaster of Chinese APT. Here is our analysis.

**1. About shared tools **

There are more and more threat actors adopting public or open source tools in their operations. This could effectively reduce their effort to develop their own weapons and also increase the barrier for researchers like us to achieve an effective attribution.

 
![04_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/04_apt-threat-landscape-in-apac-2023.jpg)
 

**2. About Webshell**

Web server exploitations have become more and more common nowadays and the importance of webshell keeps increasing. Godzilla, a full featured webshell made by Chinese threat actors, has become the favorite of Chinese APT. It is usually deployed jointly with a small webshell like China Chopper to effectively bypass detections.

 
![05_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/05_apt-threat-landscape-in-apac-2023.jpg)
 

**3. About Cross Platform RAT**

There are more and more cross platform or multi platform RAT. The reason behind is nowadays threat actors don’t only focus on Windows platform but will intrude from every possible platform like Linux, MacOS or even Android or iOS.

 
![06_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/06_apt-threat-landscape-in-apac-2023.jpg)
 

**4. Shared Quartermaster of Chinese APT**

We have observed an interesting code or feature sharing between different malware used by Chinese APT. This kind of finding makes us highly suspect there is an entity or even private company that is responsible for producing all these remote administration tools and distributing them secretly to various Chinese APT groups.

 
![07_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/07_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Targeted Countries / Regions by APT Groups

From countries / regions aspects, our data shows Taiwan, South Korea, and Japan are the most targeted countries by APT groups. Following them are countries in South or Southeast Asia, such as Vietnam, Philippine, Thailand, or Malaysia, etc. 

 
![08_09_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/08_09_apt-threat-landscape-in-apac-2023.jpg)
 

Based on this statistic, we will discuss 3 different victim areas and corresponding active threat actors, they are Taiwan, Northeast Asia, and South/Southeast Asia.

###No.1 Targeted Country / Region: Taiwan
Taiwan is the most targeted country in Asia Pacific. This chart shows the distribution of targeted industry sectors. Compared with our data in the past 2 years (2021-2022), we don’t see dramastic changes. Government, IT, education, or critical infrastructure are still on the top list. 

People might wonder why APT actors are so interested in the IT sector. We believe the reason is that there are more and more supply chain attacks and these IT companies possess good channels or privileges to access big companies or government entities. It makes the IT sector a perfect hopping point. 

And one interesting phenomena we have observed is the surging attack against the healthcare industry. We suspect the reason behind the attacks are the Taiwanese government’s effort to join WHA, or China’s ambition to collect personal identification information.

 
![10_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/10_apt-threat-landscape-in-apac-2023.jpg)
 

In the threat actors' part, there are at least 21 known groups aiming at Taiwan in 2023. Among them are Huapi, Amoeba, and Polaris - they are old faces that are on the top list hitting Taiwan. In the meantime, there is a new face, SLIME13 (also known as FlaxTyphoon by Microsoft). 

SLIME13’s operations became so wild in 2023 that we have observed more than 100 victim entities in Taiwan. This APT group also aggressively expands their attacks to other countries such as Hong Kong, Japan or South Korea, etc.

 
![11_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/11_apt-threat-landscape-in-apac-2023.jpg)
 

###No.2 Targeted Country / Region: Northeast Asia

In the Northeast Asia region, the geopolitical situation has changed dramatically in the past 2 years because Japan and South Korea are united together with the U.S. to defend against their enemies in the neighborhood. 

For this reason, the topmost targeted sectors include government, think tank, and education. These sectors often hold political documents or do sensitive research for their governments. Another interesting phenomena would be China’s attacks against South Korea which were stealthy and low profile in the past. But now China’s attacks turned to become high profile and public, threat actors such as 曉騎營 or 騰蛇 are some good example. Cryptocurrency sectors in this area are targeted and infiltrated by North Korean actors.

 
![12_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/12_apt-threat-landscape-in-apac-2023.jpg)
 


For the threat actors part, China and North Korea actors dominate this area. North Korean actors are busy collecting geopolitical intelligence and another mission: earning money for their country. In contrast, Chinese APT operations become more stealthy and harder to detect; there are several big campaigns of Barracuda, Fortigate, Citrix or ArrayVPN vulnerabilities. Many of the events are still under investigation or even uncovered yet. 

 
![13_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/13_apt-threat-landscape-in-apac-2023.jpg)
 

###No.3 Targeted Country / Region: South Asia & Southeast Asia
The third target country / region is the South Asia and Southeast Asia region. Our observations show attacks in this area are driven by issues of the South China Sea, border issues or belt & road and shift of international organization’s factory. That was reflected in the most targeted sectors - military and critical infrastructure are all closely bundled with these issues.

In the southeast Asia region, threat actors from China such as Polaris, Amoeba, Gudiao and Vietnam originated groups such as SLIME43 or OceanLotus are very active in these regions. The interesting part regarding Vietnamese APT groups is that they are not only a big concern of neighboring countries but also the domestic people in Vietnam. Our engagement with Vietnamese customers shows their great fear of being intruded by OceanLotus.

 
![14_apt-threat-landscape-in-apac-2023.jpg)](https://uploads.teamt5.org/upload/original/14_apt-threat-landscape-in-apac-2023.jpg)
 

In the South Asia region, China is also busy attacking and monitoring their neighbors. People might consider Pakistan to be a good friend of China so they could be spared. In contrast, our data shows Pakistan to be highly targeted and infiltrated by China. Another interesting thing is that India and Pakistan both have their own cyber actors and they are fighting with each other a lot.

 
![15_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/15_apt-threat-landscape-in-apac-2023.jpg)
 

##Conslusion
2023 is a busy year, both for threat actors and defenders. Also, more tensions in geopolitics will keep bringing more cyber attacks. 

New technology might solve human’s problems, but not for attack and defense scenarios. New technology becomes a new opportunity for attackers as well (e.g. cloud services, AI). The reason is that targeted attacks are human-driven; defenders should address human problems by adopting threat intelligence.

No one can be spared in the war in the cyber world, so be prepared!

 
 

>**This article is an excerpt version which summarizes key statistics. To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2023” report. **
>
>This article is adapted from "2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia". To discover similar cyber threat intelligence which is focused in Asia-Pacific region, please sign up for the trial of our threat intelligence platform ThreatVision. 
>Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website) that you would like to apply for trial.

APT Threat Landscape in APAC 2023:  New Strategy, New Normal, New Techniques, and New Territory

TeamT5 杜浦數位安全為專精亞太地區威脅情資的領導品牌。於此篇文章中，我們總結 2023 年亞太地區進階持續性威脅 (APT) 的威脅態勢，不僅提出年度觀察，更指出未來一年值得留意的資安威脅。

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。欲取得完整《2023年威脅態勢回顧》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。

>本篇文章改寫自《2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia》，探索與此相關的報告與更多亞太地區的威脅情資，立刻申請威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website) 頁面說明您希望申請試用。


## Preface
TeamT5’s cyber threat intelligence research based on well-built data collection and analysis flow. We collect data from multiple sources - malware databases, sandboxes, crawlers, and our threat forensic analysis platform ThreatSonar etc. With careful and rigorous analysis, we come up with intelligence reports for clients and the public to notify potential threats.

**For 2023, based on TeamT5 data collection and analysis, we found:**
- 411 attack operations in 39 countries
- 60 known adversary groups tracked
- 210 malware / hacking tools used

 
![01_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/01_apt-threat-landscape-in-apac-2023.jpg)
 

## Closer Look at Exploits
In 2023, we have observed at least 37 CVE exploits that were abused in the wild by threat actors. We see a tendency that more and more exploits targeting edge devices appear, which we marked with color yellow in the right table. These edge devices have no security products to monitor them so threat actors could effectively intrude their target network environments. 

There are still lots of attacks achieved spear phishing emails but the corresponding tricks are old fashioned, such as:
- Template Injection
- Microsoft LNK 
- CHM
- Macro documents
- Phishing
- CVE-2018-0798, CVE-2022-30190, CVE-2023-38831

 
![02_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/02_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Malwares
We listed the malware distribution in all attacks. Below is the ranking of **Top 10 Malwares in 2023 H1** and **Top 15 Malwares in 2023 H2**.

 
![03_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/03_apt-threat-landscape-in-apac-2023.jpg)
 

We compare these two ranks with 4 aspects - Shared tools, Webshell, Cross platform RAT, Shared Quartermaster of Chinese APT. Here is our analysis.

**1. About shared tools **

There are more and more threat actors adopting public or open source tools in their operations. This could effectively reduce their effort to develop their own weapons and also increase the barrier for researchers like us to achieve an effective attribution.

 
![04_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/04_apt-threat-landscape-in-apac-2023.jpg)
 

**2. About Webshell**

Web server exploitations have become more and more common nowadays and the importance of webshell keeps increasing. Godzilla, a full featured webshell made by Chinese threat actors, has become the favorite of Chinese APT. It is usually deployed jointly with a small webshell like China Chopper to effectively bypass detections.

 
![05_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/05_apt-threat-landscape-in-apac-2023.jpg)
 

**3. About Cross Platform RAT**

There are more and more cross platform or multi platform RAT. The reason behind is nowadays threat actors don’t only focus on Windows platform but will intrude from every possible platform like Linux, MacOS or even Android or iOS.

 
![06_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/06_apt-threat-landscape-in-apac-2023.jpg)
 

**4. Shared Quartermaster of Chinese APT**

We have observed an interesting code or feature sharing between different malware used by Chinese APT. This kind of finding makes us highly suspect there is an entity or even private company that is responsible for producing all these remote administration tools and distributing them secretly to various Chinese APT groups.

 
![07_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/07_apt-threat-landscape-in-apac-2023.jpg)
 

##Closer Look at Targeted Countries / Regions by APT Groups

From countries / regions aspects, our data shows Taiwan, South Korea, and Japan are the most targeted countries by APT groups. Following them are countries in South or Southeast Asia, such as Vietnam, Philippine, Thailand, or Malaysia, etc. 

 
![08_09_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/08_09_apt-threat-landscape-in-apac-2023.jpg)
 

Based on this statistic, we will discuss 3 different victim areas and corresponding active threat actors, they are Taiwan, Northeast Asia, and South/Southeast Asia.

###No.1 Targeted Country / Region: Taiwan
Taiwan is the most targeted country in Asia Pacific. This chart shows the distribution of targeted industry sectors. Compared with our data in the past 2 years (2021-2022), we don’t see dramastic changes. Government, IT, education, or critical infrastructure are still on the top list. 

People might wonder why APT actors are so interested in the IT sector. We believe the reason is that there are more and more supply chain attacks and these IT companies possess good channels or privileges to access big companies or government entities. It makes the IT sector a perfect hopping point. 

And one interesting phenomena we have observed is the surging attack against the healthcare industry. We suspect the reason behind the attacks are the Taiwanese government’s effort to join WHA, or China’s ambition to collect personal identification information.

 
![10_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/10_apt-threat-landscape-in-apac-2023.jpg)
 

In the threat actors' part, there are at least 21 known groups aiming at Taiwan in 2023. Among them are Huapi, Amoeba, and Polaris - they are old faces that are on the top list hitting Taiwan. In the meantime, there is a new face, SLIME13 (also known as FlaxTyphoon by Microsoft). 

SLIME13’s operations became so wild in 2023 that we have observed more than 100 victim entities in Taiwan. This APT group also aggressively expands their attacks to other countries such as Hong Kong, Japan or South Korea, etc.

 
![11_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/11_apt-threat-landscape-in-apac-2023.jpg)
 

###No.2 Targeted Country / Region: Northeast Asia

In the Northeast Asia region, the geopolitical situation has changed dramatically in the past 2 years because Japan and South Korea are united together with the U.S. to defend against their enemies in the neighborhood. 

For this reason, the topmost targeted sectors include government, think tank, and education. These sectors often hold political documents or do sensitive research for their governments. Another interesting phenomena would be China’s attacks against South Korea which were stealthy and low profile in the past. But now China’s attacks turned to become high profile and public, threat actors such as 曉騎營 or 騰蛇 are some good example. Cryptocurrency sectors in this area are targeted and infiltrated by North Korean actors.

 
![12_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/12_apt-threat-landscape-in-apac-2023.jpg)
 


For the threat actors part, China and North Korea actors dominate this area. North Korean actors are busy collecting geopolitical intelligence and another mission: earning money for their country. In contrast, Chinese APT operations become more stealthy and harder to detect; there are several big campaigns of Barracuda, Fortigate, Citrix or ArrayVPN vulnerabilities. Many of the events are still under investigation or even uncovered yet. 

 
![13_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/13_apt-threat-landscape-in-apac-2023.jpg)
 

###No.3 Targeted Country / Region: South Asia & Southeast Asia
The third target country / region is the South Asia and Southeast Asia region. Our observations show attacks in this area are driven by issues of the South China Sea, border issues or belt & road and shift of international organization’s factory. That was reflected in the most targeted sectors - military and critical infrastructure are all closely bundled with these issues.

In the southeast Asia region, threat actors from China such as Polaris, Amoeba, Gudiao and Vietnam originated groups such as SLIME43 or OceanLotus are very active in these regions. The interesting part regarding Vietnamese APT groups is that they are not only a big concern of neighboring countries but also the domestic people in Vietnam. Our engagement with Vietnamese customers shows their great fear of being intruded by OceanLotus.

 
![14_apt-threat-landscape-in-apac-2023.jpg)](https://uploads.teamt5.org/upload/original/14_apt-threat-landscape-in-apac-2023.jpg)
 

In the South Asia region, China is also busy attacking and monitoring their neighbors. People might consider Pakistan to be a good friend of China so they could be spared. In contrast, our data shows Pakistan to be highly targeted and infiltrated by China. Another interesting thing is that India and Pakistan both have their own cyber actors and they are fighting with each other a lot.

 
![15_apt-threat-landscape-in-apac-2023.jpg](https://uploads.teamt5.org/upload/original/15_apt-threat-landscape-in-apac-2023.jpg)
 

##Conslusion
2023 is a busy year, both for threat actors and defenders. Also, more tensions in geopolitics will keep bringing more cyber attacks. 

New technology might solve human’s problems, but not for attack and defense scenarios. New technology becomes a new opportunity for attackers as well (e.g. cloud services, AI). The reason is that targeted attacks are human-driven; defenders should address human problems by adopting threat intelligence.

No one can be spared in the war in the cyber world, so be prepared!


 
 


 

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。欲取得完整《2023年威脅態勢回顧》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。

>本篇文章改寫自《2023 H2 Campaign Tracking Report: APT Threat Landscape in Asia》，探索與此相關的報告與更多亞太地區的威脅情資，立刻申請威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website) 頁面說明您希望申請試用。

2023年威脅態勢回顧: 網路攻擊的新策略、新常態、新技術和新領域【英文威脅情資報告】

When it comes to endpoint security, enterprises often come across two key names: EDR (Endpoint Detection and Response) and MDR (Managed Detection and Response). Both of them play an important role in protecting enterprises from cybersecurity threats. However, there are still key differences between the two. It is recommended that enterprises carefully evaluate their own needs and choose the option that best suits their own cybersecurity protection needs.

## Endpoint Detection and Response (EDR) solution

- **Definition**: EDR refers to endpoint security solutions, which mainly assist enterprises to detect, identify and respond to possible threats, especially threats that endpoint devices (such as desktop computers and laptops) may encounter - ransomware, advanced persistent attacks (APT) etc.

- **Function**: EDR solutions usually provide real-time monitoring, log collection, threat detection and analysis functions; using information-rich pictures to help enterprises quickly track abnormal activities on endpoints and respond quickly to potential threats.

- **Purpose**: Mainly used to detect and combat threats on endpoints. It usually requires internal management and operation by the company's internal team to achieve the goal of cybersecurity protection.

## Managed Detection and Response (MDR) service

- **Definition**: MDR is a managed service that enterprises outsource and entrust cybersecurity vendors to assist enterprises in identifying, analyzing and responding to threats.

- **Functionality**: MDR services typically include 24/7 monitoring, incident analysis, threat hunting, and threat response. These services help organizations quickly respond to threats without having to own or operate endpoint security-related solutions themselves.

- **Purpose**: By using this service, enterprises can benefit from the knowledge and technology of professional security vendors and reduce the workload of maintaining an internal security team.

## Conclusion
The main difference between the two is – EDR is a technology solution, while MDR is an outsourced hosting service. EDR usually requires enterprises to manage and apply solutions by themselves. Although it has more room for autonomy, it also requires a large investment of money and time; MDR leaves the enterprise's threat detection and response steps to external professionals.

Enterprises can choose suitable solutions based on their needs and resource distribution.

> TeamT5 provides EDR solution "ThreatSonar Anti-ransomware" and MDR services. Our team members have more than 20 years of experience in cybersecurity threat investigation and analysis, and have assisted customers in the government, financial industry, technology industry, manufacturing industry, etc. to achieve cybersecurity defense goals.

>Contact us to learn how your enterprises can optimize your security defense.
 
>[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Comparison of Key Differences between EDR and MDR

當談到端點安全時，企業經常會遇到兩個關鍵名字：**EDR（Endpoint Detection and Response）**和 **MDR（Managed Detection and Response）**。這兩者在保護企業免受資安威脅時，都扮演了重要的角色，然而兩者仍有關鍵差異，建議企業審慎評估自身的需求，選擇最適合自身資安防護需求的選項。

 

## EDR（Endpoint Detection and Response）解決方案

- **定義**：EDR 指的是端點安全解決方案，主要協助企業檢測、識別和回應可能的威脅，特別是端點裝置（如：桌電、筆電）可能遭遇的威脅——勒索軟體、進階持續性攻擊（APT）等。

- **功能**：EDR 解決方案通常提供即時監控、log 收集、威脅檢測和分析功能；以具備豐富資訊的畫面，協助企業快速追蹤端點上的異常活動，並對潛在威脅做出快速回應。

- **用途**：主要用於檢測和對抗端點上的威脅，通常需要企業內部團隊自行管理和操作，達到資安防護的目標。

 

## MDR（Managed Detection and Response）服務

- **定義**：MDR 是一種代管服務，企業外包、委託資安廠商，協助企業識別、分析和應對威脅。

- **功能**：MDR 服務通常包括 24/7 監控、事件分析、威脅狩獵和威脅應變。這些服務可以幫助組織快速應對威脅，而無需自己擁有或操作端點安全相關的解決方案。

- **用途**：企業使用此服務，可受益於專業資安廠商的知識和技術，更減輕維持內部資安團隊的工作負擔。

 

## 結論
兩者主要差異為—— EDR 是一種技術解決方案，而 MDR 是一種外包代管服務。EDR 通常需要企業自行管理、運用解決方案，雖具備更多自主空間，但也需要投入大量資金與時間；MDR 則將企業進行威脅偵測和應變的步驟，交給外部專業人員。

企業可以根據其需求和資源分布，選擇適合的解決方案。

TeamT5 杜浦數位安全同時提供 EDR 解決方案「[ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」，及 [MDR 服務](https://teamt5.org/tw/service/mdr/?utm_source=blogs&utm_medium=website)。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶，達成資安防禦目標。

 
 

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 
 
*首圖來源: Unsplash

EDR、MDR 關鍵差異比較

In today's threat-filled digital age, enterprises need effective threat intelligence to protect their data and assets. The threat intelligence platform provides critical threat intelligence to help enterprises identify, analyze and respond to threats. However, when selecting and purchasing a threat intelligence platform, enterprises need to carefully consider the following key factors.

### 1. Diversity of threat resources
An excellent threat intelligence platform should provide in-depth and specific threat intelligence, including malicious program samples, remote attack characteristics, malicious threat indicators (indicator of compromise), etc.

### 2. Immediacy and accuracy
Threat intelligence should be immediate and highly accurate to ensure organizations can quickly identify and respond to threats. Suppliers providing timely, updated and reliable intelligence are key factors.

### 3. Customization capabilities
A good threat intelligence platform should have customizable features to meet the specific needs of the enterprise. This includes the ability to set alerts, select the types of threats to focus on, and integrate into existing security infrastructure.

### 4. Integration
The threat intelligence platform should be able to be seamlessly integrated into the enterprise's existing security ecosystem, including SIEM (Security Information and Event Management) systems, EDR (Endpoint Detection and Response) solutions, etc. This helps improve overall security.

### 5. Reporting and Analysis
Platforms should provide detailed reporting and analysis tools to help organizations understand the nature and impact of threat intelligence. This can help businesses adapt their security policies and improve their response capabilities.

### 6. Security and Compliance
Platforms should have appropriate security measures, including data encryption, access control and compliance capabilities, to ensure sensitive threat intelligence is protected while complying with regulatory requirements.

 
 

## Conclusion

Selecting and sourcing a threat intelligence platform is an important part of an enterprise's security strategy. Enterprises should carefully consider the above factors to ensure that the platform they choose provides high-quality, diverse threat intelligence and helps improve overall security. Threat intelligence is key to enterprise cybersecurity, so it’s a thoughtful decision worth investing time and resources into.

The threat intelligence platform, ThreatVision, provides the most comprehensive and in-depth database of adversaries in the Asia-Pacific region. Its threat intelligence reports are presented in narrative form and paragraphs, with rich and complete details, which help you quickly understand threat events and absorb more effective threat event handling tips. The readability also improves your cybersecurity team's ability to report upwards and effectiveness when communicating across teams.

>Know the enemy and know yourself; in a hundred battles you will never be in peril. Threat intelligence gives enterprises this exact ability to defend cyber threats.
 
>Contact us to learn how your enterprises can optimize your security defense.
>[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Threat Intelligence Platform (TIP) : Key Considerations for Procurement

在當今充滿威脅的數位時代，企業需要有效的威脅情資來保護其數據和資產。威脅情資平台提供了關鍵的威脅情資，幫助企業識別、分析和應對威脅。然而，在挑選和採購威脅情資平台時，企業需要謹慎考慮以下關鍵因素。

### 1. 威脅資源多樣性
一個優秀的威脅情資平台應該提供深度、具體的威脅情資，包括惡意程式樣本、遠端攻擊特徵、惡意威脅指標（indicator of compromise, IOC）等

### 2. 即時性和準確度
威脅情資應該是即時的且高度準確，以確保企業能夠迅速識別和應對威脅。供應商提供及時更新和可靠的情資是關鍵因素。

### 3. 自定義設定
一個好的威脅情資平台應該具有自定義功能，以滿足企業的特定需求。這包括能夠設定警報、選擇關注的威脅類型，以及整合到現有安全基礎設施中。

### 4. 整合性
威脅情資平台應該能夠無縫整合到企業的現有安全生態系統中，包括SIEM（Security Information and Event Management）系統、EDR（Endpoint Detection and Response）解決方案等。這有助於提高整體安全性。

### 5. 報告和分析
平台應提供詳細的報告和分析工具，以幫助企業了解威脅情資的性質和影響。這可以幫助企業調整其安全策略並改進應對能力。

### 6. 安全性和合規性
平台應該具有適當的安全措施，包括數據加密、訪問控制和合規性功能，以確保敏感的威脅情資受到保護，同時符合法規要求。

## 結論

挑選和採購威脅情資平台是企業安全戰略中的重要一環。企業應該謹慎考慮上述因素，以確保所選擇的平台能夠提供高質量、多樣化的威脅情資，並有助於提高整體安全性。威脅情資是企業安全的關鍵，因此這是一個需要深思熟慮的決策，值得投資時間和資源。

ThreatVision 威脅情資平台提供了最完整且深入的亞太區域惡意族群資料庫。威脅情資報告以敘事形式、段落式呈現，細節豐富完整，有助您快速了解威脅事件，吸收更多有效的威脅事件處理經驗，並且易讀性也可提高您的資安團隊在向上報告和跨團隊溝通時的效率。

 

>知己知彼，百戰不殆。在資安的道路上，TeamT5 是您最佳的夥伴。
>
>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
>
>[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

*首圖來源: Pexels

威脅情資平台(TIP) 評估與採購重點

## What is Pwn2own

Pwn2Own is a renowned hacking competition that focuses on discovering and exploiting vulnerabilities in various software and operating systems. The event provides a platform for cybersecurity researchers and ethical hackers to showcase their skills by attempting to compromise the security of popular software and devices. Organized by the Zero Day Initiative (ZDI), a program from Trend Micro, Pwn2Own has gained prominence for its role in identifying and addressing critical security flaws.

During the competition, participants target a range of software applications, web browsers, operating systems, and other digital platforms. Successful exploitation of a vulnerability typically involves the execution of arbitrary code or the bypassing of security mechanisms. Contestants who successfully compromise a system are awarded cash prizes and may also receive the device they exploited.

Pwn2Own plays a crucial role in improving cybersecurity by incentivizing the discovery and responsible disclosure of security vulnerabilities. The competition not only fosters a competitive spirit among security researchers but also encourages software developers and vendors to enhance the robustness of their products. The insights gained from Pwn2Own contribute to the overall improvement of digital security, making it a significant event in the cybersecurity community.

## The first trial of attempting Pwn2Own

![1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

Since this is more of a test trial for us, and we've been investing a lot of effort in the IoT field lately, we've instinctively selected some targets from the SOHO Smash-up list: one from the Initial Stage and another from the Final Stage. The devices in the Initial Stage are all routers, likely exposed to the Internet for some reason. As for devices in the Final Stage are just regular everyday devices like IP Cameras, NAS, and Printers, etc. Additionally, you'll earn bonus points if you can leverage your exploit to compromise targets all the way from Initial to Final, hence the name.

After selecting our targets, we began evaluating potential attack surfaces. It's worth mentioning that in Pwn2Own, besides the conventional approach of compromising devices directly from the external network (WAN) to gain control, they also entertain the idea of Man-in-the-Middle (MitM) attacks. In other words, if you can find a way for the device to interact with you—say, if the device regularly requests a specific DNS domain or supports a discovery protocol allowing attackers to impersonate a client and interact with it—those approaches are fair game. Alternatively, discussing common device configurations and usage patterns with the organizers is also on the table.

Before the official competition kicks off, there's an online draw organized by the officials to let everyone know when their exploits will be tested. We get a chance to see others' testing schedules and target devices. When you notice someone testing the same target as you, thoughts like, 'Are we going to collide?' or 'If there's no collision, what exploit are they using?' start creeping in. Of course, it's essential to sign an NDA and submit the final whitepaper and vulnerability proof of concept (PoC) a few days before the actual competition.

A few days before the official testing begins, we receive an official communication from Pwn2Own. The email confirms the final test versions for each target device and provides us with the Teams link and guidelines for the upcoming session. On the day of testing, the organizers reach out to ensure we've checked relevant settings on the devices, installed necessary libraries for our exploit, and confirmed language versions. They reiterate the rules for exploit testing: we have three attempting opportunities, each execution must not exceed ten minutes, and the total duration for all three attempts must stay within thirty minutes.

After making sure all the settings are good to go, the organizers initiate the countdown and run the designated exploit script. Even though we've run countless tests in our local environment, the second the organizers launch the process, seeing the screen fill with logging lines brings a rush of tension. The excitement for that elusive root shell grows, making us ponder if it'll truly come to life.

Rahhhhhhhhhh ....!! Get Shell 🤩

![2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

 

Following successful exploitation, the organizers verify with us the root cause of the vulnerability and whether it matches any previously reported issues. If there's a collision in discoveries, the points earned are reduced, and correspondingly, the prize money decreases. With that, the competition concludes, and the final results can be checked on the organizer's X (Twitter) or official website.

![3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

## The vulnerability we found

A stack-based buffer overflow has been identified in `/lib/libjansson.so.4.7.0`, a JSON parsing library. This vulnerability stems from a modified JSON dictionary key parsing feature. The library is utilized in parsing configuration files and handling web requests.

The issue arises when encountering an object (JSON dictionary type) key. At this point, a call to `sscanf(key, "%s %s", v1, v2)` is executed. As both `v1` and `v2` are local stack array variables, the unrestricted `sscanf` operation leads to a stack-based buffer overflow when processing malicious JSON input.

Here's the pseudocode of the function containing the bug in `libjansson.so.4.7.0`:

```clike
json_t *parse_object(lex_t *lex, int flags, void *error)
{
 // Stack variables
 char v1[32];
 char v2[12];
 // ...
 char *key;
 json_t *json;
 // ...
 while ( 1 )
 {
 // ...
 if ( memchr(key, 0, len) )
 {
 jsonp_free(key);
 error_set(error, lex, "NUL byte in object key not supported");
 goto error_exit;
 }
 v2[0] = 0
 _isoc99_sscanf(key, "%s %s", v1, v2);
 // ...
 }
 // ...
error_exit:
 json_decref(json);
 return 0;
}
```

This vulnerability could be leveraged to achieve remote code execution with a crafted request to the device by an attacker. Furthermore, it has been addressed and fixed in the latest version, as indicated in the release notes of BC500. Therefore, we strongly recommend that you update your device as soon as possible for your own security

## Closing

This is our first time technically attempting the Pwn2Own contest. Essentially, everything is new to us, including how to sign up for the event, submit our findings along with reports to the organizers, and, of course, negotiating with the organizers or vendor about whether the vulnerabilities we submitted have been duplicated by other participants. 

Even though everything was new to us, diving into this challenge turned out to be quite intriguing. From the team spirit during the competition to the suspense when the organizers hit 'enter,' it all added to the excitement.

The organizers were really cool too. As we waited for the testing, they struck up some casual conversation with us, throwing questions like, "Can we expect some fancy logging as output?" or "How about outputs like memory leaks?" It was a simple chat, but it instantly took the edge off our nerves.

Our experience in the Pwn2Own competition was quite an adventure. Looking ahead to our next shot, we aim to come even more prepared, unveiling more 0-days, and, of course, some fancy logging for sure. Until the next Pwn2Own, catch you later!



## Reference

- https://www.zerodayinitiative.com/blog/2023/7/12/the-soho-smashup-returns-for-pwn2own-toronto-2023
- https://www.zerodayinitiative.com/Pwn2OwnToronto2023Rules.html
- https://www.synology.com/en-global/releaseNote/BC500

【TeamT5】Pwn2Own Contest Experience Sharing and Vulnerability Demonstration

## Pwn2own 競賽介紹

Pwn2Own 是一場富有盛名的資訊安全駭客競賽，主要目的是發現並利用各種軟體和作業系統中的漏洞，指出風險所在。這個活動為網路安全研究人員和道德駭客提供一個平台，透過試圖破解常見軟體和設備的安全性，來展現他們的技術能力。由趨勢科技（Trend Micro）下的組織 Zero Day Initiative（ZDI）主辦，Pwn2Own 也因為在發現和解決重大安全漏洞上的貢獻而受到關注。

在比賽期間，參與者針對各種軟體應用程式、Web瀏覽器、作業系統和其他平台進行攻擊，成功利用漏洞的狀況，通常包括執行任意程式碼或繞過安全機制。而成功攻破系統的參賽者將獲得現金獎勵，也可能免費得到他們攻破的設備。

Pwn2Own 透過獎勵機制，來鼓勵道德駭客發現並採取負責任揭露安全漏洞的方式，對改進網路安全扮演關鍵角色。這個競賽不僅培養安全研究人員之間的競爭精神，還鼓勵軟體開發人員和供應商提升其產品的穩健性。從競賽中所獲得的經驗與累積，亦有助於資訊安全的改善與發展，這也使其成為資訊安全社群必要關注的一個重大活動。

## Pwn2Own 初體驗

![1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/1_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

這次參賽對我們來說更像一次嘗試性的體驗，並由於我們最近的研究方向主要是在物聯網（IoT）領域，我們便從 SOHO Smash-up 標的中，憑直覺挑選了一些目標——Initial Stage 、Final Stage 各一個」。

Initial Stage 的設備都是路由器，很可能因某種原因暴露在 Internet 上；Final Stage 的設備只是一些普通的日常設備，如: IP Camera、NAS 和印表機等。此外，如果你能夠讓你的攻擊從 Inital Stage 打到 Final Stage 還會獲得額外的分數，這也是 SOHO Smash-up（徹底搗毀）這個名稱的由來。

挑選好目標之後，我們便開始評估可利用的攻擊面。這裡值得一提的是，Pwn2Own 除了接受一般我們認為的從外網（WAN）攻破設備本身取得權限外，他們也接受中間人攻擊（ Man in the Middle, MitM ）的方式，也就是說如果你有辦法讓設備跟你互動，例如：設備常態性請求某個 DNS 域名、設備本身支援某種發現協定使攻擊者可以偽造成 client 與其互動等，又或者基於該設備一般常見的使用設定，達到使用者與設備互動的狀態，也可以嘗試與主辦方討論，確認是否有達到漏洞利用的比賽目標。

在正式比賽之前，官方會先線上舉行抽籤，讓大家知道自己的漏洞利用執行程式（exploit）會在哪天被測試，我們能同時看到別人的測試時間與標的設備，當你注意到有人跟你測試一樣的目標時，心裡就會開始出現一些諸如: 「會不會撞洞?」、「沒有撞的話，他們是用甚麼漏洞打設備的?」 等念頭。

當然必不可少的，參賽者在正式比賽的前幾天，會需要簽署保密協定書（NDA） ，表示遵守漏洞發現原則，以負責任的方式通報設備供應商，待供應商修補漏洞後，參賽者再行公布漏洞細節，以免被惡意攻擊者濫用該漏洞，造成供應商客戶的損失；參賽者也須提前遞交最後的白皮書與漏洞概念驗證（PoC）。

*撞洞：已有他人先行發現特定漏洞，與我方發現的漏洞相同

在正式測試前幾天，會收到 Pwn2Own 官方來信，信中內容會確定各個標的設備之最終測試版本，與正式比賽期間，我們要用到的線上會議連結與注意事項。

到了測試當天，主辦方會請我們確認是否需要檢查設備的相關設定與漏洞利用 （exploit）所需要安裝的函式庫與所使用的語言版本等。主辦方並重申（exploit）測試的規則：共有三次測試機會；每次執行的時間不可以超過十分鐘；全部三次測試機會的總時長須在三十分鐘內。

待一切設定確定就緒，主辦方就會開始計時並執行指定的漏洞利用執行程式 （exploit），雖然我們已於本地環境測試了無數次，但在主辦方執行 exploit 的那一剎那，看著螢幕 logging 一行一行的出現，心裡還是不由自主的緊張了起來，心理期待的那個 root shell 到底會不會出現。

出現惹....!! 成功 get shell 🤩

![2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/2_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

*root shell：指取得設備或系統的管理者權限。在 Pwn2Own 比賽中，即為達成最終目標。

 

當漏洞利用 （exploit）成功之後，主辦方會與我們確認這個漏洞的大概成因、，是否與其他參賽隊伍回報的漏洞相同。如果與先前其他參賽隊伍提供的漏洞相同（撞洞），本次所得到的點數就會減少，獎金也會變少。

比賽至此告一段落了，相關結果並可在主辦方的 X（Twitter） 或是官網看到該次測試的結果。

![3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg](https://uploads.teamt5.org/upload/original/3_teamt5-pwn2own-contest-experience-sharing-and-vulnerability-demonstration.jpg)

## 初試啼聲的第一個漏洞

我們在 BC500 使用的函式庫 `/lib/libjansson.so.4.7.0` 中找到了一個基於堆疊的緩衝區溢位。

這是一個解析 JSON 格式的函式庫，被用來解析存在於設定檔中或是網頁請求中的 JSON 資料。這個弱點發生在一個被修改過的 JSON 解析函式中，存在一個 `sscanf(key, "%s %s", v1, v2)`，其中 `v1` 與 `v2` 都是區域變數存於 stack 上，這個沒採取任何檢查措施的 `sscanf` 在處理惡意 JSON 資料的時，將會導致緩衝區溢位（buffer overflow）的發生。

下面是這個存在弱點函式的虛擬碼:

```clike
json_t *parse_object(lex_t *lex, int flags, void *error)
{
 // Stack variables
 char v1[32];
 char v2[12];
 // ...
 char *key;
 json_t *json;
 // ...
 while ( 1 )
 {
 // ...
 if ( memchr(key, 0, len) )
 {
 jsonp_free(key);
 error_set(error, lex, "NUL byte in object key not supported");
 goto error_exit;
 }
 v2[0] = 0
 _isoc99_sscanf(key, "%s %s", v1, v2);
 // ...
 }
 // ...
error_exit:
 json_decref(json);
 return 0;
}
```

這個弱點可以透過含有惡意構造 JSON 的網頁請求來達成遠端程式碼執行(Remode Code Execution, RCE) 進而控制裝置本身，根據[官方公告](https://www.synology.com/en-global/releaseNote/BC500)該問題已經被修復，我們建議有使用到該設備的用戶，盡快更新韌體。

## 結語

這是我們第一次參加 Pwn2Own 競賽，一切的流程與規則對我們來說相對陌生，包含如何報名、如何提交我們的報告與漏洞概念驗證（PoC）給主辦方，及與主辦方或廠商溝通是否撞洞等。

儘管如此，從與團隊一起競賽的感覺，到主辦方按下 enter 瞬間的緊張感等，這次的嘗試體驗著實有趣。

主辦方人也很好，當與我們等待測試的同時，跟我們閒聊了一下： 「等等我們會預期看到甚麼花俏（fancy）的 logging 畫面嗎？或是記憶體洩漏（memory leak）之類的輸出呢？」，不起眼的閒聊頓時讓我們的緊張感釋放不少。

期待我們下一次參與Pwn2Own 比賽，我們會準備得更充足，帶來更多的零時差漏洞（0-Day Vulnerability），當然還有花俏（fancy）的 logging 畫面。

我們下次 Pwn2Own 見!

## 參考

- https://www.zerodayinitiative.com/blog/2023/7/12/the-soho-smashup-returns-for-pwn2own-toronto-2023
- https://www.zerodayinitiative.com/Pwn2OwnToronto2023Rules.html

【TeamT5 杜浦數位安全】Pwn2Own 參賽心得分享及漏洞展示

サイバーセキュリティの領域において、企業は常に変化し続けるサイバーセキュリティ脅威に直面しており、重要な機密データが危険にさらされ、業務運営の混乱を招く可能性があります。 これらの課題に対処するために、セキュリティ専門家はさまざまな戦略を採用しており、その 1 つが脅威ハンティングです。

 

## 脅威ハンティングの定義
脅威ハンティングとは、従来のセキュリティ対策を潜り抜ける可能性のある、潜在的な脅威を特定し、無力化するように設計されたプロアクティブなセキュリティ戦略です。 事前に作成された動作モデルに依存する従来のセキュリティ手法とは異なり、脅威ハンティングでは、企業ネットワークを積極的に検索し、脅威の指標を探します。

 

## 脅威ハンティングによるアクティブディフェンスの応用で、先手を打つ
従来のサイバーセキュリティ対策は不可欠ではありますが、通常はネットワーク攻撃を検出してから反撃する、という比較的受動的なプロセスです。 一方、脅威ハンティングは、潜在的な脅威が本格的な攻撃を開始する前に、その兆候を積極的に検知します。

脅威ハンティングも「ゼロトラスト」セキュリティ概念の一部です。つまり、ネットワークシステム環境が侵害されたと仮定した場合、企業は率先して定期的にセキュリティ状況を確認する必要があります。そうすることで、侵入の疑いが検出された場合、リアルタイムで効果的に緩和することができ、セキュリティ問題が拡大することはありません。

脅威ハンティング戦略には、エンドポイントに隠れた脅威を発見するために、高度なツールと手法の組み合わせ、そして豊富な実務経験を持つセキュリティ専門家が必要です。

 

## 脅威ハンティングの鍵
### データ行動分析

脅威ハンティングは、ログ、ネットワークトラフィック、その他の有用な情報ソースなど、企業ネットワーク上のプログラムの動作によって生成された大量のデータを徹底的に分析することから始まります。

実際のハンティング プロセスでは、脅威ハンティングの専門家が独自のツールを使用し、ツールに内蔵された行動分析機能を使用して正常な行動パターンと異常な行動パターンを特定します。これにより、さらに深くに潜伏するサイバー脅威の発見が容易になります。

### 脅威インテリジェンス

脅威ハンティングの専門家が使用するツールは、正確な脅威ハンティングを実施し、進化し続けるセキュリティ脅威の一歩先を行くために、最新の攻撃手法、攻撃の背景、その他情報などの、企業に最も関連のある最新の脅威情報に基づいている必要があります。 

 

## 企業のセキュリティにおける脅威ハンティングの重要性
### 時間差の短縮

脅威ハンティングとは、脅威を積極的に発見して解決することで、企業は「ハッカーの侵入」と「脅威による実際の損失」までの時間差を大幅に短縮し、運用上の損失を回避することができます。

### サイバーセキュリティインシデントへの対応強化

脅威ハンティングは、企業が攻撃の初期段階で脅威を特定してブロックするのに役立ち、セキュリティインシデントへの対応能力を強化し、潜在的な損害を最小限に抑えることができます。

### 最新のセキュリティ脅威への効果的な対処

絶えず変化し続けるサイバーセキュリティ環境において、企業は脅威ハンティングを利用することで、従来のサイバーセキュリティ対策やツールでは検出できない、新たなセキュリティ脅威に迅速に対応できます。

 

## 結論
脅威ハンティングは、セキュリティを強化するためのプロアクティブなアプローチです。 潜在的な脅威を積極的に探すことで、企業は防御を強化し、ハッカーの行動の一歩先を行くことができます。

TeamT5の脅威ハンティングツールThreatSonarは、独自の「メモリフォレンジック」技術を搭載しており、合法なプログラムに偽装した不正プログラムを正規プログラムに注入する攻撃者の攻撃手法を特定し、悪意のあるプログラムの中継局を見つけることが可能なので、さらなる脅威の侵入をブロックできます。

ThreatSonarが搭載している最先端の脅威ハンティング技術は、以下の潜在的な脅威を特定・発見し、企業のセキュリティ耐性を強化します：
- 実行済みのプログラム、実行予定のプログラム(Executed/Autorun programs threat hunting)
- メモリに隠された悪意のあるプログラムの検出と特定（メモリフォレンジック）
- 攻撃者のハッキングツール
- 疑わしいアーティファクト（攻撃後ホストに残された記録など）
- Living Off The Land Binaries And Scripts (LOLBAS)
- サイバーハイジーン

サイバーセキュリティ環境が変化し続ける中、企業の包括的なサイバーセキュリティ戦略に脅威ハンティングを組み込むことの重要性が高まっており、重要なビジネスの機密データを保護して事業運営の堅牢性を維持し、サイバーセキュリティの強靭性を確立するのに役立ちます。

> もっと詳しく知る : [ThreatSonar](https://teamt5.org/jp/products/threatsonar/?utm_source=blog&utm_medium=website)

脅威ハンティングとは?

In the field of cybersecurity, enterprises are facing ever-changing cybersecurity threats that may compromise important data and disrupt business operations. To address these challenges, security professionals employ various strategies, one of which is threat hunting.

##Definition of Threat Hunting 
Threat hunting is a proactive cybersecurity strategy designed to identify and neutralize potential threats that may evade traditional security measures. Unlike traditional cybersecurity practices that rely on pre-established behavioral models, threat hunting involves proactively searching corporate networks for threat indicators.

##Threat Hunting Uses the Concept of Active Defense to Defeat the Enemy in Advance

Although traditional cybersecurity measures are indispensable, they usually first detect network attacks and then respond and counterattack, which is a relatively passive process. Threat hunting proactively looks for signs of potential threats before they develop into a full-scale attack.

Threat hunting is also part of the "zero trust" security concept. That is, assuming that the network system environment has been invaded, enterprise organizations should proactively confirm the security status on a regular basis. Once a suspected intrusion is discovered, it can be immediately and effectively mitigated to prevent the spread and extension. becomes a bigger cybersecurity issue.

Threat hunting strategies require security professionals with rich practical experience, coupled with advanced tools and methods, to uncover threats hidden on endpoints.

##Key Benefits to Threat Hunting
#### Data analysis

Threat hunting begins with in-depth analysis of large amounts of data generated by program behavior on corporate networks, including logs, network traffic, and other sources of helpful information.

During the actual hunting process, threat hunting experts use proprietary tools and use the tool's built-in behavioral analysis function to identify normal and abnormal activity patterns, which helps to discover possible deeper and latent cybersecurity threats.


####Behavior analysis

Threat hunting experts use proprietary tools to identify normal and abnormal activity patterns with built-in behavioral analysis capabilities, which can help uncover potentially deeper, latent cybersecurity threats.

#### Threat intelligence

The tools used by threat hunting experts need to be based on the latest threat information that is most relevant to the enterprise in order to conduct accurate threat hunting and stay ahead of the ever-evolving security threats. This includes the latest attack techniques, attack context and other information.


##The Importance of Threat Hunting to Enterprise Security
#### Reduce time difference

Threat hunting is by proactively finding and resolving threats. Enterprises can significantly reduce the time difference between "hacker invasion" and "actual losses caused by threats" and avoid operational losses.

#### Strengthen response to cybersecurity incidents

Threat hunting helps enterprises identify and block threats in the early stages of an intrusion, strengthens the enterprise's ability to respond to security incidents, and minimizes potential damage.

#### Effectively deal with the latest security threats

In an ever-changing cybersecurity environment, threat hunting enables enterprises to quickly respond to emerging cybersecurity threats that may not be detected by traditional cybersecurity measures and tools.

##Conclusion
Threat hunting is a proactive approach to security enhancement. By proactively looking for potential threats, enterprises can strengthen their defenses and stay ahead of hackers. . And stay ahead of hackers.

TeamT5's threat hunting tool ThreatSonar has a unique "memory forensics'' technology that can identify the attacker's attack method of injecting malicious programs into legitimate programs by using the legal to disguise the illegal, and find the relay station of the malicious program. Block further threat intrusions.

ThreatSonar's leading threat hunting technology can identify and uncover the following potential threats to help enterprises strengthen their security resilience:
- Programs that have been executed and will be executed (Executed/Autorun programs threat hunting)
- Detect and identify malicious programs hidden in memory (Memory forensics)
- Hacktools for attackers
- Suspicious artifacts (records left on the host after the attack)
- Living Off The Land Binaries And Scripts (LOLBAS)
- Cyber hygiene


 
 
As the cybersecurity environment continues to change, it has become increasingly important to incorporate threat hunting into an enterprise's comprehensive cybersecurity strategy. It helps protect important business sensitive data, maintains the robustness of business operations, and establishes cybersecurity resilience.
 
 
 
 
>TeamT5 is an expert in cyber threat hunting. Our team members have more than 20 years of analysis experience in malware and advanced persistent threats (APT). Based on geographical and language advantages, we master hacker attacks in the Asia-Pacific region, and are often invited to participate in world-class cybersecurity conferences and publish research results.

>The threat hunting tool we developed, ThreatSonar, has been adopted by many large enterprises, financial industries and managed security service providers (MSSPs).

 
>If you are an enterprise, please contact us immediately and use the product demonstration demo to fully grasp the excellent defense benefits brought by threat hunting.

>If you are an MSSP, please contact us immediately to discuss how to create business opportunities to strengthen cybersecurity resilience for end customers.

>https://teamt5.org/en/request-information/

 
 

*Picture source: pixabay

What is Threat Hunting?

在資安領域中，企業面臨著不斷變化的資安威脅，這些威脅可能危及重要的機敏資料數據並干擾商務運作。為了應對這些挑戰，資安專業人員採用了各種策略，其中之一即為威脅狩獵（threat hunting）。

##威脅狩獵的定義
威脅狩獵是一種主動的資安策略，旨在識別並化解可能繞過逃避傳統資訊安全措施的潛在威脅。與依賴預先建立行為模型的的傳統資安做法不同，威脅狩獵涉及主動搜尋企業網路中的威脅指標。


##威脅狩獵運用主動防禦的概念，制敵機先
傳統的資安措施雖然必不可少，但通常該類措施是先偵查到網路攻擊，再進行回應與反制，過程較為被動。威脅狩獵則通過主動尋找潛在的威脅跡象，防止其發展成全面的攻擊。

威脅狩獵更是「零信任」資安概念的一環，亦即假設網路系統環境已經遭受入侵，企業組織應定期主動確認資安狀況，一旦發現疑似入侵事件，能即時有效緩解，不致擴散延伸成更大的資安問題。

威脅狩獵策略須由具備豐富實務經驗的資安專業人員，搭配先進的工具和方法，挖掘出隱藏於端點的威脅。

 

##威脅狩獵的關鍵環節
####數據行為分析

威脅狩獵始於對企業網路的程式行為產生的大量數據，進行深度分析，分析對象數據包括日誌、網路流量和其他有助協助的資訊相關數據來源。

實際狩獵過程中，威脅狩獵專家使用專有工具，以工具內建的行為分析功能，識別正常與異常活動模式，這有助於發現可能更深層、潛伏的資訊安全威脅。

####威脅情資

威脅狩獵專家採用的工具，需基於最新、與企業最相關的威脅情資，方能進行精準的威脅狩獵，以保持在持續演化的資安威脅中，保持領先地位。這包括最新的攻擊手法、攻擊脈絡等資訊。


##威脅狩獵之於企業資安的重要性
####減少時間差

威脅狩獵是通過主動尋找並化解威脅，企業可以顯著減少「駭客入侵」與「威脅造成實際損失」之間的時間差，避免營運損失。

####強化資安事件應變

威脅狩獵協助企業在攻擊入侵的初期，即時識別與阻止威脅，強化企業對資安事件的應變能力，最小化潛在損害。

####有效應對最新的資安威脅

在變動萬千的資安環境中，威脅狩獵使企業能夠迅速應對新興的資安威脅，這些威脅可能無法經由傳統的資訊安全措施、工具所偵查到。


##結論
威脅狩獵為一種主動的資安強化方法。通過主動尋找潛在威脅，企業可以加強其防禦，超前部署，預防駭客入侵。

杜浦數位安全 TeamT5 的威脅狩獵工具 ThreatSonar 所具備的獨特「記憶體鑑識」技術，可鑑識出攻擊者利用合法掩飾非法-將惡意程式注入合法程式中的攻擊手法，找到惡意程式的中繼站，阻擋進一步的威脅入侵。

ThreatSonar 的領先威脅狩獵技術，能夠鑑識、揪出以下潛在威脅，協助企業強化資安韌性：
- 執行過以及將要執行的程式 (Executed/Autorun programs threat hunting)
- 針對隱匿於記憶體中的惡意程式，進行偵測與鑑識 (Memory forensics)
- 攻擊者的駭客工具 (Hacktools)
- Suspicious artifacts (攻擊後殘留於主機的紀錄)
- Living Off The Land Binaries And Scripts (LOLBAS)
- 網路衛生 (Cyber hygiene)


 
 
隨著資安環境的不斷變化，將威脅狩獵納入企業全面資安策略中，變得日益重要，有助保護重要商業機敏資料數據，並維護商務運作的穩健性，奠定資安韌性。

 
 
>杜浦數位安全 TeamT5 為網路威脅狩獵專家，團隊具備超過20年的惡意程式與進階持續性威脅（APT）的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
>
>我們研發的威脅狩獵工具 ThreatSonar 已獲許多大型企業、金融產業及資安代管服務廠商（MSSP）採用。

 
>如果您是企業，請立即連絡我們，透過產品展示 Demo，徹底掌握威脅狩獵帶來的絕佳防禦效益。

>如果您是資安代管服務廠商，請即刻聯絡我們，共同討論如何為終端客戶強化資安韌性，並且創造商機。
>https://teamt5.org/tw/request-information/

 
 
*圖片來源: Pixabay

什麼是威脅狩獵?

ThreatSonar Resources

>TeamT5 杜浦數位安全專精於亞太地區網路威脅研究，並提供資安事件應變服務，團隊具備超過 20 年的資安威脅調查、分析的經驗。本次以實際處理的資安事件經驗延伸說明 SSH 登入攻擊手法。

## 事件起源
TeamT5 在一次資安事件應變處理案例中，發現攻擊者使用自行編譯的 SSH binary 來達成繞過 SSH 登入驗證，同時不寫入任何紀錄於日誌中。

在此 Linux 系統的攻擊場域中，我們透過比對防火牆紀錄（存在22連線紀錄），發現無論設置多嚴謹的密碼，並未減緩攻擊者的腳步，因而進一步檢視 SSH 服務的狀態，最後找到攻擊者所替換的 binary 小後門。

以下為攻擊手法探討。

## 手法探討


### 0x1 透過覆蓋 SSH binary

如下圖所示，可以看到攻擊者加入了一組萬用密碼"allever4ALL"，任何的帳號皆可以使用該密碼進行登入。同時若不使用萬用密碼登如時，則會使用 keylooger 的功能，將主機名稱、帳號與密碼紀錄在 /usr/share/zoneinfo/right/Pacific/help/.Sd，以利攻擊者可以進行更進一步的橫向移動。

![202312_IR_Blog_pic02.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic02.png)

### 0x2 覆蓋系統原有的 pam_unix.so

另外在該受害場域也發現，攻擊者也透過置換PAM來達成相同的功能，下圖為透過置換 pam_unix.so 來達成任意密碼皆可登入

![202312_IR_Blog_pic01.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic01.png)

攻擊者可從 PAM 的開源專案對 pam_unix_auth.c 中的 pam_sm_authenticate 函式進行修改，重新編譯後部屬到受害主機完成該攻擊
![202312_IR_Blog_pic03.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic03.png)

 

**- 修改前**
![202312_IR_Blog_pic04.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic04.png)

 

**- 修改後**

![202312_IR_Blog_pic05.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic05.png)

### 0x3 修改 PAM 設定檔，讓其加載惡意的模組
PAM 設定檔位於/etc/pam.d/ 有不少的設定檔可以進行修改來達成加載模組的目的，像是 sshd、login、common-auth 等，如下圖是採用 account sufficient 條件下執行 pam_bd.so (惡意 Module)


![202312_IR_Blog_pic06.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic06.png)


## 其他惡意功能探討
若我們已經可以透過編譯新的 binary 來替換原生的 binary，如此將會有很多惡意的功能可以實作，例如登入後不寫日誌的功能等等，可依據攻擊需求來進行開發。

![202312_IR_Blog_pic07.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic07.png)



## 調查方向建議
- TeamT5 在文末提供小工具，可進行主機掃描，來檢測是否可利用後門密碼登入
- 檢查主機中的 SSHD 的 HASH(/usr/sbin/sshd等) ，是否為已知無威脅檔案(可透過 Virus Total 比對)
- 檢視/lib/x86_64-linux-gnu/security/目錄中(根據作業系統會有不同) so 檔案 HASH 是否為是已知無威脅檔案
- 檢視 PAM Config 是否有遭到異動


## 掃描工具
我們提供了一個掃描 SSH 登入是否可以使用萬用密碼登入，預設會使用 root 來進行登入
![202312_IR_Blog_pic08.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic08.png)

若有成功登入，則會有以下訊息
![202312_IR_Blog_pic09.png](https://uploads.teamt5.org/upload/original/202312_IR_Blog_pic09.png)

 
- 掃描工具下載連結: [請點此](https://uploads.teamt5.org/upload/files/TeamT5_tool_for_ssh_scan_linux_amd64)
(Linux 的執行檔，使用 chmod + x 指令，即可執行 )


## IoC

- 8d6957d0d4101d2c1b651a4308b4234126d3dc277421bed9c848bf379f22a3b8
- 03d927a00afb76d9e2dd4b27d57c673b66babcbe57681bc5a399efb66384e8e8


 
 
*首圖來源: Pexels
 
 

>TeamT5 杜浦數位安全提供[資安事件應變服務](https://teamt5.org/tw/service/ir/?utm_source=blogs&utm_medium=website)，自主研發之[威脅鑑識分析平台 ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blogs&utm_medium=website) 可為客戶精準鎖定資安事件受害範圍。我們的團隊具備超過 20 年的資安威脅調查、分析的經驗， 並為[國際最大資安事件應變組織 FIRST](https://www.first.org/?utm_source=blogs&utm_medium=website) 的成員。

>現已協助政府、金融業、科技業、製造業等廣大客戶群，迅速且有效應對資安威脅或駭客攻擊，以最小化的損失來保護關鍵資訊資產；並提供資安強化建議與事件相關威脅情資，以「知己知彼，百戰百勝」的核心概念，有效協助企業提升面對資安事件的應處能力，減少資訊系統與網路服務中斷時間，維持各項服務連續性，確保業務正常運作。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
>[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

Linux 攻擊場域：SSH 登入攻擊手法初探

**Managed Detection and Response（MDR）**服務供應商為企業提供外包的威脅偵測和應變服務，協助企業識別、分析和應對資安威脅。然而，挑選和採購合適的 MDR 服務供應商是一個重大的決策，影響企業數位資產與資訊系統能否獲得妥善防禦服務。

 

挑選 MDR 服務供應商時，企業需要謹慎考慮以下關鍵因素。

### 1. 具備資安專業知識與豐富實務經驗

選擇一家 MDR 服務供應商時，首要考慮的是其具備資安專業知識，且有豐富實務經驗，以在企業遭遇突如其來的資安事件攻擊時，供應商團隊能夠迅速識別和應對各種威脅。

 

### 2. 監控和應對能力

MDR 服務供應商應該提供 24/7 的監控和威脅應對能力，其包含：及時威脅偵測、事件分析、威脅狩獵和威脅應變。越即時的應變，越能協助企業降低潛在威脅對企業的損害。

 

### 3. 威脅情資和分析

MDR 服務供應商應該能提供目前最新、最具危害力的資安威脅情資和詳細分析。這有助於企業徹底掌握威脅趨勢，並調整其資訊安全策略。

 

### 4. 可視性和報告

MDR 服務供應商應能提供高度的可視性，包括端點狀況的全方位視覺化資料。此外，供應商應該能產製詳細的資安威脅報告，以幫助企業了解威脅的性質和影響。

 

### 5. 合規性和法規遵循

最後，MDR 服務供應商應該符合相關的安全性標準和法規要求。這包括數據加密、權限管控和合規性報告等功能，以確保企業在法律和合規性方面符合政府要求。

 

## 結論

在挑選 MDR 服務供應商時，企業應該仔細考慮上述因素，以確保所選擇的供應商能夠提供高效的威脅偵測和應變服務。MDR 服務供應商的選擇將直接影響企業的安全性和應對威脅的能力，因此這是一個極為重要的決策，值得慎重考慮。

 

TeamT5 杜浦數位安全提供 [威脅偵測應變代管服務（MDR）](https://teamt5.org/tw/service/mdr/?utm_source=blogs&utm_medium=website)。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶群，達成資安防禦目標。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 

*首圖來源: Unsplash

威脅偵測應變代管服務（MDR）評估與採購重點

脅威が蔓延する今日のデジタル時代において、企業は自社システムを攻撃やデータ盗難から確実に保護するために、最適なエンドポイントセキュリティソリューションを積極的に導入する必要があります。

EDR (エンドポイントの検出および対応) ソリューションは、企業がエンドポイントの脅威を早期に検出し、対応できる強力なツールです。 ただし、EDRソリューションを選択および購入する場合、企業は、選択したソリューションが情報セキュリティのニーズを満たし、情報システムが長期的に安定して動作するのに役立つことを確認するために、いくつかの重要な事項を考慮する必要があります。

## 1. 完全な脅威検出機能
高精度で即時の脅威検出機能を備えたEDRソリューションを選択することが重要です。また、既知と未知、両方の様々な種類の脅威を識別し、即時の警告と対応メカニズムを提供できる必要があります。


## 2. 効率的な脅威への対応とブロック機能
優れたEDRソリューションには、脅威への迅速な対応とブロック機能が必要です。 これには、脅威が特定されるとすぐに行動を起こし、被害を最小限に抑え、復旧時間を短縮する自動対応メカニズムが含まれます。


## 3. 高い可視性とレポート機能
詳細なレポートと分析を提供するEDRソリューションを選択しましょう。これは、脅威の傾向を理解し、調査の実施と今後の攻撃に対応するための鍵となります。可視性の情報はリアルタイムであるべきであり、エンドポイントとネットワークのアクティビティを包括的かつ視覚的に把握できる必要があります。

## 4. 国際的なサイバーセキュリティ防御の枠組み MITRE ATT&CK の参照
アメリカの非営利団体 MITRE は、企業組織が共通の言語と構造を持って、ネットワーク攻撃手法を理解し、分析することを目的として、国際的に広く使用されている ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) サイバーセキュリティ防御の枠組みを提案し、セキュリティ対策を講じています。


## 5. 簡単な統合と拡張性
EDR ソリューションは、SIEM (Security Information and Event Management) ソリューションなどの既存の情報セキュリティソリューションとインフラストラクチャを簡単に統合できる必要があり、ウイルス対策ソフトウェアなどの既存のソリューションとの競合も回避する必要があります。 同時に、EDR ソリューションには拡張性があり、企業の今後におけるビジネスの継続的な拡大とエンドポイント数の継続的な増加に対応できる必要があります。



## 6. セキュリティとコンプライアンス
企業が選択するEDRソリューションは、企業が所在する国の法的要件への準拠を保証するためのデータ暗号化、ユーザー権利管理、その他の機能など、関連するセキュリティ標準と規制要件に準拠する必要があります。 



## 結論

EDR ソリューションを選択および購入する場合、企業は上記項目を考慮し、特定のニーズを満たすソリューションを選択する必要があります。 これによって、企業のセキュリティが向上するだけでなく、ビジネス運営が保護され、顧客やパートナーからの信頼も得られます。 そして、最終的には優れたEDRソリューションが企業のセキュリティ戦略の重要な基盤となります。

TeamT5 は、上記の特徴を満たす EDR ソリューション「[ThreatSonar Anti-ransomware](https://teamt5.org/jp/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」をご提供しています。 幣社チームメンバーは、情報セキュリティ脅威の調査と分析において20年以上の経験があり、政府、金融業界、テクノロジー業界、製造業界などの幅広い顧客が情報セキュリティ防御の目標を達成できるよう、ご支援しています。

>貴社がサイバーセキュリティ防御を最適化する方法について知りたい場合は、ぜひお問い合わせください。
[https://teamt5.org/jp/request-information/](https://teamt5.org/jp/request-information/?utm_source=blogs&utm_medium=website)


エンドポイント検出および対応 (EDR)ソリューションの評価と購入における考慮すべき事項

In today's digital age, which is full of threats, enterprises should actively look for the best endpoint security solutions to ensure that their systems are protected from attacks and data theft.

EDR (Endpoint Detection and Response) solution is a powerful tool that can help enterprises detect and respond to endpoint threats early. However, when selecting and purchasing EDR solutions, enterprises need to pay attention to some key points to ensure that the chosen solution meets their cybersecurity needs and can help the information system operate stably in the long term.

 

### 1. Complete threat detection capabilities
It is important to choose an EDR solution with high accuracy and instant threat detection capabilities. Solutions should be able to identify various types of threats, both known and unknown, and provide immediate warning and response mechanisms.

### 2. Efficient threat response and blocking capabilities
A good EDR solution should have rapid threat response and blocking capabilities. This includes automated response mechanisms that take action as soon as a threat is identified to minimize damage and speed up recovery time.

### 3. High visibility and reporting capabilities
Choose an EDR solution that provides detailed reporting and analysis, which is key to understanding threat trends, conducting investigations, and responding to future attacks. Visibility information should be real-time and provide a comprehensive visual picture of endpoint and network activity.

### 4. Refer to the international cybersecurity defense framework MITRE ATT&CK
The American non-profit organization MITRE proposed the ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) cybersecurity defense framework that is widely used internationally. It aims to help enterprise organizations have a common language and structure, understand and analyze network attack methods, and then plan cybersecurity. Countermeasures.

### 5. Easy integration and scalability
EDR solutions should be easy to integrate with existing cybersecurity solutions and infrastructure, such as SIEM (Security Information and Event Management) solutions; they should also avoid conflicts with existing solutions, such as anti-virus software. At the same time, the EDR solution should be scalable and able to cope with the continuous expansion of the enterprise's future business and the continuous increase in the number of endpoints.

### 6. Security and compliance
The EDR solution an enterprise chooses must comply with relevant security standards and regulatory requirements. This includes data encryption, user rights control and other functions to ensure compliance with the legal requirements of the country where the enterprise is located.


 

## Conclusion

When selecting and purchasing an EDR solution, businesses should consider the above factors and select a solution that meets their specific needs. This not only improves enterprise security, but also protects business operations and gains the trust of customers and partners. Ultimately, a good EDR solution will become an important foundation for an enterprise's security strategy.

TeamT5 provides an EDR solution "[ThreatSonar Anti-ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)", which meets the above characteristics. Our team members have more than 20 years of experience in cybersecurity threat investigation and analysis, and have assisted a wide range of customer groups such as the government, financial industry, technology industry, and manufacturing industry to achieve cybersecurity defense goals.

>Contact us to learn how your enterprises can optimize your security defense.
[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Endpoint Detection and Response (EDR) Solution: Key Considerations for Procurement

在當今充滿威脅的數位時代，企業宜積極尋找最佳的端點安全解決方案，以確保企業的系統免受攻擊、數據失竊。

**EDR（Endpoint Detection and Response）**解決方案是一種強大的工具，可以幫助企業及早檢測和應對端點威脅。然而，在挑選和採購 EDR 解決方案時，企業需要注意一些關鍵重點，以確保所選擇的解決方案符合其資訊安全需求，更能協助資訊系統能長期穩定運作。

 

### 1. 完整的威脅偵測能力
選擇一個具有高精確度和即時威脅偵測能力的 EDR 解決方案，十分重要。解決方案應該能夠識別各種類型的威脅，包括已知和未知的威脅，並提供即時的警告和反應機制。

 

### 2. 高效的威脅回應和阻斷能力
一個優秀的 EDR 解決方案應該具有快速的威脅回應和阻斷功能。這包括自動化的應對機制，能夠在識別到威脅後立即採取行動，以最小化損失並加快恢復時間。

 

### 3. 高度的可視性和報告功能
選擇一個提供詳細報告和分析的 EDR 解決方案，這對於了解威脅趨勢、進行調查和應對未來攻擊非常關鍵。可視性資訊應該是即時的，並且能夠提供端點和網路活動的全方位視覺畫圖表。

 

### 4. 參考國際通用資安防禦框架 MITRE ATT&CK
美國非營利組織 MITRE 提出廣為國際使用的 ATT&CK (Adversarial Tactics, Techniques & Common Knowledge)資安防禦框架，旨在協助企業組織有共通的語言與架構，了解與分析網路攻擊手法，進而規劃資安對策。

EDR 解決方案宜具備攻擊事件與此資安防禦框架的對照資訊，使用者方可有具體、清晰的概念，理解攻擊事件的手法，採取正確的應對措施。

 

### 5. 容易整合和擴展性
EDR 解決方案應該易於與現有的資訊安全解決方案、基礎設施整合，如SIEM（Security Information and Event Management）解決方案；也避免與現有解決方案衝突，如防毒軟體。同時，EDR 解決方案應該具有擴展性，能夠應對企業未來業務持續擴展，端點數持續增加。

 

### 6. 安全性和合規性
企業所選擇的 EDR 解決方案必須符合相關的安全性標準和法規要求。這包括數據加密、使用者權限控制等功能，確保符合企業所在國家的法律規定。

 

## 結論

在挑選和採購 EDR 解決方案時，企業應該綜合考慮上述因素，並選擇一個符合其特定需求的解決方案。這不僅能夠提高企業的安全性，還能夠保護業務營運，獲得客戶和合作夥伴的信任。最終，一個優秀的 EDR 解決方案將成為企業資安策略的重要基底。

 

TeamT5 杜浦數位安全提供 EDR 解決方案「[ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website)」，符合上述特點。我們的團隊成員具備超過 20 年的資安威脅調查、分析的經驗，已協助政府、金融業、科技業、製造業等廣大客戶群，達成資安防禦目標。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

 

*首圖來源: Unsplash

端點檢測和回應解決方案（EDR） 評估與採購重點

ThreatSonar Anti-Ransomware インフォメーション

ThreatSonar Anti-Ransomware Resources

脅威インテリジェンスは情報セキュリティ防御の基礎であると主張し、アクション指向のローカル インテリジェンスの提供に重点を置いています。 クライアントが攻撃を予測し、事前に防御戦略を展開し、損失のリスクを軽減するのを支援します。

##ThreatVision

全世界のAPT脅威情報を掌握し、リアルタイムに脅威リスク状態を予測し、事前に部門を防衛します。
全世界で猛威を振るう最新の悪意あるプログラムの分析と追跡結果に対し、早期警告、悪意ある侵入指標、公開情報分析とハッカーグループの研究を提供し、企業が最新のネットワーク脅威の趨勢を掌握し、既知かつ潜在的な脅威を正確に判断するお手伝いをいたします。

**企業支援**
- 当社はあなた自身の診断、また専門家によるコンサルティングサービスを円滑にするインタラクティブなプラットフォームを提供します。
- 脅威インテリジェンスとサンプルに関連するキーワード検索により、企業の脅威リスク調査を満たすことができます。

 
もっと詳しく知る: https://teamt5.org/jp/products/threatvision/

 
 

##ThreatSonar

**事前防御のための脅威ハンティング**

企業において最高水準のサイバーセキュリティの事前防御策である、APT（Advanced Persistent Threat）の脅威ハンティングソリューションは、 自動展開・簡単な操作・異常の正確な検出・更に悪意ある脅威を迅速に検出、することで攻撃が発生した場合の防御としても、速やかに対策を講じることができるように設計されています。

**迅速な侵入脅威の検知**

デジタルフォレンジックとビヘイビア・モデルテクノロジーにより異常な動作をすばやく検出、封鎖し企業の情報セキュリティの状態を即座に把握します。

**情報セキュリティ脅威の自動調査**

インテリジェンス主導型の機能と自動調査機能により、アクティブ検出は、ハッカーが脅威を隠すために一般的に使用するTTP（戦術、技術、手順）に準拠しており、情報セキュリティインシデントの調査効率の向上を促進します。

 
もっと詳しく知る: https://teamt5.org/jp/products/threatsonar/

インテリジェンスがサイバー防御を推進

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance.

##ThreatVision: Threat Intelligence Platform

Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 10+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

- Learn more: https://teamt5.org/en/products/threatvision/

##ThreatSonar Anti-Ransomware: Endpoint detection and response platform

ThreatSonar Anti-Ransomware aims to protect enterprises from Advanced Persistent Threat (APT). With real-time threat detection & hunting, it can also prevent targeted ransomware.

Once ThreatSonar Anti-Ransomware discovers suspicious behaviors - files are encrypted or systems are damaged, it’ll isolate the threat source and prevent other systems being infected. ThreatSonar EDR can also easily restore encrypted files in order to protect enterprises’ valuable assets.

ThreatSonar Anti-Ransomware can be customized based on clients’ needs. It has been widely used by many enterprises from various industries to monitor cyber threats and manage cyber incidents.

- Learn more: https://teamt5.org/en/products/threatsonar-anti-ransomware/

##ThreatSonar: Rapid Test for Enterprise Cybersecurity’s Health Status

ThreatSonar is an easy-to-use tool to hunt cyber threats. Combining digital forensics and behavior-modeling techniques, ThreatSonar can do fast triage and hunt for anomalies.

Driven by cyber threat intelligence and run with automatic mode, it finds hidden infections with similar TTPs - Tactics, Techniques, and Procedures. Regular cybersecurity check-ups also help enterprises to better protect endpoints.

ThreatSonar offers both online and offline mode to protect endpoints in various situations. In short, ThreatSonar is an effective tool designed for assisting incident response.

- Learn more: https://teamt5.org/en/products/threatsonar/


Intelligence-driven Cyber Defense

我們堅持威脅情資是資安防禦的基石，為企業提供行動取向的在地情資，協助企業預見攻擊，提前部署防禦策略，降低損失風險。

##ThreatVision威脅情資整合平台: 預知攻擊

TeamT5 創立於台灣、深耕亞太區域，威脅情資團隊具備逾10年的威脅情資研究資歷、逾1,000件資安事件應變與處理經驗，提供最在地化、最專業威脅情資，提升企業面對資安威脅、網路攻擊的防禦能量。

- 了解更多: https://teamt5.org/tw/products/threatvision/

##ThreatSonar Anti-Ransomware 端點威脅與回應平台: 即時防禦

不論是傳統大型企業或高科技廠商，皆頻傳受到勒索軟體攻擊，導致重要資訊外流、面臨需支付鉅額贖金的壓力。

ThreatSonar Anti-Ransomware 基於人工智慧引擎，監控程式的可疑行為(如: 加密檔案、破壞系統)，及時阻擋勒索軟體，避免惡意程式擴散。
      本解決方案具備防護客製化功能，企業可依據產業特性、營運需求等，自行定義風險追蹤項目、調整風險等級，以便簡化事件調查、加速風險告警。

- 了解更多: https://teamt5.org/tw/products/threatsonar-anti-ransomware/

##威脅鑑識分析平台 ThreatSonar

網路攻擊手法持續演進，當企業發現攻擊事件時，往往機敏資料已落入駭客手中。
        ThreatSonar 基於 TeamT5 團隊對全球惡意程式研究的成果，內建超過100種惡意行為指標、超過1,000種軟體後門特徵，並結合智慧鑑識分析技術與風險模型，發掘潛藏在企業內部的未知威脅，提前預防網路攻擊。

- 了解更多: https://teamt5.org/tw/products/threatsonar/


情資驅動資安防禦 量身訂製企業策略

In today's digital age, security incidents and data leaks are becoming more and more common, so enterprises need to have strong incident response (IR) strategies and service providers to deal with potential threats.

IR services are designed to assist enterprises with immediate response and investigation of cybersecurity incidents and accidents to help them reduce damage. However, when selecting and procuring IR services, businesses need to carefully consider the following key factors.

### 1. Response time
A key IR provider selection criterion is its response time. Suppliers should be able to provide immediate response services to minimize the damage to the enterprise from potential threats and reduce the negative impact of data loss and system outages.

### 2. Professional knowledge and practical experience
The service provider's team members should have extensive security expertise and practical experience to ensure that they can effectively investigate and respond to various security incidents.

### 3. Use specialized detection tools
Cybersecurity incidents are often caused by endpoint intrusions. Therefore, service providers scan endpoint security status and detect the scope of damage for enterprises, which is the primary key to respond to cybersecurity incidents. Moreover, service providers can use specialized endpoint detection tools to get twice the result with half the effort, accurately confirm the scope of the damage, and take corresponding countermeasures.


### 4. Investigation and evidence protection
Suppliers should have professional investigation and digital evidence protection procedures in place to ensure that the incident investigation process is compliant and can be used in legal proceedings. This includes compliance reporting and evidence preservation measures.

### 5. Provide cybersecurity strengthening suggestions and cybersecurity awareness training
IR service providers should be able to provide cybersecurity enhancement suggestions to avoid encountering the same hacking incidents in the future, so as to help enterprises prevent future security incidents. This is a high-value add-on service that helps companies address root causes and improve overall security.



## Conclusion
IR services are an integral part of an enterprise's security resilience strategy, so choosing the right IR service provider is crucial. Businesses should carefully consider the above factors to ensure that the vendor they choose can provide efficient incident response and investigation services and help protect their data and systems.

The choice of IR services will directly impact an organization's ability to respond to security incidents, so it is an important decision that deserves careful consideration.

 

TeamT5 provides professional IR services. The self-developed threat identification and analysis platform ThreatSonar can accurately identify the victim scope of cybersecurity incidents for customers. Our team has more than 20 years of experience in security threat investigation and analysis, and is a member of FIRST, the largest international security incident response organization.

It has now assisted a wide range of customer groups such as the government, financial industry, technology industry, and manufacturing industry to quickly and effectively respond to cybersecurity threats or hacker attacks to protect key information assets with minimized losses; and provides cybersecurity enhancement suggestions and incidents related Threat intelligence, based on the core concept of "Know the enemy and know yourself; in a hundred battles you will never be in peril.", effectively helps enterprises improve their response capabilities in the face of cybersecurity incidents, reduce the interruption time of information systems and network services, maintain the continuity of various services, and ensure business working normally.

Welcome to contact us to learn how your company can optimize its security defense.
[https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Incident Response(IR): Key Considerations for Procurement

在當今的數位時代，安全事件和數據洩漏變得越來越普遍，因此企業需要擁有強大的資安事件應變（Incident Response，IR）策略和服務供應商來應對潛在的威脅。

IR 服務旨在協助企業，針對資訊安全事件、事故，進行即時回應和調查，以幫助企業降低損害。然而，在挑選和採購 IR 服務時，企業需要謹慎考慮以下關鍵因素。

### 1. 應變時間
一個關鍵的 IR 服務商的選擇標準是其應變時間。供應商應該能提供即時的應變服務，以最小化潛在威脅對企業的損害，降低數據丟失和系統中斷帶來的負面影響。

 

### 2. 專業知識和實務經驗
服務商的團隊成員應具備豐富的安全專業知識和實務經驗，以確保他們能夠有效地調查和應對各種安全事件。

 

### 3. 使用專門的檢測工具
資安事件的起因常是端點遭到侵入，因此服務商為企業進行端點安全狀況掃描、偵測受害範圍，是進行資安事件應變的首要關鍵。且服務商採取專門的端點檢測工具，更可收到事半功倍之效，精準確認受害範圍，採取相應對策。

 

### 4. 調查和證據保護
供應商應該具有專業的調查和數位證據保護程序，以確保事件的調查過程合規，並可以用於法律程序。這包括合規性報告和證據保全措施。

 

### 5. 提供資安強化建議和資安意識訓練
IR 服務供應商應可以提供資安強化建議，避免未來遭遇相同的駭客入侵事件，以幫助企業預防未來的安全事件。這是一個高價值的附加服務，有助於企業治本、提高整體安全性。

 

## 結論
IR 服務是企業資安韌性策略中，不可或缺的一部分，因此挑選適合的 IR 服務供應商至關重要。企業應該謹慎考慮上述因素，以確保所選擇的供應商能夠提供高效的資安事件回應和調查服務，並幫助保護其數據和系統。

IR 服務的選擇將直接影響企業對安全事件的應對能力，因此這是一個重要的決策，值得深思熟慮。

 

TeamT5 杜浦數位安全提供[資安事件應變服務](https://teamt5.org/tw/service/ir/?utm_source=blogs&utm_medium=website)，自主研發之[威脅鑑識分析平台 ThreatSonar](https://teamt5.org/tw/products/threatsonar/?utm_source=blogs&utm_medium=website) 可為客戶精準鎖定資安事件受害範圍。我們的團隊具備超過 20 年的資安威脅調查、分析的經驗， 並為[國際最大資安事件應變組織 FIRST](https://www.first.org/?utm_source=blogs&utm_medium=website) 的成員。

現已協助政府、金融業、科技業、製造業等廣大客戶群，迅速且有效應對資安威脅或駭客攻擊，以最小化的損失來保護關鍵資訊資產；並提供資安強化建議與事件相關威脅情資，以「知己知彼，百戰百勝」的核心概念，有效協助企業提升面對資安事件的應處能力，減少資訊系統與網路服務中斷時間，維持各項服務連續性，確保業務正常運作。

>歡迎聯絡我們，了解您的企業如何進行資安防禦最佳化。
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 

*首圖來源: Unsplash

資安事件應變服務 評估與採購重點

近年來，金融科技發展快速，金融業的資訊系統與服務供應鏈日益複雜化，也因此面臨更大的資安風險。台灣銀行公會於 2023 年 4 月公布[《金融機構資通系統與服務供應鏈風險管理規範》](https://www.ba.org.tw/PublicInformation/Detail/4670)，明確規範金融機構應採取的資安措施，以降低資安風險。

根據規範內容，提出三項重點，提醒金融機構宜特別注意。

### 1. 落實供應商資安管理

金融機構應建立完善的供應商資安管理制度，評估供應商的資安能力，並要求供應商遵守相關法規及標準。供應商應採取適當的資安措施，保護金融機構的資訊系統與資料，而如何評估供應鏈廠商是否有遭駭風險，除了請廠商提供端點安全檢測報告外，也可進行網路威脅情資的查證，參照比對如暗網、攻擊族群、高風險漏洞等情資。

### 2. 定期進行資安檢測

金融機構應定期進行資安檢測，找出系統中的資安漏洞，並加以修補。資安檢測可由內部人員或外部專業機構進行，內部人員進行資安檢測可以更了解系統的架構與運作，但仍建議與外部專業機構協作，以獲得更客觀、更全面的檢測結果。

資安檢測的範圍應涵蓋金融機構的所有資訊系統與資料，包括網路、伺服器、端點設備、應用程式、資料庫等。檢測內容應包括：

- 漏洞掃描：檢測系統中存在的安全漏洞，例如弱點掃描、滲透測試等。
- 稽核測試：檢測系統是否遵循相關資安標準，例如滲透測試、安全性稽核等。
- 異常偵測：檢測系統是否有異常行為，例如入侵偵測、異常行為分析等。

### 3. 建立資安事件應變機制

金融機構應建立完善的資安事件應變機制，在發生資安事件時，能迅速應變，降低損害。資安事件應變機制應包括資安事件通報、調查、處理、復原等程序，詳述如後。

- 資安事件通報
資安事件發生後，應立即向主管機關、同業公會、資安事件應變支援單位等通報。通報內容應包括事件的類型、發生時間、影響範圍等。
- 資安事件調查
資安事件發生後，應立即進行調查，以確定事件的發生原因、影響範圍、損失程度等。調查結果應作為後續處理及復原工作的依據。
- 資安事件處理
資安事件發生後，應立即採取措施，以阻止事件擴大，並降低損害。處理措施包括：封鎖受感染的系統或設備、刪除惡意程式、修補漏洞、通知客戶等。
- 資安事件復原
資安事件發生後，應採取措施，以恢復系統或設備的正常運作。復原措施包括：恢復備份資料、重建系統或設備。

 
 

TeamT5 杜浦數位安全為威脅情資領導品牌，獲國際頂尖顧問公司 Frost & Sullivan 評選為台灣最佳威脅情資公司，可協助金融機構從威脅情資角度，評估供應鏈廠商的資安風險。

我們自主研發之端點檢測工具 ThreatSonar，精準偵測異常且迅速鎖定惡意威脅，協助金融機構定期進行端點層次的資安檢測；具備豐富實務經驗的資安事件應變團隊，可協助金融機構建立資安應變機制，符合金融業管理規範。

>歡迎聯絡我們，踏出資安防禦第一步!
>https://teamt5.org/tw/request-information/

 
 
*首圖來源: Pexels

金融業資安守則：落實供應商管理、定期檢測、完善應變

The APAC region is a hotbed for cyber threats, with countries like China, North Korea, and Vietnam continuously evolving their tactics to infiltrate organizations and governments. Recognizing the importance of staying ahead of these threats, at TeamT5 we have integrated our [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website) solution with ThreatQuotient's ThreatQ platform. This integration not only enriches the ThreatQ experience but also empowers security teams with invaluable insights into APAC threats. In this article, we will explore how ThreatVision enhances the ThreatQ experience and the use cases it supports.

![how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg](https://uploads.teamt5.org/upload/original/how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg)

 

## A Unique Focus on Asia-Pacific Threat Intelligence
TeamT5 has made a name for itself in the world of threat intelligence with a unique emphasis on protecting worldwide customers from Asia-Pacific adversaries. Our expertise includes:

1. **Insights into APAC Attack TTPs**: TeamT5 offers comprehensive insights into APAC attack tactics, techniques, and procedures, providing organizations with a deep understanding of evolving APAC threats.

2. **Visibility of Asia-Pacific APT Adversaries**: In-depth research on Asia-Pacific APTs (Advanced Persistent Threats) adversaries and their campaigns is a core competency of TeamT5. This information enables customers to perform effective threat mitigation.

3. **Technical Analysis of Crucial Vulnerabilities**: TeamT5's technical analysis includes exploitation scenarios and impact assessments. This equips security teams with actionable intelligence to fortify their defenses and respond effectively to threats.

## Enhancing Security Operations with ThreatQ
ThreatQuotient's ThreatQ platform has been a game-changer for security operations, offering:

**1. Integration of Disparate Security Technologies**: ThreatQ seamlessly integrates various security technologies into a single, unified infrastructure. This integration enhances collaboration and automates actions and workflows, making security operations more efficient, especially with TeamT5’s ThreatVision intelligence.

**2. Continuous Prioritization**: Security teams benefit from continuous prioritization based on their organization's risk profile. This capability enables them to focus resources on the most pertinent threats, reducing response times and improving security posture.

**3. Comprehensive Intelligence Utilization**: TeamT5's threat intelligence, accessible through ThreatQ, enriches the user experience with various formats such as reports, malicious actors, programs, samples, and connections. This wealth of information empowers security teams to make well-informed decisions.

## Enhancing Security Operations with ThreatQ
ThreatQuotient's ThreatQ platform has been a game-changer for security operations, offering:

**1. Integration of Disparate Security Technologies**: ThreatQ seamlessly integrates various security technologies into a single, unified infrastructure. This integration enhances collaboration and automates actions and workflows, making security operations more efficient, especially with TeamT5’s ThreatVision intelligence.

**2. Continuous Prioritization**: Security teams benefit from continuous prioritization based on their organization's risk profile. This capability enables them to focus resources on the most pertinent threats, reducing response times and improving security posture.

**3. Comprehensive Intelligence Utilization**: TeamT5's threat intelligence, accessible through ThreatQ, enriches the user experience with various formats such as reports, malicious actors, programs, samples, and connections. This wealth of information empowers security teams to make well-informed decisions.

## Use Cases Supported by the Integration
The integration between TeamT5's ThreatVision and ThreatQ supports a range of use cases.

1. ** APT IOCs**: Users can leverage APT IOCs to prevent attacks and broaden their defense strategies. This capability facilitates rapid threat assessment and aids in proactive threat mitigation.

2. **Flash Reports**: These reports provide quick summaries and technical analyses of individual APT incidents, enabling rapid reporting and informed security deployments.

3. **Vulnerability Reports**: These reports include technical analysis, exploitation scenarios, and impact assessments, which equip security teams with actionable intelligence to strengthen their defenses. 

## In Summary
The integration of TeamT5's ThreatVision with ThreatQuotient's ThreatQ platform brings an unprecedented level of threat intelligence, focusing on the Asia-Pacific region, into the hands of security professionals. By providing insights into evolving threats, actionable intelligence, and seamless integration of security technologies, this collaboration enhances the overall ThreatQ experience and empowers security teams to proactively protect their organizations. 

![how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg](https://uploads.teamt5.org/upload/original/how-teamt5-s-threatvision-enriches-the-threatq-experience_pic1.jpg)

 

To learn more about TeamT5's integration with ThreatQuotient's ThreatQ platform and the latest updates, visit [ThreatVision's page on the ThreatQ Marketplace](https://marketplace.threatq.com/details/teamt5-threatvision-cdf). Stay ahead of the evolving threat landscape and bolster your organization's security with this powerful integration.

How TeamT5’s ThreatVision Enriches the ThreatQ Experience

Vulnerabilities refer to weaknesses in information systems and information equipment that may be exploited by attackers, causing unexpected behavior in the execution of system programs. 

Some vulnerabilities rank as high-risk. If a high-risk vulnerability is exploited, if the vulnerability is maliciously exploited, the enterprise organization may suffer losses, such as: important data being stolen and daily operations stopped.

*keywords: vulnerability research, vulnerability analysis, system vulnerability, CVE

 
 

>TeamT5 specializes in cyber threat research and provides an endpoint detection and response (EDR) solution - ThreatSonar, which effectively detects and prevents enterprise system vulnerabilities from being abused by malicious parties and encountering cybersecurity attacks.
 
 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. 
 
 
>For vulnerability research and endpoint protection inquiries, please contact us at [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)


 
 
*Banner source: Pexels

What is Vulnerability? What is the Classification of Vulnerabilities?

資安漏洞(vulnerability)指的是資訊系統、資訊設備中，可能被攻擊者利用的弱點，使系統程式的執行過程出現非預期行為。

有些資安漏洞被國際組織認定為高危險。若這類高危險漏洞遭受利用，可能使企業組織蒙受損失，如: 重要資料遭竊取、無法正常營運。

 
 

*本篇關鍵字: 漏洞、資安漏洞、系統漏洞、漏洞分級、CVE

 
 

>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案 - ThreatSonar，有效偵測，避免企業系統漏洞遭到有心人士濫用、遭遇資安攻擊。
 
 
>團隊具備超過10年的惡意程式與進階持續性威脅(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
 
 
>若您有資安防護的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 
 
*首圖來源: Pexels

什麼是資安漏洞? 資安漏洞有分級嗎?

##Challenges
As we all know, hackers often use various network attack methods, such as zero-day attacks, phishing, brute force attacks, social engineering, malware, etc., in an attempt to gain system access and sensitive data. Then, the data is used to target enterprises, governments, or individuals. All these cyber threat events pose a major threat. Taking the leakage of personal information as an example, it causes people to lose money due to fraud and directly damages the reputation of enterprises.

According to an IBM report[1], the global average cost of data breach reached USD $4.45 million in 2023, including operating losses, business shutdowns, remediation, legal fees and other expenses. These losses alone may be enough to bankrupt a small company. In addition, Harvard Business Review[2] pointed out that data leakage may lead to reduction in credit rating, the loss of competitive advantage, and expose the company to higher borrowing costs and financial risks.

Therefore, how should companies or organizations effectively deal with cybersecurity incidents caused by malicious attacks? The following is a case in which TeamT5 actually assists companies and organizations in handling personal data breach. In this case, you may learn (1) how hackers obtain sensitive personal data through network attacks; (2) the emergency response measures required to deal with the incident; (3) how to reduce the losses caused by the incident threat to the minimum, and plan the defense priorities for future.

##If a personal information breach is discovered, we will quickly assist in handling it.
When TeamT5 received the client's demand for cybersecurity incident handling - the company's information had been leaked, causing people to be defrauded, and important service hosts in the network environment had anti-virus alerts.

After receiving the client's request, TeamT5 Cybersecurity Incident Response Team (CSIRT) interviewed the client to understand the case situation, grasped the WebShell and malicious program alarm information of the website host , and provided relevant incident analysis and handling suggestions:

- **Interpret alarm information and determine possible causes**

The TeamT5 team has more than 20 years of experience in cyber threat research, and promptly assists clients in interpreting received alarms and determining possible intrusion routes for attackers.

- **Provide response suggestions to control the spread of incidents**

In order to prevent other digital assets from being affected, the TeamT5 team recommends taking emergency response measures such as disconnecting network equipment for forensics, endpoint isolation scanning, and system backup analysis. Before the root cause of the incident is clarified, the device will not be able to access the Internet and network communications to prevent attackers from entering the site again to cause damage. If a system cannot be isolated offline due to business operation requirements, it is recommended to adopt the minimum access principle to limit the system to only connect to relevant hosts and control the scope of service access.

- **Collection of key evidence, investigation analysis and planning**

In addition to the field network system configuration, related device information and log status provided by the client, TeamT5 also proposes a complete incident investigation plan by deploying TeamT5's self-developed threat forensic and analysis platform on the field host endpoint. ThreatSonar, coupled with professional forensic tool analysis, allows professional security incident investigators to confirm the security status of service hosts and other operating computers in the environment.

## Endpoint detection and analysis to understand the scope of attacks
On the day of the incident, TeamT5 immediately assisted the client in taking the following key actions:

- **Key forensic analysis:**
Based on the circumstances of the case, the TeamT5 team identified the host that may be the key incident, and used professional tools to conduct forensic analysis and network equipment communication records at the time of the incident for further investigation into incident correlation.

- **Comprehensive scan of endpoints and list of compromised areas:**
ThreatSonar quickly scanned the security of hosts in the site and found that the host involved had high-risk (Level 5) threats. It analyzed the malicious threats that hit the APT detection rules, abnormal login events, suspicious file paths, and malicious relay station (C2) list and other threat information. ; Another host was detected to have malicious behaviors such as lateral movement and attackers using remote desktop services.

## Investigate the root cause of the incident and visualize the attack trajectory
Based on the analysis of quick scan results of the field host and the network record analysis, the TeamT5 team performed related investigation operations on the occurrence of the field event, enabling them to understand the attack path and the root cause of the hack:

- Incident investigation and analysis: It was found that weak passwords (weak passwords) that are easily cracked were exploited on the website management page. Webshell was detected on the website. After inspection, it was found that the hacker uploaded the malicious web program to the target server through a vulnerability of file upload. At the same time, it was discovered that there was a leakage of relevant file information on the official website.

- Field evidence correlation: From the host event log, it was discovered that there were subsequent behaviors such as Powershell and lateral movement, and the accounts that may have been controlled and used were summarized, as well as the attack source IP information.

- Comprehensive investigation results: Through the visual summary of event trajectories, clients can understand the attack path of the incident and clearly understand how the attacker exploited the website's weaknesses and accessed the website's backend through different IPs, and then obtained a privileged account to have lateral movement.

 

![en_pic_ir-use-case-how-to-respond-to-private-data-breach.jpg](https://uploads.teamt5.org/upload/original/en_pic_ir-use-case-how-to-respond-to-private-data-breach.jpg)

 

##Block the source of the attack and restore the incident environment
After completing the incident investigation and identifying the root cause of the hack, TeamT5 works with the client to help determine the relevant response actions required for the security incident:

- Confirm whether the security status of field endpoints is clean
Through the endpoint security scanner, first confirm whether the endpoints in the field have malicious threatening behaviors, such as backdoors, hacking tools, lateral movement, etc., and then scan and confirm with anti-virus software, and then allow the endpoints to access the Internet one by one.

- Review whether network access rules are strict
Check the rules for network management and general users in the domain to access the service host to prevent all hosts from being able to remotely log in to the service host, such as RDP, WinRM, SMB, Anydesk, etc., and block the risk of lateral movement of attackers.

- Confirm whether the system account permissions are appropriate
For the exploited account, if it is not a known account, it must be deactivated immediately and the account creation time must be confirmed; in addition, if AD has been implanted with a backdoor or lateral movement, the domain administrator and user passwords must be changed immediately, Evaluate whether to rebuild AD.

- Confirm whether system vulnerabilities can be controlled
Analyze and investigate system records such as websites, APs, and DBs to confirm whether there are malicious sources and behaviors, block the discovered malicious sources, and repair possible vulnerabilities. Analyze and investigate the connection source of the firewall and account usage, confirm the device status and update the version. You must ensure that the device is safe before going online for service.

## Review Cybersecurity strategies and strengthen future defenses
In order to prevent similar incidents from happening again, TeamT5 recommends that clients follow the US NIST Cybersecurity Framework and review the identification, protection, detection, response, recovery, etc. in the enterprise field. Five major aspects of defense:
 
**1. Strengthen field system security (identification, detection, protection)**
 
- Understand the configuration and operation of system endpoints in the field.
- Strengthen backend management accounts and restrict access sources.
- Control data access sources and restrict the use of dangerous pre-stored programs.
- Systems with files upload function need to have a malicious file detection and prevention mechanism.

 
**2. Strengthen monitoring and analysis measures (identification, detection, protection)**
 
- Import endpoint scanning and monitoring mechanism to provide real-time alerts and block malicious behaviors.
- Strengthen network behavior monitoring and system service record backup and analysis mechanisms.
- Establish a threat information output mechanism to detect suspicious threat sources and field weaknesses early.

 
**3. Establish incident response mechanism (response & recovery)**
 
- For the types of high-risk incidents that may occur (such as ransomware, personal data theft, APT intrusion, etc.), follow the NIST Incident Response Plan to establish an IR Playbook and formulate incident handling procedures (including pre-incident monitoring and analysis, mitigation and elimination during the incident, and post-incident recovery improvement, etc.) so that you can follow the instructions when an incident occurs.

 
 

### Reference
[1] [IBM: Cost of a Data Breach Report 2023](https://www.ibm.com/reports/data-breach)

[2] Keman Huang, Xiaoqing Wang, William Wei, and Stuart Madnick, 2023,[“The Devastating Business Impacts of a Cyber Breach,” Harvard Business Review](https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach)

[3] [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)

[4] [NIST Computer Security Incident Handling Guide](https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf)

【Incident Response Case】 When personal information is breached and exploited by hackers, how do enterprises deal with it?

## 【挑戰】
眾所皆知，駭客常使用各種網路攻擊方式，例如零時差攻擊、網路釣魚、暴力攻擊、社交工程、惡意軟體等，試圖取得系統存取權與敏感資料，進而對企業、政府、組織或個人等造成重大威脅。以個資外洩為例，造成民眾受到詐騙而損失金錢，也直接造成企業名譽受損。

根據 IBM 的報告[1] ，在 2023 年，全球資料外洩的平均成本將達到 445 萬美元，包括營業損失到業務停擺、補救、法律費用等各種費用，光這些損失，就可能足以讓一家小公司破產。此外，哈佛商業評論[2] 更指出，資料外洩可能導致企業信用評等下調，影響企業維持市場地位的能力，使公司面臨更高的借貸成本和財務風險。

因此，面對駭客惡意攻擊所造成的資安事件，企業或組織該如何有效處置？以下藉由 TeamT5 實際協助企業組織處理個資外洩的案例，了解駭客如何透由網路攻擊取得敏感個資，以及處理事件所需的緊急應處作為，將事件威脅發生所造成的損失降到最低，並規劃未來場域所需注意的防禦重點。

 

## 【發現個資外洩，快速協助處置】
當 TeamT5 接獲客戶的資安事件處理需求，得知企業有個資外洩，造成民眾被詐騙情況，且網路環境中的重要服務主機有防毒告警的狀況。

收到客戶需求後，TeamT5 資安事件應變處理團隊（CSIRT）隨即與客戶訪談了解案況，即時掌握場域中的網站主機有 WebShell 及惡意程式告警資訊，立即提供相關事件研判與處置建議，說明如下。

 
##### 解讀告警資訊，研判可能肇因
TeamT5 團隊具有 20 年以上網路威脅研究經驗，及時協助客戶判讀所收到的告警，研判攻擊者的可能入侵途徑。

 
##### 提供應處建議，控制事件擴散
為避免其他數位資產受到影響，TeamT5 團隊建議採取網路設備斷網取證、端點隔離掃描、系統備份分析等緊急應變措施。在未釐清案發根因前，場域網路設備與終端應採取「不開通網路通訊」為原則，避免攻擊者再次進入場域破壞。若有系統因業務營運需求無法離線隔離時，則建議採取最小存取原則，限制系統僅能與相關主機連線，控制服務存取範圍。

 
##### 關鍵證據收集，調查分析規劃
除了客戶所提供的場域網路系統配置、相關設備資訊及記錄保存狀況等資訊外，TeamT5 同時規劃完整的事件調查計畫，藉由在場域主機端點上部署 TeamT5 自行研發的威脅鑑識分析平台 ThreatSonar，並加上專業取證工具分析，透由專業的資安事件調查人員，確認環境中服務主機與其他作業電腦的安全狀況。

 
##### 端點偵測分析，掌握受駭範圍
在事發當日，TeamT5 隨即協助客戶實行以下重點行動：
- 重點取證分析：
依據案況，TeamT5 團隊研判可能為重點事發的主機，並藉由專業工具取證分析、案發時網路設備通訊紀錄，以進一步作為事件關聯調查使用。
- 全面掃描端點，匡列受駭範圍：
ThreatSonar 快速掃描場域內主機安全，結果發現涉案主機具高風險（Level 5）威脅，分析其命中 APT 偵測規則的惡意威脅、異常登入事件、可疑檔案路徑與惡意中繼站（C2）清單等威脅情資；另有主機被偵測出有橫向移動、攻擊者利用遠端桌面服務等惡意行為。

 

## 【調查事件根因，可視化攻擊軌跡】
根據場域主機的快篩分析結果以及網路紀錄分析，TeamT5 團隊隨即對於場域事件發生狀況執行關聯調查作業，使能掌握攻擊路徑與駭侵根因。

 
##### 事件調查分析
發現網站管理頁面，有容易遭破解的弱密碼（weak passwords）被利用。並且在網站上偵測到一句話木馬，經檢視後發現，駭客是透過檔案上傳的漏洞，將惡意網頁程式上傳到目標伺服器。同時，發現官網有 相關檔案資訊洩漏問題。

 
##### 場域事證關聯
從主機事件紀錄發現，後續有 Powershell 及橫向移動等行為，並歸納可能遭掌握利用的帳號，及攻擊來源 IP 資訊。

 
##### 彙整調查結果
藉由可視化的事件軌跡彙整表達，讓客戶了解事件發生的攻擊路徑，清楚知道攻擊者是如何利用網站弱點，及透過不同 IP 存取網站後台，再取得特權帳號後，進行內網橫向移動的滲透行為。

 

![ir-use-case-how-to-respond-to-private-data-breach_pic.jpg](https://uploads.teamt5.org/upload/original/ir-use-case-how-to-respond-to-private-data-breach_pic.jpg)

 

## 【阻斷攻擊來源、復原事發環境】
在完成事件調查並找出駭侵根因後，TeamT5 與客戶合作，協助確認資安事件所需相關的回應行動狀況。

#####	確認場域端點安全狀況是否純淨
透過端點安全掃描程式，先確認場域中的端點是否有惡意威脅行為，例如後門程式、駭客工具、橫向移動等，並透過防毒軟體掃描確認後，再逐一開放端點上網。

#####	審視網路存取規則是否嚴謹
檢查場域中網管與一般使用者存取服務主機的規則，避免所有主機都能對服務主機做遠端登入行為，例如 RDP、WinRM、SMB、Anydesk 等，阻斷攻擊者橫向移動的風險。

#####	確認系統帳號權限是否適當
針對遭利用的帳號，如果非已知帳號，須立即停用並確認帳號建立時間點；另外如果 AD 已經有遭植入後門程式或橫向移動，則須立即變更網域管理者與使用者密碼、評估是否重建 AD。

#####	確認系統漏洞是否已可控制
分析調查網站、AP、DB 等系統紀錄，確認是否有惡意來源與行為，並阻擋發現到的惡意來源，同時修補可能的漏洞。並分析調查防火牆的連線來源和帳號使用狀況，確認設備狀態並更新版本，必須確保設備安全無虞後再上線服務。

 

## 【檢視資安策略、強化未來防禦】
為防禦類似的事件再度發生，TeamT5 建議客戶遵循美國 NIST Cybersecurity Framework 架構[3]，檢視企業場域中對於辨識（Identify）、保護（Protect）、偵測（Detect）、回應（Respond）、復原（Recover）[4] 等五大防禦面向：

##### 1.	強化場域系統安全（識別、偵測、保護）
- 掌握場域中的系統端點配置與運作狀況。
- 強化後台管理帳密與限制存取來源。
- 管控資料存取來源，限制危險預存程序使用。
- 對於有上傳文件之系統需要有惡意檔案檢測防範機制。

##### 2.	加強監控分析措施（識別、偵測、保護）
- 導入端點掃描監控機制，即時告警、阻擋惡意行為。
- 強化網路行為監控與系統服務紀錄備份分析機制。
- 建立威脅情資產出機制，提早發現可疑威脅來源與場域弱點。

##### 3.	建立事件應變機制（回應、復原）
- 針對可能發生之高風險事件類型(如勒索軟體、個資遭竊、APT 入侵等)，依循 NIST Incident Response Plan 建立 IR Playbook，訂定事件處理作業程序（包含事前監控分析、事中抑制消除、事後復原改善等），使事件發生時能有所依循。

 

## 【參考資料】
[1] [IBM: Cost of a Data Breach Report 2023](https://www.ibm.com/reports/data-breach)

[2] Keman Huang, Xiaoqing Wang, William Wei, and Stuart Madnick, 2023,[“The Devastating Business Impacts of a Cyber Breach,” Harvard Business Review](https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach)

[3] [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)

[4] [NIST Computer Security Incident Handling Guide](https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf)

【資安事件應變處理案例】個資外洩遭駭客利用，該如何處置與防範？

TeamT5 released mitigation and response guidelines to two vulnerabilities in Zyxel ZyWall USG 20/50, the firewall service. Both vulnerabilities were exploited in the wild and detected by the TeamT5 vulnerability research team. We temporarily tracked the two vulnerabilities as T5-VUL-11705 and T5-VUL-12195. **The threat actors can compromise the Zyxel ZyWall USG with T5-VUL-11705 and T5-VUL-12195. Our investigation suggests that the threat actors exploited the compromised Zyxel Zywall USG devices as botnet.**

For more detail, users of [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) can check our Vulnerability Insights Report (aka VIR), VIR 2023 September H1: T5-VUL-11705. VIR provides technical detail about critical and highly exploitable vulnerabilities. Users can use VIR to mitigate the threat posed by these critical and highly exploitable vulnerabilities.

## Executive Summary
T5-VUL-11705 is a server-side request forgery (SSRF) vulnerability that allows threat actors to bypass authentication and steal credential. T5-VUL-12195 is an authenticated command injection vulnerability. When combined the use of T5-VUL-11705 and T5-VUL-12195, the threat actors can use unauthenticated users to achieve remote code execution (RCE).

We assess the severity level of T5-VUL-11705 and T5-VUL-12195 as critical and urge our customers to use this report to mitigate the effects. Zyxel ZyWall USG is a firewall service with VPN functionality. Public research suggests that over 20,000 devices are vulnerable to both vulnerabilities, including over 1,500 devices in Taiwan. Furthermore, both vulnerabilities were fully weaponized. Chinese threat actors have exploited both vulnerabilities, targeting entities in Taiwan and deploying the compromised devices as botnets since July 2023. We detailed the information in **Exploitation Status**.

Based on the current exploitation status of T5-VUL-11705 and T5-VUL-12195, we have depicted the **Possible Attack Scenario** in this report. Moreover, we identified that the threat actors have deployed botnet malware, which we dubbed EmergeBot, after exploiting the vulnerabilities in Zyxel ZyWall. We concluded the malware introduction and IoCs in **Appendix II: Malware Table** and **Appendix III: Indicators of Compromise (IoC)**. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation Advisory includes:

Official Patch Information
- Threat Hunting Tools, including:
- A Vulnerability Scanner
 - Two Snort Rules
 - The first rule will detect potential attack attempts of T5-VUL-11705.
 - The second rule will detect potential connection of EmergeBot.

## Exploitation Status
The vulnerabilities have affected a board version of Zyxel ZyWall USG models.

- Public research suggests that over 20,000 Zyxel ZyWall USG devices worldwide are affected, including over 1,500 devices in Taiwan.
- Since July 2023, Chinese threat actors have exploited the vulnerabilities in the Zyxel ZyWall USG-20/50 series targeting entities in Taiwan.
- According to our analysis, the threat actors deployed at least two malware, Microsocks and EmergeBot, for botnet attacks.

## Patch Status
The latest version [1] of the Zyxel ZyWall USG 20/50 series has patched T5-VUL-11705, while the latest version of model USG20 and USG50 are still vulnerable to T5-VUL-12195. Moreover, the USG 20 series are already End-of-Life (EOL) products: Zyxel will not provide updates for the product line in the future. [2]

|| USG20 (3.30 BDS)| USG50 (3.30 BDQ) | USG60 (V4.73(AAKY.2)C0) |
|:---: |:---: | :---: | :---: |
|T5-VUL-11705|Patched|Patched|Patched|
|T5-VUL-12195|Vulnerable|Vulnerable|Patched|

## Mitigation and Response Advisory

### 1. Official Patch Information

To mitigate the impact of the vulnerabilities, we highly recommend our customers follow the instructions below:
- Upgrade your Zyxel USG 20/50 series to latest versions.
 - Download the Patch at https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released
- Restrict the WEB administration interface of your ZyXel USG devices to trusted source IP and domain only.

### 2. Threat Hunting Tools

We have prepared a vulnerability scanner and two SNORT rule for our customer. Contact us for the tools if you have subscribed to our ThreatVision.

##### Vulnerability Scanner
Zyxel ZyWall USG has different models and product lines with different patch status. We have prepare a vulnerability scanner for our customers to check if your Zyxel ZyWall USG device is vulenrabile to T5-VUL-11705. 

##### SNORT Rules
As the vulnerabilities have been actively exploited by the threat actors, TeamT5 prepared two SNORT rules for our customers to detect the attack attempts. 

Zyxel ZyWall USG is a relatively close platform, making it difficult for Incident Response. Deploy the following two SNORT rules to detect if your Zyxel ZyWall USG devices were under potential attack attempts. 
- The first rule will detect potential attack attempts exploiting T5-VUL-11705. 
- The second rule will detect potential connection to EmergeBot. 

## Possible Attack Scenario

Chinese threat actors have actively exploited the vulnerabilities in attacks against entities in Taiwan since July 2023, even though the two vulnerabilities (T5-VUL-11705 and T5-VUL-12195) have not been disclosed publicly. The threat actors deployed malware to the targeted devices and exploited the compromised ZyXel USG devices as botnet.

Specifically, we identified two types of malware in the attack: the open-source hacking tool Microsocks and a newly discovered RAT, EmergeBot. 

-	The Microsocks [3] is an open-source and lightweight SOCKS5 proxy tool that can be ported on IoT devices in MIPS or ARM architecture. Once exploited by T5-VUL-11705 and T5-VUL-12195, the launcher [4] will execute the Microsocks on ZyXel USG devices. The Microsocks we found in the attack is designed for the MIPS architecture.
-	The EmergeBot [5] is a RAT we first identified in the July 2023 attack. EmergeBot is designed for the MIPS architecture and will only be executed when the first 15-byte in the payload is consistent with ` 3rg3c-27s9-hrl0`. We dubbed the RAT EmergeBot based on its feature to build botnet.

Notably, we also found that the actors disabled the firewall via CLI command: `no firewall activate`. We recommend our customer check your Zyxel firewall policy and restore the original firewall policy if it was modified. Additionally, we also found that plain text administrator credentials of Zyxel firewalls were leaked though T5-VUL-11705. We recommend our customer change the administator passwords of Zyxel firewalls.

## Appendix I: More about T5-VUL-11705 and T5-VUL-12195

_Below table is an excerpt of another upcoming new series, **Patch Management Report (PMR)**_. _Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information._

### T5-VUL-11705 and T5-VUL-12195

|CVE|Vendor|CVSS|Description|Threat Level|Date|Patch|Reference|
|---|---|---|---|---|---|---|---|
|T5-VUL-11705| <details><summary>ZyXel</summary>ZyWALL USG Series </details>| <details><summary>9.8</summary>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG series have SSRF (Server-side request forgery) vulnerability that allows threat actors to bypass authenticaton and leak credential.|HIGH| 2023-07-31 2023-09-18 | <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|
|T5-VUL-12195| <details><summary>ZyXel</summary>Zywall USG Series </details>| <details><summary>7.2</summary>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG Series Authenticated Command Injection Vulnerability|HIGH|2023-07-31 2023-09-18| <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/ZyWALL-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|

## Appendix II: Malware Table

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Microsocks</td>
 <td>Hacking Tool</td>
 <td>Microsocks is an open-source SOCKS5 proxy tools, and it is lightweight to port on IoT devices in MIPS and ARM architecture, and it has been ported to ZyXel firewall massively in Taiwan by Chinese actors since July 2023.</td>
 <td>Open-source</td>
 <td>2023.07</td>
 </tr>
 <tr>
 <td>EmergeBot</td>
 <td>RAT</td>
 <td>EmergeBot has been deployed by a Chinese actor on IoT devices such as firewall, WIFI router, etc, and it has been exploited to build botnet in Taiwan since July 2023. </td>
 <td>Unknown</td>
 <td>2023.07</td>
 </tr>
</table>
 
## Appendix III: Indicators of Compromise (IoC)

**SHA-256**
 
```
3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79
4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061
9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358
```



##### Note
1. [https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released](https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released)

2. [https://www.zyxelguard.com/ZyXEL-EOL.asp](https://www.zyxelguard.com/ZyXEL-EOL.asp)

3. SHA-256: 4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061

4. SHA-256: 9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358 

5. SHA-256: 3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79


 
 
*Banner source: pixabay

Alerts of Exploiting Zyxel ZyWall USG 20/50 (T5-VUL-11705 & T5-VUL-12195)

>本篇文章中，TeamT5 杜浦數位安全針對 Zyxel ZyWall USG 20/50 防火牆服務的兩個漏洞，釋出緩解與回應指南。這兩個漏洞已被開採、流傳，並被 TeamT5 漏洞研究團隊偵測到。我們現以編號「T5-VUL-11705」、「T5-VUL-12195」稱之，並進行追蹤。**經我們的調查，威脅行動者可利用「T5-VUL-11705」、「T5-VUL-12195」入侵 Zyxel ZyWall，且濫用該設備為殭屍網路（botnet）。**

 

>若為 TeamT5 威脅情資平台 – [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 的用戶，現可閱讀漏洞情資報告（Vulnerability Insights Report）之「VIR 2023 September H1: T5-VUL-11705」，該報告提供詳細說明，協助使用者減輕這些關鍵且高度可利用的漏洞所造成的威脅。**本文則摘錄前述報告的基本說明與緩解方式，初步協助使用者應對漏洞威脅。**

## Executive Summary
T5-VUL-11705 is a server-side request forgery (SSRF) vulnerability that allows threat actors to bypass authentication and steal credential. T5-VUL-12195 is an authenticated command injection vulnerability. When combined the use of T5-VUL-11705 and T5-VUL-12195, the threat actors can use unauthenticated users to achieve remote code execution (RCE).

We assess the severity level of T5-VUL-11705 and T5-VUL-12195 as critical and urge our customers to use this report to mitigate the effects. Zyxel ZyWall USG is a firewall service with VPN functionality. Public research suggests that over 20,000 devices are vulnerable to both vulnerabilities, including over 1,500 devices in Taiwan. Furthermore, both vulnerabilities were fully weaponized. Chinese threat actors have exploited both vulnerabilities, targeting entities in Taiwan and deploying the compromised devices as botnets since July 2023. We detailed the information in **Exploitation Status**.

Based on the current exploitation status of T5-VUL-11705 and T5-VUL-12195, we have depicted the **Possible Attack Scenario** in this report. Moreover, we identified that the threat actors have deployed botnet malware, which we dubbed EmergeBot, after exploiting the vulnerabilities in Zyxel ZyWall. We concluded the malware introduction and IoCs in **Appendix II: Malware Table** and **Appendix III: Indicators of Compromise (IoC)**. Most importantly, we prepare a comprehensive **Mitigation and Response Advisory** for our customers.

The Mitigation Advisory includes:

Official Patch Information
- Threat Hunting Tools, including:
- A Vulnerability Scanner
 - Two Snort Rules
 - The first rule will detect potential attack attempts of T5-VUL-11705.
 - The second rule will detect potential connection of EmergeBot.

## Exploitation Status
The vulnerabilities have affected a board version of Zyxel ZyWall USG models.

- Public research suggests that over 20,000 Zyxel ZyWall USG devices worldwide are affected, including over 1,500 devices in Taiwan.
- Since July 2023, Chinese threat actors have exploited the vulnerabilities in the Zyxel ZyWall USG-20/50 series targeting entities in Taiwan.
- According to our analysis, the threat actors deployed at least two malware, Microsocks and EmergeBot, for botnet attacks.

## Patch Status
The latest version [1] of the Zyxel ZyWall USG 20/50 series has patched T5-VUL-11705, while the latest version of model USG20 and USG50 are still vulnerable to T5-VUL-12195. Moreover, the USG 20 series are already End-of-Life (EOL) products: Zyxel will not provide updates for the product line in the future. [2]

|| USG20 (3.30 BDS)| USG50 (3.30 BDQ) | USG60 (V4.73(AAKY.2)C0) |
|:---: |:---: | :---: | :---: |
|T5-VUL-11705|Patched|Patched|Patched|
|T5-VUL-12195|Vulnerable|Vulnerable|Patched|

## Mitigation and Response Advisory

### 1. Official Patch Information

To mitigate the impact of the vulnerabilities, we highly recommend our customers follow the instructions below:
- Upgrade your Zyxel USG 20/50 series to latest versions.
 - Download the Patch at https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released
- Restrict the WEB administration interface of your ZyXel USG devices to trusted source IP and domain only.

### 2. Threat Hunting Tools

We have prepared a vulnerability scanner and two SNORT rule for our customer. Contact us for the tools if you have subscribed to our ThreatVision.

##### Vulnerability Scanner
Zyxel ZyWall USG has different models and product lines with different patch status. We have prepare a vulnerability scanner for our customers to check if your Zyxel ZyWall USG device is vulenrabile to T5-VUL-11705. 

##### SNORT Rules
As the vulnerabilities have been actively exploited by the threat actors, TeamT5 prepared two SNORT rules for our customers to detect the attack attempts. 

Zyxel ZyWall USG is a relatively close platform, making it difficult for Incident Response. Deploy the following two SNORT rules to detect if your Zyxel ZyWall USG devices were under potential attack attempts. 
- The first rule will detect potential attack attempts exploiting T5-VUL-11705. 
- The second rule will detect potential connection to EmergeBot. 

## Possible Attack Scenario

Chinese threat actors have actively exploited the vulnerabilities in attacks against entities in Taiwan since July 2023, even though the two vulnerabilities (T5-VUL-11705 and T5-VUL-12195) have not been disclosed publicly. The threat actors deployed malware to the targeted devices and exploited the compromised ZyXel USG devices as botnet.

Specifically, we identified two types of malware in the attack: the open-source hacking tool Microsocks and a newly discovered RAT, EmergeBot. 

-	The Microsocks [3] is an open-source and lightweight SOCKS5 proxy tool that can be ported on IoT devices in MIPS or ARM architecture. Once exploited by T5-VUL-11705 and T5-VUL-12195, the launcher [4] will execute the Microsocks on ZyXel USG devices. The Microsocks we found in the attack is designed for the MIPS architecture.
-	The EmergeBot [5] is a RAT we first identified in the July 2023 attack. EmergeBot is designed for the MIPS architecture and will only be executed when the first 15-byte in the payload is consistent with ` 3rg3c-27s9-hrl0`. We dubbed the RAT EmergeBot based on its feature to build botnet.

Notably, we also found that the actors disabled the firewall via CLI command: `no firewall activate`. We recommend our customer check your Zyxel firewall policy and restore the original firewall policy if it was modified. Additionally, we also found that plain text administrator credentials of Zyxel firewalls were leaked though T5-VUL-11705. We recommend our customer change the administator passwords of Zyxel firewalls.

## Appendix I: More about T5-VUL-11705 and T5-VUL-12195

_Below table is an excerpt of another upcoming new series, **Patch Management Report (PMR)**_. _Published every two weeks (or more), the PMR will provide our customers with concise yet comprehensive updates on the most critical and exploitable vulnerabilities selected by TeamT5 vulnerability research team during the period. Each vulnerability will be provided with patch information. If you are interested in subscribing to this new report series, please contact TeamT5 for more information._

### T5-VUL-11705 and T5-VUL-12195

|CVE|Vendor|CVSS|Description|Threat Level|Date|Patch|Reference|
|---|---|---|---|---|---|---|---|
|T5-VUL-11705| <details><summary>ZyXel</summary>ZyWALL USG Series </details>| <details><summary>9.8</summary>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG series have SSRF (Server-side request forgery) vulnerability that allows threat actors to bypass authenticaton and leak credential.|HIGH| 2023-07-31 2023-09-18 | <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|
|T5-VUL-12195| <details><summary>ZyXel</summary>Zywall USG Series </details>| <details><summary>7.2</summary>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H </details>|ZyXel ZyWALL USG Series Authenticated Command Injection Vulnerability|HIGH|2023-07-31 2023-09-18| <details><summary>Details</summary>https://community.zyxel.com/en/discussion/4247/ZyWALL-usg-series-v3-30p9-wk48-firmware-released</details> |N/A|

## Appendix II: Malware Table

<table>
 <tr>
 <th>Name</th>
 <th>Type</th>
 <th>Description</th>
 <th>Attribution</th>
 <th>First Seen</th>
 </tr>
 <tr>
 <td>Microsocks</td>
 <td>Hacking Tool</td>
 <td>Microsocks is an open-source SOCKS5 proxy tools, and it is lightweight to port on IoT devices in MIPS and ARM architecture, and it has been ported to ZyXel firewall massively in Taiwan by Chinese actors since July 2023.</td>
 <td>Open-source</td>
 <td>2023.07</td>
 </tr>
 <tr>
 <td>EmergeBot</td>
 <td>RAT</td>
 <td>EmergeBot has been deployed by a Chinese actor on IoT devices such as firewall, WIFI router, etc, and it has been exploited to build botnet in Taiwan since July 2023. </td>
 <td>Unknown</td>
 <td>2023.07</td>
 </tr>
</table>
 
## Appendix III: Indicators of Compromise (IoC)

**SHA-256**
 
```
3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79
4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061
9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358
```



##### Note
1. [https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released](https://community.zyxel.com/en/discussion/4247/zywall-usg-series-v3-30p9-wk48-firmware-released)

2. [https://www.zyxelguard.com/ZyXEL-EOL.asp](https://www.zyxelguard.com/ZyXEL-EOL.asp)

3. SHA-256: 4E32C7CEB09F7CD612CFEEB4F291968455453C3B4A45EFC2C1D297295D9AD061

4. SHA-256: 9B59CB890949017B07D93B4BCFAF0A7372829C6892E49ACE8A9B793563869358 

5. SHA-256: 3D6209705E75A79FF38EB8941DF4FA67F47FC758A8F909B98ED6983F67C89A79


 
 
*首圖來源: pixabay

【漏洞揭露】Zyxel ZyWall USG 20/50 防火牆服務(T5-VUL-11705 & T5-VUL-12195)

Vulnerability research is an analysis of the integrity of information systems and equipment to discover unexpected behaviors that may exist in equipment or services. For example, unauthorized access vulnerability can be entered without an account or password. This type of vulnerability can let hackers access the administrator interface.

Usually, vulnerability researchers will conduct black-box testing or white-box testing, combined with dynamic and static analysis techniques to reveal potential vulnerabilities. Finally, a vulnerability research report will be written to detail the complete research process and provide vulnerability exploits. Methods and repair suggestions.

*keywords: vulnerability research, vulnerability analysis, system vulnerability

 
 

>TeamT5 specializes in cyber threat research and provides an endpoint detection and response (EDR) solution - ThreatSonar, which effectively detects and prevents enterprise system vulnerabilities from being abused by malicious parties and encountering cybersecurity attacks.
 
 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. 
 
 
>For vulnerability research and endpoint protection inquiries, please contact us at [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)


 
 
*Banner source: Pexels

What is Vulnerability Research?

漏洞研究(vulnerability research)為針對資訊系統、設備進行完整性的分析，以發現可能尋存在於設備或服務中的非預期行為，例如，未經授權的訪問，不需帳號和密碼，即可進入管理者介面等安全漏洞。

通常，漏洞研究人員會透過黑箱測試或白箱測試來進行，並搭配動態和靜態分析技術，來揭示潛在的漏洞，最後，將撰寫漏洞研究報告，詳述完整的研究過程，並提供漏洞利用方式及修補建議。

 
 
*本篇關鍵字: 漏洞研究、漏洞分析、漏洞、資安漏洞、系統漏洞
 
 

>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案 - ThreatSonar，有效偵測，避免企業系統漏洞遭到有心人士濫用、遭遇資安攻擊。
 
 
>團隊具備超過10年的惡意程式與進階持續性威脅(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響；更經常受邀參加世界級資安會議、發表研究成果。
 
 
>若您有資安防護的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)


 
 
*首圖來源: Pexels

什麼是漏洞研究? 

It’s Cyber Security Awareness Month. 

As we enter the digital age, it's crucial to stay vigilant against cyber threats. And with the rise of remote work and increasing reliance on technology, the risk of cyber attacks has never been greater. 

So stay ahead of the game by learning the latest cyber threats - and take these 5 actionable steps to ensure your organization is protected. 

## 1.Invest in Security Framework
Implement a multi-layered security framework, including firewalls, antivirus software, encryption and regular updates.

## 2.Educate Your Employees
Ensure that your team understands the danger of cyber threats and the importance of good cyber hygiene. Conduct regular training sessions to keep them up-to-date.

## 3.Use Strong Passwords
The first line of defense against cyber attacks, it’s always important to use strong, unique passwords. Also, enable multi-factor authentication wherever possible.

## 4. Backup Your Data
Make sure you have a robust data backup and recovery plan. Regularly back up your data to protect against data loss in case of an attack or system failure.

## 5.Regularly Test Your Systems
Conduct regular vulnerability and penetration testing to identify and address any weaknesses in your security framework.


 
 
By following these tips, you can ensure your organization is well-protected against cyber threats.
Stay safe & secure!

Cybersecurity Awareness Month 2023: Take 5 Actions Today and Achieve Cybersecurity Resilience

>資安意識月 (Cybersecurity Awareness Month) 由美國國家網路安全聯盟 (NCA)、美國網路安全暨基礎設施安全局 (CISA) 發起，為每年10月舉辦，至今已邁入第20年，透過宣導活動，提升大眾的資安意識。

隨著數位時代，遠端工作的興起、對數位技術的日益依賴，使得網路攻擊的風險比以往都具破壞力，而對資安威脅保持警惕，更顯重要

我們建議企業組織了解最新的資安威脅，並採取下列 5 個步驟，確保所屬的企業組織受到保護。

## 1.部署多層次資訊安全機制
導入、部署多層次的資訊安全防禦機制，包括防火牆、防病毒軟體、加密和定期更新。

## 2.企業員工接受教育訓練
確保企業組織的員工了解網路威脅的危險及良好網路使用原則的重要性。企業組織也應定期舉辦培訓課程，讓員工了解最新資安守則。

## 3.使用高強度密碼
作為抵禦網路攻擊的第一道防線，使用高強度而獨特的密碼十分重要。 此外，盡可能啟用多重身份驗證(multi-factor authentication)。

## 4. 備份資料
確保企業組織有可行、有效的資料備份和恢復計劃，也應定期備份資料，以防止企業組織在遭受攻擊或系統故障時，損失資料。

## 5.定期測試系統
定期進行漏洞和滲透測試，以偵測、處理安全框架與部署中的任何弱點。


 
 
依據以上步驟進行資安超前部署，您可以確保您的企業組織受到良好的保護，免受網路威脅，達到資安韌性!

2023 資安意識月: 5步驟保護企業數位資產、為資安韌性打底

## Challenges
When an enterprise or organization faces a destructive cyber attack, time is of the essence in order to be able to respond and recover from it. If the attacker group can be detected at an early stage when they have infiltrated the victim organization's network, there is still a chance to effectively block the attacker group's behavior immediately, with less impact on the enterprise or organization.

However, the more serious situation that enterprises currently face is that they fail to detect cyber threats in the early stages of attackers' infiltration, or even discover them only after data has been stolen or the system has been damaged. When organizations lack the deployment of endpoint protection tools, ransomware attackers are likely to spread rapidly from the initial access point, encrypting other related systems and hundreds or thousands of important files, shutting down the business. This also makes enterprises facing more and more challenges to quickly recover from ransomware attacks and avoid business interruption caused by damaged networks.

How can enterprises or organizations respond to ransomware effectively? Through the following sharing of the case in which TeamT5 assists enterprises and organizations in cybersecurity incidents you may learn how to strengthen cybersecurity defense, not only prevent malicious attacks, but also minimize the losses caused by cyber threats.

## Detect intrusions and respond quickly
TeamT5 received a notification from an information technology company in Taiwan on July 18 that important service hosts in the network environment were subject to encryption and ransomware, and ransomware information was displayed on the desktop of the VM environment.

Upon receiving this notification, the TeamT5 Cybersecurity Incident Response Team (CSIRT) grasped the critical time for incident response and took the following actions as soon as possible:

- **Interviewed clients and clarified needs and case status**

The incident response team directly held an emergency meeting with the client, clarified the client's needs through interviews, and the current situation of the site being hacked: the VM environment of the ESXi host in the site was encrypted, and ransomware information was displayed on the desktop in the VM environment .

- **Provide attack-related information for clients to evaluate and make decisions**

The TeamT5 team has more than 20 years of experience in cyber threat research. It immediately assists clients in interpreting the received ransomware information, confirms the ransomware group and other related information, and provides clients with the suggestions in decision-making process.

- **Provide suggestions of blocking attackers’ control and proliferation countermeasures**

In order to prevent other digital assets from being affected by the attack, the TeamT5 team provides countermeasures to block the attack, including network equipment disconnection and forensics, isolated endpoint scan, system backup and other emergency response measures. Before the root cause of the incident is clarified, it is recommended that relevant network equipment and systems should not connect to the Internet nor enable network communications to prevent attackers from entering the site again to cause damage.

- **Collection of key evidence and customized response and investigation plan**

In addition to providing information such as field network system configuration, related equipment information and log status, TeamT5 also proposes an overall incident investigation plan. By deploying ThreatSonar, TeamT5's self-developed threat forensic and analysis platform, it can perform evidence collection and forensic analysis on key hosts, and also confirm the cybersecurity posture of other hosts in the VM environment.

The scan results found that five hosts had high-risk (Level 5) threats and one host had medium-high risk (Level 4). The analysis included hacking tools, ransomware, suspicious accounts, IP sources, etc.

 

![en_pic1_ir-use-case-how-to-respond-to-ransomware-attack.jpg](https://uploads.teamt5.org/upload/original/en_pic1_ir-use-case-how-to-respond-to-ransomware-attack.jpg)

 

## Investigate the root cause of the incident and visualize the attack trajectory

Based on the analysis of quick scan results of the field host and the network communication records, the TeamT5 team immediately carried out related investigation operations on the occurrence of the field incident, and grasped the attack time, tools and other details in detail as follows:

- Ransomware: Scanning analysis found that eight of the fourteen hosts were injected with ransomware.

Injection location: C:\Documents and Settings\All Users\"Start" menu\Programs\Startup\fast.exe

- Hacking Tools:

Location: C:\WINDOWS\Temp\temp(mimikatz)

- Incident correlation:

RDP login information: Source IP, Target User, Source Workstation (MONSTER), Logon Type 10 (RDP)

 

Through threat hunting, lateral movement trajectories are visualized, allowing clients to clearly understand the root causes of incidents and carry out subsequent enhanced cybersecurity defense plans.

 

![en_pic2_update_ir-use-case-how-to-respond-to-ransomware-attack.jpg](https://uploads.teamt5.org/upload/original/en_pic2_update_ir-use-case-how-to-respond-to-ransomware-attack.jpg)

 

## Restore the pre-invasion environment and strengthen defenses to prevent similar attacks.
After completing the incident investigation and identifying the root cause of the incident, TeamT5 works with the client to help confirm whether the following response actions to the cybersecurity incident have been implemented.

- **Confirm endpoint cybersecurity posture**

First confirm that there is no running ransomware on the endpoint. You can try to start in the system safe mode. After removing the ransomware, use ThreatSonar to continuously scan other endpoints to confirm the cybersecurity status of the endpoint.

- **Check network access policy**

Check the access rules for service hosts in the field to reduce the risk of attackers moving laterally.

- **Confirm system account usage**

For accounts found to be exploited in the case, if they are not known accounts, they must be immediately deactivated and the account creation time must be confirmed; domain administrator and user passwords must be changed immediately, and AD reconstruction must be evaluated.

- **Confirm the source of the attack**

It is found that the source of the attack in this incident is the firewall. It is recommended to confirm the status of the firewall device, update the version, and check the device access status.


## Learn from incidents to optimize long-term strategies for Cybersecurity defense
TeamT5 provides a complete incident investigation report. In addition to detailing the root cause of the incident, hacker groups, attack methods, etc., it also provides targeted remedies and further practical suggestions for long-term cybersecurity defense:

 

**1. Block the source of hacker control and reduce the risk of secondary hacking:**

 

- Digital assets assessment: Confirm the security status of endpoints, grasp the security status of service interfaces that are exposed and may be attacked, and reduce the risk of being controlled by hackers, encrypted and extorted, causing service shutdown.

 

- Confirm the security of VPN equipment and systems: Based on the client's actual site environment, it is recommended to patch equipment vulnerabilities, prohibit multiple people from sharing accounts, and enable the two-stage verification mechanism and device verification mechanism to prevent attackers from gaining access and moving laterally to cause damage.

 

- Control network access management : When clients use Remote Desktop (RDP), if remote management is not implemented, it is recommended to strengthen the management interface and access control of important hosts to prevent attackers from accessing important hosts through internal hosts and encrypted ransomware.

 

- Improve personnel security awareness: You need to be security aware of phishing emails and website downloads to avoid account and password theft or execution of malicious programs.

 

**2. Strengthen cybersecurity monitoring measures to detect abnormalities early:**

 

- Endpoint detection and protection: It is not only necessary to rely on anti-virus software, but also to establish a terminal security defense mechanism to reduce the risk of threats such as malicious programs, encryption ransomware, and lateral movement.

 

- Enable event log: Enable event logs such as Event ID 4688 (program execution), Event ID 4625, 4624 (login audit), etc.
AD and account authorization management: Confirm the usage of privileged accounts and general accounts to avoid password theft.

 

- Network communication policy settings: Confirm the systems or terminals allowed by the rules and their open connection settings to reduce the risk of access control threats.

 

- Check the server service log: Confirm whether there is any detection or attack situation, detect it in advance, handle it as soon as possible, and prevent intrusion detection.

 
**3. Improve data backup and system restoration mechanisms to minimize hacker losses:**

 
- Strengthen the 3-2-1 backup principle to ensure that normal operations can be restored when data is damaged or encrypted, and can prevent threats such as encryption blackmail and service shutdown.

 

By reviewing the entire cybersecurity incident handling process and reviewing whether there are any areas that need to be strengthened, firstly, this can reduce the possibility of similar attacks happening again, and secondly, even if similar cybersecurity incidents are faced again in the future, they can be handled more effectively.

【Incident Response Case】 Ransomware encryption comes to your door, how should you respond?

## 挑戰
當企業或組織面對破壞性資安攻擊，要能應變且從中恢復，時間就決定一切。若能在攻擊者潛入受害組織的網路的早期階段發現，仍有機會即時有效阻擋攻擊者的行為，對企業或組織的影響較小。

但組織目前面臨更嚴重的情況是，未能在攻擊者潛入初期發現資安威脅，甚至是被竊取了資料或破壞系統才發現，在組織缺乏部署端點防護工具的情況下，勒索攻擊者很可能會從最初的存取點迅速擴散，加密其他相關系統與上百、上千個重要檔案，使業務停擺。這也使得組織要能從勒索攻擊中快速恢復、避免受損網路環境造成業務中斷，眼前要克服的挑戰變得越來越多。

企業或組織該如何有效應變？藉著以下 TeamT5 實際協助資安事件應變處理的實例分享，了解如何強化資安防禦，除了防範惡意攻擊，同時也將威脅造成的損失降到最低。

## 發現入侵，快速應變
TeamT5 在 7 月 18 日接獲台灣的資訊科技公司通報，網路環境中的重要服務主機遭到加密勒索狀況，並且有勒索資訊顯示在 VM 環境的桌面。

一收到此通報，TeamT5 資安事件應變處理團隊（CSIRT）掌握事件應變的關鍵時間，第一時間採取以下行動：

- **與客戶訪談、了解需求、掌握案況**
 
事件應變處理團隊直接與客戶召開緊急會議，藉由訪談了解客戶需求，即時掌握到場域受駭現況：場域中的 ESXi主機的 VM 環境被加密，並有勒索資訊顯示於VM環境桌面。
 

- **提供攻擊者資訊，供客戶評估決策**
 
TeamT5 團隊擁有 20 年以上網路威脅研究經驗，第一時間協助客戶判讀所收到的勒索資訊，確認勒索族群等相關資訊，提供客戶評估決策使用。
 

- **提供即時阻斷攻擊者控制與擴散對策**
 
為避免其他數位資產受到攻擊影響，TeamT5 團隊提供阻斷攻擊的因應對策，包括網路設備斷網取證、端點隔離掃描、系統備份等緊急應變措施。在未釐清案發根因前，建議相關網路設備與系統不開通上網、不開通網路通訊，避免攻擊者再次進入場域破壞。
 

- **關鍵證據收集，客製化應變調查計畫**
 
客戶除了提供場域網路系統配置、相關設備資訊及記錄保存狀況等資訊外，TeamT5 同時規劃整體事件調查計畫，藉由部署TeamT5 自行研發的威脅鑑識分析平台 ThreatSonar，針對關鍵主機取證分析，並同時確認 VM 環境中的其他主機安全狀況。
 


## 收集事證與偵測環境，掌握受駭範圍

客戶在同意 TeamT5 所提出的應變計畫後，在 7 月 19 日隨即實行以下重點行動：
- 重點取證分析：
TeamT5 團隊依據案況，研判可能為重點事發的主機或網路設備，並藉由相對應系統作業環境的專業工具，取證分析。客戶並同步提供案發時網路設備通訊紀錄，作為事件關聯調查使用。
- 端點部署掃描，匡列受駭範圍：
部署 ThreatSonar 掃描端點，快速篩檢場域內主機安全。由於端點有加密勒索狀況，所以必須先中止勒索程式執行，才能進行掃描取證。

掃描結果發現，有五台主機具高風險（Level 5）威脅、一台主機具中高風險（Level 4），分析有駭客工具、勒索軟體外，同時有可疑帳號、IP 來源等。

 
![ir-use-case-how-to-respond-to-ransomware-attack_pic1.jpg](https://uploads.teamt5.org/upload/original/ir-use-case-how-to-respond-to-ransomware-attack_pic1.jpg)
 

## 調查事件根因，可視化攻擊軌跡

根據場域主機的快篩分析結果以及網路通訊紀錄，TeamT5 團隊隨即對於場域事件發生狀況執行關聯調查作業，鉅細靡遺地掌握攻擊時間、工具等詳情如下：
- 勒索軟體：掃描分析結果發現，十四台主機中，有八台被植入勒索軟體。
植入位置：C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\fast.exe
- 駭客工具：
存放位置：C:\WINDOWS\Temp\temp(mimikatz)
- 關鍵事件關聯：
遠端登入資訊：Source IP、Target User、Source Workstation（MONSTER）、Logon Type 10 （RDP）

透過威脅狩獵，可視化橫向移動軌跡，讓客戶清楚掌握事件根因，以進行後續強化資安防禦計畫。

 
![ir-use-case-how-to-respond-to-ransomware-attack_pic_2.jpg](https://uploads.teamt5.org/upload/original/ir-use-case-how-to-respond-to-ransomware-attack_pic_2.jpg)
 

## 復原入侵前環境、強化防禦，防止類似攻擊入侵

在完成事件調查、找出事件根因之後，TeamT5 與客戶合作，協助確認以下針對該資安事件的回應行動是否落實。
- 確認端點安全狀況
 
先確認端點沒有正在執行的勒索軟體，可嘗試採用系統安全模式啟動，移除勒索軟體後，再使用 ThreatSonar 持續掃描其他端點，確認端點安全狀況。
 

- 檢視網路存取規則
 
檢查場域中對於服務主機的存取規則，降低攻擊者橫向移動風險。
 

- 確認系統帳號用途
 
針對案內發現遭利用之帳號，如非已知帳號，須立即停用並確認帳號建立時間點；另立即變更網域管理者與使用者密碼、評估是否重建 AD。
 

- 確認攻擊來源狀況
 
發現此事件攻擊來源為防火牆，建議確認防火牆設備狀態並更新版本，並檢查設備存取狀況。
 

## 從事件中學習，優化資安防禦長期策略
TeamT5 提供完整的事件調查報告，除了詳列事件根因、駭客族群、攻擊手法等，更對症下藥，進一步提供長期資安防禦的實質建議：

**1.	阻斷駭客控制來源，降低二次遭駭風險：**
 
- 盤點資訊資產狀態：確認端點的安全狀態，掌握暴露在外、可能遭受攻擊的服務介面安全狀態，減低被駭客進入控制、加密勒索，造成服務停擺的狀況。
- 確認 VPN 設備及系統安全性：針對客戶實際場域環境，建議修補設備漏洞、禁止多人共用帳號、開啟兩階段驗證機制和設備驗證機制，避免攻擊者取得權限進入後橫向移動，造成破壞。
- 管控網管存取途徑：客戶在使用遠端桌面（RDP）時，若未落實遠端維管，建議加強重要主機管理介面與存取控制，避免攻擊者透過內部主機存取重要主機，加密勒索。
- 提升人員安全意識：對於釣魚郵件、網站下載需有安全意識，避免帳號密碼被盜，或執行惡意程式。

 

**2.	加強資安監控措施，及早發現異常：**
 
- 端點偵測防禦：不單靠防毒軟體，更須建立終端安全防禦機制，降低惡意程式、加密勒索、橫向移動等威脅風險。
- 啟用事件紀錄功能：開啟如 Event ID 4688（程式執行）、Event ID 4625、4624（登錄稽核）等事件紀錄功能。
- AD 與帳號權限管理：確認特權帳號與一般帳號的使用情況，避免密碼被盜用。
- 網路通訊規則設定：確認規則所允許的系統或終端，其開放連線的設定，減少存取控制的威脅風險。
- 伺服器服務紀錄檢查：確認是否有遭受探測或攻擊狀況，提早發現、及早應處理，防堵入侵探測。

 

**3.	完善資料備份與系統還原機制，極小化遭駭損失：**
 
強化 3-2-1 備份原則，確保資料遭破壞或加密時可恢復正常運作，能防堵加密勒索、服務停擺等威脅。
 
 

藉由回顧整起資安事件處理過程，檢討是否有需要強化的地方，一來減少類似攻擊再次發生的可能，二來即便未來再次面臨類似的資安事件，可更有效的處理。

 
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件應變與處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
若您有資安事件處理、應變的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

【資安事件應變處理案例】勒索加密找上門，該如何應變？

每隔一段時間，國內外媒體即會報導消費者愛用的企業品牌網站，其個資、信用卡資料外洩，消費者收到詐騙電話，或信用卡遭盜刷。

## 資料庫外洩產生的問題
企業品牌網站的資料庫常涵蓋眾多資料，協助企業有效營運，為消費者提供良好服務。然而資料外洩，則會造成消費者權益受損。

- 消費者的消費明細外洩：消費明細如購買服務、商品的內容及購買時間點等資料。若被詐騙集團掌握，將可用於詐騙電話內容，獲得消費者初步信任，進一步詐取錢財。

- 消費者的付款資料外洩：付款資料如信用卡的卡號、有效日期，若有心人士獲得，則可能盜刷，使消費者蒙受損失。雖信用卡發卡銀行設有爭議款機制，能將可疑的信用卡消費款項暫停授權，然而消費者與發卡銀行之間的來回溝通，仍會造成消費者困擾與時間金錢的損失。

顯見資料庫外洩，將影響消費者的消費體驗，更會造成對企業的不信任，對品牌留下負面印象。 

## 資料庫外洩的可能原因
資料庫外洩有諸多可能原因，根據我們長期進行資安事件調查與應變專案之經驗，以下列舉可能原因。

- **資料庫洩漏（又稱「拖庫」）**
 
指的是網站系統有漏洞或資料庫存取介面有暴露在外部管控不佳，造成攻擊者可藉由此途徑將資料庫下載或查詢；亦或是有權限存取資料庫的人員，其使用的筆電、桌電等終端裝置，遭到入侵，以致有心人士可以透過此終端裝置，進入資料庫，取得資料。

- **資料流洩漏**
 
指的是資料流存取過程中有某個環節遭不當利用，例如APP資料存取流程、Web API查詢功能等資訊被攻擊者掌握，亦或是資料流有經過不安全的終端處理，造成資料被取得利用。

- **撞庫**
 
指的是網站或系統服務登入介面，遭到不當測試，例如使用其他網站服務帳密，透過手動或密碼自動填入測試程式，重複嘗試用不同帳密登入，成功登入後就可再取得其他系統內的相關資訊。

- **內部人員洩漏**
 
指的是內部人員透過正常或盜用方式，存取資料庫，再將資料販賣給其他公司外部人員作為非法用途。

若企業要發現以上狀況，只有透過固定稽核或取證調查，才能分析掌握資料庫外洩的真正原因。

## 如何檢查資料庫外洩

若企業懷疑自身系統、機器等可能遭受攻擊入侵，依據長期豐富的資安事件調查經驗，提供下列簡易檢查方式。

- 若為**資料庫洩露（又稱「拖庫」）**，處理方式為：
調查可存取資料庫的終端是否遭駭，包含進行終端掃描分析、終端取證分析以及Web、資料庫存取紀錄分析等，確認資料處理過程中，攻擊者可取得資料之管道，防堵未來非法存取行為發生。

- 若為**資料流洩漏**，處理方式為：
調查資料流存取過程是否有遭不當利用，需針對資料流會經過之終端掃描分析以及網站相關資料存取紀錄分析，調查重點在於如資料存取、資料加解密或提供其他第三方服務介接運用等。

- 若為**撞庫**，處理方式為：調查系統帳號密碼登入過程，包含進行 Web 紀錄與 API 紀錄分析，判斷是否有攻擊者對系統大量做密碼測試狀況，未來可加強密碼複雜度與登入多因子驗證機制(MFA)及異地登入告警等機制，防範竊取密碼利用等攻擊。

- 若為**內部人員洩漏**，處理方式為：調查人員操作紀錄是否有機會存取，需檢查網站相關資料存取紀錄分析。

 
 

企業若懷疑網站遭遇攻擊，建議尋求專業協助，由經驗豐富的資安事件應變團隊，協助企業徹底掌握整體狀況及取證分析，並且排除問題，達到真正的損害控制、根因調查與系統復原。


>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
 
>若您有資安事件處理、應變的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

【viewpoinT 專欄】懷疑資料庫被駭、消費者資料外流，企業該怎麼辦?

## Executive Summary
A critical vulnerability in WinRAR's ZIP file processing has been discovered, enabling attackers to distribute malware, with a focus on the cryptocurrency industry. Users are urged to update to WinRAR version 6.23, as numerous weaponized PoCs have emerged.

## CVE-2023-38831 Details
Threat actors can exploit CVE-2023-38831 with a crafted RAR file to deploy malware to the targets’ devices. Such RAR files are created with spoofing extensions, disguising as standard file formats such as .txt and .jpg to lure the target into execution. User interaction is required to exploit the vulnerability, but as users believe they are opening a standard file, user action is easy to prompt, resulting in a wide range of tactics attackers can implement.

WinRar is a highly popular piece of software, having been on the market for 28 years and available in over 50 languages. WinRar claims to have [over 500 million users worldwide](https://www.win-rar.com/start.html?&L=0#:~:text=With%20over%20500%20million%20users,efficient%20and%20secure%20file%20transfer.), and since WinRar does not update automatically, the impact of this vulnerability is very severe.

Till now, CVE-2023-38831 has primarily been used to target the cryptocurrency industry, and a large number of weaponized PoCs have been released making use of the vulnerability.

## Protection
### Patching
The vulnerability has been resolved in the latest version of WinRAR 6.23. TeamT5 strongly recommends that all WinRar users update to the latest version to protect their systems. For more information, please refer to the [official WinRAR announcement](https://www.win-rar.com/singlenewsview.html?&L=0).

### Detection
We are pleased to report that [ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website), TeamT5’s endpoint detection and response solution can already detect this vulnerability. ThreatSonar Anti-Ransomware users are already equipped to identify and mitigate this threat and need not worry.

![cve-2023-38831-winrar-vulnerability_pic.jpg](https://uploads.teamt5.org/upload/original/cve-2023-38831-winrar-vulnerability_pic.jpg)

### Intelligence
For those interested in a detailed analysis, TeamT5’s intelligence platform, ThreatVision will soon release a comprehensive Vulnerability Insights Report (VIR) on CVE-2023-38831. This report will provide in-depth information and insights to help you understand the nature of this vulnerability and how to best protect your systems. Data regarding the CVE-2023-38831 vulnerability can also be found on 2023-Aug-2’s Patch Management Report(PMR). 

Learn more about [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)!


【TeamT5 Flash Alert】CVE-2023-38831 WinRAR Vulnerability

## 重點摘要

攻擊者利用 WinRAR 在處理 ZIP 格式文件時的重大漏洞，傳播惡意程式，針對加密貨幣業攻擊。此概念用於實際攻擊的概念驗證（POC）已被大量發布，我們強烈建議使用者更新到 WinRAR 版本 6.23。

## CVE-2023-38831 具體細節 
攻擊者可以藉由精心設計的 RAR 文件來利用 CVE-2023-38831，將惡意程式部署到目標設備。此類 RAR 文件的副檔名偽裝成標準文件格式（例如 .txt 和 .jpg），以誘使目標執行。要利用此漏洞，需藉由使用者的互動。當使用者相信自己開啟的是一般檔案時，就很容易執行指令，結果導致攻擊者能執行多種攻擊戰術。

WinRar 是一款非常普遍的軟體，已上市 28 年，[在全球擁有超過 5 億位使用者](https://www.win-rar.com/start.html?&L=0#:~:text=With%20over%20500%20million%20users,efficient%20and%20secure%20file%20transfer.)，提供 50 多種語言版本。但由於 WinRar 不會自動更新，該漏洞的影響會非常嚴重。

到目前為止，CVE-2023-38831 主要被利用在針對加密貨幣業的攻擊，此概念用於實際攻擊的概念驗證（POC）已被大量發布。

## 防禦方式
### 修補
該漏洞已在最新版本的 WinRAR 6.23 中解決。我們強烈建議您更新 WinRAR 到最新版本，以保護您的系統。更多相關訊息，可以參考 [WinRAR 官方公告](https://www.win-rar.com/singlenewsview.html?&L=0)。

### 偵測
TeamT5 的端點威脅鑑識分析與回應平台 [ThreatSonar Anti-Ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website) 已可檢測到此漏洞攻擊行為。ThreatSonar Anti-Ransomware 的使用者只要啟用 Defense 模組，即可持續受到保護，無須擔心此威脅。

![cve-2023-38831-winrar-vulnerability_pic.jpg](https://uploads.teamt5.org/upload/original/cve-2023-38831-winrar-vulnerability_pic.jpg)
<center>圖 1：顯示 ThreatSonar Anti-Ransomware 檢測到 CVE-2023-38831 漏洞畫面。</center>


### 情資

想進一步了解詳細分析，TeamT5 的 ThreatVision 威脅情資平台將很快在全方位漏洞情資暨應對緩解雙週報（Vulnerability Insights Report，VIR）中，發布有關 CVE-2023-38831 的資訊。該報告將提供深入的資訊和洞察，幫助您了解此漏洞特性以及如何最好地保護您的系統。

CVE-2023-38831 漏洞的相關資料，也分享在 2023/8/2 的漏洞修補管理雙週報（Patch Management Report，PMR）中。

了解更多 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 資訊!

【資安即時快訊】CVE-2023-38831 WinRAR 漏洞通報

ThreatVisionはサイバーセキュリティ態勢を強化し、中国、北朝鮮、韓国、パキスタン、ベトナム、インド等、APAC諸国の主な敵対国に対する防御態勢を改善しようと試みる 一連のAPAC諸国政府部門によって利用されています。

## ThreatVisionとは? 
 
ThreatVisionとは、 APAC(アジア太平洋地域)を中心としたサイバー脅威インテリジェンスの提供に特化した、包括的なインテリジェンスプラットフォームです。 APACにおける悪意のあるコード、APT（Advanced Persistent Threat）グループ、サイバー脅威の調査において10年以上の実績を持つThreatVisionは、組織に豊富なインテリジェンスリソースを提供しています。このプラットフォームは、戦略的、運用的、戦術的な脅威インテリジェンスを提供することで、意思決定者、リスクマネージャーやインシデント対応者など、サイバーセキュリティ環境内のさまざまな役割に対応しています。 Cレベルの経営幹部、リスクマネージャー、インシデント対応者が脅威ランドスケープを理解し、悪意のある攻撃者を特定およびサイバー脅威に対する効果的な防御を展開するのに役立ちます。 ThreatVisionのカスタマイズ可能なインテリジェンス調査とコンサルティングサービスは、ユーザーフレンドリーなインターフェースと精選されたレポートとともに、組織が情報に基づいた意思決定を行えるよう支援し、セキュリティリソースを効果的に割り当て、サイバーセキュリティの強化をお手伝いします。


## APAC諸国政府のインテリジェンス要件 
当社のAPAC諸国政府の顧客は通常、脅威インテリジェンス・プラットフォームを必要としていますが、データを自力でフィルタリングし、分析するための十分なリソースがありません。 攻撃者の活動を理解し、攻撃の背後に誰がいるのかを調査およびAPACで誰が攻撃されているかを把握する必要があります。このようなインテリジェンスがない場合、攻撃を受ける危険性が高くなります。 

## APAC諸国政府にとってのThreatVisionの利点 
これらのインテリジェンス要件を満たすために、APAC 諸国政府の顧客は、詳細なレポートと技術ツールを提供する ThreatVision を利用しています。 ThreatVisionを使用することで、敵の活動、戦術、技術、手順に関する貴重な洞察を得ることができ、プロアクティブな防御手段を強化し、進化するサイバー脅威の一歩先を行くことができます。パートナー企業への侵害指標リストの提供や、経営幹部への詳細なプレゼンテーションに加え、分析用サンプルの提出や、自社環境で発見された疑わしいサンプルのカスタム分析を注文することもできます。

## APAC諸国政府によるThreatVisionの利用方法
![how-threatvision-supports-apac-governments-threat-intelligence-jp_pic1.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-jp_pic1.png)

脅威の検出に関して、APAC諸国政府の顧客は通常、侵害を検出するためにThreatVisionの侵害指標リストと脅威ハンティングツールを使用しています。また、EDR/XDRを開始した後、ThreatVisionの脅威ランドスケープ、敵対者、マルウェア、サンプル管理機能を通じて脅威の調査を開始します。最終的にはマルウェアを検出し、脅威をより深く理解および敵対者のTTPを学習し、今後の攻撃を阻止することができます。

 

![how-threatvision-supports-apac-governments-threat-intelligence-jp_pic2.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-jp_pic2.png)

脅威インテリジェンスの観点から、顧客はThreatVisionの様々なレポートを読むことでインテリジェンスに関する知見を得ることができます。その後、調査結果を上層部に報告し、リスクを軽減するための予防措置を実行します。最終的な結果として、情報セキュリティポリシーが最適化され、予算の意思決定が容易になり、情報セキュリティ環境が強化されるとともに、
脅威ランドスケープについて非常に豊富な知見が得られます。


## ThreatVisionの利用について 
TeamT5の担当者にご連絡の上、14日間のThreatVisionトライアルアカウントをお申し込み頂くか、弊社製品を初めてご利用になるお客様で詳細をお知りになりたい場合は、 sales@teamt5.org まで電子メールをお送りください。 

お客様の組織をサイバー脅威から守るため、協力させていただきます。

- 使用事例: [ダウンロード](https://uploads.teamt5.org/upload/files/Successful_Story_How-ThreatVision-Supports-APAC-Governments-Threat-Intelligence_jp.pdf)

ThreatVisionによるAPAC諸国政府の脅威インテリジェンスのサポート

ThreatVision is utilized by a series of APAC government departments who are looking to enhance their cybersecurity posture and improve their defensive stance against key APAC adversaries including China, North Korea, South Korea, Pakistan, Vietnam and India.

## What is ThreatVision?
ThreatVision is a comprehensive intelligence platform that specializes in providing Asia-Pacific-centered cyber threat intelligence. With over a decade of experience in researching malicious code, APT (Advanced Persistent Threat) groups, and cyber threats in the Asia-Pacific region, ThreatVision offers a wealth of intelligence resources for organizations. The platform caters to different roles within the cybersecurity landscape, including decision-makers, risk managers, and incident responders, by offering strategic, operational, and tactical threat intelligence. It aids C-level executives, risk managers, and incident responders in understanding the threat landscape, identifying malicious actors, and deploying effective defenses against cyber threats. ThreatVision's customizable intelligence investigation and consulting services, along with its user-friendly interface and curated reports, empower organizations to make informed decisions, allocate security resources effectively, and enhance their cybersecurity.

## APAC Governments’ Intelligence Requirements
Our APAC government customers typically are in need of a threat intelligence platform, but they don’t have enough resources to filter and analyze data by themselves. They need to be able to understand adversaries’ activities, be able to study who is behind attacks, and know who is being attacked in the APAC region. Without this intelligence, they are at high risk of an attack.

## ThreatVision’s Benefits for APAC Governments’
To meet these intelligence requirements, our APAC government customers utilize ThreatVision, which provides detailed reports and technical tools. ThreatVision enables them to gain valuable insights into their adversaries' activities, tactics, techniques, and procedures, and strengthen their proactive defense measures, staying one step ahead of evolving cyber threats. In addition to being able to give indicators of compromise lists to partner entities, and give detailed presentations to executives, they are also able to submit samples for analysis and order customized analysis of suspicious samples found in their environment.

## How APAC Governments Use ThreatVision
![how-threatvision-supports-apac-governments-threat-intelligence-en_pic2.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-en_pic2.png)

In terms of threat detection, APAC government customers usually use ThreatVision’s indicators of compromise lists, and threat hunting tools to detect breaches. After initiating EDR/XDR, they also initiate research on the threat through ThreatVision’s threat landscape, adversaries, malware and sample management features. In the end they are able to detect malware, better understand the threat, learn their adversary’s TTPs, and thwart future attacks.

 

![how-threatvision-supports-apac-governments-threat-intelligence-en_pic1.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-en_pic1.png)

In terms of threat intelligence, these customers gain intelligence insights by reading ThreatVision’s many different reports. After that they report their findings to higher ups, and execute preventative measures to reduce their risk. The final result is that their infosec policies are optimized, their budget decision making is eased, their infosec environment strengthened, and they also gain highly rich insights into their threat landscape.


## Getting Started with ThreatVision
To get started, contact your TeamT5 representative and apply for a 14 day ThreatVision trial account, or email us at sales@teamt5.org if you are new to our products and wish to learn more. We look forward to working with you to keep your organization safe from cyber threats.


- Successful Story: [Download](https://uploads.teamt5.org/upload/files/Successful_Story_How-ThreatVision-Supports-APAC-Governments-Threat-Intelligence_en.pdf)

How ThreatVision Supports APAC Governments’ Threat Intelligence

許多亞太地區政府部門採用 ThreatVision，希望藉其增強網路安全態勢，並改善對亞太地區主要攻擊者如中國、北韓、南韓、巴基斯坦、越南和印度等地的防禦。

## 什麼是 ThreatVision?
憑藉針對亞太地區惡意程式、APT（進階持續性威脅）族群和網路威脅的十多年研究經驗，ThreatVision威脅情資平台專為組織，提供以亞太地區為中心的豐富網路威脅情資。平台透過提供戰略、營運和戰術威脅情資，來滿足網路安全領域的不同角色，包括決策者、風險管理者和事件應變人員，協助 C 層級高階經理人、風險經理和事件處理人員了解威脅形勢、識別惡意行為者並部署有效的網路威脅防禦。ThreatVision 提供可客製情資調查與諮詢服務，以及其易於使用的介面和精選報告，協助組織能做出明智的決策，有效地分配資安資源，並增強網路安全。

## 亞太地區政府的情資需求
一般來說，我們的亞太地區政府客戶需要威脅情資平台，但他們沒有足夠的資源來自行過濾和分析數據。他們期望能夠了解對手的活動、研究誰是攻擊背後的攻擊者，並知道誰在亞太地區受到攻擊。如果沒有這類情資，就會面臨很高的被攻擊風險。

## ThreatVision對亞太地區政府的效益
ThreatVision 所提供詳細的報告和技術工具，可滿足亞太地區政府客戶的情資需求。ThreatVision 能讓亞太地區政府深入了解對手的活動、戰術、技術和程序，並加強主動防禦措施，面對不斷變化的網路威脅保持領先。除了為合作夥伴提供威脅入侵指標（IoC）、為管理階層提供詳細簡報外，能夠進行樣本分析，以及客製化分析環境中發現的可疑樣本。

## 亞太地區政府如何使用 ThreatVision
![how-threatvision-supports-apac-governments-threat-intelligence-tw_pic1.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-tw_pic1.png)

在威脅偵測方面，亞太地區政府客戶通常使用 ThreatVision 的威脅入侵指標（IoC）和威脅狩獵工具來偵測入侵。在啟動 EDR / XDR 後，透過 ThreatVision 提供的威脅態勢、攻擊者族群、惡意程式和樣本管理功能，啟動威脅研究。最終達成能夠偵測惡意程式、更了解威脅與攻擊者的 TTPs，並阻絕未來的攻擊。

 

![how-threatvision-supports-apac-governments-threat-intelligence-tw_pic2.png](https://uploads.teamt5.org/upload/original/how-threatvision-supports-apac-governments-threat-intelligence-tw_pic2.png)


在威脅情報方面，客戶可從 ThreatVision 的許多不同報告中獲得情資洞見。協助他們隨後向上級報告調查結果，並採取預防措施，以降低風險。最終達到資安政策優化、預算決策變得更加輕鬆、強化資安環境，並且獲得高豐富的威脅形勢洞察。

## 如何開始使用 ThreatVision
請聯繫您的 TeamT5 代表並申請 14 天的 ThreatVision 試用帳戶。
若您希望了解此產品更多細節，請發送電子郵件至 sales@teamt5.org。我們期待與您合作，確保您的組織免受網路威脅。

- 成功案例: [下載](https://uploads.teamt5.org/upload/files/Successful_Story_How-ThreatVision-Supports-APAC-Governments-Threat-Intelligence_tw.pdf)

ThreatVision 如何協助亞太地區政府應用威脅情資

**MDR 廠商對於威脅情資的專業度，決定了 MDR 服務的深度與廣度。**

擁有豐富威脅情資的 MDR 廠商，就像賽場上掌握對手資訊的情蒐人員，運用這些情報
建構更廣的守備範圍，掌握對手攻勢，並有效回擊。

##威脅情資是什麼? 為什麼重要?
威脅情資（threat intelligence） 指的是與網路攻擊相關的資訊，需經由專業的團隊收集、轉換、分析、解釋等處理後，才能夠轉化為有用的情資，這也是提供資安決策過程所需要的基礎。

威脅情資依其依其內涵，分為3個層次，每個層次都可為企業的資安計畫帶來效益。
 
 
**1. 戰術型威脅情資**
指的是用來監看特定攻擊事件的入侵指標（IoC），如：資安團隊匯入企業資安設備中的 ip/ domain 黑名單等。

**2. 實戰型威脅情資**
指的能理解攻擊者手法的資訊。如果資安團隊能妥善掌握攻擊手法，就可以追蹤、識別和清除攻擊。特別是了解攻擊者的策略，可以大幅幫助資安團隊在初始階段，就提早發現攻擊，防患於未然。

**3. 戰略型威脅情資**
此類情資用於辨別誰會進行攻擊、為何會進行攻擊。威脅情資專業團隊透過分析不同駭客族群（又稱攻擊族群）常用的攻擊手法，識別發動攻擊的組織、了解攻擊目的。

而資安團隊可基於此類情資，掌握敵人現況，預測威脅的發展趨勢，更能提前調整資安部署，達到制敵機先的效果。

##威脅情資如何應用在 MDR 服務?

![the-key-to-mdr-cyber-threat-intelligence_pic.jpg](https://uploads.teamt5.org/upload/original/the-key-to-mdr-cyber-threat-intelligence_pic.jpg)

 

網路攻擊可拆解為3大階段，分為入侵前、入侵中、入侵後。
於一般的 MDR 服務中，在企業遭遇入侵前，廠商會協助於企業內部部署環境監控機制、導入資安設備。

當攻擊者已經開始嘗試入侵的時候，MDR 廠商透過監測端點內的行為事件，即時對異常行為發出告警。
入侵後，MDR 廠商透過威脅狩獵來釐清事件全貌、追溯根源，並提供正確的處置建議，後續也可以協助企業調整資安政策規範。

**然而有效掌握威脅情資的 MDR 廠商，能在原本的攻擊防禦上，提供更精準且更有效益的服務。**

具體來說，掌握威脅情資的MDR 廠商在入侵前，即可透過監控暗網、關注惡意族群動向等方式，可以預先掌握近期可能的攻擊目標，或攻擊發生的前兆。例如在暗網上發現有人在採購、收集特定企業的登入憑證；MDR 廠商也可藉由威脅情資的內容，來安排企業資產的重要順序，提早對重要的目標進行修補，將資源優先分配到需要保護的地方。

在入侵事件初期，掌握威脅情資的 MDR 廠商即已熟知駭客族群攻擊手法，或已基於威脅情資訂定有效的偵測指標，可以幫助企業在事件發生初期分辨異常行為，進行防範或啟動應變機制。

入侵事件後，MDR 廠商則可結合威脅情資與威脅狩獵技巧，深入追查主機內的蛛絲馬跡，以達到縱深防禦的效果。

威脅情資在 MDR 服務過程中，扮演了重要角色。直接掌握、有效運用威脅情的 MDR 廠商提供了更佳的服務品質，因此 MDR 廠商對於威脅情資的專業度，決定了服務的深度與廣度。

 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，掌握深度專業威脅情資，並提供威脅偵測應變代管服務（MDR） 與端點偵測與回應解決方案（EDR）。已協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。

 

>進一步了解: [TeamT5 杜浦數位安全的 MDR 服務](https://teamt5.org/tw/service/mdr/?utm_source=blog&utm_medium=website) 

 

>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 
*圖片來源: unsplash

MDR 服務的關鍵：專業威脅情資

In the rapidly evolving digital landscape of the Asia-Pacific region, the need for localized cyber threat intelligence is paramount. While Europe and America have well-established cyber threat intelligence infrastructures, the Asia-Pacific region lags behind, with limited local resources. Enter TeamT5, a beacon of expertise in the Asia-Pacific cyber threat intelligence domain.

## The Asia-Pacific Edge
The Asia-Pacific region is a hotbed of geopolitical dynamics. Yet, there's a scarcity of intelligence firms that truly specialize in this region. TeamT5 stands out with its Asia-Pacific-centered intelligence professional team. With over a decade of dedication to researching Asia-Pacific cyber threat intelligence, our team's proficiency in the Chinese language, combined with their in-depth understanding of APT hacker groups in the region, especially those originating from China, places us in a unique position. Our extensive knowledge of attack details and techniques has made us a sought-after participant in world-class conferences like Code Blue, AVTokyo, Troopers, Hack In The Box, and FIRST.

## The Imperative of Threat Intelligence

Threat intelligence is not just a buzzword; it's a necessity. From decision-makers to risk managers and incident responders, everyone in the corporate information security team faces unique challenges. To address these challenges, intelligence information can be categorized into:

1. **Strategic Threat Intelligence**: Tailored for C-level executives, it offers insights into trends, the organization's threat landscape, and potential malicious actors.

2. **Operational Threat Intelligence**: Essential for SOC leaders and analysts, it delves into hacker techniques and proactive threat prevention.

3. **Tactical Threat Intelligence**: Vital for rapid incident response teams, it provides precise threat indicators for swift assessment and mitigation.

## ThreatVision: The Ultimate Solution
So, where does ThreatVision fit into this landscape? Unlike many platforms that merely redistribute open-source intelligence, ThreatVision stands out by researching and analyzing intelligence in-house. This ensures that the intelligence provided is not only up-to-date but also more accurate. The clear presentation of data makes it accessible even for non-technical users, bridging the gap between complex cybersecurity threats and business decision-makers.

ThreatVision offers:

- **A Rich Library**: From Indicators of Compromise (IOCs) for swift threat identification to Threat Hunting Tools for direct detection, and Intelligence Reports for a multi-dimensional analysis of hacker behavior.

- **Customized Services**: Request For Information(RFI) Service offers tailored reports and customized analysis.

- **Integration Capabilities**: With its API Service, ThreatVision facilitates automation and enhances threat response efficiency.

For C-level executives, Risk Managers, and event responders, ThreatVision provides tailored solutions. From CTI reports that consolidate event motives to comprehensive technical information for proactive risk mitigation and an API for rapid integration of situational information, ThreatVision ensures that every cybersecurity team member is equipped with the right tools and intelligence.

## Summary
In an era where both human resources and technology are limited, the right intelligence can make or break an organization's cybersecurity strategy. ThreatVision, with its comprehensive offerings and in-house research, ensures that businesses are not just reactive but proactive in their defense strategies. By understanding the behavior and objectives of attackers, organizations can craft effective security policies, enhancing overall response efficiency. With [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blogs&utm_medium=website), you're not just securing your organization; you're future-proofing it.


Why ThreatVision - Threat Intelligence Platform Empowering Organizations to Make Informed Decisions

在亞太地區快速發展的數位環境中，對在地化威脅情資的需求至關重要。 雖然歐洲和美國擁有完善的網路威脅情資背景，但亞太地區卻相對落後，在地化資源有限。而 TeamT5 專精於亞太網路威脅情資研究，正是補足此缺口。

## 亞太態勢
亞太地區面臨動盪的地緣政治與動態勢，然而真正專注於該地區的情資公司卻很少。 TeamT5 以其專注亞太的威脅情資專業團隊脫穎而出。 

我們的團隊20多年年來致力於研究亞太網路威脅情資，精通中文，加上對該地區 APT 威脅族群，特別是來自中國的APT威脅族群的深入了解，使我們處於獨特的地位。 我們對攻擊細節和技術的廣泛了解使我們成為 Code Blue、AVTokyo、Troopers、Hack In The Box 和 FIRST 等世界級會議的搶手參與者。

## 威脅情資的必要性

威脅情資不只是一個流行詞；它是一種威脅情資。 這是必要的。 從決策者到風險經理和事件回應者，企業資訊安全團隊中的每個人都面臨著獨特的挑戰。 為了應對這些挑戰，威脅情資可以分為：

1. **戰略威脅情資**：專為高階管理人員量身訂製，其提供對資安威脅趨勢、組織面臨的威脅情勢和潛在惡意攻擊者的洞察情資。

2. **營運威脅情資**：對於安全營運中心 (SOC) 領導者和分析師至關重要，其提供威脅族群技術和主動威脅預防的深度分析。

3. **戰術威脅情資**：對於事件應變團隊至關重要，其提供精確的威脅指標以進行快速評估和緩解。

 

## ThreatVision：終極解決方案
那麼，ThreatVision 適合這個環境嗎？ 與許多僅重新整理、轉發開源情資內容的平台不同，ThreatVision 透過團隊內部研究和分析情資而脫穎而出，提供了前述的多種威脅情資，且確保所提供的情資不僅是最新的，而且更加準確。

威脅情資也以簡單易懂的方式呈現，使得非技術背景的使用者也能快速瀏覽與了解，從而彌補複雜的網路安全威脅資訊，和決策者之間的落差。

ThreatVision 提供：

- **豐富的資料庫**：從用於快速識別威脅的妥協指標 (IOC) 到用於直接檢測的威脅狩獵工具，以及針對入侵行為，進行多面向分析的情資報告。

- **客製化服務**：資訊請求 (RFI) 服務提供客製化報告和客製化分析。

- **整合功能**：ThreatVision 透過其 API 服務促進自動化並提高威脅回應效率。

ThreatVision 為高階管理人員、風險管理經理和事件應變人員提供量身訂製的解決方案。 從整合事件動機的威脅情資報告，到用於主動緩解風險的漏洞技術資訊，再到用於快速整合威脅情資的 API，ThreatVision 確保每個網路安全團隊成員都配備了正確的工具和威脅情資。

## 結論
在人力資源和技術都有限的時代，正確的威脅情資可以助力企業、組織打造完善網路安全策略。

ThreatVision 威脅情資平台憑藉其豐厚的研究內容，確保企業在防禦策略中，並非被動防禦、而是主動部署 – 透過了解攻擊者的行為和目標，企業與組織可以制定有效的資訊安全策略，從而提高整體回應資安威脅的效率。 

透過 [ThreatVision](https://teamt5.org/tw/products/threatvision/?utm_source=blogs&utm_medium=website)，您將可超強部署，妥善保護您的企業、組織。

選擇 ThreatVision 威脅情資平台的好原因: 企業有效做出聰明的資安決策

CVE-2023-2868: Barracuda Email Security Gateway Vulnerability

CVE-2023-2868: Barracuda 電子郵件安全閘道漏洞

精彩刺激的球賽似乎和嚴肅的資安防禦搭不上關係，然而其實都存在兩方的角力。球賽由我方球隊和敵方球隊廝殺，資安攻防賽則由企業資訊資安團隊，對決神出鬼沒的攻擊族群（或稱駭客族群）。

本文分為5階段，分析資安攻防賽如同球隊準備上場比賽、乃至收集對手情資，直到實際對陣等，每階段都需戰戰兢兢，才能達到完全比賽（perfect game）。

##階段1：報名比賽
當企業踏上數位轉型之路，導入各類聯網裝置與線上系統，甚至資料上雲，企業即是報名了資安防禦比賽，正式面對與駭客的賽局。

企業需要盤點聯網裝置（又稱端點）、帳戶權限清單、資訊資產清單等，方能全面掌握自身強弱處。（[了解如何運用 NIST 資安框架，盤點企業資安防禦力](https://teamt5.org/tw/posts/how-to-check-cyber-resilience-of-the-enterprise-based-on-nist-cybersecurity-framework?utm_source=blog&utm_medium=website)）

 

##階段2：對戰表公布
相較於球隊參與比賽，會由主辦單位規劃與公布對戰表，球隊能夠明確預先知道對手是哪一個球隊。而資安攻防賽則需企業多方收集資訊，預先判斷敵方實力，具體作法包含：

- 閱讀到資安威脅新聞，企業人員應運用高層次、戰略型威型情資，反思企業是否面臨風險，掌握對手與其可能的攻擊範圍
- 獲得可行動型的威脅情資，掌握入侵指標（IOC），包含惡意樣本、惡意中繼站、駭客慣用的社交工程手法等，作為找出對手的手段。
- 借助威脅情資供應商提供的分析報告，得知發生於相關產業的攻擊事件，進一步確認自身環境的安全性；也可根據分析報告，了解對手是誰、攻擊動機與目標（如：癱瘓工廠產線、竊取商業資訊、竊取消費者個資）

根據前述資訊，企業掌握可能的敵方，也可針對其近期行為，確認自身是否可能在攻擊範圍之內。（[威脅情資有三種，詳細介紹見此文](https://teamt5.org/tw/posts/what-is-cyber-threat-intelligence-cti/?utm_source=blog&utm_medium=website)）

敵方的完整資訊側寫需涵蓋該攻擊族群的慣用手法、攻擊目的及來源國家，這皆須威脅情資供應商專家團隊長期深度觀察，基於攻擊狀況，進行分類。而側寫更會指出攻擊族群背後由不同勢力所支持（常見是由國家級單位支持），如同美國職棒大聯盟的洋基隊由洋基全球企業集團持有、日本職棒的北海道日本火腿鬥士隊是由日本火腿株式會社注資。

 

##階段3：分析敵情
如同球隊掌握對手基本資料後，需要透過觀察過去比賽紀錄、影片，進一步掌握與分析敵隊能力，如: 慣用戰術、防守配置、擅長球路。

而資安攻防賽中，當企業掌握特定一至數個攻擊族群較可能對自身造成影響，企業應進一步取得攻擊者入侵手法（TTPs），即是：

- 戰術（tactic）: 以宏觀層次描述描述網路攻擊
- 技巧（technique）: 提供攻擊的完整脈絡，如攻擊者使用的工具、利用了哪個漏洞
- 程序（procedure）: 說明完整的攻擊過程

企業若能瞭解攻擊者的入侵手法，可以更好地保護系統，免於遭受攻擊；更有助於調查和追蹤駭客的行動，以便找到攻擊來源，並採取適當的對策。

 

##階段4：賽前訓練
球隊於正式上場前，需要多輪集訓，培養球員默契，建立團隊合作模式。而資安攻防賽中，企業迎向攻擊族群，也需按部就班，進行模擬訓練，以便在實際攻防中，成功防禦企業資安，具體措施如:
- 擬定應對的策略，規劃營運持續計畫、資安事件應變劇本
- 選用適合的資安解決方案輔助，如同選用適合的球具
- 進行紅藍隊演練 : 經由了解對手情資，做到模仿對手可能的戰術與技巧，自行演練，抓出目前需要加強的方向
- 強化作戰能量，進行教育訓練
- 摘要情報蒐集成果，進行跨部門溝通


最重要的，上述資訊包含紅隊演練、詳細的事件劇本與駭客背景說明與技術實力，都宜摘要成非技術導向的報告，進行跨部門溝通，也與企業高層溝通，以規劃足夠的預算，完成相應的準備計畫。

威脅情資在此階段，同樣扮演讓溝通更有效果的重要角色。如同球隊參照過往比賽，對手如何使用擅長的技巧擊敗該次輸家，企業則透過威脅情資，了解之前資安事件，受害企業是如何被入侵系統、被攻破防禦；如同比賽以分數論勝敗，企業也可從威脅情資獲得過去受害企業損失多少金錢；而比賽的勝敗影響了球隊的人氣、粉絲支持度，企業遭攻擊的負面事件也會使企業損失品牌聲譽；最後，企業綜合上述面向，即能得出有效對應的方針，迎向資安攻防賽。

 

##階段5：比賽開始
企業專注商業營運，而資安攻防賽並不是企業樂見的事情，但若真正開打，除了企業已配合的資安代管服務，也建議依照資安事件嚴重性，尋求資安事件應變團隊（incident response, IR）的專業服務，及時解決問題，防止災情擴大。

在此階段，如果有威脅情資協助，可以增加這些外援團隊判斷的效率與準度，更妥善、有效地處理資安事件。

球賽不只眼前的這一場，資安攻防也不只當下此刻面臨的事件，與駭客的比賽是無限賽局，企業宜持續提升資安韌性，而採用威脅情資更是關鍵點。

 
 
![what-ball-games-teach-us-about-cyber-defense_pic.jpg](https://uploads.teamt5.org/upload/original/what-ball-games-teach-us-about-cyber-defense_pic.jpg)
 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，掌握深度專業威脅情資，並提供威脅偵測應變代管服務（MDR） 與端點偵測與回應解決方案（EDR）。已協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
 

關鍵字: 球賽、棒球賽、籃球賽、資安懶人包

從球賽看資安防禦：企業為什麼需要威脅情資

TeamT5 杜浦數位安全 長期研究駭客族群，深度了解駭客攻擊手法、對組織企業的影響，以及因應對策。

本次特別針對勒索軟體集團 LockBit，進行介紹與分析。

LockBit 集團如同網路攻擊界的軍火商，持續研發強大的勒索軟體作為武器，使企業蒙受鉅額損失。我們建議 LockBit 勒索軟體的預防之道為「持續快速修補漏洞」，並注意最新漏洞被各種攻擊族群利用的狀況，而掌握最新的威脅情資就是關鍵。

 
 

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/E5pLdQ6Ml4I?si=Gulkb4VwonstxzTA" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

 
本片關鍵字: LockBit、網路攻擊、勒索軟體、企業資安、供應鏈資安、APT、威脅情資、資安情資、漏洞、漏洞分析、漏洞修補
 
 


>關於杜浦數位安全 TeamT5
 
>我們專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
團隊具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。
 
>進一步了解我們的解決方案，由情資驅動您企業的資安防禦: [連結](https://teamt5.org/tw/posts/intelligence_driven_cyber_defense/?utm_source=blog&utm_medium=website)

網路攻擊趨勢大揭密: 勒索軟體軍火商 LockBit

In today's digital landscape, cybersecurity has become one of the most critical concerns for governments and companies worldwide. With the rise of sophisticated cyber threats, such as Advanced Persistent Threats (APTs), organizations need robust and specialized tools to combat these evolving dangers effectively. This is where TeamT5's ThreatVision comes in, offering unparalleled expertise and intelligence to help governments and enterprises in the Asia-Pacific.

 

## The Power of TeamT5 and ThreatVision
TeamT5, renowned for its Asia-Pacific-centered intelligence professional team, has been at the forefront of researching cyber threat intelligence in the region for over a decade. Our Chinese language proficiency and geopolitical knowledge, coupled with ten years of experience in malicious code and APT research, have granted us a deep understanding and research capabilities of APT hacker groups, particularly those originating from China. Our expertise has earned us invitations to world-class conferences, further solidifying our reputation as the top choice for Asia-Pacific APT intelligence, especially for those looking to defend against China.

## The Importance of Threat Intelligence
Threat intelligence plays a pivotal role in a company's cybersecurity strategy. It serves three key roles: assisting decision-makers, enabling risk managers, and supporting incident responders. TeamT5 recognizes the significance of each type of intelligence, including:

### Strategic Threat Intelligence
Vital for C-level executives responsible for decision-making, strategic threat intelligence provides insights into an organization's threat landscape, identifies malicious actors targeting the organization, and sheds light on their objectives.

### Operational Threat Intelligence
Crucial for SOC leaders and analysts, operational threat intelligence focuses on understanding hacker techniques and actively preventing potential threats.

### Tactical Threat Intelligence
Essential for rapid incident response teams, tactical threat intelligence provides precise threat indicators to assess the current situation and take appropriate measures to mitigate the impact and resolve the situation at hand.

 

## What Does ThreatVision Offer?
ThreatVision offers a comprehensive library of threat intelligence features to cater to various cybersecurity team members, enhancing internal collaboration and response efficiency.

- **Indicators of Compromise (IOCs)**: IOCs provide rapid threat identification and serve as essential clues for tracing attack sources within an enterprise.
- **Threat Hunting Tools**: These tools offer direct detection capabilities to quickly understand the current environment and identify potential issues.
- **Intelligence Reports**: TeamT5's most renowned resource, intelligence reports offer multi-dimensional analysis of hacker behavior, providing a deeper understanding of incidents and the motives behind hackers' actions.
- **Adversary and Malware Gallery**: Contains a comprehensive library of first-hand files on malicious groups and programs, enabling organizations to understand threat sources.
- **RFI Service**: Analysts provide customized reports and tool services to customers.
- **API Service**: Allows for quick integration of platform resources to facilitate automation.

 

##Meeting Customer Needs with Actionable Intel
ThreatVision addresses various customer needs through its diverse offerings:

### Threat Identification and Technical Details
ThreatVision quickly identifies malware and adversaries and provides technical details, backgrounds, and attack methods commonly used by them. It serves as a one-stop intelligence platform for enterprise security teams, helping them allocate security budgets more effectively.

### Auto-Analysis Sandbox Service
This service offers fast automated analysis, allowing users to choose specific samples for further manual analysis by TeamT5's expert analysts.

### Customized Intelligence Investigation and Consulting Services
TeamT5 offers tailored services to meet intelligence investigation and consulting requirements.

### Threat Hunting Tools and API Integration
ThreatVision's Threat Hunting Tools enable users to proactively confirm their own situation and ensure environmental security. The API service provides convenient access to intelligence, reducing the burden on personnel and facilitating integration into automated processes.

 

## Actionable Intelligence Through Reports
ThreatVision's intelligence reports fall under three categories: APT in Asia, Vulnerability, and Cyber Affairs. These reports provide invaluable insights for decision-making and response.

 
![pic_how-threat-vision-helps-fight-against-apts-through-cyber-threat-intelligence.jpg](https://uploads.teamt5.org/upload/original/pic_how-threat-vision-helps-fight-against-apts-through-cyber-threat-intelligence.jpg)
 

### APT in Asia Flash Reports
TeamT5’s APT in Asia Flash (aka Flash Report) provides timely, accurate, and actionable intelligence. Users can use Flash Reports to get just-in-time alerts of the latest APT intrusions. Flash Reports are published twice a week. Each Flash Report details a specific targeted attack and provides all essential IOCs.

### APT Campaign Tracking Reports
APT Campaign Tracking Report (aka CTR) provides TeamT5’s comprehensive understanding of significant threat groups and campaigns. Users can use CTR to enhance their knowledge of trends and challenges in the APAC region with a broader perspective. TeamT5 publishes two CTRs at the end of every quarter. Each CTR provides an in-depth analysis on a particular threat group/campaign, covering its TTPs, target scope, etc., over the past 2-3 years. Moreover, at the end of Q2 and Q4, CTRs provide an APT Threat Landscape report covering major incidents, popular TTPs, most targeted industries, and top malwares/APTs over the past two quarters.

### APT in Asia Monthly Reports
TeamT5’s APT in Asia Monthly (aka Monthly Report) provides strategic and actionable intelligence in the Asia Pacific region. Monthly Reports connect the dots between cyberattacks and recent political events, policies, and foreign affairs. Users can use Monthly Reports to understand the latest trends and the current threat landscape. Monthly Reports are published every month. Each Monthly Report summarizes 13-16 APT attack cases in the Asia Pacific region over the past month.

### Cyber Affairs Biweekly Reports
TeamT5’s Cyber Affairs Biweekly Report (aka Biweekly Report) provides strategic cyber intelligence about the Chinese-speaking cyber world. Users of the Biweekly Report can understand the cyber capabilities of the emerging superpower, China. The Biweekly Report is published every two weeks. Each Biweekly Report provides a quick recap of cybersecurity news in the Chinese-speaking cyber world, covering the latest policies, regulations, and cyber incidents.

### Vulnerability Insights Reports
TeamT5’s Vulnerability Insights Report (aka VIR) provides technical details about critical and highly exploitable vulnerabilities. Users can use VIRs to mitigate the threat posed by these critical and highly exploitable vulnerabilities. VIR is published every two weeks. Each VIR focuses on one critical and highly exploitable vulnerability. Moreover, VIRs depict the possible attacking scenarios and provide detection tools.

### Patch Management Reports
TeamT5’s Patch Management Report (aka PMR) provides all the relevant information on all critical and highly exploitable vulnerabilities. Users can use PMRs to prioritize their patch management. PMRs are updated every two weeks. Each PMR summarizes around 100 of the most critical vulnerabilities during the period in a table, and lists all the essential information about these vulnerabilities, such as the affected products, patching details, and even publicly available PoC codes.

 

## Summary
ThreatVision, developed by TeamT5, is a game-changer in the fight against Advanced Persistent Threats. With our unparalleled expertise in the Asia-Pacific region, ThreatVision provides actionable threat intelligence that empowers governments and companies to make informed decisions, proactively manage risks, and swiftly respond to cyber incidents. As the cyber threat landscape continues to evolve, ThreatVision stands ready to protect organizations and secure the digital world against APTs. 

To get started, contact your TeamT5 representative and apply for a 14 day ThreatVision trial account, or email us at sales@teamt5.org if you are new to our products and wish to learn more. We look forward to keeping your organization safe.

How ThreatVision Helps Fight Against APTs Through Cyber Threat Intelligence

在當今的數位環境中，資訊安全已成為全球政府和公司最關心的問題之一。 隨著進階持續性威脅 (APT) 等複雜多變的網路威脅興起，企業與組織需要強大且專業的工具，以有效應對這些持續變化、演進的危險。 這就是 TeamT5 威脅情資平台 ThreatVision 能夠發揮關鍵功用之處，其提供深度專業知識和威脅情資，幫助亞太地區的政府和企業。

 

## ThreatVision 協助企業超前部署，抵禦資安威脅

TeamT5 專注亞太地區威脅情資研究，備受肯定，20多年來一直為此區域的網路威脅情資研究領導品牌。 我們的中文語言優勢和地緣政治知識，再加上十年的惡意程式和 APT 研究經驗，使我們對 APT 攻擊族群，特別是來自中國的攻擊族群有深入的了解和研究能力。 我們的專業知識為我們贏得參加世界級會議的邀請，進一步鞏固了我們作為亞太地區 APT 威脅情資首選的名聲，特別是對於那些希望防禦中國威脅的企業、組織。

## 威脅情資的重要性
威脅情資在公司的資訊安全戰略中發揮關鍵作用。 它扮演三個關鍵角色：協助決策者、支持風險管理者和支持事件回應者。 TeamT5 認為每種威脅情資皆十分重要，包括：

### 戰略威脅情資
戰略威脅情資對於負責決策的高階管理人員至關重要，它可以協助企業洞察整體的威脅形勢，識別針對企業的惡意攻擊者，並闡明攻擊者的目標。

### 營運威脅情資
對於安全營運中心 (SOC) 領導者和分析師來說至關重要，營運威脅情資協助企業專了解惡意攻擊者技術，並積極預防潛在威脅。

### 戰術威脅情資
此類對於快速事件應變團隊 (incident response team) 來說非常重要，特別是戰術威脅情資提供精確的入侵指標 (IOC)，協助企業評估當前情況並採取適當措施，減輕、解決資安威脅。

 

## ThreatVision 特點
ThreatVision 提供全面的威脅情資功能庫，滿足各種網路安全團隊成員的需求，更能增強內部協作和回應效率。

- **入侵指標 (IOC)**：IOC 提供快速威脅識別，並作為追蹤企業內攻擊來源的重要線索。
- **威脅狩獵工具**：這些工具提供直接檢測功能，可快速了解當前環境並識別潛在問題。
- **情資報告**：TeamT5 最著名的資源，情資報告提供對駭客行為的多維度分析，讓您更深入地了解事件和惡意攻擊者行為背後的動機。
- **惡意攻擊者和惡意軟體庫**：包含有關惡意攻擊者組織、惡意軟體的第一手文件的綜合庫，使企業能夠了解威脅來源。
- **RFI 服務**：分析師為客戶提供客製化報告和工具服務。
- **API 服務**：可快速整合平台資源，方便自動化。

 


##透過可行的威脅情資滿足客戶需求
ThreatVision 透過其多樣化的產品滿足各種客戶需求：

### 威脅識別與技術細節
ThreatVision 可以快速識別惡意軟體和攻擊者，並提供他們常用的技術細節、背景和攻擊方法。 本平台為企業的資訊安全團隊提供一站式情資平台，以利更有效地分配安全預算。

### 自動分析沙箱服務
該服務提供快速的自動化分析，讓使用者可以選擇特定樣本，由 TeamT5 的專家分析師進行進一步的手動分析。

### 客製化情資調查諮詢服務
TeamT5 提供量身訂製的服務，以滿足情資調查和諮詢需求。

### 威脅追蹤工具和 API 整合
ThreatVision 的威脅狩獵工具有助使用者主動確認自身情況並確保環境安全。 API 服務提供更簡易的資料獲取途徑，減輕人員負擔，並有利於整合到企業的自動化流程中。

 

## 透過報告提供可行的情資
ThreatVision 的情資報告分為三類：亞洲 APT、漏洞和網路事務。 這些報告為決策和回應提供了寶貴的見解。

 
![pic_how-threat-vision-helps-fight-against-apts-through-cyber-threat-intelligence.jpg](https://uploads.teamt5.org/upload/original/pic_how-threat-vision-helps-fight -against-apts-through-cyber-threat-intelligence.jpg)
 

### APT 威脅情資週報
TeamT5 在 APT 威脅情資週報（又稱 Flash Report）提供及時、準確且可妥善利用的情資。 使用者可以使用週報，獲得最新 APT 入侵的即時警報。週報於每週發布兩次，每個報告都詳細說明了特定的目標攻擊並提供所有必要的 IOC。


### 威脅族群追蹤報告
威脅族群追蹤報告（又稱 CTR）提供 TeamT5 真對重大惡意攻擊者團體和活動的全面分析。 使用者可以利用此報告，以更廣闊的視角，深度了解對亞太地區威脅情勢和挑戰。 

TeamT5 在每個季度末發布兩個威脅族群追蹤報告。 每份威脅族群追蹤報告都提供對特定威脅團體/活動的深入分析，涵蓋過去 2-3 年的戰術、技巧和程序 (TTP)、目標範圍等。 此外，本報告在第二季末和第四季末提供了 APT 威脅態勢分析，涵蓋過去兩個季度的重大事件、熱門 TTP、受到威脅族群鎖定的產業以及重大惡意軟體/APT。

### APT 威脅情資月報
TeamT5 的APT 威脅情資月報提供亞太地區的策略性和可指引防禦行動的威脅情資。月報將網路攻擊與最近的政治事件、政策和外交事務脈絡進行連結與分析，因此使用者可以運用此報告來了解最新趨勢和當前威脅情勢。

此報告每月發布，每份月報總結了過去一個月亞太地區發生的 APT 攻擊案例。

### 亞太網路雙週報
TeamT5 的亞太網路雙週報提供有關中文網路世界的策略網路情資，藉此報告使用者可以了解新興超級大國中國的網路能力。 

雙週報每兩週發布一次。每份報告快速回顧中文網路世界的網路安全新聞，涵蓋最新政策、法規和網路事件。

### 漏洞情資報告
TeamT5 的漏洞情資報告（又稱 VIR）提供了關鍵且高度可利用的漏洞之技術詳細資訊。 使用者可以運用此報告，減輕這些漏洞所造成的威脅。 

此報告每兩週發布一次。每份報告都專注於一個關鍵且高度可利用的漏洞。 此外，VIR 描述了可能的攻擊場景並提供偵測工具。


### 漏洞修補管理報告
TeamT5 的漏洞修補管理報告（又稱 PMR）提供了所有關鍵且高度可利用的漏洞的所有相關資訊。 使用者可以使用此報告，來確定補丁管理的優先順序。 

漏洞修補管理報告為每兩週更新一次。每個報告都以表格形式總結了該期間約 100 個最關鍵的漏洞，並列出了有關這些漏洞的所有基本資訊，例如受影響的產品、補丁詳細資訊，甚至公開可用的 PoC 程式碼。

 

##結論
ThreatVision 由 TeamT5 開發，是對抗進階持續性威脅的關鍵。 憑藉我們在亞太地區無與倫比的專業知識，ThreatVision 提供具可妥善利用的威脅情資，使政府和公司能夠做出明智的決策、主動管理風險並快速回應網路事件。

隨著網路威脅情勢的不斷發展，ThreatVision 隨時能保護企業、組織，並確保數位世界免受 APT 攻擊。

獲得解決方案試用、了解更多資訊，請立刻聯絡我們: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

如何透過 ThreatVision 威脅情資平台，對抗進階持續性威脅(APT)

威脅偵測與應變服務（MDR）是由專業的資安團隊提供深度與廣度兼具的代管服務，有效協助企業妥善保護其系統環境和機密資訊。根據國際研究公司 Gartner 的報告指出，預計 2025 年逾50% 的企業或組織，將採用 MDR 服務，提升資安韌性。

![how-do-enterprises-choose-best-mdr-provider_pic.jpg](https://uploads.teamt5.org/upload/original/how-do-enterprises-choose-best-mdr-provider_pic.jpg)

 

而選擇企業適合的 MDR 廠商，更顯重要。不僅須考量價格，更應考量該服務能否為企業帶來最佳效益，考量的項目包含：

- MDR 廠商是否具有優秀的威脅狩獵能力，能夠掌握威脅入侵的整體狀況?
- MDR 廠商的服務團隊中有多少資安分析師將支援您的企業?
- 當資安威脅事件發生時，MDR 廠商是否有能力進行分析，並識別不同類型的威脅?
- MDR 廠商是否能迅速協助您的企業，採取適當的應變措施?
- MDR 廠商是否能有效協助您的企業，進行系統等方面的復原?

 

這些項目不僅仰賴廠商多年專業經驗，也考驗廠商是否具有專業的知識背景。而其中最關鍵的區別點即是該廠商是否具備完整、專業的威脅情資資料庫。

俗話說，「知己知彼，百戰百勝」，威脅情資即是資安威脅事件應變中，最重要的制敵關鍵，指引事件處理人員直搗問題關鍵，採取正確工具與手法，解決問題所在。而建立並維護威脅情資資料庫，需要人員花費長時間的觀察與研究，深度剖析不同駭客族群的攻擊手法，並且持續追蹤網路世界的暗網情資。

企業在選擇適合的 MDR 服務廠商時，宜考慮擁有豐富威脅情資的廠商，就像戰場上掌握敵軍動向的情蒐人員，運用這些情報，為企業建構更廣的守備範圍，強化偵測和應變能力，抵擋駭客攻擊。

 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，掌握深度專業威脅情資，並提供威脅偵測應變代管服務（MDR） 與端點偵測與回應解決方案（EDR）。已協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>進一步了解: [TeamT5 杜浦數位安全的 MDR 服務](https://teamt5.org/tw/service/mdr/?utm_source=blog&utm_medium=website) 
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

企業如何選擇適合的 MDR 服務廠商?

MDR 全名是威脅偵測與應變服務（managed detection and response），是讓企業使用者享受專業資安技術人員所提供的服務，如全時的監測、威脅告警、資安事件應變及威脅狩獵等。此外，部分 MDR 廠商會為定期提供風險評估或報告，讓企業能隨時掌握內部環境現況。

MDR 服務對於現今企業營運至關重要。國際顧問諮詢公司 PwC 於2022年《全球數位信任洞察報告》（Global Digital Trust Insights Survey）中，針對來自全球65個國家、共3522位企業職員和高階主管進行調查，發現過去三年中，全球有 27% 企業因發生資料外洩事件而遭受財務損失；損失金額主要落在100萬至2,000萬美元區間，甚至更多。

換言之，高達四分之一的企業，面臨台幣上千萬、甚至上億的財務損失，非常可觀。

![why-do-enterprise-need-managed-detection-and-response-service-mdr_pic.jpg](https://uploads.teamt5.org/upload/original/why-do-enterprise-need-managed-detection-and-response-service-mdr_pic.jpg)

 

即便近年來資安意識高漲，大型企業有能力成立專責的資安團隊，然而根據國際資安核准聯盟的調查，資安人才的缺口在今年已經達到 65%。意味著專業人才的缺乏，已經導致企業想要找人也找不到，更不用說資源有限的中小型企業，更無力面對這樣的困境。

MDR 服務即是彌補這些空缺，為企業並將損害降到最低。且根據國際研究公司 Gartner 的報告指出，預計 2025 年逾50% 的企業或組織，將採用 MDR 服務，顯見導入 MDR 服務已成趨勢。

透過 MDR 廠商的專業團隊與企業協力，有效共同對抗資安威脅，企業將有效提高資安防禦，專注商業營運。

 
 
資料來源：
- PwC: 2022年《全球數位信任洞察報告》（Global Digital Trust Insights Survey）https://www.pwc.com/dti2022
- Gartner: https://www.gartner.com/doc/reprints?id=1-2C2A0LS9&ct=221220&st=sb+

 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，掌握深度專業威脅情資，並提供威脅偵測應變代管服務（MDR） 與端點偵測與回應解決方案（EDR）。已協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>進一步了解: [TeamT5 杜浦數位安全的 MDR 服務](https://teamt5.org/tw/service/mdr/?utm_source=blog&utm_medium=website) 
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

企業需要威脅偵測應變代管服務(MDR)嗎?

##什麼是 MDR? 
MDR 全名是 Managed Detection and Response，指的是威脅偵測與應變服務。這是由專業的資安團隊提供深度與廣度兼具的代管服務，有效協助企業妥善保護其系統環境和機密資訊。

由於攻擊者的技術和手段不斷變化，傳統的資安解決方案已經無法提供足夠的保護，因此越來越多的企業開始採用 MDR（Managed Detection and Response）服務。 

##MDR 服務對企業的好處是什麼？

首先，MDR 服務提供持續監測威脅的能力。通過即時監控企業網路和系統，MDR 團隊能夠快速識別和分析潛在的威脅，確保企業能夠及時發現並應對安全事件，減少潛在的損失和停機時間。

其次，MDR 服務提供高度專業化的威脅回應能力。 MDR 團隊中的資安專家具備深度資安知識和經驗，能夠快速回應各種威脅事件。他們能夠進行迅速的調查、分析和應對，以最小化潛在的損害，並追溯攻擊源頭。這種專業化的威脅回應能力，對於保護企業免受攻擊的影響至關重要。

此外，MDR 服務還強調了數據分析和威脅情資驅動的方法。通過使用先進的分析工具和技術，MDR 團隊能夠從大量的安全事件資訊中提取有價值的信息，並進行威脅情資分析。這使企業能夠更好地了解攻擊者的策略和技術，並採取相應的防禦措施，以增強資訊安全防禦能力。

MDR 服務還具備彈性、靈活的優勢。企業的安全需求可能會隨著時間和規模的變化而改變，而傳統的安全解決方案往往難以適應這種變化。 MDR 服務提供商能夠根據企業的需求進行靈活調整，為其提供所需的資源和能力，以應對不斷變化的威脅環境。

另一個關鍵的優勢是 MDR 服務的綜合性。與傳統的安全解決方案相比，MDR 服務涵蓋了整個安全生命週期，從威脅檢測到響應和恢復。這意味著企業無需自行部署和維護複雜的安全基礎設施，而可以將精力集中在核心業務上，同時獲得全面的安全保護。

最後，MDR 服務還提供了更好的安全可見性。通過即時監測和威脅檢測，MDR 團隊能夠提供詳盡的安全報告和分析，讓企業了解其環境的安全狀況。這種安全可見性對於合規性要求和法規遵循非常重要，幫助企業證明其安全控制和合規性。

##MDR 服務協助企業增強營運韌性

綜上所述，MDR 服務具有持續監測和威脅檢測、專業化的威脅回應能力、數據分析和威脅情資驅動、彈性與靈活性、綜合性以及安全可見性等特點。企業評估自身需求，選擇適合的 MDR 服務提供商，能夠有效提高其資訊安全防禦能力，及時發現並應對威脅，保護其機密資訊和關鍵資產，確保業務的連續性和穩定性。

>TeamT5 杜浦數位安全團隊專精網路威脅研究，掌握深度專業威脅情資，並提供威脅偵測應變代管服務(MDR) 與端點偵測與回應解決方案(EDR)。已協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>進一步了解: [TeamT5 杜浦數位安全的 MDR 服務](https://teamt5.org/tw/service/mdr/?utm_source=blog&utm_medium=website) 
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

什麼是 MDR？ MDR 服務對企業的好處是什麼？

脅威インテリジェンスは情報セキュリティ防御の基礎であると主張し、アクション指向のローカル インテリジェンスの提供に重点を置いています。 クライアントが攻撃を予測し、事前に防御戦略を展開し、損失のリスクを軽減するのを支援します。

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/xbK3-oQVaJs?si=EP1DqSbNQuBSkffK" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

ThreatVision は、リアルタイム警告、技術データ、OSINT 分析、精密 APT 調査を提供する、顧客参加型の脅威情報のプラットホームです。当社のプラットフォームは、作戦行動から戦略計画まで、脅威情報を適用するための多段階のアプローチを用意しており、既知のサイバー脅威や潜在的なサイバー脅威を正確に判断することができます。

インテリジェンスがサイバー防御を推進: ThreatVision

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance.

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/KB_U_oJIi2Q?si=e_VvRIP7W9vp86eW" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

ThreatVision is TeamT5's customer-engaged threat intelligence platform that provides early warnings, technical data, OSINT analysis, and in-depth APT investigation. Our platform possesses multi-level approaches to apply intelligence, from operational actions to strategic planning, which allows implementing precise measures to occurred or hidden threat.

Intelligence-Driven Cyber Defense: ThreatVision

TeamT5 威脅情資團隊創立於台灣，深耕亞太區域，具備逾20年的威脅情資研究資歷、逾1,000件資安事件應變與處理經驗，提供來自亞太區域、與臺灣企業最切身相關的深度威脅情資。

ThreatVision 威脅情資平台適用於需要資安風險預測與預防之企業，及希望優化資安決策、透過入侵指標快速應變的企業。

了解更多: [https://teamt5.org/tw/products/threatvision/](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/1kaL4WqOG38" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</center>

情資驅動資安防禦: ThreatVision 威脅情資平台

NIST サイバーセキュリティフレームワークは、米国標準技術研究所によって提案された体系的、標準的フレームワークです。企業が自社でサイバーセキュリティの欠陥を調べ、具体的な計画を持って防御強化をすることに役立ちます。 [基本的な紹介](https://teamt5.org/jp/posts/how-to-check-cyber-resilience-of-the-enterprise-based-on-nist-cybersecurity-framework/)については、こちらの記事をご参照ください。

当記事では、NIST サイバーセキュリティフレームワークのコアを構成する5つの機能に基づいた、企業がサイバーセキュリティの状況を確認する方法をご紹介します。これにより、企業がサイバー防御能力を強化し、セキュリティの強靭性を高める目標の達成を促します。


## 識別(Identify)

企業の情報資産リストを作成し、保護する必要がある重要な情報資産を明確にします。同様に、ソフトウェアのリストを作成して、どのソフトウェアに脆弱性があるかを把握し、製造元の情報を参照しながらアップデートを行います。

また、データ管理ポリシー、システム特権アカウント管理リストなどを作成し、社内のサイバーセキュリティ状況を把握します。その他、具体的に実施できる事項は、321原則に従った、データのバックアップ、外部サービスパートナー（サイバーセキュリティチーム、法務チーム、広報チーム）の準備、サイバーセキュリティの保険加入、教育訓練の実施、サイバーセキュリティ訓練の実施などが挙げられます。

## 防御(Protect)

攻撃者が侵入する経路を遮断、及び考えられるすべての攻撃経路に保護を施して、完全なアクセス制御を行い、最小特権の原則を採用します。

具体的な対策は以下の通りです。

**設定:**
- ネットワークセグメントの計画策定と実施
- セキュリティポリシーの設定、継続的なメンテナンスと確認：システムアカウント、ファイアウォール、外部サービス

**アカウント:**
- アカウントセキュリティポリシーと継続的な確認
- アカウント管理、パスワード設定、アクセス権限の適用と停止、特権アカウントの設定と管理
- 外部からアクセス可能なアカウントポリシーと管理:MFA、最小権限

**脆弱性管理:**
- 脆弱性の管理、更新プロセス、アクセス管理、セキュリティ保証のメカニズム

**防御:**
- 様々な侵入経路に対する防御策の確立:IPS、WAF、EPPなど
- 防御メカニズムが最新であることの確認
- 侵入経路の制限と管理: 例)USBを使用しない


## 検知(Detect)
完全な記録(ログ)を収集並びに不審なトラフィックや行動を監視するメカニズムを導入し、異常な動作を積極的に探すことが重要です。

また、サイバーセキュリティソリューションが発するアラートについても、重要なアラートを区別、及び攻撃の状況を把握し、サイバーセキュリティ対応に適切なリソースを投入することが肝心です。


## 対応(Respond)
フレームワークの中核となる「対応」の目的は、損失を最小限に抑え、状況を迅速に解決し、侵入の原因を特定することです。
上記のステップを段階的に実行することで、企業の損失を最低限に減らすことができます。したがって、実際のセキュリティインシデントが発生した場合に適切な対応ができるよう、平時からチームメンバーがどのように対応すべきかを具体的に定めたインシデント対応計画を策定する必要があります。

具体的に実行可能な対策は以下の通りです。

**ヒエラルキーコントロール**
- 被害状況や影響範囲の確認、状況の制御、損失の軽減

**記録**
- 証拠の保全、様々なシステムログ収集メカニズム、集中化やバックアップの確保

**調査**
- 侵入原因の追跡と被害状況の把握

**連絡**
- 社内窓口、社外窓口、報告窓口、責任者、コーディネーター、社内外への状況説明
- 外部チームの支援と通報
- 法務、広報、保険会社へ協力の要請

**チーム**
- セキュリティインシデント対応チームへ支援の要請(詳細については、こちらの記事をご参照ください)

**ポリシー**
- サイバーセキュリティインシデント対応(incident response)プロセス
- 標準化された通知プロセス
- コンプライアンス

 
 
さらに、ランサムウェアによる攻撃を受け、攻撃者がデータの身代金を要求してきた場合、企業は交渉の計画を立て、身代金の支払いに備える必要もあります。

 
 

>TeamT5はアジア太平洋地域におけるサイバー脅威の研究を専門としているサイバーセキュリティ・ソリューションプロバイダーです。脅威インテリジェンスを主軸にしたサービスを提供しており、脅威アクターの監視、分析、追跡を行い、顧客のエンドポイントを標的型攻撃からお守りします。
>
>米国、台湾、日本の幅広い業界の顧客にサービスをご利用いただいております。
>
>企業のサイバーセキュリティ対策は簡単に実施できます。ご興味のある方は、是非お問い合わせください。：
https://teamt5.org/tw/request-information/

NIST サイバーセキュリティフレームワークに基づいて、企業のサイバーセキュリティ状況を確認するには?

The NIST Cybersecurity Framework is proposed by the U.S. National Institute of Standards and Technology. Through systematic and structured standards, it helps companies examine the deficiencies of their own cybersecurity defenses and make enhancements for specific projects. For a basic introduction, please refer to [this article](https://teamt5.org/en/posts/what-is-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website).

Based on the five areas of the NIST Cybersecurity Framework, this article provides tips for checking the status of enterprise cybersecurity defenses, aiming to help enterprises & organizations enhance their cybersecurity defense capabilities and achieve high-level cybersecurity resilience goals.

## Identify
First, you need to make a list of corporate digital assets to clarify which are important digital assets and need to be protected. You also need to make a list of software to understand which software may have vulnerabilities. You need to refer to the original manufacturer information and update it.

Enterprises should also establish data management policies, system privileged account management lists, etc., to understand the internal cybersecurity situation. Other specific matters that can be carried out include: following the 321 principle and backing up data; preparing external service partners (cybersecurity team, legal team, public relations team), purchasing cybersecurity insurance, conducting education and training, and conducting cybersecurity drills.


## Protect
Enterprises should block the channels for attackers to invade, add protection to all possible attack channels, conduct complete permission control, and adopt the principle of least privilege.

Specific measures include:

 
**Setting:**
- Network segment planning policies and implementation
- Security setting policy and ongoing maintenance and confirmation: system accounts, firewalls, external services

 
**Account:**
- Account Security Policy and Continuous Verification
- Account management, password specifications, permission application and deactivation, privileged account specifications and management
- Externally accessible account policy and management: MFA, least privilege

 
**Vulnerability management:**
- Vulnerability management and update process, rights and responsibilities, and assurance mechanism

 
**Defense:**
- Establish defense measures against various intrusion channels: IPS, WAF, EPP, etc.
- Ensure defense mechanisms are updated
- Intrusion pipeline restriction and management: for example: disabling flash drives

## Detect
It is recommended that enterprises collect complete records (logs), deploy suspicious traffic or behavior monitoring mechanisms, and proactively look for any suspicious traffic or behavior.

Regarding the alerts issued by the cybersecurity solution, important alarms should also be distinguished, and the attack situation should be understood from them, so that appropriate resources can be deployed for the cybersecurity response.

## Respond
The goal of "response" is to minimize losses, quickly resolve situations, and find the cause of the intrusion.

If the above steps can be implemented in a step-by-step manner, it will help reduce corporate losses. Therefore, companies should formulate incident contingency plans at ordinary times, specifically listing how team members should respond when encountering a security incident, so as to avoid the actual occurrence of security incidents. Failure to respond appropriately.

Specific executable measures include:
 
 
**Control hierarchy**
- Confirm the damage and scope of impact, control the situation, and reduce losses

 
**Record **
- Retain evidence and ensure various system log collection mechanisms, centralization and backup

 
**Investigation**
- Tracing the cause of the intrusion and assessing the damage

 
**Contact**
- Internal and external contact, reporting window and rights and responsibilities, coordination, internal and external explanations
- External team assistance and reporting
- Seek assistance from legal affairs, public relations, and insurance companies

 
**Team**
- Seek assistance from the security incident response team (please refer to this article for details)

 
**Policy**
- Cybersecurity incident response (incident response) process
- Standardized notification process
- Compliance

## Recovery 
The goal of "recovery" at the core of the framework is the data backup and recovery mechanism. Enterprises should do system recovery and service recovery according to standard procedures. And it’s crucial for enterprises to formulate a disaster recovery plan and business continuity plan in advance, and execute drills.

 

In addition, if you are attacked by ransomware and the attacker demands a ransom for your data, companies must also plan for negotiations and prepare for ransom payments. 

 
 

>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
 
>Contact us and start cyber defense plan: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

How to Check  the Cybersecurity Defense Status of the Enterprise  according to the NIST Cybersecurity Framework?

NIST 資安框架由美國國家標準與技術研究所提出，透過有系統、有架構的標準，協助企業檢視自身資安防禦的不足，並針對特定項目進行補強。基本介紹可參考[此文](https://teamt5.org/tw/posts/what-is-nist-cybersecurity-framework/?utm_source=blog&utm_medium=website)。

本文依據 NIST 資安框架的5大框架核心，提供檢查企業資安防禦狀況的訣竅，希望協助企業增強資安防禦力，達成高度資安韌性目標。

##Identify 辨識
首先需列出企業資訊資產清單，釐清哪些是重要資訊資產，需要保護；也需列出軟體清單，以便掌握哪些軟體可能存在漏洞，需參考原廠資訊、進行更新。

企業也應建立資料管理政策、系統特權帳號管理清單等，掌握內部資安全貌。其他可以進行的具體事項還包含：遵循321原則，進行資料備份；準備外部服務合作對象 (資安團隊、法務團隊、公關團隊)、採購資安險、進行教育訓練、進行資安演習。


##Protect 保護
企業宜堵住攻擊者入侵的管道，在所有可能攻擊途徑加上防護，進行完整權限控，並採取最低權限原則。

具體措施包含：
 
 
**設定層次：**
- 網段規劃政策與落實
- 安全設定政策與持續維護與確認: 系統帳號、防火牆、對外服務

**帳號層次：**
- 帳號安全政策與持續確認
- 帳號管理、密碼規範、權限申請與停用、特權帳號規範與管理
- 外部可存取帳號政策與管理: MFA、最低權限

**漏洞管理層次：**
- 漏洞管理與更新流程、權責，和確保機制

**防禦層次：**
- 針對各種入侵管道建立防禦措施: IPS, WAF, EPP 等
- 確保防禦機制的更新
- 入侵管道限制與管理: 例如停用隨身碟


##Detect 偵測
建議企業完整收集紀錄 (log)，部署可疑流量或行為監控機制，並主動找尋任何可疑流量、行為。

針對資安解決方案發出的告警(alert)，也應區別出重要的告警，並從中了解攻擊態勢，才能部署適當的資源，進行資安應變。

##Respond 應變
框架核心「應變」之目標為極小化損失、快速解決狀況、找到入侵原因。

上述步驟若能有按步驟實施，有助降低企業損失，因此企業平時即應制定事件應變計畫，具體列出遭遇資安事件時，團隊成員該如何應對，才能避免資安事件實際發生時，未能妥善應對處理。

具體可執行的措施包含：
 
**控制層次**
- 確認損害、影響範圍，控制狀況，降低損失

**紀錄層次**
- 保留證據，確保各種系統 log 收集機制、集中與備份

**調查層次**
- 追查入侵原因與損害評估

**聯繫層次**
- 對內對外聯繫、回報窗口與權責、協調、對內外說明
- 外部團隊協助、報案
- 尋求法務、公關、保險公司協助

**團隊層次**
- 尋求資安事件應變團隊協助 ( 詳細可參考[本文](https://teamt5.org/tw/posts/how-to-collaborate-with-incident-response-team/?utm_source=blog&utm_medium=website) )

**政策層次**
- 資安事件應變(incident response)流程
- 標準化通報流程
- 法規遵循

##Recovery 復原
框架核心「復原」的目標為資料備份與復原機制，企業應按標準流程進行系統復原、服務復原，因此事先制定災害復原計畫(disaster recovery plan)、營運持續計畫(business continuity plan)，並執行演習，十分關鍵。

此外，若是遭勒索軟體(ransomware)攻擊，攻擊者要求為資料支付贖金，企業也須規劃談判、贖金付款準備。( 防患於未然，防禦勒索軟體攻擊的詳細作法可參考[此文](https://teamt5.org/tw/posts/how-enterprise-can-do-to-protect-from-ransomware-attack/?utm_source=blog&utm_medium=website) )

 
關鍵字: NIST 網路資安框架、NIST CSF
 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

如何依據 NIST 資安框架，檢查企業資安防禦狀況?

## NIST サイバーセキュリティフレームワークとは?

NIST サイバーセキュリティ フレームワークとは、米国標準技術研究所によって提案された体系的、標準的フレームワークです。企業が自社でサイバーセキュリティの欠陥を調べ、具体的な計画を持って防御強化をすることに役立ちます。

 サイバーセキュリティフレームワークは、フレームワークコア（Framework Core）、インプリメンテーションティア（Implementation Tier）、フレームワークプロファイル（Framework Profile）の 3 つの要素で構成されており、企業の様々な部門のメンバーが統一された文書に基づき、サイバーセキュリティ対策について議論できます。
 
## NIST サイバーセキュリティ フレームワークのコアとなる機能とは?

当記事では、5 つの機能に分かれている NIST サイバーセキュリティフレームワークのコアについて具体的に説明します。


**1. 識別 (Identify)**
 
サイバーセキュリティの防御範囲を把握し、遭遇する可能性のあるサイバー脅威の理解を深めます。

**2. 防御 (Protect)**
 
システムの権限を適切に管理し、基礎となるサイバー防御を確立します。

**3. 検知 (Detect)**
 
IT環境とエンドポイントデバイスの稼働状況を包括的に監視し、不審なソフトウェアの動作を適宜検知ならび記録を保存します。 利用可能なツールには、EDRなどがあります。

**4. 対応 (Respond)**
 
ソフトウェアの不審な動作を検知した場合、営業上の損失を回避するために、迅速に対応し、徹底的に調査します。

**5. 復旧 (Recovery)**
 
ソフトウェアの不審な動作により、実際にシステムへの損害やデータ漏洩などが発生した場合は、サイバーセキュリティの専門家にシステムの対処と復旧を依頼します。また、 今後同様のデータセキュリティ損傷を回避するため、復旧プロセスのレビュー記録も作成されます。

 
 

>TeamT5はアジア太平洋地域におけるサイバー脅威の研究を専門としているサイバーセキュリティ・ソリューションプロバイダーです。脅威インテリジェンスを主軸にしたサービスを提供しており、脅威アクターの監視、分析、追跡を行い、顧客のエンドポイントを標的型攻撃からお守りします。
>
>米国、台湾、日本の幅広い業界の顧客にサービスをご利用いただいております。
>
>企業のサイバーセキュリティ対策は簡単に実施できます。ご興味のある方は、是非お問い合わせください。：
>https://teamt5.org/tw/request-information/

NIST サイバーセキュリティフレームワークとは? コアとなる機能は?

## What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework is proposed by the U.S. National Institute of Standards and Technology. Through a systematic and complete framework of standards, it helps enterprises examine the deficiencies of their own security defenses and strengthen them for specific projects.

The NIST Cybersecurity Framework consists of three aspects, including Framework Core, Implementation Tiers, and Framework Profiles, so that members from various departments of the enterprise can discuss cybersecurity defense measures based on the same set of documents.

## What are the Core Concepts of the NIST Cybersecurity Framework?

This article specifically explains the core of the NIST Cybersecurity Framework, which is divided into 5 aspects, including:

**1. Identify**

Enterprises should understand the scope of cybersecurity defense and understand the cybersecurity threats they may encounter.


**2. Protect**

Enterprises should control authority and establish basic cybersecurity defenses.


**3. Detect**

Enterprises should comprehensively monitor the information technology environment and the operating status of endpoint devices to detect suspicious software behavior in a timely manner and also keep complete records. Tools available include endpoint detection strain solutions.


**4. Respond**

If an enterprise detects suspicious software behavior, it should respond quickly and investigate thoroughly to avoid operating losses.


**5. Recovery **

If suspicious software behavior causes actual damage to the system, data leakage, etc., you should seek cybersecurity experts to handle and restore the system. A review record of the recovery process will also be made to avoid similar data security damage incidents in the future.

 
 
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan. 
>
> Contact us and start cyber defence plan: [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

What is the NIST Cybersecurity Framework? What are the Core Concepts?

##什麼是 NIST 資安框架?

NIST 資安框架全稱為 NIST Cybersecurity Framework，是由美國國家標準與技術研究所提出，透過系統性、完整架構的標準，協助企業檢視自身資安防禦的不足，並針對特定項目進行補強。

 資安框架由3種元素組成，包含框架核心(Framework Core)、框架層級(Implementation Tiers)、框架輪廓(Profiles)，以利企業各部門成員可基於同一套文件，詳細討論資安防禦的措施。

##NIST 資安框架的核心是什麼?

![what-is-nist-cybersecurity-framework_pic.jpg](https://uploads.teamt5.org/upload/original/what-is-nist-cybersecurity-framework_pic.jpg)

本文特別說明 NIST 資安框架的核心，其分為5個項目，包含：
 
 
**1. Identify 辨識**
 
企業應了解資安防禦面涵括的範圍，了解可能遭遇的資安威脅。

**2. Protect 保護**
 
企業應做好權限控管，建立基本資安防禦。

**3. Detect 偵測**
 
企業應全面監控資訊環境、端點設備的營運狀況，以便及時測知軟體可疑行為，同時也進行完整紀錄。可採用的工具如端點偵測應變解決方案。

**4. Respond 應變**
 
若企業偵查到可疑軟體行為，宜快速應變，詳盡調查，避免造成營運損失。

**5. Recover 復原**
 
倘若可疑軟體行為造成系統實際損害、資料外洩等問題，應尋找資安專家處理，進行復原。也將復原過程做成檢討紀錄，避免未來遭遇類似資安損害事件。

 
關鍵字: NIST 網路資安框架、NIST CSF
 
 

>TeamT5 杜浦數位安全團隊專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
>輕鬆展開企業資安防禦第一步，立即聯絡我們：
[https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

什麼是 NIST 資安框架? 核心概念是什麼?

TeamT5 杜浦數位安全專注資安威脅情資分析與端點防護解決方案，並成立威脅偵測應變代管服務(MDR)團隊，協助國內外客戶狩獵資安威脅，即時防禦可疑的資安事件。

本次部落格綜合近期威脅狩獵案例，與讀者分享 TeamT5實際如何進行威脅狩獵，給予使用類似資訊系統配置的企業，做為參考。

##事件開端
TeamT5 威脅偵測應變代管服務(MDR)團隊同仁於2023年4月中旬，發現客戶端部署TeamT5 解決方案 ThreatSonar Anti-ransomware(下簡稱ThreatSonar)之設備，跳出勒索事件阻擋告警；團隊同仁即於第一時間通報客戶，客戶表示此端點為伺服器區的資料庫主機。

##事件通報內容
本次事件由 ThreatSonar 雲端平台版本偵測到，標記為高風險事件。TeamT5團隊隨即通報客戶，內容包含有以下資訊：
- 端點HOSTNAME：WEB-DB
- 端點IP：172.16.x.x
- 觸發條件：Ransomware 
- 惡意程式路徑：C:\XXX\example.exe
- 分析結果：端點遭執行勒索軟體，因觸發ThreatSonar勒索防護規則遭攔截
- 處置建議：
 - 透過ThreatSonar對端點進行隔離，避免攻擊者進行橫向移動，減低受害範圍。
 - 進行資安事件調查程序(Incident Response, IR)。

##事件調查
通報完成後，TeamT5 團隊 – 威脅偵測應變代管服務團隊與資安事件調查團隊 – 共同協助客戶進行根因調查，詳細檢視 ThreatSonar 雲端平台上相關主機的報告及客戶端主動提供之 log 檔案。

##事件結果
- 在這次的勒索事件中，ThreatSonar 的掃描報告顯示，除勒索軟體本身之外，並未有其他惡意程式或是木馬軟體存在，因此增加調查的困難度。隨後查閱 eventlog 發現有異常的登入紀錄(EventID 4625)，便與管理者確認來源為對外服務之網頁應用程式主機。
- 可疑來源主機於 ThreatSonar 並無監控記錄，管理者表示這台主機主要負責對外廠商提供網頁服務，並未安裝 ThreatSonar Agent。TeamT5團隊認為這台主機極有可能是攻擊者所使用之跳板，當下請管理者對該主機進行實體隔離，並使用 ThreatSonar 離線掃描工具進行檢測。
- TeamT5 團隊在取得報告之後發現該主機上含有 Webshell 惡意程式和開源內網穿透工具FRP，攻擊者可以透過此 Webshell 對內網進行攻擊(如：遠端指令、竊取帳密、提權、內網探測等行為)。
- TeamT5 團隊在分析相關 log 後確認攻擊者利用客戶網頁之上傳功能漏洞，於數個月前便對客戶網站進行掃描，並於年初上傳了 Webshell 惡意程式，進行後續一連串的探測和攻擊行為。

##本次事件攻擊路徑與時間軸

![teamt5-mdr-team-threat-hunting-case_pic1.JPG](https://uploads.teamt5.org/upload/original/teamt5-mdr-team-threat-hunting-case_pic1.JPG)

 
![teamt5-mdr-team-threat-hunting-case_pic2.JPG](https://uploads.teamt5.org/upload/original/teamt5-mdr-team-threat-hunting-case_pic2.JPG)

##事件後續改善做法
TeamT5 團隊在調查完成之後，對客戶提出以下建議：
- 針對遭勒索攻擊之主機，建議還原取回重要檔案後重建。
- 相關遭利用之主機，建議清除惡意程式和駭客工具。
- 盤點網頁服務中的上傳功能，對前後端進行上傳檔案限制(檔案類型、附檔名、大小)，對於上傳的檔案利用沙箱或是檔案清洗方案進行檢測，並加強具有上傳功能頁面之權限控管。
- 盤點場域內未控管主機，安裝並持續使用 ThreatSonar 監控。
- 對 Webshell 及 FRP 調查中所取得之 Command & Control (C2)位置，於防火牆進行封鎖和關聯，確認是否有其他受害主機。
- 內網劃分區隔，各網段間流量要通過防火牆控管及監控。
- 重設高權限使用者密碼。

##TeamT5 威脅偵測應變代管服務(MDR)團隊呼籲
針對近期攻擊行為，我們建議企業採取以下做法，增強資安韌性，防禦可能的攻擊：
- 採用VPN帳號啟用雙因子驗證(Two-Factor Authentication, 2FA)。
- 加強網頁上傳功能的前後端驗證機制。
- 除重要主機資料定期備份外，勒索軟體第一步會刪除Windows還原點，需要對還原點進行保護措施。

 
 
 

>TeamT5 杜浦數位安全提供威脅偵測應變代管服務(Managed Detection and Response, MDR)，由擅長防禦的專家團隊與企業一同應變，防禦多元的惡意程式入侵；由經驗豐富的專家團隊與企業攜手，防禦持續演進的攻擊手法。
 
>立刻聯絡我們，展開資安防禦第一步: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

威脅狩獵案例分享：勒索軟體入侵之調查與應變

セキュリティは、情報、資産、システム、ネットワーク、および人々を不正なアクセスや危害から保護することを含む重要な概念です。 組織のセキュリティを確保するには、悪意のある攻撃や悪用の恐れなく、すべての従業員が安全に作業できる安全な環境を構築することが含まれます。


組織はサイバー攻撃だけでなく、盗難や破壊行為などの物理的な脅威からも身を守る必要があります。 サイバーセキュリティは、ハッカーによる機密データの盗難や漏洩を防ぐため、今日のデジタル世界では特に重要です。

## 組織を保護するためのツールと実践方法
セキュリティに関しては、組織の安全を確保するために役立つツールや実践方法が数多くあります。 組織には、ファイアウォール、ウイルス対策ソフトウェア、VPNなどの技術的ソリューションから、アクセス制御システムや監視カメラなどの物理的なセキュリティ対策まで、資産を保護するためのさまざまなツールがあります。 組織を保護するために使用できるベストプラクティスをいくつか見てみましょう。

### 1.オンプレミスのセキュリティ
オンプレミスセキュリティとは、組織の物理インフラストラクチャ内にインストールおよび運用されるセキュリティツールとプラクティスを使用することを指します。 このセキュリティへのアプローチにより、組織にセキュリティ対策の制御と監視を強化し、組織固有のニーズに合わせて対策を調整する力を提供します。

組織がオンプレミス環境を保護するために使用できるツールの一部を次に示します。
- ファイアウォールは、送受信されるネットワークトラフィックを監視し、組織のネットワークへの不正アクセスをブロックするセキュリティツールです。 これらはハードウェアベースまたはソフトウェアベースであり、特定の種類のトラフィックをブロックしたり、信頼できる送信元からのトラフィックのみを許可したりするように構成できます。
侵入検知および防御システム（IDPS）は、ネットワークトラフィックを監視して、脆弱性を悪用しようとする試みや異常なトラフィックパターンなど、悪意のある活動の兆候がないか確認します。 IDPSは、特定の送信元からのトラフィックをブロックするなど、攻撃を防ぐためのアクションを実行するように構成することもできます。
- アクセス制御は、機密情報やリソースへのアクセスを許可されたユーザーのみに制限するセキュリティ対策です。 オンプレミスのアクセス制御には、パスワードポリシー、2要素認証、ロールベースのアクセス制御などの対策を含めることができます。
- パッチ管理ツールは、組織がネットワーク上のすべてのデバイスにパッチを特定して展開するプロセスを自動化するのに役立ちます。 最新のセキュリティパッチを適用してソフトウェアを最新の状態に保つことは、あらゆるセキュリティ戦略にとって不可欠です。

オンプレミス セキュリティのトピックへの追加点として、一部の企業 (当社のような) は、高レベルのセキュリティとデータの制御を必要とする組織の特定のニーズを満たすために、オンプレミス セキュリティ ソリューションを提供しています。 オンプレミスモードでは、組織はすべてのデータを独自のサーバーに保持しながら、ファイアウォール、侵入検知システム、マルウェア対策ソフトウェアなどのセキュリティ対策を完全に制御できます。 これは、厳格なデータセキュリティ要件と規制が遵守されている軍事部隊や銀行などの組織にとって特に重要です。

## 2.認証と承認のプロセス
認証プロセスは、組織のデジタル資産を保護し、不正アクセスを防止するために不可欠なツールです。 認証はユーザーまたはデバイスの身元を確認するプロセスであり、承認はユーザーまたはデバイスがシステム内で実行できるアクションを決定するプロセスです。 次のようないくつかの認証方法を使用できます。

- パスワードベースの認証は、最も一般的に使用される認証方法であり、ユーザーはシステムにアクセスするためにユーザー名とパスワードを入力する必要があります。 セキュリティを強化するには、強力なパスワードを推奨し、パスワードの有効期限や2要素認証などのポリシーを実装することが不可欠です。

- 生体認証は、指紋、顔認識、音声認識などのユーザー固有の身体的特徴を使用して身元を認証します。

- 多要素認証では、ユーザーは、パスワードと、モバイルデバイスによって生成されたワンタイムコード、または指紋とスマートカードなど、2つ以上の認証形式を提供する必要があります。

ユーザーが認証されると、承認プロセスが開始され、システム内でユーザーが実行できるアクションが決定されます。 承認は、役割、権限、または場所、時刻、デバイスの種類などの属性に基づいて行うことができます。


アクセス制御リスト（ACL）およびロールベースのアクセス制御（RBAC）を実装すると、機密データやリソースへのアクセスを必要な権限を持つユーザーのみに制限することで、承認プロセスの管理に役立ちます。

### 3. APTとランサムウェア防御

APT（Advanced Persistent Th特定）とランサムウェア攻撃は、今日の組織が直面している最も一般的で壊滅的なタイプのサイバー攻撃の2つです。 APT は、長期間にわたって機密データへの不正アクセスを取得することを目的とした、高度に標的を絞った攻撃です。一方、ランサムウェア攻撃には、データの暗号化と、復号化キーと引き換えに支払いの要求が伴います。 APTやランサムウェアから防御するには、予防策と対応策を含む包括的なセキュリティ戦略を採用する必要があります。

- セキュリティ情報とイベント管理（SIEM）ツールは、組織がネットワークを監視し、APTまたはランサムウェア攻撃を示す可能性のある異常なアクティビティを検出するのに役立ちます。 これらのツールは、組織がインシデントを調査し、セキュリティ問題の根本原因を特定するのにも役立ちます。
- エンドポイントの検出と対応（EDR）ソリューションは、従来のウイルス対策ソフトウェアを回避する可能性のある高度な脅威を検出し、対応するように設計されています。 これらのソリューションは、組織がエンドポイントでAPTとランサムウェアを検出し、発生した損害を封じ込めて修復するのに役立ちます。
- 重要なデータの定期的なデータバックアップは、暗号化されたデータを以前の暗号化されていない状態に復元することで、組織がランサムウェア攻撃から回復するのに役立ちます。 組織は、攻撃が発生した場合にバックアップが侵害されるのを防ぐために、安全なオフサイトの場所にバックアップを保存する必要があります。
- インシデント対応計画：組織は、APTまたはランサムウェア攻撃が発生した場合に取るべき手順を概説した包括的なインシデント対応計画を作成する必要があります。 この計画には、影響を受けるシステムの隔離、利害関係者への通知、法執行機関やその他の第三者の専門家との連携の手順を含める必要があります。

当社のサービスはAIと複数のルールに基づいており、クライアントがサイバー攻撃、特にAPTやランサムウェアと戦うのを支援します。 当社と協力することで、お客様の特定のニーズに合わせた包括的なセキュリティを実装するThreatSonarアンチランサムウェア対策ソリューションの恩恵を受けることができます。

### 4.従業員のトレーニングと意識向上
技術的なツールとソリューションは組織の安全を確保するために不可欠ですが、従業員のトレーニングと意識への投資も重要です。 多くのサイバー攻撃は人為的ミスや過失の結果であるため、従業員は組織のセキュリティチェーンの中で最も弱い部分になることが
あります。

フィッシングメール、ソーシャルエンジニアリング詐欺、パスワード攻撃などの一般的なセキュリティ脅威を認識して回避できるように従業員をトレーニングすることは、攻撃の成功を防ぐのに大いに役立ちます。 さらに、従業員にサイバーセキュリティの最新トレンドを知らせ、セキュリティ意識の文化を醸成することで、従業員がセキュリティを真剣に受け止め、不審なアクティビティを組織の IT チームまたはセキュリティ チームに報告するよう促すことができます。

また、サイバーセキュリティ担当者を継続的にトレーニングして、最新の脅威に備えることも重要です。 たとえば、サイバー レンジ トレーニングでは、IT および OT/ICS 攻撃のシミュレーション、実際のセキュリティ ツール、詳細な指標と分析を使用してセキュリティ オペレーション センターとインシデント対応チームが次の攻撃に備える事を確実にするために行われます。

模擬フィッシング演習やその他の形態のサイバーセキュリティトレーニングを含む定期的なセキュリティ意識向上トレーニングは、従業員が最新のセキュリティ脅威とベストプラクティスについて最新の情報を入手できるようにするのに役立ちます。

## 結論
安全な環境を確保することは、組織の成功にとって非常に重要です。 信頼の向上、法的責任の軽減、効率の向上、評判の向上などのメリットが得られるため、価値ある投資となります。

サイバー脅威が進化し、より高度になるにつれて、組織の保護を支援するために、私たちのような信頼できるパートナー、TeamT5を持つことが重要です。 当社の専門アナリストとThreatSonar アンチランサムウェアテクノロジーにより、お客様のビジネスの安全性は、安心して任せて頂けます。

 
 
※この記事はサイバーニュースとの連携によるものです。
 
※画像提供：Pexels

組織のセキュリティを確保する：ベストツールとプラクティス

Security is an important concept that encompasses the protection of information, assets, systems, networks, and people from unauthorized access or harm. Securing an organization involves creating a secure environment in which all personnel can safely conduct their work without fear of malicious attack or exploitation.

Organizations need to protect themselves against cyber-attacks as well as physical threats such as theft or vandalism. Cybersecurity is especially important in today's digital world, as it can prevent hackers from stealing or compromising sensitive data. 

## Tools and Practices to Secure Your Organization 
When it comes to security, there are many tools and practices that can help organizations stay safe. Organizations have various tools to protect their assets, from technical solutions such as firewalls, anti-virus software, and [VPNs](https://cybernews.com/best-vpn/vpn-for-mac/) to physical security measures like access control systems and surveillance cameras. 
Let's look at some of the best practices you can use to secure your organization.


###1. On-Premise Security
On-premise security refers to using security tools and practices installed and operated within an organization's physical infrastructure. This approach to security provides organizations with more control and oversight over their security measures and the ability to tailor those measures to their organization's specific needs. 

Here are some of the tools that organizations can use to secure their on-premises environments:

- **Firewalls** are security tools that monitor incoming and outgoing network traffic and block unauthorized access to an organization's network. They can be hardware-based or software-based and can be configured to block specific types of traffic or to allow traffic from trusted sources only.
- **Intrusion detection and prevention systems (IDPS)** monitor network traffic for signs of malicious activity, such as attempts to exploit vulnerabilities or unusual traffic patterns. An IDPS can also be configured to take action to prevent attacks, such as blocking traffic from a particular source.
- **Access controls** are security measures that limit access to sensitive information or resources to authorized users only. On-premise access controls can include measures such as password policies, two-factor authentication, and role-based access controls.
- **Patch management tools** can help organizations automate the process of identifying and deploying patches to all devices on their network. Keeping software up-to-date with the latest security patches is essential to any security strategy. 

As an additional point to the topic of on-premise security, some companies (like [ours](https://teamt5.org/en/about-us/?utm_source=blogs&utm_medium=website)) offer on-premise security solutions to meet the specific needs of organizations that require high levels of security and control over their data.
Their on-premise mode allows organizations to have complete control over their security measures, including firewalls, intrusion detection systems, and anti-malware software, while keeping all data on their own servers. This is particularly important for organizations such as military units and banks, which have strict data security requirements and regulations to adhere to.

###2. Authentication and Authorization Processes 
Authorization processes are essential tools to secure an organization's digital assets and prevent unauthorized access. Authentication is the process of verifying the identity of a user or device, while authorization is the process of determining what actions a user or device is allowed to perform within the system.
There are several authentication methods available, including:
- **Password-based authentication** is the most commonly used authentication method, where users are required to enter a username and password to access the system. It’s essential to encourage strong passwords and implement policies such as password expiration and two-factor authentication to enhance security.
- **Biometric authentication** uses unique physical characteristics of the user, such as fingerprints, facial recognition, or voice recognition, to authenticate their identity.
- **Multi-factor authentication** requires users to provide two or more forms of authentication, such as a password and a one-time code generated by a mobile device or a fingerprint and a smart card.

Once a user is authenticated, authorization processes come into play to determine what actions they are allowed to perform within the system. Authorization can be based on roles, permissions, or attributes such as location, time of day, and device type.

Implementing access control lists (ACLs) and role-based access control (RBAC) can help manage authorization processes by restricting access to sensitive data and resources to only users with the necessary permissions.

### 3. APT and Ransomware Defense
APTs (Advanced Persistent Threats) and ransomware attacks are two of the most common and devastating types of cyberattacks that organizations face today. APTs are highly targeted and sophisticated attacks designed to gain unauthorized access to sensitive data over an extended period, while ransomware attacks involve the encryption of data and a demand for payment in exchange for the decryption key.
To defend against APTs and ransomware, organizations must adopt a comprehensive security strategy that includes preventative and responsive measures. 

- **Security Information and Event Management (SIEM)** Tools can help organizations monitor their networks and detect unusual activity that may be indicative of an APT or ransomware attack. These tools can also help organizations investigate incidents and identify the root cause of any security issues.
- **Endpoint Detection and Response (EDR) Solutions** are designed to detect and respond to advanced threats that may evade traditional antivirus software. These solutions can help organizations detect APTs and ransomware at the endpoint, as well as contain and remediate any damage that has been done.
- **Regular Data Backups** of critical data can help organizations recover from a ransomware attack by restoring the encrypted data to a previous, unencrypted state. Organizations should store backups in a secure, off-site location to prevent them from being compromised in the event of an attack.
- **Incident Response Planning**: Organizations should develop a comprehensive incident response plan that outlines the steps to take in the event of an APT or ransomware attack. This plan should include procedures for isolating affected systems, notifying stakeholders, and engaging with law enforcement and other third-party experts.

Our services are based on AI and multiple rules to help clients fight against cyber attacks, especially APT and ransomware. By working with us, you can benefit from our [ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/) Solution, through which we implement comprehensive security tailored to your specific needs.

##4. Employee Training and Awareness
While technical tools and solutions are essential to securing an organization, investing in employee training and awareness is also important. Employees are often the weakest link in an organization's security chain, with many cyber-attacks being the result of human error or negligence.

Training employees to recognize and avoid common security threats such as phishing emails, social engineering scams, and password attacks can go a long way in preventing successful attacks. Additionally, informing employees about the latest cybersecurity trends and creating a culture of security awareness can encourage employees to take security seriously and report any suspicious activity to the organization's IT or security team. 

It’s also critical to continuously train cybersecurity practitioners so they are prepared for the latest threats. For example, [cyber range training](https://cybersecurityguide.org/resources/cyber-ranges/) prepares security operations center and incident response teams with simulated IT and OT/ICS attacks, real security tools, and detailed metrics and analysis to ensure they are ready for the next attack.

Regular security awareness training, including simulated phishing exercises and other forms of cybersecurity training, can help keep employees up-to-date on the latest security threats and best practices.

##Bottom Line
Having a secure environment is crucial for the success of any organization. The benefits of increased trust, reduced legal liability, improved efficiency, and enhanced reputation make it a worthwhile investment. 

As cyber threats continue to evolve and become more sophisticated, it's important to have a reliable partner like us – [TeamT5](https://teamt5.org/) – to help protect your organization. With our expert analysts and [ThreatSonar Anti-ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website) technology, you can rest assured that your business is in good hands. 
 
 
 
*The article is in collaboration with [Cybernews](https://cybernews.com/).
 
*Image courtesy: Pexels

Securing Your Organization: Best Tools And Practices

安全是一個重要的概念，包括保護資訊、資產、系統、網路和人員免受未經授權的訪問或傷害。 確保組織安全的關鍵在於創建一個安全的環境，使所有人員都可以安全地開展工作，而無需擔心惡意攻擊或手邊數位資產遭到濫用。

組織需要保護自己免受網路攻擊以及盜竊或破壞等物理威脅。 網路安全在當今的數位世界中尤其重要，因為它可以防止駭客竊取或洩露敏感數據。

## 確保組織安全的工具和實務做法

在安全方面，有許多工具和實務做法可以幫助組織達到安全營運的目標。 組織擁有各種工具來保護其資產，從防火牆、防毒軟體和 VPN 等技術解決方案，到權限控制系統、監控攝影機等物理安全措施。以下是可用於保護組織安全的實務做法、建議。

### 1. 地端安全
地端安全是指使用在組織的物理基礎設施內，所安裝、運行的安全工具和實務。 這種安全方法使組織能夠更好地控制和監督其安全措施，也可根據組織的特定需求，客製化這些措施。

- 防火牆(firewall)是一種安全軟體，用於監視傳入和傳出的網路流量並阻止對組織網路未經授權之訪問。 它們可以基於硬體或基於軟體，並且可以配置為阻止特定類型的流量或僅允許來自可信來源的流量。
- 入侵檢測和防禦系統 (intrusion detection and prevention systems) 監視網路流量是否存在惡意活動跡象，例如嘗試利用漏洞或異常流量模式。 IDPS 還可以配置特定措施，防止攻擊，例如阻止來自特定來源的流量。
- 權限控制(access control)是一種安全措施，僅允許授權用戶訪問敏感資訊或資源。 地端訪問控制可以包括密碼策略、雙因素身份驗證和基於角色的權限控制等措施。
- 補丁管理工具(patch management tool)可以幫助組織自動化識別補丁，並協助將其部署到網路上所有設備的過程。 讓軟體保持最新的安全補丁對於任何安全策略都是至關重要。

作為地端安全主題的另一個要點，一些公司（例如[我們公司](https://teamt5.org/tw/about-us/?utm_source=blogs&utm_medium=website)）提供端點安全解決方案，以滿足需要高安全性和資料控制的組織之特定需求。 它們的地端模式允許組織完全控制其安全措施，包括防火牆、入侵檢測系統和反惡意軟體，同時將所有資料保留在自己的服務器上。 這對於軍事單位和銀行等組織尤其重要，因為它們有嚴格的資料安全要求和法規遵循需求。

### 2. 認證和授權流程
授權流程是保護組織數位資產，並防止未經授權的訪問的重要工具。 身份驗證是驗證用戶或設備身份的過程，而授權是確定允許用戶或設備在系統內執行哪些操作的過程。 有多種身份驗證方法可用，包括：

- 基於密碼的身份驗證是最常用的身份驗證方法，用戶需要輸入用戶名和密碼才能訪問系統。 鼓勵使用強密碼並實施密碼過期和雙因素身份驗證等策略，來增強安全性，是十分重要的做法。
- 生物辨識身份驗證使用用戶獨特的身體特徵（例如指紋、面部辨識或語音辨識）來驗證其身份。
- 多重身份驗證要求用戶提供兩種或多種形式的身份驗證，例如密碼和移動設備生成的一次性代碼、指紋、智慧卡片。

一旦用戶通過身份驗證，授權過程就會開始發揮作用，以允許他們在系統內執行哪些操作。 授權可以基於角色、權限或屬性，例如位置、一天中的特定時段和設備類型。

實施權限控制列表 (implementing access control list) 和基於角色的權限控制 (role-based access control) 可以通過將對敏感資訊和資源的訪問限制為「僅具有必要權限」的用戶，以協助組織管理授權流程。

### 3. APT和勒索軟體防禦

APT（進階持續性威脅）和勒索軟體攻擊是組織當今面臨的兩種最常見、最具破壞性的網路攻擊類型。 APT 是具有高度針對性和複雜性的攻擊，旨在在較長時間內獲得對敏感資料之未經授權的訪問，而勒索軟體攻擊涉及數據加密和要求付款以換取解密密鑰。

為了防禦 APT 和勒索軟體，組織必須採用包括預防和回應措施等全面安全策略。

- 安全資訊和事件管理 (security information and event M\management , SIEM) 工具可以幫助組織監控其網路並檢測可能表明 APT 或勒索軟體攻擊的異常活動。這些工具還可以幫助組織調查事件，並確定任何安全問題的根本原因。
- 端點檢測和回應 (endpoint detection and response, EDR) 解決方案旨在檢測和回應可能逃避傳統防毒軟體的高階威脅。 這些解決方案可以幫助組織在端點檢測 APT 和勒索軟體，並遏制和修復已造成的任何損害。
- 關鍵數據進行定期備份，可以通過將被加密數據恢復到之前的未加密狀態，來幫助組織從勒索軟體攻擊中恢復。 組織應將備份存儲在安全的異地位置，以防止它們在發生攻擊時受到損害。
- 事件應變計劃：組織應制定全面的事件應變計劃，概述發生 APT 或勒索軟體攻擊時應採取的步驟。 該計劃應包括隔離受影響系統、通知利益相關者以及與執法部門和其他第三方專家合作的程序。

我們的服務基於人工智慧和多種規則，幫助客戶抵禦網路攻擊，特別是 APT 和勒索軟體。 通過與我們合作，您可以從我們的 ThreatSonar Anti-Ransomware 威脅鑑識分析與回應解決方案中受益，通過該解決方案，我們可以根據您的特定需求，實施全面的安全保護。

### 4. 員工培訓和意識
雖然技術工具和解決方案對於保護組織至關重要，但對員工培訓和意識的投資也很重要。 員工往往是組織安全鏈中最薄弱的環節，許多網路攻擊是人為錯誤或疏忽造成。

培訓員工識別和避免常見的安全威脅（例如網路釣魚電子郵件、社會工程詐騙和密碼攻擊）可以大大有助於防止成功的攻擊。 此外，向員工通報最新的網路安全趨勢，並營造資訊安全意識文化可以鼓勵員工認真對待資訊安全，並向組織的 IT 或資安團隊報告任何可疑活動。

持續培訓資訊安全從業人員也很重要，以便他們為最新的威脅做好準備。 例如，數位攻防靶場培訓為安全運營中心（SOC）和事件應變團隊提供模擬 IT 和 OT/ICS 攻擊、真正的安全工具以及詳細的指標和分析，以確保他們為下一次攻擊做好準備。

定期的安全意識培訓，包括模擬網路釣魚練習和其他形式的網路安全培訓，可以幫助員工了解最新的安全威脅和最佳實踐。

## 總結
擁有安全的環境對於任何組織的成功都至關重要。 增加信任、減少法律責任、提高效率和提高聲譽的好處使其成為一項值得的投資。

隨著網路威脅不斷演變、複雜化，擁有像我們這樣可靠的合作夥伴 - TeamT5 杜浦數位安全 - 來幫助保護您的組織非常重要。 透過我們的專業威脅情資分析團隊和 [ThreatSonar Anti-ransomware](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blogs&utm_medium=website) 解決方案，您可以放心，您的業務將得到妥善保護。



*本文與 [Cybernews](https://cybernews.com/) 合作。
*圖片提供：Pexels



保護您的組織：最佳工具和實務做法

IoC (侵害指標) の利用は効果的な企業のサイバーセキュリティオペレーションにとって重要です。サイバーセキュリティソリューションプロバイダーが長年に渡り蓄積した侵入の手がかりと広範な探索を通じて、IoCは企業が侵入を特定して防御することを可能にし、それにより損失を最小限に抑えることができます。

一般企業がIOCを利用する場合、IOCをさまざまなネットワーク機器やソフトウェアツールに取り込み、環境のあらゆる場所に監視を設定し、担当者がこれを検知し、遮断、隔離、削除などの対策を講じることができます。

一般的な脅威防御メカニズムに加えて、APT IoCはサイバー攻撃を防止し、企業が情報に基づいてサイバーセキュリティの決定を事前に行う事を可能にする上で重要な役割を果たします。

APT IoC は、サイバーセキュリティ アナリストとマルウェア研究者が実施した複雑なインシデント調査を通じて洗練された重要な指標を指します。 

各 IoC の出力は、特定の悪意のあるグループとその敵が採用した手法を表します。

 

**脅威インテリジェンス プラットフォームである ThreatVision の IoC を例に挙げると、IoC の背後には、次の 3 種類の豊富なデータがプラットフォームに組み込まれています。**

1. 悪意のあるグループのデータベース: 企業は、悪意のあるグループのデータを通じて、悪意のあるグループの背景と動機を理解し、特定のデジタル資産 (特定のサーバー、VM、データベースなど) に対する防御的な展開を事前に実行できます。
2. 悪意のあるプログラム データベース: 悪意のあるプログラム データベースは、企業の技術者が正しく効果的な防御ツールを選択し、適切に展開するのに役立つ、より多くの技術的な詳細を提供します。
3. 脅威インテリジェンス レポート: 
企業は、脅威インテリジェンス レポートを参照して、自社の状況がレポートの内容と一致しているかどうかを確認することができます。また企業はサイバー防御の展開により最新のサイバー脅威を確実に防御できるようになります。

 

**APT IoC の正しい使用プロセスには、次の手順が含まれている必要があります。**
1. 環境内のネットワーク機器および情報セキュリティ ソフトウェアに APT IoC を適切に導入します。 導入は、完全性と一貫性を確保するために自動ツールを使用して行うのが最適です。
2. アラートが発生した場合は、マルウェアのブロック、隔離、削除など、直ちに対処する必要があります。 タイムリーな行動により、被害とリスクを軽減できます。
3. 処理が完了したら、事件の詳細な調査が必要になります。 インテリジェンスプラットフォームを通じてIoCの発生源と原因を収集し、攻撃者の身元と目的を特定すると同時に、当該インシデントが自身と同質性の高い業界でどのように発生したのかを確認します。 これにより、企業はこの悪意のあるグループの攻撃手法と攻撃ツールをより深く理解し、対象を絞った防御を実行できるようになります。
4. 情報セキュリティツールの正しい選択と設定、より完全な企業情報セキュリティシステムの構築など、的を絞った防御措置を講じます。 これは、企業のセキュリティを強化し、重要なデータの機密性を保護するのに役立ちます。
5. 持続的標的型攻撃(APT攻撃)はターゲット企業の特定の脆弱性を突く攻撃をする特徴があります。したがって、企業は正しい防御措置を講じるために、攻撃者/悪意のあるグループをより包括的に理解する必要があります。

 

TeamT5は、アジア太平洋地域の攻撃者関する広範なデータベースを提供する強力な脅威インテリジェンスプラットフォームである[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blogs&utm_medium=website)を提供します。 

このプラットフォームは包括的且つ完全な詳細情報を含むナラティブ形式および段落形式で表示される脅威インテリジェンスレポートを提供するため、企業は脅威イベントを迅速に理解し、そうしたイベントの対処を通して貴重な経験を得ることができます。


ThreatVision脅威インテリジェンスプラットフォームは、APT IoCを含む広範なコンテンツをカバーしており、これはThreatVisionの膨大なアドバーサリ（攻撃者)、マルウェア、およびその他の脅威インテリジェンスレポートと関連付けることができ、企業がサイバーセキュリティの脅威を包括的に理解し高度な展開戦略を実装するのに役立ちます。 

敵を知り己を知れば百戦危うからず。
情報セキュリティの分野において、TeamT5 はあなたのベストパートナーです。

積極的な情報セキュリティ防御のために APT 侵入インジケーターを正しく使用するには?

The use of Indicators of Compromise (IoC) is critical for effective enterprise cybersecurity operations. With the help of cybersecurity solution providers' extensive search for intrusion clues, IoC enables enterprises to identify and block intrusions, thereby minimizing losses.

Enterprises utilize IoC import into various network devices and software tools to establish monitoring across their entire environment. When an IoC is detected by a device or software, it triggers an alarm, allowing cybersecurity personnel to detect and deal with the threat by blocking, isolating, and clearing it.

In addition to general threat defense mechanisms, APT IoCs play a crucial role in preventing cyber attacks and enabling enterprises to make informed cybersecurity decisions in advance. APT IoCs are key indicators refined through complex incident investigations conducted by cybersecurity analysts and malware researchers. The output of each IoC represents a specific adversary and the methods employed by the adversary, providing valuable intelligence to strengthen cybersecurity posture.

APT IoC refers to the key indicators refined through complex incident investigations conducted by cybersecurity analysts and malware researchers. The output of each IoC represents a specific adversary and intrusion methods. 

Take the IoC from ThreatVision(a powerful threat intelligence platform) as an example. Users can link IoC to three types of rich data built in the platform:
1. Adversary database: Through adversary data, enterprises can understand the background and motivation of adversaries, and carry out defensive deployments for specific digital assets (such as specific servers, VMs, or databases) in advance.

2. Malicious program database: The malicious program database can provide more technical details to help enterprise technicians choose correct and effective defense tools and deploy them properly.

3. Threat intelligence report: Enterprises can also refer to the threat intelligence reports to confirm whether their own situation matches the description in the report. Also, enterprises can ensure their cyber defense deployment can defend recent cyber threats.


The correct APT IoC usage process should include the following steps:
1. Properly deploy APT IoC in network equipment and cybersecurity software in the environment. Deployment is best done using automated tools to ensure completeness and consistency.

2. When an alert occurs, it should be dealt with immediately, including blocking, quarantining, and removing malware. Timely action can reduce damage and risk.

3. Once disposition is complete, a detailed investigation of the incident will be required. Collect the source and cause of IoC through the intelligence platform, and determine the identity and purpose of the attacker, and at the same time confirm how the relevant incident occurred in an industry with high homogeneity with itself. This helps enterprises better understand the attack methods and attack tools of adversaries, so that they can carry out targeted defense.

4. Take targeted defense measures, including the correct selection and setting of cybersecurity tools, and the establishment of a more complete enterprise cybersecurity system. This helps to increase the security of the enterprise and protect the confidentiality of important data.

 
 
 

In Advanced Persistent Threat (APT) attacks, adversaries often target specific vulnerabilities in their target companies. To effectively defend against these attacks, enterprises need to have a comprehensive understanding of the adversaries and attackers behind them.

TeamT5 provides ThreatVision, a powerful threat intelligence platform, which offers an extensive database of adversaries in the Asia-Pacific region. This platform provides detailed and comprehensive threat intelligence reports in a narrative and paragraph style, enabling enterprises to quickly understand threat events and gain valuable experience in handling such events. Furthermore, the readability of these reports can improve the reporting efficiency of cybersecurity teams when communicating across teams.

The ThreatVision threat intelligence platform covers a wide range of content, including APT IoC which can link to ThreatVision's vast databases of adversaries, malware, and other threat intelligence reports to help enterprises gain a comprehensive understanding of cybersecurity threats and implement advanced deployment strategies. By leveraging ThreatVision's powerful features, enterprises can enhance their cybersecurity posture and protect themselves against the ever-evolving threat landscape.

 
 

Know yourself and the enemy, and you will never be imperiled in a hundred battles. On the road of cybersecurity, TeamT5 is your best partner.

How to Utilize APT IoC to Do Proactive Defense?

IOC (Indicator of Compromise) 中文稱「入侵指標」，在企業資安的營運中已是不可或缺的工具，經由資安廠商長期廣泛情蒐所累積的入侵線索，協助初步發現駭客入侵痕跡，即時阻擋駭客入侵行為，以最大化的降低資安事件發生時所造成的損失。

一般企業在使用 IOC 時，會將 IOC 匯入各種網路設備以及軟體工具中，以便在環境各處設置監控，經由設備或軟體偵測到 IOC 時，設備或軟體會進行報警，讓資安人員能夠察知，並且進行阻擋、隔離、清除等處置。

但除了一般的阻擋、隔離、清除等處置外，APT IOC —— 針對[進階持續性威脅(Advanced Persistent Threat)](https://teamt5.org/tw/posts/what-is-advanced-persistent-threat-apt/)的 IOC ——更扮演了重要的威脅防禦參考，可以幫助企業於駭客下手前，提前做出正確資安決策。

APT IOC 指的是透過資安分析師及惡意程式研究員進行複雜的事件調查，所精煉出的關鍵指標。每一個IOC的產出背後都代表著特定惡意族群及駭客手法。**以威脅情資平台 ThreatVision 的 IOC 為例，IOC 背後可連結平台內建的 3 類豐富資料**: 
1. 惡意族群資料庫: 透過惡意族群資料，企業可以了解惡意族群的背景、動機，並提前對特定數位資產(如特定伺服器、VM或是資料庫)進行防備部署。
2. 惡意程式資料庫: 惡意程式資料庫可提供更多技術細節，幫助企業技術人員選擇正確有效的防禦工具並妥善部署。
3. 威脅情資報告: 企業更可參考威脅情資報告，確認自身狀況是否與報告中的描述吻合，從而確保處置過程及事後防禦部署，萬無一失。

 

**正確的APT IOC使用流程應包含以下步驟**：
1. 將APT IOC妥善部署於環境中的網路設備與資安軟體中。最好使用自動化工具進行部署，以確保完整性和一致性。
2. 當警報發生時，應立即對其進行處置，包括阻擋、隔離和清除惡意軟體。及時採取行動可以減少損害和風險。
3. 處置完成後，需要對事件進行詳細調查。通過情報平台搜集IOC的來源和成因，並確定攻擊者的身份和目的，同時確認相關事件如何發生於與自身同質性高的產業。這有助於企業更好地了解該惡意族群的攻擊手法和攻擊工具，才能進行針對性的防禦。
4. 採取針對性防禦措施，包括正確的資安工具選擇和設置，以及更完善的企業資安制度建立。這有助於提高企業的安全性並保護重要資料的機密性。
5. 由於APT攻擊的特點是針對性強，攻擊者會根據目標企業的弱點進行攻擊。因此，企業端需要對攻擊者/惡意族群進行更全面的了解，以便採取正確的防禦措施。

 
 
 

ThreatVision 威脅情資平台提供了最完整且深入的亞太區域惡意族群資料庫。威脅情資報告以敘事形式、段落式呈現，細節豐富完整，有助您快速了解威脅事件，吸收更多有效的威脅事件處理經驗，並且易讀性也可提高您的資安團隊在向上報告和跨團隊溝通時的效率。

ThreatVision 威脅情資平台提供的內容即包含 APT IOC，並可進一步連結到 ThreatVision 豐富的惡意族群資料庫、惡意程式資料庫及威脅情資報告內容，協助企業掌握資安威脅全貌，進行超前部署。

知己知彼，百戰不殆。在資安的道路上，TeamT5 是您最佳的夥伴。

如何正確利用APT入侵指標，進行主動資安防禦?

勒索軟體(ransomware，又稱勒索病毒) 是近年來重大網路威脅之一，勒索軟體鎖定企業和各類組織進行攻擊，受害事件頻傳，不僅影響企業日常營運，更造成鉅額損失。
本文建議企業透過4個方式應對，冷靜、妥善應對勒索軟體攻擊，避免損失進一步擴大。


1. 從網路上移除受感染的主機或設備，避免勒索軟體擴散。

2. 向防毒軟體或 EDR 端點防護廠商確認，蒐集相關跡證，掌握勒索軟體類型與可能入侵方式，並嘗試移除惡意軟體、阻斷攻擊鏈與修補漏洞後，再執行系統還原與資料回復作業。

3. 更改相關系統密碼，尤其是重要的系統網管帳密，或可供外部存取系統入口帳密，阻止或降低入侵者使用已控帳密再進入系統進行滲透勒索動作。

4. 立即通知公司相關客戶或合作夥伴，避免勒索資料遭盜用後，造成其他商業詐騙郵件或個人詐騙事件損失。
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
>
>若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
參考資料: https://cba.ca/ransomware-small-business
首圖來源: Unsplash

若企業受到勒索軟體攻擊，如何應變

勒索軟體(ransomware，又稱勒索病毒) 是近年來重大網路威脅之一，勒索軟體鎖定企業和各類組織進行攻擊，受害事件頻傳，不僅影響企業日常營運，更造成鉅額損失。

企業日常即可採取4個措施，避免遭受勒索軟體攻擊，詳列如下:

1. 安裝有信用、有良好商譽的軟體，並保持防毒軟體或惡意程式保護程式，處在最新病毒碼與偵測規則的狀態；另要求員工不要任意關閉相關資安防護軟體與機制，及在有收到系統或軟體更新訊息時，要立即進行更新、修補可能遭駭漏洞，避免遭勒索軟體犯罪組織利用正面攻擊或社交工程等手法滲透利用。

2. 企業內部要做好資產盤點與系統更新管理，確保公司所擁有的作業系統或應用程式，維持最新版本與更新黨。

3. 平時運用外接碟或雲端硬碟等外部裝置或服務，時常進行資料備份；同時必須注意備份管道不能與電腦常態保持連線狀況，應於備份完畢後隨即關閉或移除外接碟，避免感染勒索軟體時一併將其加密。

4. 教育並提醒員工不要任意下載、開啟或點擊來路不明的附件或檔案及使用公司電腦瀏覽各類影音或程式分享網站，並注意社交工程詐騙手法，如遇到可疑郵件或檔案應即時反應妥處；另關閉巨集執行功能，避免不小心點擊附件後，惡意檔案透過巨集下載惡意程式或開啟網頁瀏覽而遭到攻擊。
 

>TeamT5 杜浦數位安全團隊長期研究與解析駭客族群入侵行為，具備第一線國內外資安事件處理的豐富經驗。當資安事件發生，我們可快速完成受駭現場與歷史軌跡的綜整分析，發掘攻擊者的入侵過程與手法，提供事件處理的深入分析及建議，協助您復原與改善資安環境。
>
>若您有資安事件處理、應變的需求，歡迎填寫諮詢表單: [https://teamt5.org/tw/request-information/](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 
*參考資料: https://cba.ca/ransomware-small-business
*首圖來源: Pixabay