TeamT5 is deeply involved in the Vietnamese market, and recently joined a seminar which is held by TeamT5’s partners Netpoleon and FPT IS. The seminar aimed to introduce TeamT5 cybersecurity solutions to clients. Seminar participants were IT experts, representatives of large Vietnamese enterprises and government organizations.

The seminar started with Bui Duy Khanh‘s presentation (the representative of FPT IS). He explained the background and development of cybersecurity in Vietnam. Then, John Lu(the representative of TeamT5) analyzed the cybersecurity threat landscape. He pointed out that Vietnam faces two major cybersecurity threats - ransomware attacks, and APT attacks (whose path is directly or indirectly through individual users) targeting enterprises & organizations .

John Lu said that the threat identification and analysis platform ThreatSonar and the threat intelligence platform developed by TeamT5 can effectively assist enterprises & organizations to proactively protect endpoints and defend against cyber threats.

Also, Tran Chi Dung (FPT IS representative) shared the threat assessment and detection services provided by FPT IS in order to assist enterprises to beat cybersecurity defense challenges, such as lack of deployment manpower, information security solutions cannot be fully deployed, and deployment time-consuming .

At the end of the seminar, Bui Duy Khanh(FPT IS representative) received a medal and certification which symbolizes FPT IS partners with TeamT5.

- Related post: [FPT IS là đối tác cung cấp dịch vụ bảo mật của TeamT5](https://chungta.vn/kinh-doanh/fpt-is-la-doi-tac-cung-cap-dich-vu-bao-mat-cua-teamt5-1136834.html)


TeamT5 Join Workshop with Vietnamese Partners Netpoleon & FPT IS

TeamT5 深耕越南市場，近期與合作夥伴 Netpoleon、FPT IS 合辦研討會，為客戶介紹資安解決方案。參加該研討會包含 IT 專家、越南大型企業和政府單位組織的代表。

研討會首先由 FPT IS 代表 - Bui Duy Khanh 說明越南資安發展的背景。 接著由 TeamT5 代表 - John Lu 分析了越南面臨的資安威脅態勢。 指出越南面臨兩個重要的資安威脅 - 勒索軟體攻擊，以及直接或通過個人用戶間接進行的 APT 攻擊，藉此滲入企業組織。

John Lu 表示 TeamT5 研發的威脅鑑識分析平台 ThreatSonar 與威脅情資整合平台能有效協助企業組織主動保護端點設備，防禦資安威脅。

此外，FPT IS 代表 - Tran Chi Dung 也分享該公司提供的威脅評估和偵測的服務，協助企業進行資安防禦時的挑戰，如缺乏部署人力、資安解決方案無法完全部署，及部署耗時。

研討會最後由 Bui Duy Khanh 獲得了 FPT IS 作為TeamT5 合作夥伴的獎牌和證書，象徵雙方長期合作。


- 相關報導: [FPT IS là đối tác cung cấp dịch vụ bảo mật của TeamT5](https://chungta.vn/kinh-doanh/fpt-is-la-doi-tac-cung-cap-dich-vu-bao-mat-cua-teamt5-1136834.html)


TeamT5 與越南合作夥伴 Netpoleon、FPT IS 合辦研討會

Events

TeamT5, a provider of top cyber threat intelligence and endpoint detection and response (EDR) solutions in APAC, is going to showcase solutions at upcoming cybersecurity event InterOp in Japan 2023.


This event, which attracts experts and professionals from around the world, is an excellent platform to showcase the cutting edge cybersecurity technologies and solutions. And TeamT5 will be showcasing our latest solutions, including threat intelligence platform ThreatVision and advanced persistent threat detection tool ThreatSonar.

We believe that threat intelligence is the cornerstone of cyber defense.
We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance. We sincerely welcome you to experience our intelligence-driven cyber defense at booth C613 at InterOp.

## Our Solutions
### ThreatVision, a powerful threat intelligence platform 
Advantages:
1. Grasp latest & advanced cyber threats 
2. Boost power to defend cyber attacks 
3. Expand insights & database for Advanced Persistent Threat (APT)

Intro:
Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 10+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

More at https://teamt5.org/en/products/threatvision/

## ThreatSonar, a cyber threat forensic & analysis platform 
Advantages: 
1. Assess system compromised events more precisely
2. Respond to cyber incidents faster
3. Deploy the tool automatically
Intro:
ThreatSonar is an easy-to-use tool to hunt cyber threats. Combining digital forensics and behavior-modeling techniques, ThreatSonar can do fast triage and hunt for anomalies.

Drive by cyber threat intelligence and run with automatic mode, it finds hidden infections with similar TTPs - Tactics, Techniques, and Procedures. Regular cybersecurity check-ups also help enterprises to better protect endpoints.

ThreatSonar offers both online and offline mode to protect endpoints in various situations. In short, ThreatSonar is an effective tool designed for assisting incident response.

More at https://teamt5.org/en/products/threatsonar/

## TeamT5 at InterOp
- Date: 2023 / 6 / 14 ～16
- Time: 10:00 ~18:00 (Last day closes at 17:00)
- Venue: Makuhari Messe
- Booth Number: 6C13

![interop_TeamT5_booth.png](https://uploads.teamt5.org/upload/original/interop_TeamT5_booth.png)

TeamT5 Will Showcase Solutions at InterOp (Japan)

>TeamT5 Launch a Conceptive Bar at CYBERSEC to Tailor Enterprise Cybersecurity Protection
 
>Join hands with ST Engineering to strengthen enterprise IT & OT cybersecurity defense


In this hot summer, Asia-Pacific threat intelligence expert TeamT5 comes up with a conceptive bar for CYBERSEC, the biggest Taiwan cybersecurity event. The booth with bar ideas symbolizes - while a bartender produces an extraordinary cocktail that is a perfect fit for the customer's taste, TeamT5 provides tailored enterprise cybersecurity protection just as a bartender does.

TeamT5 believes that the best enterprise cybersecurity defense is driven by intelligence which should be customized for clients. We not only fully understand the characteristics of cyber attackers, but also understand their intrusion methods and tools.

Also, TeamT5 invited its partner ST Engineering, a listed company in Singapore, to come to Taiwan and share insights. The two parties will integrate information technology (IT) and operational technology (OT) intelligence and provide comprehensive protection for clients. By working together, TeamT5 and ST Engineering hope to provide a holistic approach to cybersecurity and assist enterprises in mitigating the risks of cyber threats. This will enable enterprises to meet the ever-changing market demand and achieve long-term success.

The scale of this year's CYBERSEC is larger than ever. Apart from setting an attractive bar, TeamT5 also participated in conference forums, ransomware forums, and CyberLAB, to share best cybersecurity practices. TeamT5 also calls on enterprises to carry out intelligence-driven cyber defense and adopt action-oriented intelligence to help enterprises foresee attacks, deploy defense strategies in advance, and reduce loss.

![cybersec-2023-retrospect.jpg](https://uploads.teamt5.org/upload/original/cybersec-2023-retrospect.jpg)
<center>TeamT5 Launch a Conceptive Bar at CYBERSEC to Tailor Enterprise Cybersecurity Protection</center>


###[About TeamT5]
TeamT5 consists of top cyber threat analysts with more than 20-year experience. We provide cyber threat intelligence reports and anti-ransomware solutions to Asia Pacific clients in industries like government agencies, financial business, telecom operators, high-tech enterprises, electronic manufacturing service companies, and managed security service providers(MSSP).

We're also frequently invited to share our insights in Black Hat (USA), Code Blue/ AVTokyo (Japan), Troopers(Germany) and other events by global organizations such as Hack In The Box, FIRST.

In 2022, TeamT5 has secured Series A funding as it looks to expand into the Japanese market. The round was led by JAFCO Asia, the Asia group company of the prevailing Japanese venture capital firm. Also participating were ITOCHU, one of Japan's largest multinational corporations with many business units globally, as well as MACNICA, Japan's predominant cybersecurity service provider.

TeamT5 Launch a Conceptive Bar at CYBERSEC to Tailor Enterprise Cybersecurity Protection

>TeamT5 酒吧插旗臺灣資安大會 為企業特調端點威脅防護
 
>攜手新加坡最大科技公司 ST Engineering 一同強化企業資安防禦

炎炎夏日，來杯特調嗎？喜歡酸甜的口感還是苦澀的煙燻味？你沒看錯，亞太威脅情資專家 TeamT5 杜浦數位安全將酒吧搬進臺灣資安大會， TeamT5 就是那位調酒師，根據你的喜好調製你最喜歡的風味。如同杜浦的產品特色，客製化客戶的端點威脅防護計畫。

調酒師為客人調製專屬的雞尾酒風味，乃是細緻、高深的過程。不僅要清楚掌握各種酒的口感特性、如何相互搭配，再技術性的使用調酒器具輔助，最後為客人端出一杯特調。如同 TeamT5 相信最好的企業資安防禦，乃是情資驅動，我們不僅徹底掌握網路攻擊者的特性，也瞭解其入侵手法、工具；同時，我們的解決方案依據客戶的需求做特制。

TeamT5 期望與大眾一同提升企業資安防護力，特邀請合作夥伴新加坡最大科技公司 ST Engineering 來台分享，雙方將透過資訊科技 (IT) 與營運科技 (OT) 威脅情資整合，為製造業客戶打造更強韌的資安防護力。ST Engineering 與 TeamT5 本次強強合作，希望協助企業在此升級轉型歷程中，免於網路威脅，使企業可以實現更安全且更高效的生產過程，以滿足不斷變化的市場需求！

TeamT5 更呼籲企業，要進行以情資驅動的資安防禦，採納行動取向的在地情資，以協助企業預見攻擊，提前部署防禦策略，降低損失風險。

![cybersec-2023-retrospect.jpg](https://uploads.teamt5.org/upload/original/cybersec-2023-retrospect.jpg)
<center>TeamT5 酒吧插旗臺灣資安大會 為企業特調端點威脅防護</center>



###[關於 TeamT5 杜浦數位安全]
TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。更獲得日本三大巨頭投資，包含日本最大創投 JAFCO 集富集團、日本最大跨國企業並在全球皆有商業投資的 ITOCHU 伊藤忠商事，與日本最大資安解决方案提供商 MACNICA。

團隊具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

TeamT5 酒吧插旗臺灣資安大會 為企業特調端點威脅防護

TeamT5 將參與智慧大工廠台中場活動，由專業團隊駐點，為您提供勒索軟體防禦的諮詢。
更由資安技術經理 Shawn 帶來精彩演講，分享製造業、工具機業等產業，應如何主動、有效防禦勒索軟體。

📌報名連結: https://buzzorange.com/techorange/forum/2023-smart-manufacturing-taichung/

## 攤位資訊
📌時間: 5/19(五) 9:30~16:20  (08:20 開放報到)
📌地點: 台中金典酒店13樓 金典全廳 (台中市西區健行路1049號)

## 特別演講
📌演講時段: 5/19(五) 13:50~14:10
📌講題: 新型態資安攻防戰開打，製造業面對勒索軟體該如何主動防禦？
📌講師: Shawn (資深技術經理)

![202305_techorange_seminar_taichung.png](https://uploads.teamt5.org/upload/original/202305_techorange_seminar_taichung.png)


TeamT5 為製造業提供端點防禦解方 就在智慧大工廠論壇(台中)

TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. We’re also frequently invited to share our insights in top cybersecurity conferences.

Based on our research in malware & Advanced Persistent Threat (APT), we provide anti-ransomware solutions and  cyber threat intelligence reports  to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

Our work is also seen by the media as TeamT5 is honored to be featured in [CyberNews](https://cybernews.com/)' pick of Best endpoint protection solutions.

Cybernews wrote:

>TeamT5 is a cyber security solution provider that offers multiple services to help you protect your data from cybercriminals. One of the best services it offers is called ThreatSonar Anti-Ransomware.

>It’s a comprehensive cybersecurity defense program that’s designed to protect enterprises against APTs (Advanced Persistent Threats) and targeted ransomware attacks.

>It uses an AI-powered engine to detect and prevent malware from attacking endpoints in real time. Additionally, it offers proactive ransomware containment to stop ransomware attacks before they can inflict any damage.

>ThreatSonar Anti-Ransomware also provides backup protection to make sure that ransomware attacks do not destroy backups. It also ensures that your organization can restore data whenever needed. You can use the demo version that TeamT5 offers to see how ThreatSonar Anti-Ransomware performs.

To read the whole article, please check [this link](https://cybernews.com/resources/best-endpoint-protection-solutions/).

TeamT5 Featured Best endpoint protection solutions on Cybernews

TeamT5 由頂尖資安威脅分析師與研究員組成。基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。我們為美國、日本和台灣的客戶提供資安威脅情報報告和防勒索軟體解決方案。客戶包括政府機構、金融業和高科技業。

媒體 [CyberNews](https://cybernews.com/) 也留意到我們的成績，將 TeamT5 解決方案選為最佳端點保護解決方案。

Cybernews 寫道:

>It’s a comprehensive cybersecurity defense program that’s designed to protect enterprises against APTs (Advanced Persistent Threats) and targeted ransomware attacks.
(ThreatSonar Anti-Ransomware 是一個全面性的資安防禦解決方案，旨在保護企業免受 APT（進階持續性威脅）和針對性的勒索軟體攻擊。)

>It uses an AI-powered engine to detect and prevent malware from attacking endpoints in real time. Additionally, it offers proactive ransomware containment to stop ransomware attacks before they can inflict any damage.
(它使用 AI 驅動的引擎，及時檢測和防止惡意軟體攻擊端點。 此外，它還提供主動應變勒索軟體之功能，以在勒索軟體攻擊造成任何損害前，阻止它們。)

>ThreatSonar Anti-Ransomware also provides backup protection to make sure that ransomware attacks do not destroy backups. It also ensures that your organization can restore data whenever needed. 
(ThreatSonar Anti-Ransomware 並提供備份保護還原，以確保勒索軟體攻擊不會破壞備份。 它還確保企業組織可以在需要時恢復資料。) 

完整文章請見 [此連結](https://cybernews.com/resources/best-endpoint-protection-solutions/)。


TeamT5 獲美國專業媒體 Cybernews 選為最佳端點保護解決方案提供商

News

This year, Black Hat Asia is held online and in-person, May 9-12, 2023 in Singapore Time (UTC+8). Yue-Tien Chen and Zih-Cing Liao, cyber threat intelligence researchers from TeamT5, will give a talk on the topic “Operation Clairvoyance: How APT Groups Spy on the Media Industry”.

From TeamT5’s long term research, cyber espionage actors have demonstrated great interest in the media industry. These actors seem to like to see Taiwan's daily activities through the "eyes" of these media companies and journalists. During Taiwan's intense 2022, TeamT5 saw more and more [advanced persistent threat (APT)](https://teamt5.org/en/posts/what-is-advanced-persistent-threat-apt/) groups infiltrate Taiwan's media industry. In our observation, the media has become the first non-government target of those APT groups.

This talk will focus on APT's targeted attack against media companies in Taiwan. We dubbed this series of attacks "Operation Clairvoyance." Because Taiwan has a much more intensive political situation, such as the former US House Speaker Nancy Pelosi's visit and the 2022 Local Election, we will dissect more than 20 targeted attack operations TeamT5 has tracked since 2020. Our analysis shows technical links between these targeted attacks and the notorious Chinese APT, including APT23 (aka GouShe), APT41 (aka Winnti, Amoeba), and BlackTech (aka Huapi).

TeamT5 researchers’ presentation will cover these attacks' [tactic, techniques and procedures (TTPs)](https://teamt5.org/en/posts/what-are-tactics-techniques-and-procedures-ttps/). We have seen those APT groups adopt different TTPs aimed at media companies. Some of those backdoor abuse cloud service as their C2.

More importantly, these cases gave us a peek into China's strategic move. We believe that these APT attacks are the preliminary work of the Chinese government. Also, our strategic intelligence indicates several possible scenarios which could lead us to consider the ultimate goal of these APT attacks. 

By sharing this talk at Black Hat Asia, TeamT5 hopes more people and organizations are aware of this topic.

 

<center>
![black_hat_asia_2023_picture.jpg](https://uploads.teamt5.org/upload/original/black_hat_asia_2023_picture.jpg)
</center>

 


## About Black Hat Asia
Black Hat is the world leading cybersecurity event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.

【Black Hat Asia】TeamT5 Will Give the Talk on “How APT Groups Spy on the Media Industry”

全球資安盛會「亞洲黑帽安全大會」（Black Hat Asia, BHASIA）今年以線上與實體混合方式舉辦，自 2021 年 5 月 9 日至 12 日（新加坡時間 UTC+8），為期3天的精彩議程（Black Hat Briefing）、專業深度培訓（Training），以及最新開源駭客工具的展示（Black Hat Arsenal），由頂尖資訊安全專家們傳授最新、第一手的技術與研究發現。

TeamT5 威脅情資研究員們連續第3年登上 BHASIA，本次將發表演講「千里眼行動 : 威脅族群是如何採取針對媒體業的間諜行動（Operation Clairvoyance: How APT Groups Spy on the Media Industry）」，並與世界各地的資安研究人員交流最新的資訊安全風險、研究與趨勢。

根據 TeamT5 長期研究，網路間諜行動者持續對媒體業表現出極大的興趣。這些行動者似乎喜歡通過這些媒體公司和記者的「眼睛」觀察台灣的日常活動。2022 年，臺灣局勢更顯嚴峻，TeamT5 觀察到越來越多的[進階持續性威脅（advanced persistent threat, APT）](https://teamt5.org/tw/posts/what-is-advanced-persistent-threat-apt/) 族群滲透到臺灣的媒體業。 據我們觀察，媒體業已成為這些 APT 組織的第一個非政府組織類型的攻擊目標。

本次演講將重點關注 APT 族群針對臺灣媒體公司的針對性攻擊。 我們將這一系列攻擊稱為「千里眼行動」。 由於時任美國眾議院議長佩洛西(Pelosi)女士訪臺，及2022年臺灣地方選舉，帶來更加緊張的臺灣政治局勢，而我們將剖析自2020年以來追蹤的二十多次針對性攻擊行動。我們的研究顯示，這些針對性攻擊與惡名昭彰的中國 APT 族群有技術關聯性，包括 APT23（又名 GouShe）、APT41（又名 Winnti、Amoeba）和 BlackTech（又名 Huapi）。

TeamT5 研究員的演講將涵蓋這些攻擊的[戰術、技巧和程序（TTP）](https://teamt5.org/tw/posts/what-are-tactics-techniques-and-procedures-ttps/)。我們已經觀察到到那些 APT 族群針對媒體公司，採取不同的 TTP，其中一些後門程式則濫用雲服務作為他們的 C2 (command and control)。

更重要的是，這些案例讓我們窺見了中國的戰略。 我們認為，這些 APT 攻擊是中國政府的前期工作。 此外，我們的威脅情資指出了幾種可能的情況，這些情況可能會讓我們考慮這些 APT 攻擊的最終目標。

透過在 Black Hat Asia 分享，TeamT5 希望更多的人和組織意識到這個議題。

 

<center>
![black_hat_asia_2023_picture.jpg](https://uploads.teamt5.org/upload/original/black_hat_asia_2023_picture.jpg)
</center>

 

## 關於黑帽大會（Black Hat）
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。

【Black Hat Asia】TeamT5 研究員將再度於亞洲黑帽安全大會發表深度分析

全臺最大資安專業展 CYBERSEC 2023 臺灣資安大會，將在 5 月 9 日至 5 月 11 日於南港展覽二館盛大登場！

TeamT5 杜浦數位安全將帶來眾多演講活動，現場更提供企業防勒索計畫特調服務，邀請您體驗！
 


>精彩專題演講、解決方案展示總覽，請見TeamT5 臺灣資安大會品牌專頁
>👉[連結](https://cybersec2023.teamt5.org/)

>預約現場諮詢，即可獲得特調飲品
>👉[連結](https://forms.gle/7Pg9J2kJGXDKJoBL6)


## R103 品牌攤位 | TeamT5 杜浦數位安全
為您特調 端點威脅防護

無論是想增強企業資安防護、尋找專業資安服務夥伴，還是有各種資安防護的疑難雜症 ... 
別駭怕，快來 R103 攤位找 TeamT5 杜浦數位安全！
 
👉攤位活動總覽: [連結](https://cybersec2023.teamt5.org/)

## CT09 資安人才專區攤位 | TeamT5 杜浦數位安全 
資安工作的滋味，有點甜，有點酸，偶爾有點嗆
 
TeamT5 特調就差你這一位!

歡迎來到我們的徵才攤位 CT09 聊聊，了解業界人才需求，以及進入資安領域的職能發展。
也歡迎大家來聽講座，聽聽我們分享資安業界徵才最新趨勢!
 
- 時間: 5月11日 (四) 11:45 - 12:00
- 地點: 南港展覽館二館4樓 Cyber Talent 舞台
- 題目: 最強亞太威脅與駭客研究團隊 - TeamT5
- 講者: 李尚韋 Turkey (D39 漏洞研究團隊 PM)

## 參觀資訊
- 日期: 5 月 9 日(二) - 5 月 11 日(四) 
- 地點: 臺北南港展覽二館(台北市南港區經貿二路2號)
- TeamT5 杜浦數位安全攤位指引:

<center>
![cybersec2023_booth_guide.png](https://uploads.teamt5.org/upload/original/cybersec2023_booth_guide.png)
</center>

【CYBERSEC 2023 臺灣資安大會】為您特調 端點威脅防護

台灣處於地緣政治的焦點，受中國駭客鎖定為主要攻擊目標。近期 TeamT5 威脅情資研究團隊即偵查到中國駭客針對台灣金融單位的連續網路攻擊，以保單借款、聖誕節賀卡為主題，發送釣魚信件。TeamT5 呼籲企業提高警覺心，即便是業務相關信件也應留意可疑處，並宜持續掌握國際威脅情資動態，制敵機先。

##聖誕不快樂 賀卡內藏惡意軟體
TeamT5 研判，攻擊者於 2022 年 12 月時，便以「Merry Christmas，聖誕快樂」為主旨的魚叉式釣魚信展開攻擊行動，釣魚信附帶一個惡意的 7z 格式壓縮檔「Christmas notice.7z」。解壓縮之後，該檔案會投放一個 CobaltStrike Beacon 載入程式「Christmas notice.pdf .exe」。
攻擊者在此載入程式的副檔名前插入許多空格，並利用 Word 圖示將該 EXE 執行檔偽裝成是一份 DOC 文件；不僅檔名經過偽裝，在技術層次上，該檔案也被塞入許多垃圾程式碼，並運用控制流程扁平化（control flow flattening）的混淆技術。
我們進一步發現，本次攻擊利用的誘餌是由中國履歷模板網站「稻壳简历」製作而成。因稻壳简历的使用者多為中國人，所以我們高度懷疑本次攻擊是由中國威脅行動者所策動。

##正式文件暗藏禍心 不可不慎
接著於今年1月中旬，TeamT5 偵查到另一起針對台灣金融單位的攻擊，攻擊者利用一份保單借款文件當作誘餌，遞送 CobaltStrike Beacon，濫用合法的資安滲透測試工具，執行惡意目的。
綜觀兩起攻擊事件的技術證據及攻擊手法，包含諸多相似之處：
1.	兩起攻擊的檔案內含源自同個 GitHub 專案的特殊字串。
2.	兩起攻擊 CobaltStrike Beacon shellcode 的浮水印編號相同，皆為 391144938。
3.	攻擊者使用了相同的混淆技術。
4.	兩起攻擊所使用的假 Word 圖示，其雜湊值相同。
因此，我們推斷這兩起攻擊是由同一中國威脅行動者所發起。

TeamT5 呼籲企業提高警覺心，進行員工資安教育訓練，增強資安防禦力，並宜持續掌握國際威脅情資動態，預先防範網路攻擊。

![picture_press-release-chinese-adversaries-targeting-taiwan-finace-institutions.png](https://uploads.teamt5.org/upload/original/picture_press-release-chinese-adversaries-targeting-taiwan-finace-institutions.png)
<center>TeamT5呼籲企業提高警覺心，留意釣魚信件</center>

 
 
###[關於 TeamT5 杜浦數位安全]
TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。更獲得日本三大巨頭投資，包含日本最大創投 JAFCO集富集團、日本最大跨國企業並在全球皆有商業投資的 ITOCHU 伊藤忠商事，與日本最大資安解决方案提供商 MACNICA。

團隊具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

###[新聞稿聯絡窗口]
TeamT5 杜浦數位安全 
https://teamt5.org/tw/request-information/

【新聞稿】中國駭客鎖定台灣金融機構 持續進行釣魚信件攻擊

>Our cyber threat analyst Che Chang gives observations on China state-sponsored adversaries and their attacks on South Easr Asia countries. This is an expert of WIRED's article. Read more at [WIRED](https://www.wired.com/story/china-hack-emails-asean-southeast-asia/)。

IN MAY 2022, Joe Biden was on a charm offensive. The US president invited the leaders of 10 Southeast Asian nations to the White House for the first time for talks about the region, which is home to more than 600 million people. High on the agenda was China—a key trading partner for all the countries, but also a potential threat to their stability. Biden promised $150 million in extra support for the nations to help improve their security, infrastructure, and ongoing pandemic response. 

However, in the weeks leading up to the meeting, according to a cybersecurity alert seen by WIRED, hackers working on behalf of China were stealing thousands of emails and sensitive details from the Southeast Asian nations. The cyberespionage, which has not been previously reported, is the latest in a string of incidents where Chinese-linked hackers have quietly compromised neighboring countries, looking to gain political and economic information.

...

IN MAY 2022, Joe Biden was on a charm offensive. The US president invited the leaders of 10 Southeast Asian nations to the White House for the first time for talks about the region, which is home to more than 600 million people. High on the agenda was China—a key trading partner for all the countries, but also a potential threat to their stability. Biden promised $150 million in extra support for the nations to help improve their security, infrastructure, and ongoing pandemic response. 

However, in the weeks leading up to the meeting, according to a cybersecurity alert seen by WIRED, hackers working on behalf of China were stealing thousands of emails and sensitive details from the Southeast Asian nations. The cyberespionage, which has not been previously reported, is the latest in a string of incidents where Chinese-linked hackers have quietly compromised neighboring countries, looking to gain political and economic information.

 
 
*Image courtesy of [pixabay](https://pixabay.com/)

【WIRED】China Is Relentlessly Hacking Its Neighbors

>TeamT5 資安威脅情資分析師 Che Chang 接受 WIRED 訪問，針對中國支持的國家級駭客攻擊東南亞國家，進行評論與分析。本文為摘錄，完整文章請見 [WIRED](https://www.wired.com/story/china-hack-emails-asean-southeast-asia/)。

IN MAY 2022, Joe Biden was on a charm offensive. The US president invited the leaders of 10 Southeast Asian nations to the White House for the first time for talks about the region, which is home to more than 600 million people. High on the agenda was China—a key trading partner for all the countries, but also a potential threat to their stability. Biden promised $150 million in extra support for the nations to help improve their security, infrastructure, and ongoing pandemic response. 

However, in the weeks leading up to the meeting, according to a cybersecurity alert seen by WIRED, hackers working on behalf of China were stealing thousands of emails and sensitive details from the Southeast Asian nations. The cyberespionage, which has not been previously reported, is the latest in a string of incidents where Chinese-linked hackers have quietly compromised neighboring countries, looking to gain political and economic information.

...

IN MAY 2022, Joe Biden was on a charm offensive. The US president invited the leaders of 10 Southeast Asian nations to the White House for the first time for talks about the region, which is home to more than 600 million people. High on the agenda was China—a key trading partner for all the countries, but also a potential threat to their stability. Biden promised $150 million in extra support for the nations to help improve their security, infrastructure, and ongoing pandemic response. 

However, in the weeks leading up to the meeting, according to a cybersecurity alert seen by WIRED, hackers working on behalf of China were stealing thousands of emails and sensitive details from the Southeast Asian nations. The cyberespionage, which has not been previously reported, is the latest in a string of incidents where Chinese-linked hackers have quietly compromised neighboring countries, looking to gain political and economic information.
 
 
完整文章請見 [WIRED](https://www.wired.com/story/china-hack-emails-asean-southeast-asia/)。
 
 
*首圖來源: [pixbay](https://pixabay.com/)

【WIRED 採訪報導】China Is Relentlessly Hacking Its Neighbors

>As Chinese mysterious balloons hover over the US, tension between China and the US is rising. For Taiwan, they also spotted these kinds of balloons in recent years. But more than that, Bloomberg points out Taiwan is more concerned with Chinese hacking. 
>Our CTI analyst took Bloomberg’s interview and commented on this topic. This is an expert of Bloomberg's article. Read more at
 [Bloomberg](https://www.bloomberg.com/news/newsletters/2023-02-14/spy-balloons-no-match-for-china-s-cyber-attacks-suggests-taiwan)

Mysterious balloons hovering ominously over parts of North America are understandably causing some panic. If Taiwan is any indication, these sightings are happening around the globe.

Taiwan has spotted dozens of these sorts of balloons — suspected Chinese military aircraft — in its airspace in recent years, the Financial Times reported. After the US shot down four balloons, a Taiwanese Defense spokesperson said Taipei might do the same if it were concerned enough about them.

What could be more frightening than a big, white spy balloon suspended overhead? The answer, recent moves by Taiwan suggest, is malicious Chinese hackers.

……

“For an ordinary person, you walk to the convenience store and see it’s been defaced, and then you walk into the high-speed rail station and see defacement messages,” said Silvia Yeh, an analyst at the research firm TeamT5. “Then you go online and see that you can’t access Taiwan’s presidential website. Their first impression would be that China’s capabilities are so strong, and our internal systems have already been compromised.”

……

*Image courtesy of [Pexels](https://www.pexels.com/)

【Bloomberg】Worse Than Spy Balloons? Taiwan Is More Concerned With Chinese Hacking

>美中高空氣球事件備受關注，台灣官方也表示近年曾偵獲中國氣球進入台灣空域。
>亞太威脅情資專家 TeamT5 長期關注中國駭客族群與攻擊事件，也接彭博社(Bloomberg)訪問，針對中美氣球事件延伸出的討論 - 台灣面臨的中國駭客威脅，進行評論。本文為摘錄，完整文章請見 [Bloomberg](https://www.bloomberg.com/news/newsletters/2023-02-14/spy-balloons-no-match-for-china-s-cyber-attacks-suggests-taiwan)

Mysterious balloons hovering ominously over parts of North America are understandably causing some panic. If Taiwan is any indication, these sightings are happening around the globe.

Taiwan has spotted dozens of these sorts of balloons — suspected Chinese military aircraft — in its airspace in recent years, the Financial Times reported. After the US shot down four balloons, a Taiwanese Defense spokesperson said Taipei might do the same if it were concerned enough about them.

What could be more frightening than a big, white spy balloon suspended overhead? The answer, recent moves by Taiwan suggest, is malicious Chinese hackers.

……

“For an ordinary person, you walk to the convenience store and see it’s been defaced, and then you walk into the high-speed rail station and see defacement messages,” said Silvia Yeh, an analyst at the research firm TeamT5. “Then you go online and see that you can’t access Taiwan’s presidential website. Their first impression would be that China’s capabilities are so strong, and our internal systems have already been compromised.”

……

*首圖來源: [Pexels](https://www.pexels.com/)

【Bloomberg 採訪報導】Worse Than Spy Balloons? Taiwan Is More Concerned With Chinese Hacking

>大受好評的「TeamT5 Security Camp 資安培訓營」進入第三屆!
>本次於 2023 / 2 / 1~2 、2 / 7~9 舉行，共五天的精彩課程，由專精於各領域的資訊安全研究員，透過一系列培訓課程與實作挑戰，帶大家體驗資安工作的日常。

「資安」是近年來熱門職缺之一，但許多對資安領域有興趣、有志從事資安工作的同學們，面對種種資安職缺，卻不知道該如何選擇。TeamT5 杜浦數位安全作為台灣專精網路攻擊分析、漏洞研究的資安公司，希望透過持續舉辦的資安培訓營，提供來自業界的實戰經驗與資源，幫助同學快速探索資安領域的無限可能，了解資安工作有哪些類別、實際工作內容、需要的技能等。

![2023-teamt5-security-camp_pic1_update.JPG](https://uploads.teamt5.org/upload/original/2023-teamt5-security-camp_pic1_update.JPG)
<center>圖1、TeamT5 Security Camp 第三屆結業式大合照</center>
<center>並感謝輔仁大學的 許見章教授、臺北科技大學的 孫勤昱教授蒞臨指導、給予學員回饋</center>



## 資安培訓營上課實況
本次「TeamT5 Security Camp 資安培訓營」有四大主題，包含威脅情資探究、資安事件剖析、系統底層進階防禦與攻擊手法、漏洞深度挖掘，帶領學員體驗資安研究員的工作日常。

第一天首先登場的課程為「初探威脅情資的奧秘」，研究員 Still 在課程中深入淺出的介紹活躍於亞州地區的駭客族群，以及其慣用的攻擊路徑及惡意程式，讓學員們對威脅情資有基礎的認識。

第二天，我們安排「資安事件處理剖析」課程，教導學員如何從各個紀錄檔，察覺入侵痕跡，看似繁複的檢查作業，實際上非常需要細心及耐心反覆觀察，才能發掘出大量資料中的蛛絲馬跡，同時輔以數則實務案例演練，提供最貼近業界的練習機會！

![2023-teamt5-security-camp_pic2.jpg](https://uploads.teamt5.org/upload/original/2023-teamt5-security-camp_pic2.jpg)
<center>圖2、來自全台大專院校的同學們專心上課，探索資安世界</center>

第三天由研發工程師 Will 及 Zeze 聯手教學，深入熟悉 Windows 系統介紹進階攻擊與防禦手法，透過課程讓學員反思其偵測方式，同時輔以實戰演練的 Lab ，讓學員親自在系統上了解與駭客之間的攻防交戰，期待學員吸收課程精華後，能更熟練逆向分析及撰寫攻防程式的能力。

接續由漏洞研究員 Nick 傳遞漏洞挖掘心法，從何謂弱點、漏洞及物聯網裝置的各個攻擊面向到成因進行講解，同時也安排三堂時間較長的 Lab ，讓學員一步步的進行實務體驗，期盼學員在課程過後都可以透過今日所學，挖掘到自己的 CVE 。

在最後一天，我們讓各個小組自行選定主題，舉行研究成果發表會。主題需結合前幾天在課程上得到的知識，以及各種主題的 Lab 演練，最後由導師特別指導，每一組都提出相當有深度的主題，並詳細解釋其論證、研究的過程，原來平常個性害羞的各個學員都深藏不露！

![2023-teamt5-security-camp_pic3_update.JPG](https://uploads.teamt5.org/upload/original/2023-teamt5-security-camp_pic3_update.JPG)
<center>圖3、同學們熱烈討論實作內容</center>

 
 

TeamT5 非常開心同學們能感受到資安研究的樂趣，也認識我們想打造一個更安全世界的熱情。

對資安培訓營、資安實習有興趣的同學們，歡迎追蹤我們的 [IG](https://www.instagram.com/lifeatteamt5/) ，獲得最新開課資訊及實習職缺 ! 

也可以追蹤我們的 [FB](https://www.facebook.com/TeamT5.org/)，了解我們最新的資安威脅研究 !

TeamT5 Security Camp 資安培訓營 第三屆圓滿落幕

Japan Security Analyst Conference 2023 (JSAC2023) held on Jan. 25-26 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis. This year, TeamT5 had two sessions during the event.

One is TeamT5’s CTI Researcher Still Hsu gave a talk on “Brief History of MustangPanda and its PlugX Evolution”. He points out that Polaris/MustangPanda is continuing to evolve their TTPs. Frequent attacks are observed. Also, multiple campaigns focusing on a wide variety of targets.

The other session is presented by TeamT5’s research engineers Peter Syu and Jr-Wei Huang on the topic “Track Down Stealth Fileless Injection-based Nginx Backdoor in the Attack ”. The presentation focuses on Nginx, a widely used Web Server in the industry. During an incident response, they found a Nginx-based backdoor stored in the server, which used a previously unseen attack vector: Injection, to achieve the fileless effect, and we called the backdoor - NginxStealth and NginxSpy.

They introduced how the attacker gained initial access to the Nginx server, and how the malicious payload works. Furthermore, they explain how the backdoor NginxStealth and NginxSpy are skillfully hidden in the system in detail, and compare the techniques used by NginxStealth with the existing Nginx-based backdoors.

Finally, they developed a Nginx module based on the hook method of the NginxStealth. This module can list the addresses of the hook. If the address does not exist in the normal Nginx memory space or the module memory space, there is a high possibility that the Nginx process is injected with NginxStealth.

The slides of the speech can be downloaded on the official website. 

 

📌Brief History of MustangPanda and its PlugX Evolution

- Speaker: Still Hsu
- Slides (English Version): [Link](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_LT4.pdf)

 

📌Track Down Stealth Fileless Injection-based Nginx Backdoor in the Attack

- Speaker: Peter Syu, Jr-Wei Huang
- Slides (English Version): [Link](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_4_peter-jr-wei_en.pdf)


 

##About JSAC
Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC website](https://jsac.jpcert.or.jp/index.html).

 

*Image courtesy of [JSAC](https://jsac.jpcert.or.jp/index.html)

Japan Security Analyst Conference 2023

日本資安分析研討會 Japan Security Analyst Conference 2023 (JSAC2023) 於1月25-26日，採取實體與線上混和的方式舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件回應與分析的技術、知識。

本年度活動中，TeamT5 專業團隊成員共有2場演講，1場由威脅情資研究員 Still Hsu 分享駭客族群 MustangPanda 與其使用的惡意軟體 PlugX 之演進史。另1場則由研發工程師Peter Syu 和 Jr-Wei Huang ，針對 Nginx 後門程式進行深度剖析。

演講簡報現可於研討會官網下載。

 

📌 Brief History of MustangPanda and its PlugX Evolution

- 講者: Still Hsu
- 下載連結: [請點此](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_LT4.pdf)

 

📌Track Down Stealth Fileless Injection-based Nginx Backdoor in the Attack 

- 講者: Peter Syu, Jr-Wei Huang
- 下載連結: [請點此](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_4_peter-jr-wei_en.pdf)

 

##關於JSAC
日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。

更多資訊請見 [JSAC 官網](https://jsac.jpcert.or.jp/en/index.html)

 
*首圖來源: [JSAC](https://jsac.jpcert.or.jp/en/index.html)

日本資安分析師研討會 JSAC2023

>感謝 iThome 報導 TeamT5 舉辦之[資安攻擊事件回顧與情勢展望研討會](https://teamt5.org/tw/posts/teamt5-seminar-2022/)，以下節錄報導，完整內容請至 [iThome](https://www.ithome.com.tw/news/154758)

面對詭譎多變的國際政治情勢，以及地緣政治的衝擊時，具有獨特政治角色的臺灣，持續是網軍鎖定攻擊的對象。

根據臺灣資安公司TeamT5（杜浦數位安全）技術長李庭閣日前揭露的研究顯示，截至今年11月1日為止，臺灣總計發生109起APT攻擊事件，而這段期間，該公司已協助9個客戶進行深入分析與應變，並對其他26個包括政府、企業與學校的受駭單位，進行資安通報。

他表示，上述發動APT攻擊，大多來自中國駭客組織，其中，只有一起攻擊事件，是由北韓駭客組織Lazarus發動。
 
 
_完整內容請至 [iThome](https://www.ithome.com.tw/news/154758) 閱讀_

【iThome 報導】2022年TeamT5臺灣APT攻擊研究出爐：觀察109起APT攻擊行動，26個受駭單位

今年國內外網路攻擊事件頻傳，挑戰企業的資安應變能力。亞太威脅情資專家 TeamT5 杜浦數位安全特辦理 「撥開蛛絲馬跡：2022 資安攻擊事件回顧與情勢展望 」研討會，指出 3 大防禦重點，協助企業超前部署資安防禦。TeamT5 建議企業訂閱威脅情資報告，妥善掌握攻擊敵方的動態；採取積極的資安防禦策略、導入適合的解決方案與資安框架，預防入侵破口；與專業團隊合作，若遭遇網路攻擊，可快速應變、恢復營運。

##回顧今年臺灣遭遇的網路攻擊事件 以中國駭客團體為大宗來源
根據 TeamT5 截至今年度 11 月掌握的情資，觀察到 109 件進階持續性威脅 (APT) 事件，大多數與中國駭客團體相關，受害組織以政府單位、軍方居多。TeamT5 技術長李庭閣指出，2022 年台灣遭遇的網路攻擊與 2021 年相比，整體態勢相似，然而攻擊者攻勢更凌厲、採用更多元的工具，甚至濫用合法軟體、雲端平台等，偽裝其攻擊行動。

##裴洛西議長訪台伴隨的網路攻擊 凸顯應留意供應鏈資安
此外，TeamT5 網路威脅分析師黃芷芸深度分析裴洛西 (時任美國眾議院議長) 訪台伴隨的威路威脅事件，指出台灣面臨的網路攻擊 (如: 網頁竄改、分散式阻斷服務攻擊 DDoS) 造成的實際影響有限，且這些攻擊多缺乏 APT 技術含量，威嚇宣傳意味恐大於實際攻擊效果。

團隊研判主要目的是塑造中國政府的強硬態度，向世界展現中國統一台灣的決心，也可對其國內民眾表露中國政府的手腕。綜合來看，本次事件的受害對象不限於政府單位，包括各級機關、企業的上下游供應商都可能成為網路攻擊的入侵破口。

##政府單位、企業面臨共通的網路威脅 宜採取更積極的資安管理與應對措施
從實務面分析，TeamT5 合作夥伴安碁資訊鑑識部門蔡東霖經理指出，該部門於 2022 年處理之資安事件，高達 9 成是來自政府單位的需求，特別是以「上傳漏洞」、「SQL Injection 攻擊」為大宗，其次為「勒索軟體攻擊」。

企業面臨網路威脅的共同主因為攻擊者利用系統弱點、利用系統上傳功能，更因基本資安管理未能落實(如: 密碼強度不佳、未安裝防毒)，乃至設備未觸發警告，使得資安防禦需仰賴有經驗的資安人員察覺可疑處，進而應變處理。

最後 TeamT5 特別呼籲，關鍵基礎設施與各級機關需留意上下游廠商面臨的網路威脅，更應儘速整合第三方網路威脅情資，並導入零信任架構 (Zero Trust Architecture) 來降低遭受供應鏈攻擊的機率。針對企業單位，則建議採用國際電腦稽核協會(CISA)所制定的流程、項目，檢視內部的資安應處機制、資安設備佈署及專業作業人力是否足夠應對資安事件，並考量導入外部專業團隊協助。

![teamt5-seminar-2022-press-release_pic.jpg](https://uploads.teamt5.org/upload/original/teamt5-seminar-2022-press-release_pic.jpg)
<center>
講師合影
</center>


##[關於 TeamT5 杜浦數位安全]
TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺企業、政府單位防禦勒索軟體與進階持續性滲透攻擊(APT)，有效保護商業機密文件，營運不受網路攻擊影響。
我們基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。2022年並獲日本三大巨頭共同投資 - 日本最大創投 JAFCO 集富集團、日本最大跨國企業並在全球都有商業投資的 ITOCHU 伊藤忠商事，與日本最大資安解决方案提供商 MACNICA，是客戶的最佳資安後盾。

【TeamT5 研討會回顧】資安攻擊不斷 專家指出3大防禦重點

東吳大學致力於提升資訊安全防護能量，成立全台首個「網路勒索攻擊應變小組」 ，邀請專注亞太威脅情資、勒索軟體防護的杜浦數位安全 (TeamT5) 共襄盛舉，以及星國資訊龍頭新加坡科技工程公司(ST Engineering)、台灣資安長協會、中華資通訊法律協會簽屬聯盟協議 ，共同面對日益猖獗的網路勒索攻擊事件。

「網路勒索攻擊應變小組」 將提供完整的因應對策，希望協助企業、組織在資安軟體與硬體設備、 資安威脅情資以及人員教育培訓上，提升防禦能量，有效保護商業資產與機密資料。

本次東吳大學「網路勒索攻擊應變小組」 成立儀式，由杜浦數位安全創辦人暨執行長蔡松廷代表參與。杜浦數位安全長期投入資安領域，擁有 一流的威脅情資研究與端點防護解決方案，致力協助政府與企業，對抗來自網路間諜團體的進階持續性威脅 (Advanced Persistent Threat, APT)。 

近年勒索軟體對企業、組織的攻擊事件頻傳，不僅影響日常營運，更造成鉅額損失。根據杜浦數位安全對亞太地區的 APT 駭客族群深入瞭解與研究，以及資安攻擊事件後續應變、追查的實務經驗，建議可從技術面與管理面， 採取應變措施，有效控制損害， 儘早恢復正常營運。

![teamt5-collaborates-with-scu_pic1.jpg](https://uploads.teamt5.org/upload/original/teamt5-collaborates-with-scu_pic1.jpg)
<center>杜浦數位安全創辦人暨執行長蔡松廷(右三)參與東吳大學「網路勒索攻擊應變小組」成立活動</center>

![teamt5-collaborates-with-scu_pic2.jpg](https://uploads.teamt5.org/upload/original/teamt5-collaborates-with-scu_pic2.jpg)
<center>杜浦數位安全創辦人暨執行長蔡松廷(右)與東吳大學潘維大校長(左)共同簽署合作協議</center>

杜浦數位安全與東吳大學合作 助全台首個「網路勒索攻擊應變小組」 成立

TeamT5 joined one of the largest events in Vietnam - Vietnam Cyber Security Day.

In our booth, we’re happy to see people are interested in threat intelligence. Our solution ThreatVision helps enterprises prevent advanced persistent threat(APT) by knowing hackers’ playbooks.

 
![Vietnam%20Cyber%20Security%20Day_pic1.JPG](https://uploads.teamt5.org/upload/original/Vietnam%20Cyber%20Security%20Day_pic1.JPG)
 
![Vietnam%20Cyber%20Security%20Day_pic2.jpg](https://uploads.teamt5.org/upload/original/Vietnam%20Cyber%20Security%20Day_pic2.jpg)

<center>TeamT5 introduced our cybersecurity solutions to Tech Day's attendees</center>

TeamT5 Joined Vietnam Cyber Security Day, Help Enterprise to Enhance Cybersecurity Protection

網路攻擊威脅不限地域，TeamT5 提供在地化情資，協助企業抵抗攻擊。

「知己知彼，百戰百勝」 ── TeamT5 首度參與越南資安日(Vietnam Cyber Security Day)，與合作夥伴 Netpoleon 共同介紹威脅情資平台 ThreatVision，協助企業防禦網路攻擊、資安威脅。 


 
![Vietnam%20Cyber%20Security%20Day_pic1.JPG](https://uploads.teamt5.org/upload/original/Vietnam%20Cyber%20Security%20Day_pic1.JPG)
 
![Vietnam%20Cyber%20Security%20Day_pic2.jpg](https://uploads.teamt5.org/upload/original/Vietnam%20Cyber%20Security%20Day_pic2.jpg)

<center>TeamT5 與合作夥伴 Netpoleon 向參觀者介紹解決方案</center>

TeamT5 積極助力越南企業提升資安防護，首度參與越南資安日(Vietnam Cyber Security Day)

回顧 2022 年國內外層出不窮的網路攻擊、資安威脅，皆挑戰組織單位的資安應變能力與思維。

TeamT5 杜浦數位安全為亞太威脅情資安專家，專長從各類實務事件中，撥開蛛絲馬跡，分析廣雜的資訊與線索，找出有助資安防禦的關鍵點，並指出未來資安威脅演變與發展態勢。
本次研討會藉由回顧2022年重大資安事件，與展望2023年資安威脅全景，告訴您重要資安情勢發展，想更深入了解的您絕對不能錯過！

📌時間：2022-12-08(四) 13:30 ~ 17:00  (13:00 開始報到)

📌地點：台北喜來登大飯店-B2福廳 (台北市中正區忠孝東路一段12號-B2)

📌邀請對象：本活動免費報名參加，敬邀各產業及政府單位之管理職、資訊、資安相關職務人員踴躍報名。

📌立刻報名: https://www.accupass.com/event/2210280650141930169462

TeamT5 資安攻擊事件回顧與情勢展望研討會 免費報名! (已截止)

###想找資安實習嗎？想了解資安職涯發展嗎? 想了解適合自己的資安工作嗎？

我們是 TeamT5 杜浦數位安全，專精於**網路惡意入侵行為分析**與**漏洞安全研究**，為頂尖資安威脅研究團隊。

我們即將在明年（2023）寒假期間舉行五天的 TeamT5 Security Camp 資安培訓營，將帶著大家透過一系列的完整課程，快速了解每一個資安職位的工作內容。更透過導師制度，讓大家不僅可以從中學習資安技術，更能接觸真實的實務案例！

##資安培訓營內容
五天的 Security Camp 資安培訓營，你將接觸到：
- 初探威脅情資的奧秘
- 資安事件處理的剖析
- 與系統底層一日邂逅
- 漏洞挖掘的深入體驗
 

##上課日期（皆需實體到場）
2023 年 2月1日（三）、2月2日（四）、2月7日（二）、2月8日（三）、2月9日（四）
 

##報名資格與費用
- 報名資格：國內大專院校大學生、碩士生
 
- 活動費用：免費
 

##徵選方式
- 即日起至至 12/12（一）: 開放索取筆試題目
 
 題目索取表單 👉https://reurl.cc/EX2q5n 
 
- 11/25（五）: 題目寄出 (較晚填寫表單者，將依序寄送題目)
- 12/12（一）: 題目繳交截止日(因應同學反應準備考試中，特別延長~)
- 12/23（五）: 通知錄取者 (實際日期依報名狀況，彈性調整) 
- 01/04（三）: 通知備取者遞補 (實際日期依報名狀況，彈性調整) 


##活動諮詢窗口
若有任何問題，歡迎來信 camp@teamt5.org

第三屆 TeamT5 Security Camp 資安培訓營 開始招生! (報名截止)

TeamT5 Joined AISA Melbourne Cybercon, Showcase Threat Intelligence Solution 

The AISA Melbourne Cybercon which took place Oct. 11-13 has been an exciting event for the TeamT5 crew. 

Not only did our talented team host informative sessions on cyber threat intelligence in China, they also listened to some great panel discussions, took in the awesome live events and caught up with leading industry experts. 

We would like to take this opportunity to thank all the people who stopped by our booth and to extend a big congrats to the winners of our Apple HomePod Mini!

Looking forward to seeing you in more activities in Australia.

![aisa-melbourne-cybercon-2022_photo.jpg](https://uploads.teamt5.org/upload/original/aisa-melbourne-cybercon-2022_photo.jpg)
<center>TeamT5 crew at the booth and introduced ThreatVision</center>

TeamT5 Joined AISA Melbourne Cybercon, Showcase Threat Intelligence Solution 

網路攻擊威脅不限地域，TeamT5 提供在地化情資，協助企業抵抗攻擊。

「知己知彼，百戰百勝」 ── TeamT5 首度參與澳洲資安展 AISA CyberCon，不僅由威脅情資團隊 Charles Li、Leon Chang 進行精采演說；也於攤位展示威脅情資平台 ThreatVision，協助企業防禦網路攻擊、資安威脅。


![aisa-melbourne-cybercon-2022_photo.jpg](https://uploads.teamt5.org/upload/original/aisa-melbourne-cybercon-2022_photo.jpg)
<center>TeamT5 團隊於攤位展示威脅情資平台 ThreatVision</center>

 TeamT5 參與澳洲資安展 AISA CyberCon 展示資安威脅情資解決方案

The biggest information security conference in Japan, CODE BLUE 2022, will be held in hybrid style in Tokyo, both virtual and on-site, on October 27th and 28th. TeamT5, with its Taiwan headquarter & Japan subsidiary, is proud to support, sponsor and participate in this Asia top international cybersecurity event.

This year, our cyber threat analysts & cyber security researchers will share their latest study on China’s Bots-Driven InfoOps and North Korean APT “CloudDragon” at this year’s conference.

See below for highlights of our events at CODE BLUE 2022.

##Speech: From Parroting to Echoing: The Evolution of China’s Bots-Driven InfoOps targeting Taiwan
Presented by : Silvia Yeh(Cyber Threat Analyst),  Che Chang(Cyber Threat Analyst)

Social media is no doubt a critical battlefield for threat actors to launch InfoOps, especially in a critical moment such as wartime or the election season. We have seen Bot-Driven Information Operations (InfoOps, aka influence campaign) have attempted to spread disinformation, incite protests in the physical world, and doxxing against journalists.
China's Bots-Driven InfoOps, despite operating on a massive scale, are often considered to have low impact and very little organic engagement. In this talk, we will share our observations on these persistent Bots-Driven InfoOps and dissect their harmful disinformation campaigns circulated in cyberspace.

In the past, most bots-driven operations simply parroted narratives of the Chinese propaganda machine, mechanically disseminating the same propaganda and disinformation artifacts made by Chinese state media. However, recently, we saw the newly created bots turn to post artifacts in a livelier manner. They utilized various tactics, including reposting screenshots of forum posts and disguised as members of “Milk Tea Alliance,” to create a false appearance that such content is being echoed across cyberspace.
We particularly focus on an ongoing China's bots-driven InfoOps targeting Taiwan, which we dub "Operation ChinaRoot." Starting in mid-2021, the bots have been disseminating manipulated information about Taiwan's local politics and Covid-19 measures. Our further investigation has also identified the linkage between Operation ChinaRoot and other Chinese state-linked networks such as DRAGONBRIDGE and Spamouflage.


##Speech: CloudDragon’s Credential Factory is Powering Up Its Espionage Activities Against All the Policymakers
Presented by : Zih-Cing Liao(Cyber Security Researcher), Yu-Tung Chang(Cyber Security Researcher)

Kimsuky is a North Korean APT possibly controlled by North Korea's Reconnaissance General Bureau. Based on reports from the Korea Internet & Security Agency (KISA) and other vendors, TeamT5 identified that Kimsuky's most active group, CloudDragon, built a workflow functioning as a "Credential Factory," collecting and exploiting these massive credentials.

The credential factory powers CloudDragon to start its espionage campaigns. CloudDragon's campaigns have aligned with DPRK's interests, targeting the organizations and key figures playing a role in the DPRK relationship. Our database suggested that CloudDragon has possibly infiltrated targets in South Korea, Japan, and the United States. Victims include think tanks, NGOs, media agencies, educational institutes, and many individuals.

CloudDragon's "Credential Factory" can be divided into three small cycles, "Daily Cycle," "Campaign Cycle," and "Post-exploit Cycle." The"Daily Cycle" can collect massive credentials and use the stolen credentials to accelerate its APT life cycle.

In the "Campaign Cycle," CloudDragon develops many new malware. While we responded to CloudDragon's incidents, we found that the actor still relied on BabyShark malware. CloudDragon once used BabyShark to deploy a new browser extension malware targeting victims' browsers. Moreover, CloudDragon is also developing a shellcode-based malware, Dust.

In the "Post-exploit Cycle," the actor relied on hacking tools rather than malicious backdoors. We also identified that the actor used remote desktop software to prevent detection.

In this presentation, we will go through some of the most significant operations conducted by CloudDragon, and more importantly, we will provide possible scenarios of future invasions for defense and detection.


##What is CODE BLUE?
CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on [CODE BLUE 2022 Official Website](https://codeblue.jp/2022/en/).

*Image courtesy of [CODE BLUE](https://codeblue.jp/2022/en/).

【TeamT5 x CODE BLUE 2022】Because Security Matters

日本最大級のセキュリティ国際会議「CODE BLUE 2022」が10月27日、28日の２日間に開催されます。
台湾を拠点とするTeamT5株式会社は、アジア圏域で最大級のサイバーセキュリティ国際会議に参加できる事は大変光栄です

当社のサイバーセキュウリティアナリストとサイバーセキュリティ分析者は、今年中国を主導のInfoOps と北朝鮮主導のAPT「CloudDragon」について最新の調査結果を発表します。

CODE BLUE 2022における当社イベントについて手短に紹介します。

##講演: オウム返しから反響へ：台湾を標的とした中国のボット駆動型情報操作の進化

特別ゲスト：Silvia Yeh - シルビア・イェ (Cyber Security Analyst), Che Chang - チェ・チャン (Cyber Security Analyst)

ソーシャルメディア (SNS）は、特に戦時中や選挙シーズンなどの重大な局面で、脅威者が情報操作を展開するための重要な戦場であることに疑いの余地はない。ボット駆動型情報操作（InfoOps、別名インフルエンス・キャンペーン）が、偽情報の拡散、物理的な世界での抗議活動の扇動、ジャーナリストのDoxing（晒す）などを試みているのを誰もが目にしてきた。

中国のボット駆動型情報操作は、大規模に活動しているにもかかわらず、インパクトが弱く、有機的な関与が非常に少ないと見られている。本講演では、こうした根強いボット駆動型情報操作に関するわれわれの見解を紹介し、サイバー空間で流通する有害な偽情報キャンペーンについて解剖する。
過去には、ほとんどのボット駆動型オペレーションは、中国のプロパガンダマシンの物語を単にオウム返しし、中国の国営メディアが作ったのと同じプロパガンダや偽情報の人工投稿を機械的に広めていた。しかし、最近、新しく作られたボットは、より自然な投稿をするようになっている。彼らは、フォーラムの投稿のスクリーンショットを再投稿したり、「ミルクティー同盟」のメンバーになりすましたりするなど、さまざまな手口を用いて、そのようなコンテンツがサイバー空間で反響しているかのように見せかけている。

私たちは特に、「ChinaRoot作戦」と名付けた、台湾を標的とした中国のボット駆動型情報操作に注目している。2021年半ばから、ボットは台湾の地方政治とCOVID–19対策について操作された情報を発信している。さらに調査を進めると、「ChinaRoot作戦」と、「DRAGONBRIDGE」や「Spamouflage」といった中国国家と連携した他のネットワークとの関連も確認された。

##講演: クラウドドラゴンの認証情報工場、政策担当者へのスパイ活動をより強化へ
特別ゲスト：Zih-Cing Liao - ズーチン・リャオo(Cyber Security Researcher) , Yu-Tung Chang - ユーツン・チャン(Cyber Security Researcher) 

Kimsukyは、北朝鮮系APTで北朝鮮の偵察総局が支配していると思われる。KISA（Korea Internet & Security Agency）や他のベンダーからの報告に基づき、TeamT5はKimsukyの最も活発なグループであるCloudDragonが「Credential Factory（認証情報工場）」として機能するワークフローを構築して大量のクレデンシャルを収集・悪用していることを確認した。

この「Credential Factory」は、CloudDragonがスパイ活動を開始するための動力源となっている。CloudDragonのキャンペーンはDPRKの利益に沿うもので、DPRKとの関係で役割を果たす組織や重要人物をターゲットにしている。私たちのデータベースは、CloudDragonが韓国、日本、米国のターゲットに潜入した可能性があることを示唆した。被害者は、シンクタンク、NGO、メディア機関、教育機関、そして多くの個人である。

CloudDragonの 「Credential Factory」は、「Daily Cycle」、「Campaign Cycle」、「Post-exploit Cycle」の3つの小さなサイクルに分けられる。「Daily Cycle」では、大量のクレデンシャルを収集し、盗んだクレデンシャルを使用してAPTのライフサイクルを加速させることができる。

「Campaign Cycle」では、CloudDragonは多くの新しいマルウェアを開発する。われわれはCloudDragonのインシデントに対応したが、このアクターは依然としてBabySharkマルウェアを利用していることが明らかになった。CloudDragonは、BabySharkを利用して、被害者のブラウザーを標的としたマルウェアを含んだ新しいブラウザー拡張機能を展開していたことがある。さらに、CloudDragonは、「Dust」というシェルコードベースのマルウェアも開発している。
Post-exploit Cycle」では、悪意のあるバックドアではなく、ハッキングツールに依存している。また、検知されないようにするために、リモートデスクトップソフトウェアを使用していることも確認している。

本発表では、CloudDragonが行った最も重要な作戦のいくつかを紹介し、さらに重要なこととして、防御と検知のために、今後の侵入の可能なシナリオを提示する。

##CODE BLUEとは？
CODE BLUE is Japan's largest international information security CODE BLUEは日本最大の国際情報セキュリティ会議です。CODE（技術）を使用し、BLUE（大洋）を超えて人々をつなげることで、インターネット世界をよりよくすることを目指します。毎年、世界最高レベルの専門家や研究者が一堂に会し、最新の調査結果を発表して最先端のトピックについて話し合います。情報セキュリティの課題を解決するために、すべての参加者が情報を交換して協力し合う場です。
詳細情報は [CODE BLUE 2022](https://codeblue.jp/2022/)の公式ウェブサイトをご覧ください。

*画像のソース: [CODE BLUE](https://codeblue.jp/2022/)



【TeamT5 x CODE BLUE 2022】セキュリティは常に重要です

今年的臺灣資安大會眾多攤位之中，出現了一間西裝店！

TeamT5 杜浦數位安全大玩特務梗，將高級西裝店搬進展會會場，推出量身訂製專屬的防勒索服務。以電影「金牌特務」為概念，打造量身訂製西裝店，呈現 TeamT5 如同裁縫師為客戶製作獨一無二的西裝，客製化企業的勒索防護計畫。

此次大會主辦單位特別安排副總統賴清德親臨 TeamT5 資安西裝店，由資深產品經理 Shawn 侯翔齡向賴副總統介紹 TeamT5 量身訂製的設計理念及資安防護服務。


![cybersec-2022-retrospect_pic1.jpg](https://uploads.teamt5.org/upload/original/cybersec-2022-retrospect_pic1.jpg)

<center>
副總統賴清德 (右) 今日親臨臺灣資安大會參觀 TeamT5 資安西裝店，由 TeamT5 資深產品經理 Shawn 侯翔齡 (左) 介紹 TeamT5 量身訂製的設計理念及資安防護服務。
</center>


西裝訂製流程從瞭解使用情境開始、至挑選樣式與布料、測量身形、畫線製圖、穿針引線等步驟，缺一不可。就像 TeamT5 深信最好的企業資安防禦，乃是「量身訂製」，配合客戶的規模、產業、法規等，規劃完整符合客戶需求的解決方案。

在這情勢詭譎多變的年代，駭客入侵手法千變萬化，企業資安需求千般萬樣，如何有效防禦攻擊、確保營運效率及穩定，值得企業細細思量。


![cybersec-2022-retrospect_pic2.jpg](https://uploads.teamt5.org/upload/original/cybersec-2022-retrospect_pic2.jpg)

<center>
TeamT5 杜浦數位安全上週甫宣布獲日本最大創投 JAFCO 集富集團、ITOCHU 伊藤忠商事及 MACNICA 共同投資，將擴大日本市場布局，本周參與 CYBERSEC 2022 臺灣資安大會，別出心裁設計高級西裝店，成為本次展會一大焦點。
</center>

同時，TeamT5 冀望與大眾一同提升企業資安防護力，在攤位舉辦一系列資安講座，特別邀請來自專業顧問諮詢公司的重量級來賓與 TeamT5 執行長蔡松廷 (TT)，一同暢談企業資安防禦策略的規劃與實務。KPMG 安侯企業管理林大馗副總經理將於講座中談論對抗勒索軟體，該做些什麼準備；Deloitte 勤業眾信簡宏偉執行副總談論遇到勒索攻擊時，OT 和 IT 應有什麼不一樣的防禦計畫；最後由EY 安永萬幼筠總經理分享實際案例，談勒索對抗與準備。

今年度資安大會規模更勝以往，TeamT5 參展攤位吸引眾多目光，並積極參與大會論壇、勒索軟體論壇及 CyberLAB，分享資安實務，期望攜手合作夥伴，共同打造一個更安全的世界。

【CYBERSEC 2022 台灣資安大會回顧】資安大會大玩特務梗 TeamT5推防勒索訂製服務

>TeamT5 Expands its Cyber Threat Intelligence Solutions Securing Series A Funding
>
>TeamT5 Deepens Footprint in Japan Market, Establishing K.K.

TeamT5, a provider of top cyber threat intelligence and endpoint detection and response (EDR) solutions in APAC, has secured Series A funding as it looks to expand into the Japanese market. The round was led by [JAFCO](https://jafcoasia.com/), the Asia group company of the prevailing Japanese venture capital firm. Also participating were [ITOCHU](https://www.itochu.co.jp/cn/index.html), one of Japan’s largest multi-national corporations with many business units globally, as well as [MACNICA](https://www.macnica.com/global/web/), Japan’s predominant cybersecurity service provider. TeamT5 also established the K.K. subsidiary Japan office to strengthen local sales activities, provide better service and help support expansion of distribution.

According to the Information-Technology Promotion Agency (IPA) research of "Information Security 10 Major Threats 2022”, damage caused by ransomware and theft of sensitive information through target attacks are the top security concerns for Japan businesses.
The Series A funding will better position TeamT5 to address these kinds of cyberthreats in Japan by providing cyber threat intelligence reports and anti-ransomware solutions.

Tsai-Sung Ting (TT), TeamT5 founder & CEO, says, “TeamT5 has been providing solutions to Japanese clients for a long time, including large enterprises and banks. From this moment onward, we will not only be able to provide better service for existing clients, but we will also be able to gain new prospects in Japan. We look forward to working with Japanese investors and extending our reach into other industries and segments, as we continue to enhance our product competitiveness and recruit more local talents to ensure superior service.”

JAFCO remarks, “The cybersecurity market is projected to grow significantly in this digital era. JAFCO is very happy to know that TeamT5 provides best-in-class cybersecurity protection & defense solutions for clients, safeguarding and ensuring the integrity of critical digital assets. We hope more Japanese enterprises will recognize the importance of cybersecurity and mitigating risks.”

ITOCHU comments, “We are thrilled to work with Team T5, providing solutions invented by the world’s most experienced talents in the security industry. With this investment in Team T5, we expect that Team T5 will be able to accelerate their expansion efforts to bring their cutting-edge technologies to enterprises, service providers and government organizations across the region looking for greater security and peace of mind.”

MACNICA states, “TeamT5’s solutions are widely adopted by Japanese clients. We expect the TeamT5 brand to reach more enterprises and governments through our strengthened collaboration.”

##About TeamT5
Based in Taiwan, TeamT5 is a firm of over 10 years, consisting of world-class cyber threat analysts, engineers, and professionals. Leveraging geographic and cultural advantages, TeamT5 is sought after for its special expertise on cyber attackers and cyber espionage in the Asia Pacific region. Derived from in-house research in malware & Advanced Persistent Threat (APT) detection, TeamT5 provides cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial institutions, telecom operators, high-tech enterprises, electronic manufacturing service companies, and managed security service providers (MSSP). Passionate and dedicated, TeamT5 is committed to refining and enhancing its anti-ransomware and endpoint detection and response solutions to always ensure the utmost protection for its enterprises’ daily operations.


## Press Contact
TeamT5, Inc.
 
pr@teamt5.org

TeamT5 Expands its Cyber Threat Intelligence Solutions Securing Series A Funding

亞太地區資安威脅情資與端點資安解決方案提供商 TeamT5 杜浦數位安全，獲日本最大創投 JAFCO集富集團、日本最大跨國企業並在全球都有商業投資的 ITOCHU 伊藤忠商事，與日本最大資安解决方案提供商 MACNICA 共同投資。同時成立日本子公司，除了強化售後服務，更擴大深耕日本市場，也將持續優化端點偵測與回應解決方案，提升惡意軟體反制能力。

　　TeamT5 創辦人暨執行長蔡松廷(TT)表示，TeamT5 杜浦數位安全切入日本市場已久，第一個客戶就在日本，由衷感謝日本客戶的肯定。未來，不僅將擴大服務既有的大型銀行、政府機構等客戶，更會積極拓展至其他產業及部門，期待與日方投資人多方合作，強化在地商業模式，持續召募臺灣與日本人才，為各領域守護資安，使組織運作順暢不中斷。

　　JAFCO 創投指出，科技發展更凸顯資安在未來具高速成長潛力。JAFCO 看好 TeamT5 杜浦數位安全 技術及研發能力，為客戶提供的最佳資安防禦方案，也希望能讓更多日本企業了解資安的重要性。ITOCHU 表示，很高興與 TeamT5 杜浦數位安全 合作，提供全球最具經驗資安專業人才發明的解決方案；預期 TeamT5 杜浦數位安全 將加速擴張，將最先進的技術帶給渴望資訊安全的企業、服務提供商和政府組織。MACNICA 評論，TeamT5 杜浦數位安全 的產品深得日本客戶肯定與信賴，透過雙方結盟加強合作，將讓 TeamT5 杜浦數位安全 的品牌擴及更多的企業及政府部門。

　　TeamT5 杜浦數位安全 團隊專家具備超過10年以上對抗惡意程式與進階持續性滲透攻擊(APT)的經驗，基於亞太地區地緣和語言優勢，有效掌握無國界的駭客攻擊，提供最專業的威脅情資研究，達到「知己知彼，百戰百勝」之防禦效益。TeamT5 杜浦數位安全 從威脅情資出發，以端點偵測與回應解決方案，協助美日臺大型機構反制勒索軟體，有效保護商業資產與機密文件，成為客戶資安防護的最強後盾。

##投資者簡介
###[JAFCO 集富集團](https://jafcoasia.com/): 日本最大創投 
集富亞洲(JAFCO Asia)設立於1990年，為亞太地區之風險投資產業的領先品牌。母公司為日本最大的創投集團JAFCO(於東京證交所上市 TYO 8595)，目前總管理基金規模為US$6億元(迄今總累計管理規模為US$17億元)。JAFCO Asia 目前投資企業累計超過500家，其中已有115家成功公開發行。

###[ITOCHU 伊藤忠商事](https://www.itochu.co.jp/cn/index.html): 日本最大跨國企業 
伊藤忠商事創始於1858年，在日本及全球62個國家共有100個據點，並有300餘間關聯公司，為歷史悠久的綜合貿易公司。除了進出口及三角貿易外，也大幅展開對於國內外的事業投資，目前整個集團內共有超過10萬名來自世界各國的人才。2020財年以市值、股票價格及合併淨收入等三方面的表現，正式成為日本第一大綜合貿易公司。

###[MACNICA](https://www.macnica.com/global/web) :日本最大資安解决方案提供商
MACNICA 為日本創新技術解決方案的全球增值經銷商和服務提供商。解決方案領域涵蓋資安、人工智慧、工業物聯網、大數據、醫療保健、半導體等。其在日本及美國、中國、東南亞、印度、巴西、歐洲等市場經營相關業務。

##新聞稿聯絡窗口
TeamT5 杜浦數位安全 
 
pr@teamt5.org

日本三大巨頭共同投資台灣資安公司  TeamT5 杜浦數位安全獲青睞 將強化布局日本與亞太市場

アジア太平洋地域においてトップのサイバー脅威インテリジェンスと従来にない脅威ハンティングツールを提供するTeam T5, Inc.(本社：台湾、CEO：Sung-ting Tsai、以下TeamT5)は、日本市場における事業拡大に向けて、シリーズA資金調達を完了したことを発表しました。この資金調達は、JAFCO Asia (日本の有力なベンチャーキャピタルであるジャフコグループ株式会社のグループ)が主導し、世界に多くの事業部門を持つ日本最大の多国籍企業の1つである伊藤忠商事株式会社(以下：「伊藤忠商事」)、ならびに日本を代表するサイバーセキュリティサービスプロバイダーの株式会社マクニカ(以下：「マクニカ」が参加しました。TeamT5はまた、日本国内での営業活動の強化、より良いサービスの提供、当社製品の導入推進に向けて、日本法人を設立しました。

独立行政法人 情報処理推進機構（IPA）の調査「情報セキュリティ10大脅威2022」によると、ランサムウェアによる被害や標的型攻撃による機密情報の盗難が、日本企業にとってセキュリティ上の最大の懸念事項であるとされています。

今回の資金調達により、TeamT5は、サイバー脅威のインテリジェンスレポートやランサムウェア対策ソリューションを提供することで、日本におけるこれらのサイバー脅威への対応をさらに加速することができるようになります。

TeamT5の創立者およびCEOであるツァイ ソンティン(Tsai-Sung Ting)は、次のように述べています。
「TeamT5 は、大企業や大手銀行など、日本の顧客に対して長年にわたりソリューションを提供してきました。今後は、既存のお客様により良いサービスを提供するだけでなく、日本において新たな事業を展開して参ります。日本の投資家の皆様と協力し、様々な業界や事業形態にも適用範囲を拡大すると共に、製品競争力の強化、ならびにより優れたサービスの提供に向けた国内の人材を採用に引き続き取り組んでまいります」

JAFCO Asia（John Linマネージングディレクター）は、次のように述べています。
「デジタル時代において、サイバーセキュリティ市場は大きく成長することが予測されています。JAFCO Asiaは、TeamT5が業界最高クラスのサイバーセキュリティならびに防衛ソリューションを顧客に提供することで、重要なデジタル資産の保護と健全性の維持を実現していることを評価しています。より多くの日本企業がサイバーセキュリティとリスク軽減の重要性を認識することを願っています。」

伊藤忠商事は、次のように述べています。
「セキュリティ業界において世界で最も経験豊富な専門家によって開発されたソリューションを提供するTeam T5と協業できることを大変嬉しく思います。当社は、Team T5への出資によって、Team T5が、より優れたセキュリティと安心を求めている企業、サービスプロバイダー、政府機関に最先端のテクノロジーを提供し、事業拡大を加速できるものと期待しています。」

マクニカは、次のように述べています。
「TeamT5のソリューションは、日本の顧客に広く採用されています。今回の連携強化により、TeamT5ブランドがより多くの企業や政府機関に届くことを期待しています。」

##TeamT5について
台湾に拠点を置くTeamT5は、世界トップクラスのサイバー脅威アナリスト、エンジニア、専門家で構成された10年以上の歴史を持ち、アジア太平洋地域のサイバー攻撃者およびサイバースパイに関する特別な専門知識を持つ企業として注目を集めています。TeamT5は、マルウェアや高度標的型攻撃（APT）検知に関する社内調査に基づいたサイバー脅威インテリジェンスレポートとアンチランサムウェアソリューションを、政府機関、金融機関、通信事業者、ハイテク企業、電子機器製造サービス会社、マネージド・セキュリティ・サービス・プロバイダー（MSSP）などを含む、米国、日本、台湾の組織に提供しています。TeamT5は、情熱と献身をもって、ランサムウェア対策とエンドポイント検出・対応ソリューションの改良と強化に取り組み、企業の日常業務に常に最大限の保護を保証しています。

###【本件に関する問い合わせ先】
TeamT5広報事務局（神谷・水田）
 
Tel：03-5269-1038
 
e-mail: teamt5@jspin.co.jp

TeamT5、シリーズA資金調達を完了し、サイバー脅威インテリジェンスソリューションを拡大 日本法人で、国内事業を強化

全臺最大資安專業展 CYBERSEC 2022 臺灣資安大會，將在 9 月 20 日至 9 月 22 日於南港展覽二館盛大登場！

今年，TeamT5 杜浦數位安全很榮幸擔任大會的鑽石級贊助夥伴，面對持續演化的勒索軟體攻擊、網路威脅，我們持續守護大家的資安。


>精彩專題演講、解決方案展示總覽，請見TeamT5 台灣資安大會品牌專頁
👉 [連結](https://cybersec2022.teamt5.org/)

>預約現場諮詢，還有機會獲得小禮物喔 
👉  [連結](https://forms.gle/YwEJFxfME5jP96Pq9)

## #L04 品牌攤位 | TeamT5 杜浦數位安全
### 為您量身訂製 專屬勒索防護

想了解預防勒索軟體的根本作法、想為自家企業規劃最切身的勒索防護方案，還是有各種資安防護的疑難雜症，就到 #L04 攤位找 TeamT5 杜浦數位安全，由專業團隊為您提供特別諮詢服務、量身打造最佳對策！

現場不只展示我們獨特的網路威脅解決方案，還有產品 Demo、攤位限定講座、資安小遊戲，所有關於勒索軟體防禦的疑問，一次獲得解答！

## #CT02 Cyber Talent Connect 徵才專區 | TeamT5 杜浦數位安全
### 對抗網路威脅攻擊，我們需要熱情的你

TeamT5 杜浦數位安全在 #CT02 攤位，歡迎有志進入資安產業的朋友們來參觀，了解業界人才需求，以及進入資安領域的職能發展。

也歡迎大家來 Cyber Talent 講座，聽聽我們分享與最新資安業界徵才趨勢!

## 參觀資訊
CYBERSEC 臺灣資安大會
- 展期: 9 月 20 日 - 22 日 
- 展場: 臺北南港展覽二館4樓 (台北市南港區經貿二路2號)
- 杜浦數位安全 TeamT5 品牌攤位與徵才攤位指引
![%E8%B3%87%E5%AE%89%E5%A4%A7%E6%9C%83%E5%B1%95%E5%8D%80%E5%9C%96.png](https://uploads.teamt5.org/upload/original/%E8%B3%87%E5%AE%89%E5%A4%A7%E6%9C%83%E5%B1%95%E5%8D%80%E5%9C%96.png)


【CYBERSEC 2022 台灣資安大會】為您量身訂製 專屬勒索防護

>Thanks for The Wall Street Journal's interview. Our chief analyst Charles Li told the journalist about our observations & insights about China’s sustained cyberattacks during House Speaker Nancy Pelosi’s visit to Taiwan. This is an expert of The Wall Street Journal's article. Read more at [The Wall Street Journal](https://www.wsj.com/articles/china-extends-military-exercises-as-taiwan-battles-cyberattacks-11659969484?st=i4ryxtpdvkdtxy1&reflink=desktopwebshare_permalink)

In addition to defacing some websites and rendering others inaccessible, Charles Li, chief analyst at Taipei-based cybersecurity company TeamT5, said clients affiliated with Taiwan’s government and other critical infrastructure also reported instances of brute-force attacks and server intrusions from unknown sources.
 
 
 
*Image courtesy of [Pixabay](https://pixabay.com/)

【The Wall Street Journal】China Extends Military Exercises as Taiwan Battles Cyberattacks

>TeamT5 杜浦數位安全專精網路威脅、資訊作戰研究，近日接受美國《華爾街日報 The Wall Street Journal》採訪，發表針對中國回應美國眾議院議長裴洛西（Nancy Pelosi）訪台，針對臺灣進行網路攻擊之觀察。下文為節錄，完整報導請見[原文](https://www.wsj.com/articles/china-extends-military-exercises-as-taiwan-battles-cyberattacks-11659969484?st=i4ryxtpdvkdtxy1&reflink=desktopwebshare_permalink)。

In addition to defacing some websites and rendering others inaccessible, Charles Li, chief analyst at Taipei-based cybersecurity company TeamT5, said clients affiliated with Taiwan’s government and other critical infrastructure also reported instances of brute-force attacks and server intrusions from unknown sources.
 
_(TeamT5 杜浦數位安全 首席分析師 李庭閣(Charles Li)表示，與台灣政府單位、關鍵基礎設施有關聯之客戶，回報其遭受不明來源的暴力攻擊(brute-force attack)、伺服器入侵等網路攻擊。)_
 
 
完整報導請見[原文](https://www.wsj.com/articles/china-extends-military-exercises-as-taiwan-battles-cyberattacks-11659969484?st=i4ryxtpdvkdtxy1&reflink=desktopwebshare_permalink)
 
 
 
*首圖來源: [Pixabay](https://pixabay.com/)

【華爾街日報 WSJ 採訪報導】中國延長環台軍事演習，台灣多處遭網路攻擊

>TeamT5 杜浦數位安全專精網路威脅、資訊作戰研究，近日接受《報導者》採訪，發表針對中國回應美國眾議院議長裴洛西（Nancy Pelosi）訪台，所進行文攻武嚇之深度分析。下文為節錄，完整報導請見[原文](https://www.twreporter.org/a/us-house-speaker-nancy-pelosi-asia-tour-information-warfare)。

隨著美國眾議院議長裴洛西（Nancy Pelosi）訪台，中國除了在演習時發射飛彈，雲端上的戰火更早已開打──不實資訊內容包含中英文、至少4種敘事，灌進中國國內、台灣和國際輿論環境。同時，來自中共相關團體的網路惡意攻擊，更往總統府、台電等政府網站和國營企業進攻，並搭配電子廣告看板的入侵。

專精網路威脅研究，與多國企業、政府部門與軍方合作的TeamT5 技術長李庭閣接受《報導者》採訪時表示，接受《報導者》採訪時表示，這次的電子看板廣告入侵，可能只是攻擊者手上掌握的多個資安缺口之一，台灣各界必須正視外包廠商帶來的潛在風險，「對岸一直想要攻擊台灣政府、軍方、關鍵基礎設施，這些單位被打久了，技術、預算、設備都買好買滿。但相對應的是，外包商其實沒有做好準備。」

完整報導請見[原文](https://www.twreporter.org/a/us-house-speaker-nancy-pelosi-asia-tour-information-warfare)。
 
 
*首圖來源: [Pixabay](https://pixabay.com/)

【報導者】網軍現身──裴洛西來台揭開台海網戰序曲，「混合戰」將如何發生？平民與企業如何應對？

TeamT5 與您共同守護台灣，抵禦威脅
 
防護就從第一線團隊的資訊設備開始
 
雲端快速部署，立即自動保護，專家加強巡檢
 
 
本方案將可**免費試用**美日台企業肯定的解決方案 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/) 與 MDR 專業服務
 
協助檢測機構單位的各端點(筆電、伺服器)的可疑行為
 
 
**立刻聯絡我們: sales@teamt5.org**
 
 
**[說明事項]**
- 申請期限: 2022/8/31前，立即申請，免費健檢
- 申請對象: 各級政府單位與關鍵基礎設施單位申請 (適用新客戶)
- 免費試用: 3個月
- 免費掃描端點數量: 200個端點設備以內(含)
- 了解 ThreatSonar : [產品簡介](https://teamt5.org/tw/products/threatsonar/)
 
 
 
*TeamT5 保有本方案最終解釋權

TeamT5 網路戰備特別方案 即刻起免費申請! (已截止)

✨TeamT5 works with Netpoleon to penetrate into Vietnam market
✨With localized threat intelligence, we help enterprises defend cyber threats

TeamT5 joined Netpoleon Vietnam’s Tech Day. We gave a speech on notable cyber threats related to Vietnam. We urged people to use threat intelligence in order to better protect enterprises’ daily operations.

In our booth, we’re happy to see people are interested in threat intelligence. Our solution ThreatVision helps enterprises prepare, prevent, and defeat threat groups by knowing their playbook.

![Netpoleon%20Vietnam%20Tech%20Day_1.jpg](https://uploads.teamt5.org/upload/original/Netpoleon%20Vietnam%20Tech%20Day_1.jpg)

<center>TeamT5 closely work with our partner Netpoleon to penetrate into Vietnam market</center>

 
 

![Netpoleon%20Vietnam%20Tech%20Day_6.jpg](https://uploads.teamt5.org/upload/original/Netpoleon%20Vietnam%20Tech%20Day_6.jpg)

<center>TeamT5 introduced our cybersecurity solutions to Tech Day's attendees</center>

TeamT5 Joined Netpoleon Vietnam’s Tech Day

✨TeamT5 深耕越南市場，贊助暨參與頂尖系統整合商 Netpoleon 科技日✨

網路攻擊威脅不限地域，TeamT5 提供在地化情資，協助企業抵抗攻擊。

「知己知彼，百戰百勝」 ── TeamT5 於現場分享近期越南網路攻擊情資，與合作夥伴 Netpoleon 共同協助企業防禦，與對手的每次交鋒，總能制敵機先。

![Netpoleon%20Vietnam%20Tech%20Day_1.jpg](https://uploads.teamt5.org/upload/original/Netpoleon%20Vietnam%20Tech%20Day_1.jpg)

<center>TeamT5 代表與合作夥伴 Netpoleon 代表於活動現場合照</center>

 
 

![Netpoleon%20Vietnam%20Tech%20Day_6.jpg](https://uploads.teamt5.org/upload/original/Netpoleon%20Vietnam%20Tech%20Day_6.jpg)

<center>TeamT5 代表向參觀者介紹解決方案，獲得熱烈回應</center>

TeamT5 深耕越南市場，贊助暨參與頂尖系統整合商 Netpoleon 科技日

# 歡迎敦新科技成為杜浦數位安全之台灣代理商

感謝通路夥伴們長期對 TeamT5 杜浦數位安全產品的支持與厚愛，使得雙方建立了互信良好的合作關係，TeamT5 也得以日益茁壯成長。為了能更全面的照顧通路夥伴，並提升終端用戶的服務滿意度，TeamT5 遴選長期深耕資訊安全領域的敦新科技股份有限公司為台灣地區(含澎湖、金門、馬祖)授權之合法代理商。

[敦新科技](https://www.dawningtech.com.tw/home.jsp)自2000年成立至今，一直專注於資訊設備代理與深耕品牌通路，提供的解決方案包含資訊安全，運算資源、儲存系統、網路架構、備份備援、雲端服務、AI數據分析及大數據等，協助合作夥伴為企業從基礎建設開始紮根，打造新商業模式與價值，以創造有價值的數位轉型為主要商業目標。

TeamT5 期許未來能透過更完整的通路角色的佈建，與夥伴們更加緊密地攜手合作，共同為客戶的資訊安全把關，創造雙贏的共好局面。

![collaboration_TeamT5_DawningTech.jpg](https://uploads.teamt5.org/upload/original/collaboration_TeamT5_DawningTech.jpg)
<center>杜浦數位安全蔡松廷執行長(右)與敦新科技林承軒執行長(左)合照</center>
 
 
 
 
 
*首圖來源: [Pixabay](https://pixabay.com/)

【公告】歡迎敦新科技成為杜浦數位安全之台灣代理商

受到勒索軟體攻擊，怎麼辦? 拔網路線就結束了嗎?
TeamT5 於 CYBERSECNOW 線上研討會分享，當公司受到勒索軟體攻擊，資安/資訊團隊面臨長官、攻擊者、甚至媒體報導的壓力，可以怎麼做!

## 演講重點
- 如何做好事後處理的工作
- 如果想找到兇手入侵的管道，應該如何跟事件處理團隊合作
- 如何預防再度被勒索攻擊

##演講簡報

[下載連結請點此](https://uploads.teamt5.org/upload/files/[CYBERSECNOW2022]TeamT5%E7%B2%BE%E5%BD%A9%E6%BC%94%E7%B0%A1%E5%A0%B1-%E5%8B%92%E7%B4%A2%E5%88%9D%E4%B8%8A_%E9%99%A4%E4%BA%86%E4%BB%98%E8%B4%96%E9%87%91_%E9%82%84%E8%83%BD%E5%81%9A%E4%BA%9B%E4%BB%80%E9%BA%BC.pdf)

## 演講回顧影片

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/_TOkys8E59g" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</center>

【CYBERSECNOW】精彩回顧: 勒索初上，除了付贖金，還能做些什麼?

日本 [Macnica](https://www.macnica.co.jp) (半導體、網路、網路安全和 AI/IoT 的整體服務解決方案供應商) 與 [TeamT5 杜浦數位安全](https://teamt5.org/)(網路威脅專業分析團隊)共同撰寫並出版了2021年在日本發生的針對型網路攻擊的調查報告[《針對型網路攻擊的現態與對策》第6版](https://www.macnica.co.jp/business/security/2022/report_02.html)。


去年，許多組織受到利用勒索軟體和供應鏈弱點的攻擊，這在新聞中也大為報導。 雖然此類事件浮出水面，但許多企業組織在很長一段時間內都沒有意識到這類攻擊行為，特別是未察覺 「透過有針對性的攻擊，竊取敏感資訊」之攻擊；然而在「[2022年資訊安全10大威脅](https://www.ipa.go.jp/security/vuln/10threats2022.html)」中， 「透過有針對性的攻擊，竊取敏感資訊」是企業組織面臨的第二大威脅。 這情況威脅到日本企業的競爭力來源，並削弱其國際產業競爭力。

在這種情況下，跨組織的戰略資訊共用和情報升級，點出每個攻擊族群的 TTPs、目標和意圖以及技能水準，可以有效應對這些攻擊。 此外，由於針對型網路攻擊在很大程度上取決於地緣政治風險和國家間緊張關係，因此，在當今動蕩的世界形勢下，日本 Macnica 與臺灣 TeamT5 合作進行分析和寫作具有重要意義。

為了提升人們的警覺意識，本報告旨在描述2021財務年度（2021年4月至2022年3月），從日本組織竊取機密資訊（個人資訊、政策相關資訊、製造數據等）之攻擊活動分析。 此外，還介紹了新的攻擊方法和威脅檢測，重點是使用高度隱身的遠端惡意軟體 （emotely controlled malware, RAT）事件。 在報告末尾，我們並列出了這些攻擊活動中威脅入侵指標 （indicator of compromise, IoC） ，以便您可以檢查自身企業組織是否有遭遇這類攻擊。


- 《針對型網路攻擊的現態與對策》第6版報告下載處(日文)
[https://www.macnica.co.jp/business/security/2022/report_02.html](https://www.macnica.co.jp/business/security/2022/report_02.html)
 
 

## 關於 TeamT5 杜浦數位安全
TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。

團隊具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

官網: [https://teamt5.org/](https://teamt5.org/)
 
 
## 關於 Macnica
自 1972 年成立以來，Macnica 一直為最先進的半導體、電子設備、網路和資訊安全產品提供技術加值服務。 基於我們傳統優勢的全球尖端技術採購和技術規劃能力，Macnica 正在人工智慧/物聯網、自動駕駛和機器人等領域拓展新業務。 

Macnica 將尖端技術和團隊專長相結合，提供獨特的服務和解決方案，創造社會價值，為未來社會的發展做出貢獻。 公司總部位於日本橫濱，在全球24個國家設有80個辦事處，並在全球開展業務。 

官網: [https://www.macnica.co.jp](https://www.macnica.co.jp)

Macnica 和 TeamT5 發佈 FY2021鎖定日本的針對型網路攻擊趨勢報告

Macnica, Inc. (a total service and solution provider for semiconductors, networks, cybersecurity, and AI/IoT) and Team T5, Inc.(a threat intelligence provider for cyber espionage activities in the Asia-Pacific region) announced joint report "Reality of Targeted Attacks and Countermeasures Approach, 6th Edition," a report on targeted attacks that landed in Japan in FY2021.

Last year, many organizations were victims of ransomwares and attacks as attacker groups exploited weaknesses in the supply chain. These attacks were widely reported in the news. While such incidents have surfaced, many organizations have not been aware of the breach for a long period of time, and they weren’t aware that they’re under the threat of "theft of confidential information through targeted attacks", which is listed as the second threat for organizations in the "[10 Major Cybersecurity Threats in 2022](https://www.ipa.go.jp/security/vuln/10threats2022.html)". However, this threatens international industrial competitiveness of Japanese companies.

Under these circumstances, by strategically sharing information and sublimating to threat intelligence across organizations, the report highlights the TTPs, objectives, intentions, skill levels, etc. of each attacker group. It also shares effective countermeasures against these attacks. In addition, since targeted attacks (cyber espionage) rely heavily on geopolitical risks and tensions between countries, it is significant to analyze and write a report jointly with Macnica in Japan & TeamT5 in Taiwan under the current unstable world situation.

For the purpose of raising awareness, this report provides analysis of attack campaigns observed in FY2021 (April 2021 to March 2022) that seek to steal confidential information (personal information, policy-related information, manufacturing data, etc.) from Japanese organizations. In addition, focusing on cases using highly stealthy remotely controlled malware (RAT), we introduce new attack methods and threat detection. At the end of the report, we also include the indicator of compromise(IoC) used in the attack campaigns introduced in the report so that you can check your own organization.


- Download the report (in Japanese) 👉
https://www.macnica.co.jp/business/security/2022/report_02.html
 
 

## About Team T5, Inc.
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. We’re also frequently invited to share our insights in top cybersecurity conferences.

Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

Website: [https://teamt5.org/](https://www.macnica.co.jp)
 
 
## About Macnica
Macnica is a Global Value Added Distributor and Service Solution Provider of innovative technology solutions. Our core domains are AI, IIoT, Mobility, Cyber Security, Big Data, Healthcare, Biotech, Retail, Robotics, Semiconductors. 

Macnica operates globally in Japan (HQ), USA, China, South East Asia, India, Brazil, Europe.

Website: [https://www.macnica.co.jp](https://www.macnica.co.jp)

Macnica and TeamT5 Publish Joint Report on Trends in Targeted Attacks Targeting Japan in FY2021

半導体、ネットワーク、サイバーセキュリティ、AI/IoTにおけるトータルサービス・ソリューションプロバイダーの株式会社マクニカ（本社：神奈川県横浜市、代表取締役社長：原 一将、以下マクニカ）は、アジア太平洋地域において行われるサイバースパイ活動の脅威インテリジェンスを持つTeam T5, Inc.(本社：台湾、CEO：Sung-ting Tsai、以下TeamT5)と、2021年度に日本に着弾した標的型攻撃に関する調査レポート「標的型攻撃の実態と対策アプローチ　第6版」を共同著書し、公開いたします。

昨年度も多くの組織がランサムウェアやサプライチェーンの弱点を悪用した攻撃の被害に遭い、ニュースでも大きく取り上げられました。このようなインシデントが表面化する一方、「[情報セキュリティ10大脅威 2022](https://www.ipa.go.jp/security/vuln/10threats2022.html)」でも組織向け脅威第2位にあげられている「標的型攻撃による機密情報の窃取」＊については、長期間に渡って侵害に気づかない組織が多く、表面化するケースもあまり多くありません。しかし、これは日本企業の競争力の源泉を奪い国際産業競争力を低下させる脅威となります。

このような状況下で、組織を超えた戦略的な情報共有とインテリジェンスへの昇華により、各攻撃グループのTTPs、目的や意図、スキルレベルなどを浮き彫りにすることが、これら攻撃に対しての効果的な対策につながります。また、標的型攻撃（サイバーエスピオナージ）は地政学リスクや国家間の緊張関係に大きく依存するため、昨今の不安定な世界情勢下では、台湾のTeamT5と共同で分析・執筆することには大きな意味と意義があります。

本レポートでは、2021年度(2021年4月から2022年3月)に観測された、日本の組織から機密情報(個人情報、政策関連情報、製造データなど)を窃取しようとする攻撃キャンペーンに関する分析内容を、注意喚起を目的として記載しています。また、ステルス性の高い遠隔操作マルウェア(RAT)を用いた事案を中心に、新しい攻撃手法やその脅威の検出についてご紹介しています。レポートの最後には、自組織の確認を行えるよう、本文中で紹介した攻撃キャンペーンで使われたインディケータも掲載しています。

マクニカは今後も日本企業の産業競争力を徐々に蝕んでいく標的型攻撃に対して、粘り強い分析と啓発活動に取り組み、微力ながらも日本経済の発展に寄与できるよう努めてまいります。

■レポートダウンロード先
[https://www.macnica.co.jp/business/security/2022/report_02.html](https://www.macnica.co.jp/business/security/2022/report_02.html)
 
 
## Team T5, Inc.について
TeamT5は、世界有数のマルウェア分析チームであり、アジア太平洋圏におけるサイバースパイ活動に対するベストソリューションプロバイダーです。サイバー脅威の監視、分析、追跡を行いクライアントのシステムとネットワークを攻撃から守ることを支援しています。更に脅威インテリジェンス、分析レポート、APT対策ソリューション、脅威分析、インシデントレスポンスサービスを提供しています。メンバーは、数多くの世界的なセキュリティカンファレンスで研究成果を発表しています。詳細はWebサイト（[https://teamt5.org/](https://teamt5.org/)）をご覧ください。
 
 
## 株式会社マクニカについて
マクニカは、1972 年の設立以来、最先端の半導体、電子デバイス、ネットワーク、サイバーセキュリティ商品に技術的付加価値を加えて提供してきました。従来からの強みであるグローバルにおける最先端テクノロジーのソーシング力と技術企画力をベースに、AI/IoT、自動運転、ロボットなどの分野で新たなビジネスを展開しています。「Co.Tomorrowing」をスローガンに、最先端のテクノロジーとマクニカが持つインテリジェンスをつなぎ、ユニークなサービス＆ソリューションを提供する存在として、社会的価値を生み出し未来社会の発展へ貢献していきます。当社は、横浜に本社を構え、世界24ヶ国80拠点をベースにグローバルなビジネスを展開しています。詳細はWebサイト（[https://www.macnica.co.jp](https://www.macnica.co.jp)）をご覧ください。

マクニカとTeamT5社、2021年度の日本を狙う標的型攻撃の動向レポートを公開

隨著數位轉型、雲端技術的發展，許多企業紛紛將資料上雲；疫情期間，遠距工作也成為許多企業的日常型態，這樣的新工作型態，大幅提升了企業營運和管理的效率，但若未建立好安全措施，卻可能會讓企業更容易遭受網路攻擊。

APT 攻擊（Advanced Persistent Threats）可說是近年令企業最頭痛的網路攻擊型態，也是最大的資安挑戰之一，攻擊者大多精心策畫且針對特定的目標進行攻擊，透過長時間潛伏保持高隱蔽性，並使用複雜精密的惡意軟體及技術入侵系統中的漏洞。進階的攻擊手法加上長期持續性的潛伏與監控，在目標未察覺的情況下對企業造成威脅，讓這種攻擊手法難以防範。

在網路活動持續增加的新時代，企業也都相當看重資訊安全防護，但現有的防護軟體為何不足以抵抗這樣的資安威脅？面對 APT 這種長期隱匿又難以防禦的駭客攻擊，又該如何進行防範？

TeamT5 長年投入資源收集 APT 駭客族群與威脅情資，過去也提供許多企業完善的 APT 防禦方案協助化解惡意威脅問題，侯翔齡指出，面對傳統資安設備單一、片面的偵測邏輯，APT 攻擊者或團體很可能早已繞過傳統資安防禦設備入侵環境並伺機而動，當邊防遭到突破，如何在威脅試圖擴散前，主動出手制止是阻擋 APT 威脅的關鍵。

...

TeamT5 長年投入資源收集 APT 駭客族群與威脅情資，過去也提供許多企業完善的 APT 防禦方案協助化解惡意威脅問題，[TeamT5 資深技術經理]侯翔齡指出，面對傳統資安設備單一、片面的偵測邏輯，APT 攻擊者或團體很可能早已繞過傳統資安防禦設備入侵環境並伺機而動，當邊防遭到突破，如何在威脅試圖擴散前，主動出手制止是阻擋 APT 威脅的關鍵。



![%E7%A7%91%E6%8A%80%E5%A0%B1%E6%A9%98%E5%A0%B1%E5%B0%8E__banner.jpg](https://uploads.teamt5.org/upload/original/%E7%A7%91%E6%8A%80%E5%A0%B1%E6%A9%98%E5%A0%B1%E5%B0%8E__banner.jpg)
<center>TeamT5 杜浦數位安全 ThreatSonarAnti-Ransomware 防禦勒索軟體策略</center>
 
 
[點此閱讀科技報橘 TechOrange 完整報導](https://buzzorange.com/techorange/2022/06/09/teamt5-cyber-security/)

【科技報橘 採訪報導】新型態資安攻防戰開打，面對 APT 攻擊該如何主動防禦？

>Our cyber threat analyst Che Chang gives observations on China’s sudden warnings about US hackers. This is an expert of WIRED's article. Read more at [WIRED](https://www.wired.co.uk/article/china-us-hacking-accusations).

For the best part of a decade, US officials and cybersecurity companies have been naming and shaming hackers they believe work for the Chinese government. These hackers [have stolen](https://www.wired.com/2013/02/chinese-army-linked-to-hacks/) terabytes of data from pharmaceutical companies to [video game firms](https://www.wired.com/story/chinese-hackers-charged-decade-long-crime-spying-spree/), [compromised servers](https://www.wired.com/story/fbi-takes-drastic-step-to-fight-china-hacking-spree/), [stripped security protections](https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/), and [highjacked hacking tools](https://www.wired.com/story/china-nsa-hacking-tool-epme-hijack/), according to security experts. And as [China’s alleged hacking has grown in aggression](https://www.wired.com/story/china-hacking-reckless-new-phase/), individual Chinese hackers face indictments. However, things may be changing.

Since the start of 2022, there has been a marked uptick in China’s Foreign Ministry and the country’s cybersecurity firms calling out alleged US cyberespionage. Until now, these allegations have been a rarity. But the disclosures come with a catch: They appear to rely on years-old technical details, which are already publicly known and don’t contain fresh information. The move may be a strategic change for China as the nation tussles to cement its position as a tech superpower.

“These are useful materials for China’s tit-for-tat propaganda campaigns when they faced US accusation and indictment of China’s cyberespionage activities,” says Che Chang, a cyber threat analyst at Taiwan-based cybersecurity firm TeamT5.

 
 
*Image courtesy of [Pexels](https://www.pexels.com/)

【WIRED】The Mystery of China’s Sudden Warnings About US Hackers

>TeamT5 資安威脅情資分析師 Che Chang 接受 WIRED 訪問，針對中國警告美國駭客行動的消息，進行評論與分析。本文為摘錄，完整文章請見 [WIRED](https://www.wired.co.uk/article/china-us-hacking-accusations)。

近十年來，美國方常點名那些被視為替中國工作的駭客，這些駭客從製藥公司竊取了大量數據，或破壞企業的伺服器等，個別駭客並面臨起訴。

然而 WIRED 記者觀察到，自2022年初，中國外交部和該國資安公司指稱與美國有關聯的網路間諜活動明顯增加，然而這類指稱是基於已有多年歷史的資料，細節也已廣為人知。

WIRED 記者訪問多位專家，TeamT5 資安威脅情資分析師 Che Chang 提出推測，即中方提出這些指控的動機，是因中國面臨美國的網路間諜指控和起訴時，做為以牙還牙的材料。

完整文章請見 [WIRED](https://www.wired.co.uk/article/china-us-hacking-accusations)。

 
 
*首圖來源: [Pexels](https://www.pexels.com/)

【WIRED 採訪報導】關於中國突發針對美國駭客警告之謎團與分析

We're happy to take the interview from [Cyber Security Weekly Podcast](https://mysecuritymarketplace.com/av-channel/cyber-security-weekly-podcast/). It has introduced latest cybersecurity insights for professionals.

In the podcast, Charles Li (Chief Technology Officer & Chief Analyst, TeamT5) shares some highlights of our team’s presentation at Black Hat Asia 2022. Focusing on the notorious Chinese threat actor groups (APT 10, APT 27, APT 41) he discussed key characteristics, such as how their motivations extend beyond espionage to monetisation, tools overlap, targets, and growing OpSec sophistication.

He also touches on the Chinese Cyber Threat landscape from the Taiwanese perspective, such as the information warfare campaigns. With shifting geopolitical landscapes increasing the frequency of cyberattacks on Taiwanese targets, he notes the Taiwanese responses in increasing cybersecurity regulations and investments.

Charles Li advises cyber defenders to invest in tailored threat intelligence, to complement tools such as EDR or firewalls.

🎧 Listen the podcast here➡ [link](https://mysecuritymarketplace.com/av-media/episode-324-chinese-cyber-threat-landscape-perspectives-from-a-taiwanese-cyber-security-expert)

【Cyber Security Weekly Podcast】TeamT5 Talks About Chinese Cyber Threat Landscape

TeamT5 杜浦數位安全接受  [Cyber Security Weekly Podcast](https://mysecuritymarketplace.com/av-channel/cyber-security-weekly-podcast/) 邀請，與主持人對談，分析中國網路威脅態勢。

本集 Podcast 中，TeamT5 杜浦數位安全 Charles Li (技術長暨首席分析師)分享團隊於本年度亞洲黑帽大會(Black Hat Asia)的演講重點，也談論惡名昭彰的中國網路威脅族群(APT 10, APT 27, APT 41)的關鍵特徵，例如他們的動機從網路間諜，延伸至利益獲取，各族群使用的攻擊工具也有重疊處。

Charles Li 也從台灣角度，討論中國網路威脅的態勢，如: 資訊戰(information operation)。此外，隨著地緣政治轉移，網路攻擊更多、更頻繁地鎖定台灣目標，台灣則以加強監管措施、提升資安相關投資因應。

最後，Charles Li 建議資安防禦團隊宜投資在為組織良身打造的威脅情資，並搭配如端點偵測與回應工具(EDR)、防火牆，作為輔助。


🎧 Podcast 聆聽➡ [連結](https://mysecuritymarketplace.com/av-media/episode-324-chinese-cyber-threat-landscape-perspectives-from-a-taiwanese-cyber-security-expert)

【Cyber Security Weekly Podcast】TeamT5 分析中國網路威脅態勢

TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. We’re also frequently invited to share our insights in top cybersecurity conferences.

Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

Our work is also seen by the media as TeamT5 is honored to be featured in [CyberNews](https://cybernews.com/)' pick of Best Threat Intelligence Solutions. In the list, ThreatQuotient and many top solution providers are also mentioned. 

CyberNews wrote:

>With a vast team of experts, TeamT5 provides a cybersecurity defense and threat hunting platform. Easy-to-navigate, advanced, and automated, with it, you secure yourself not only from APT (Advanced Persistent Threat) but from targeted ransomware as well.

>TeamT5 threat hunting tool monitors endpoints in real time. The platform is threat intelligence-driven and can execute incidents effectively. Their AI-powered engine can detect and stop malware, while a ransomware attack is automatically blocked in the first place.

>Speaking of ransomware attacks, enterprise backups are also protected – preventing threats from destroying them. So if you’re in need of a flexible solution that is easy to deploy, ThreatSonar is all that and more.

To read the whole article, please check [this link](https://cybernews.com/resources/best-threat-intelligence-solutions/).

TeamT5 Featured Best Threat Intelligence Solutions on Cybernews

TeamT5 由頂尖資安威脅分析師與研究員組成。基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。我們為美國、日本和台灣的客戶提供資安威脅情報報告和防勒索軟體解決方案。客戶包括政府機構、金融業和高科技業。

媒體[CyberNews](https://cybernews.com/) 也留意到我們的成績，將 TeamT5 解決方案選為最佳威脅情資解決方案。在列表中，還提到了 ThreatQuotient 和許多頂尖解決方案提供商。

CyberNews 寫道:

>With a vast team of experts, TeamT5 provides a cybersecurity defense and threat hunting platform. Easy-to-navigate, advanced, and automated, with it, you secure yourself not only from APT (Advanced Persistent Threat) but from targeted ransomware as well.

>(TeamT5 擁有完整的專家團隊，提供了資安防禦與威脅狩獵平台，該平台易於瀏覽、先進、自動化。當您導入該解決方案，你可以有效保護自身，不僅免於進階持續性攻擊(APT)，更可免於勒索軟體的威脅。)

完整文章請見 [此連結](https://cybernews.com/resources/best-threat-intelligence-solutions/)。

TeamT5 獲美國專業媒體 Cybernews 選為最佳威脅情資解決方案提供商

>TeamT5 is a leading APT intelligence provider in the Asia & Pacific region. TeamT5 shared our research in the Black Hat Asia 2022. In this seminar, TeamT5 pointed out China-nexus APT groups who launched massive attacks against the online entertainment business in the APAC region. 

Charles Li (Chief Analyst) and Che Chang (Cyber Threat Analyst) from TeamT5 pointed out these attacks are not only money-driven, they also collect data from victim companies. The motives are closely aligned with the national interests of the Chinese government.

The Chinese government has put significant pressure on the online entertainment industry. It freezes gaming licenses from Sept 2021 to Apr 2022. It crackdown on Macau gambling
industry and forced gamblers to move online. During the time of pandemic, online gambling skyrocketed. 

China-nexus APT groups' attacks on online entertainment business might be one of the crackdown moves by the Chinese government. Previously, many cases were believed to be financially-motivated attacks because of the usage of ransomware. However, based on TeamT5’s observation in the past few years, APT attacks against online entertainment companies are also driven by espionage purposes.

These threat groups use various tactics, techniques, and procedures (TTPs). For example, they collect info in recruiting websites or forums. Then, they conduct spear phishing which targets customer supporting teams. The content of the phishing email is complaining about system issues and asking team staff to open attachments. Another way is phishing via social network platforms by crafting profiles and approaching sales, ITs, RDs in the targeting companies. 

These threat groups also exploit vulnerabilities of exchange server, VPN server, browser, web, or NAS to compromise the targeting companies. Supply chain attack is another way they use. By compromising the ERP system or official website, they’re able to fulfill their goals.

In the process, some threat groups modify specific weapons to attack online entertainment industry (e.g. SLIME 29). For Amoeba (a.k.a APT41), they use the same weapons that have been used to attack other industries but they developed proprietary tools  for maintaining. Others didn’t develop tailored weapons to attack the online entertainment industry (e.g. TianWu、Greedy Taotie、SLIME34).

Dissecting the current TTPs is merely the first step. TeamT5 urges organizations to start the threat intelligence cycle and have tailored & accurate threat intelligence.

- Presentation slides: [link](https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf)
- Speech video: [link](https://topicplay.com/v/490271)

## About Black Hat Asia
Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.


【Black Hat Asia 2022】Chinese APTs are Looting the Online Entertainment Industry, TeamT5 Researchers Publish Analysis at Black Hat Asia

>TeamT5 杜浦數位安全專精亞太地區駭客團體分析，最新研究於亞太最大資安研討會 Black Hat Asia 發布，指出與中國關聯之多個駭客團體，針對亞太地區的線上博弈產業發起大規模攻擊。這波攻擊據除了獲取金錢利益，對產業的資料展現高度興趣，推測可能暗含中國政府蒐集資訊的動機，異於過去攻擊行動。

中國政府近年來限縮線上遊戲產業發展空間，如停發遊戲版號，及取締賭博產業，使賭博產業多轉為線上營運。而蓬勃發展、跨境經營的線上博弈產業遭受多個駭客團體攻擊，入侵手法精密，TeamT5 首席分析師李庭閣(Charles Li)與分析師張哲誠(Che Chang)指出這波駭客攻擊與中國政府的官方利益一致，使駭客可掌握參與玩家、業主等資料，背後策略與動機實屬不尋常。

駭客團體使用多種手法(TTPs)進攻，如於該產業招募員工的網站論壇收集資料，進一步採取魚叉式網路釣魚(spear phishing)，鎖定客服人員，以抱怨系統為主旨釣魚信件，誘騙客服人員點擊附件；駭客團體也透過社群網站建立假帳戶，藉以接近目標公司的業務、工程師等。

駭客團體並利用各項漏洞，進行攻擊，如瀏覽器、VPN、NAS的漏洞；或採取供應鏈攻擊，從公司官網、ERP系統入侵至公司內部。

針對亞太地區的線上娛樂產業的網路攻擊事件中，攻擊者通常使用非市售的工具，或自行修改、研發工具，以達成攻擊目的。TeamT5 觀察的駭客團體中，SLIME29 的攻擊武器相較於其他團體，乃是為攻擊博奕產業特別製造；Amoeba (又稱 APT41)的攻擊武器也曾用於攻擊其他產業，同時也為博奕產業量身打造可協助他們長期控制目標之工具；此波攻擊中的其他駭客團體如 TianWu、Greedy Taotie、SLIME34 則無特別未博奕產業打造攻擊武器。

TeamT5 表示拆解中國駭客團體攻擊線上博弈產業的手法與背後動機，僅是協助企業了解最新趨勢的開端，後續動向值得關注。

- 演講完整演講簡報檔: [連結](https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf)
- 演講完整錄影: [link](https://topicplay.com/v/490271)

## 關於黑帽大會（Black Hat）
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。


【Black Hat Asia 2022】中國駭客團體攔胡線上博弈產業 TeamT5 分析最新大規模網路攻擊手法

>TeamT5 is a leading APT threat intelligence provider in the Asia & Pacific region. In Black Hat Asia 2022, TeamT5 published our analysis of modular backdoor Pangolin8RAT and its associated threat group "Tianwu”. As modular backdoors and shared malwares are becoming key trends in the threat landscape, Silvia Yeh (Threat Intelligence Analyst) and Leon Chang (Threat Intelligence Researcher) from TeamT5 warn the public that previous APT analysis mindset might not be suitable.

In the past, modular malware like PlugX and ShadowPad have been the most popular shared trojans used in Chinese state-sponsored cyber operations. Since mid-2020, TeamT5 has detected a new modular trojan emerging in the APAC region which has the potential to be their successor. The trojan was named "Pangolin8RAT" after "pangolin" and “p8rat" found in its PDB string and RTTI. Pangolin8RAT is modular, as its functionalities can be expanded by downloading DLL from its C2. Its early feature supported 8 communication protocols, including TCP, HTTPS, UDP, DNS, ICMP, HTTPSIPV6, WEB, and SSH.

TeamT5 researchers names the threat group behind Pangolin8RAT as “Tianwu”, a beast with 8 human heads in Chinese mythology. From 2020 to 2021, TeamT5 has observed Tianwu leveraging Pangolin8RAT to snipe at online gaming/gambling industry, transportation, telecom, government, and dissidents in the Asia Pacific region.

In this talk, TeamT5 researchers also explored Tianwu’s connections with the notorious Chinese APT group Amoeba (aka APT41) by illustrating the similarities in the two group’s modular malware structure, TTPs, and target scope.

TeamT5 researchers concluded that modular backdoor has become a trend as it can reduce the cost of malware development by APT groups. For that reason, previous analysis frameworks and categories might not be suitable for future APT attacks. In order to have an overview of the threat landscape, enterprises should defend themselves with all-level intelligence from tactical & operational level to strategic level.


- Presentation slides: [link](https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf)
- Speech video: [link](https://topicplay.com/v/477689)

## About Black Hat Asia
Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.


【Black Hat Asia 2022】New Trend of Modular Backdoor and APT Attacks, TeamT5 Researchers Publish Analysis at Black Hat Asia

>TeamT5 杜浦數位安全長期致力於亞太地區駭客團體研究，於今年度亞洲最大資安研討會 Black Hat Asia 發布最新研究，說明新興的模組化後門程式 Pangolin8RAT 與其關聯駭客團體。有鑑於後門程式模組化及多駭客團體共用的趨勢，TeamT5 威脅情資分析師 Silvia Yeh 與威脅情資研究員 Leon Chang 警示既有 APT 攻擊分析方法可能不再適合，企業組織宜運用多層次威脅情資，掌握駭客動態。

過去像是 PlugX、ShadowPad等模組化惡意軟體製作而成的木馬程式，常見於中國國家級支持的網路行動。自2020年中，TeamT5 偵測到模組化木馬程式 Pangolin8RAT 在亞太區域區域，有可能是前述模組化惡意軟體的後繼者。Pangolin8RAT 命名來自其 PDB string "pangolin" 和其 RTTI “p8rat”，該模組化特徵為可經由C2指令，進行DLL下載，而擴展功能。其早期版本支援8種通訊協定，包含 TCP, HTTPS, UDP, DNS, ICMP, HTTPSIPV6, WEB, SSH。

TeamT5 將使用 Pangolin8RAT 後門程式的駭客團體命名為「天吳」，為記載於《山海經》的八首人面怪獸。2020-2021年之間，該駭客團體鎖定線上娛樂產業、賭博業、資訊業、電信業、交通運輸業、政府單位、異議人士等，進行網路攻擊。

本次演講中，TeamT5 研究團隊並探索「天吳」與惡名昭彰的中國 APT 團體 Amoeba (別名 APT41)的關聯，兩者的相似性來自他們使用之模組化惡意程式結構、攻擊手法(TTPs)與攻擊範圍。

TeamT5 研究團隊指出由於模組化後門程式可以降低駭客團體研發惡意軟體的成本，模組化後門程式成為趨勢。有鑑於此，先前針對 APT 攻擊的研究架構與分類可能不再適用於未來出現的 APT 攻擊，建議企業組織宜運用從戰術(tactic)、實戰(operation)、戰略(strategy)等層級的威脅情資，掌握網路威脅的全貌。

- 演講完整演講簡報檔: [連結](https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf)
- 演講完整錄影: [link](https://topicplay.com/v/477689)

## 關於黑帽大會（Black Hat）
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。


【Black Hat Asia 2022】後門程式模組化與 APT 攻擊趨勢剖析  TeamT5 於 Black Hat Asia 發布最新研究

全球資安盛會「亞洲黑帽安全大會」（Black Hat Asia, BHASIA）今年以線上與實體混合方式舉辦，自 2021 年 5 月 10 日至 13 日（新加坡時間 UTC+8），為期3天的精彩議程（Black Hat Briefing）、專業深度培訓（Training），以及最新開源駭客工具的展示（Black Hat Arsenal），由頂尖資訊安全專家們傳授最新、第一手的技術與研究發現。

TeamT5 威脅情資研究員們連續第2年登上 BHASIA，發表兩場最新研究，與世界各地的資安研究人員交流最新的資訊安全風險、研究與趨勢。

第一場演講「[To Loot or Not to Loot? That Is Not a Question When State-Nexus APT Targets Online Entertainment Industry](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143)」由 TeamT5 威脅情資分析師 Che Chang 與首席威脅情資分析師 Charles Li 介紹近年進階持續性威脅 (Advanced Persistent Threat, APT) 轉向線上娛樂/賭博產業之趨勢，動機不僅是財務勒索、更帶有間諜活動成分。演講中將以逾20個案例，說明駭客族群APT10 (又名 menuPass), APT41 (又名 Winnti, Amoeba)及 APT27 (又名 GreedyTaotie)的攻擊行為。

第二場演講「[The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT](https://www.blackhat.com/asia-22/briefings/schedule/#the-next-gen-plugxshadowpad-a-dive-into-the-emerging-china-nexus-modular-trojan-pangolinrat-25950)」，則由我們的威脅情資分析師 Silivia Yeh 與研究員 Leon Chang，剖析一個自2021年初開始嶄露頭角的「天吳(Tianwu)」族群。該群與 APT41 的入侵手法（TTPs）有不少相似之處；其專用後門（Proto8RAT）是一個高度模組化、且能支持八種協定的木馬程式。
根據此特徵，我們將該族群命名為「天吳(Tianwu)」，一個記載於《山海經》中八首人面的怪獸。目前，我們已經觀察到不少天吳針對亞太地區的攻擊，受害產業包括遊戲軟體業、交通運輸及電信。本演講將會分享分析結果與相關族群未來可能的發展動向。

**關於黑帽大會（Black Hat）**
 
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。

![https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg](
https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg)

【Black Hat Asia】TeamT5 研究員將於亞洲黑帽安全大會發表深度分析

This year, Black Hat Asia is held online and in-person, May 10-13, 2022 in Singapore Time (UTC+8). Our analysts & researchers will give 2 speeches on recent notable APTs.

One talk “[To Loot or Not to Loot? That Is Not a Question When State-Nexus APT Targets Online Entertainment Industry](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143)” is given by Che Chang (Cyber Threat Analyst) and
Charles Li (Chief Analyst). 

This talk will focus on APT's targeted attack against online entertainment companies which have solid cash flow and a massive amount of personal data. In the talk, we will dissect more than 20 targeted attack operations TeamT5 has tracked since 2018. The analysis shows technical links between these targeted attacks and the infamous Chinese APT, including APT10 (aka menuPass), APT41 (aka Winnti, Amoeba), and APT27 (aka GreedyTaotie). The presentation will cover these attacks' Tactic Technique and Procedures (TTPs) as we have seen those APT groups adopt different TTPs aimed at the online entertainment industry. We believe that these APT attacks are the preliminary work of the Chinese government. 

The other talk “[The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT](https://www.blackhat.com/asia-22/briefings/schedule/#the-next-gen-plugxshadowpad-a-dive-into-the-emerging-china-nexus-modular-trojan-pangolinrat-25950)” is given by Silvia Yeh (Threat Intelligence Analyst) and Leon Chang (Threat Intelligence Researcher). 

Since mid-2020, TeamT5 has detected a new modular trojan emerging in the APAC region which has the potential to be their successor. We name this trojan "Pangolin8RAT" because its PDB string contains "pangolin" and its RTTI contains "p8rat." 

Its early features supported 8 communication protocols, including TCP, HTTPS, UDP, DNS, ICMP, HTTPSIPV6, WEB, and SSH. Pangolin8RAT has only been associated with a Chinese APT group we track as "Tianwu." In this talk, they will also give a brief attack timeline of Pangolin8RAT/Tianwu from 2020 to 2021 as well as our outlook on the group's future development.

**About Black Hat Asia**
 
Black Hat is the world leading cybersecurity event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.

![https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg](
https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg)

【Black Hat Asia】TeamT5 Will Give Talks on Notable APTs

世界的な情報セキュリティイベント「ブラックハットアジア（Black Hat Asia）」（BHASIA）が、今年は2021年5月10日から13日（シンガポール時間 UTC+8）までオンラインとオンサイトの混合方式で開催されました。3日間の開催期間で素晴らしいブリーフィング（Black Hat Briefing）、専門的かつ詳細なトレーニング（Training）、最新のオープンソースハッキングツールの展示（Black Hat Arsenal）、トップクラスの情報セキュリティ専門家たちによる最新の技術や研究による発見の共有などが行われました。

TeamT5の脅威インテリジェンス研究員たちは2年連続でBHASIAに参加して2つの最新の研究結果を発表し、世界各地の情報セキュリティ研究員と最新の情報セキュリティリスク、研究、トレンドについて交流しました。

最初の発表、「[To Loot or Not to Loot? That Is Not a Question When State-Nexus APT Targets Online Entertainment Industry](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143)」では、TeamT5の脅威インテリジェンスアナリストのChe Changと脅威インテリジェンスチーフアナリストのCharles Liが、オンラインエンターテイメント/ギャンブル産業を狙った近年のAPT（Advanced Persistent Threat, 高度で持続的な脅威）は、身代金の要求だけでなく、スパイ活動が動機となっているというトレンドを紹介しました。20以上の例をあげ、サイバー攻撃グループのAPT10（別名menuPass）、APT41（別名Winnti, Amoeba）、APT27（別名GreedyTaotie）の攻撃行動について説明しました。

2回目の発表、「[The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT](https://www.blackhat.com/asia-22/briefings/schedule/#the-next-gen-plugxshadowpad-a-dive-into-the-emerging-china-nexus-modular-trojan-pangolinrat-25950)」，では、当社の脅威インテリジェンスアナリストのSilivia Yehと研究員のLeon Changが、2021年初頭から徐々に現れ始めた「天呉（Tianwu）」グループの分析について発表しました。同グループとAPT41の侵入方法（TTPs）には多くの類似点があります。その特殊なバックドア（Proto8RAT）は、8つのプロトコルに対応するよう高度にモジュール化されたトロイの木馬です。

この特徴から、当社は同グループを『山海経』に登場する人の顔を八つもつ人面獣にちなんで、「天呉（Tianwu）」と名付けました。現在、当社は、アジア太平洋地域におけるゲームソフトウェア、交通、輸送、電気通信業界に対して「天呉」の攻撃が多発していることを確認しています。今回の発表では、分析結果および今後考えられる関連グループの進化と方向性を共有しました。

** ブラックハット（Black Hat）について**
 
ブラックハット（Black Hat）では、毎年世界の情報セキュリティ専門家、優秀な研究員が一堂に会します。情報セキュリティの研究開発や最新のトレンドについて交流することで、学界、世界レベルの研究員、各分野における意思決定、リーダー同士の協力、成長が促進されます。ブラックハットブリーフィング（Black Hat Briefing）とトレーニング（Training）は、世界トップクラスの情報セキュリティ担当者が参加するイベントで、毎年アメリカ、ヨーロッパ、アジアで開催されます。

![https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg](
https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg)

【Black Hat Asia】TeamT5の研究員がブラックハットアジア（Black Hat Asia）で詳細な分析を発表

## 歡迎衡崴科技成為杜浦數位安全之台灣代理商

感謝通路夥伴們長期對 TeamT5 產品的支持與厚愛，使得雙方建立了互信良好的合作關係，TeamT5 也得以日益茁壯成長。為了能更全面的照顧通路夥伴，並提升終端用戶的服務滿意度，TeamT5 遴選於資訊安全領域俱備一定專業程度的**衡崴科技股份有限公司**為台灣地區(含澎湖、金門、馬祖)授權之合法代理商。

期許未來能透過更完整的通路角色的佈建，與夥伴們更加緊密地攜手合作，共同為客戶的資訊安全把關，創造雙贏的共好局面。

此通知將自 2022 年 04 月 01 日起正式生效。



 
*圖片來源: [Pixabay](https://pixabay.com/)

【公告】歡迎衡崴科技成為杜浦數位安全之台灣代理商

> We are honored to be interviewed by  [Cybernews](https://cybernews.com/), a research-based online publication that helps people navigate a safe path through their increasingly complex digital lives. In the interview, we share how TeamT5 originated with our cyber threat intelligence researches and how we do to help clients fight against ransomware. The whole interview report is below or can be viewed at [Cybernews](https://cybernews.com/security/sung-ting-tsai-teamt5-companies-shouldnt-claim-themselves-as-100-secured-or-unhackable/)。

**A ransomware attack may be a once-in-a-lifetime event for some, while for others, it is more so of an evergoing battle of wits, technology, and speed, which requires constant diligence and preparations.**

While more and more companies invest in proper cybersecurity measures, both by investing in professional infrastructures and [relying on commercial privacy and data protection management tools](https://cybernews.com/best-password-managers/), not many are involved in actively hunting threats that may as well have already penetrated their defenses.

To discuss such issues, Cybernews sat down with Sung-ting Tsai, the Chief Executive Officer of [TeamT5](https://teamt5.org/en/) – a cybersecurity intelligence firm. We talked about the dos and don’ts in the event of a ransomware attack and what cybersecurity measures are most important to take.

### Tell us about your story. How did TeamT5 originate?

Previously, I worked in a big cybersecurity company and led a research team. I found that clients often got hacked even though we made great solutions. I think the key is we didn’t have insights on attackers’ TTP (tactics, techniques, and procedures) so our defense couldn’t protect clients from those attackers.

Therefore, I became interested in cyber threat intelligence (CTI) research and decided to build TeamT5 to do CTI research. Back then, our team already discovered that the latest and advanced cyberattacks happened in Taiwan first. It gives us advantages to publish in-depth analysis and research.

Our niche is that we have focused on cyberattacks and cyber espionage for a long time. As not many people focus on this area, our research results are even more valuable and help many people and organizations around the world, especially in the US, Japan, and Korea.

Then, we made our reports of cyber threat intelligence into a solution – ThreatVision, a portal to see through the chaos. In 2017, we developed ThreatSonar which is an engine to hunt down intruders. It helps clients to defend against cyberattacks. When others can’t catch malicious cyberattacks – we can.

Since we established, we consider cyber threat intelligence research as the most important task. We have published more than 30 research papers in international cybersecurity seminars and conferences, including Black Hat Asia, SANS Institute – CTI Summit, Virus Bulletin (VT), and CodeBlue. Our findings are recognized by many clients, including one of the top five international banks, top telecom and business groups in Japan, and governmental critical infrastructures in Taiwan.

### Can you tell us a little bit about what you do? What challenges do you help navigate?

Our mission is to become the best partner to defend against advanced persistent threats (APTs).

Clients are facing two challenges:

1. While attackers know a lot about clients, our clients know a little about what they’re facing.
2. Clients don’t have sufficient technology to defend against attackers.

To help a client beat ransomware and cyber espionage, we provide three types of solutions:

1. **Threat Intelligence** – let clients know the enemies well and plan defense strategies.
2. **Defense Technology **– let clients be equipped with good tools in order to hunt down the enemies.
3. **Professional Service** – we work with clients to help them deal with various cyber threats.

### You often emphasize the importance of proactive threat hunting. Can you briefly describe this practice?

Traditionally, the idea of cybersecurity protection is to do multi-layered defense. However, the current problem is that enterprises don’t know whether attackers are already on the intranet.

So, we suggest that “proactive threat hunting” is a better idea for cyber protection nowadays. It means enterprises use our tool ThreatSonar Anti-Ransomware to do active and aggressive scans on logs from SIEM (security information and event management). Enterprises can even apply new screening rules on previous logs to discover previous malicious activities.

### How do you think the recent global events influenced the ways in which threat actors operate?

Looking into cyber attackers' behaviors, you can see that cyberattacks are effective and their impacts are bigger than ever. These impacts can be categorized into two types – one is leaking important information, while the other is data sabotage and ransom.

We observe that more operations with more power are conducted by many countries. Countries are also focusing on information operations (InfoOps). They invest more resources in public opinion operations, social media operations, and media operations. Their goal is to achieve impacts with certain purposes.

Recently, Ukraine conducts such operations really well. It indicates that if there are wars or disputes between counties in the future, such InfoOps will be common scenes.

### In the age of frequent cyberattacks, do you think small businesses and big enterprises require the same security measures?

In fact, it’s unlikely that small businesses apply the same cybersecurity measures as big enterprises. Our suggestion is for small businesses to use the same cybersecurity framework and ideas as big enterprises do. And small businesses shall prioritize each task and start with the most important parts.

We found that the most challenges that small businesses are not willing to invest in are cybersecurity measures. However, it’s important to do that in order to make business operations go smoothly.

### Since ransomware is one of your main fields of focus, could you give us a few tips on what should and shouldn't be done in the event of such an attack?

I advise companies to do defense in four steps:

1. **Threat awareness** – catch up on the latest cyber intelligence to understand the potential threats.

2. **Before attack** – deploy tools and measures to be prepared, e.g. backup your data and deploy anti-ransomware solutions.

3. **During attack** – have tools to see attacks that are happening (which means to make attacks visible); if there are attacks happening, enterprises shall have response measures.

4. **After attack** – companies shall have a standard operation procedure (SOP) on how to recover files and services. If companies prepare well, they may return to normal operations within a day; otherwise, they may still be shut down for a week, or even have to pay a ransom. Companies shall prepare for a negotiation. Some professional teams can help with that and lower the ransom amount.

Other things one should and shouldn't do:

1. Should – backup your files and patch up security

2. Shouldn't – threaten attackers

### In your opinion, what are the worst cybersecurity habits that make companies attractive targets for ransomware hackers?

Do not provoke actors! They are more capable than you think. Companies shouldn’t claim themselves as 100% secured or unhackable as tall trees catch much wind. For ransomware prevention, the most important thing is to do backups and put them offline.

### What new threats do you think the public should be ready to take on in the next few years? What security tools should be implemented by every internet user?

Firstly, there will be more ransomware attacks. The reason is that attackers are protected and hidden behind various technologies, such as the dark web (run on Tor), cryptocurrencies, and secured instant messengers. And victims are willing to pay to get files back. It makes ransomware attacks a profitable business.

The second threat is that countries will invest more in cyberattacks, including developing cyber weapons, increasing the power of cyberattacks, and recruiting more talents.

We suggest enterprises and government units invest more in cybersecurity in order to defend against the threats mentioned above. We think the key is cyber threat intelligence rather than tools. When enterprises and government units know more about attackers, they can defend better. As the old saying goes – know the enemy and know yourself in a hundred battles, and you will never be in peril.

### Share with us, what’s next for TeamT5?
We hope to increase our influence through cyber threat intelligence research. We believe our experience, research, and technology shared with more people can help them deal with APT threats.

【Cybernews】Sung-ting Tsai, TeamT5: “companies shouldn’t claim themselves as 100% secured or unhackable”

> 我們很高興受到  [Cybernews](https://cybernews.com/) 專訪，該線上媒體以資安研究為核心，協助人們在日益複雜的數位生活中，走出一條安全的道路。在本次專訪中，執行長蔡松廷(Sung-ting Tsai)分享公司成立的緣起，乃是基於威脅情資研究；並分享我們如何協助客戶防禦勒索軟體入侵。完整訪問內容可參考下方轉載，或至 CyberNews 官網閱讀 ([全文連結](https://cybernews.com/security/sung-ting-tsai-teamt5-companies-shouldnt-claim-themselves-as-100-secured-or-unhackable/)).

**A ransomware attack may be a once-in-a-lifetime event for some, while for others, it is more so of an evergoing battle of wits, technology, and speed, which requires constant diligence and preparations.**

While more and more companies invest in proper cybersecurity measures, both by investing in professional infrastructures and [relying on commercial privacy and data protection management tools](https://cybernews.com/best-password-managers/), not many are involved in actively hunting threats that may as well have already penetrated their defenses.

To discuss such issues, Cybernews sat down with Sung-ting Tsai, the Chief Executive Officer of [TeamT5](https://teamt5.org/en/) – a cybersecurity intelligence firm. We talked about the dos and don’ts in the event of a ransomware attack and what cybersecurity measures are most important to take.

### Tell us about your story. How did TeamT5 originate?

Previously, I worked in a big cybersecurity company and led a research team. I found that clients often got hacked even though we made great solutions. I think the key is we didn’t have insights on attackers’ TTP (tactics, techniques, and procedures) so our defense couldn’t protect clients from those attackers.

Therefore, I became interested in cyber threat intelligence (CTI) research and decided to build TeamT5 to do CTI research. Back then, our team already discovered that the latest and advanced cyberattacks happened in Taiwan first. It gives us advantages to publish in-depth analysis and research.

Our niche is that we have focused on cyberattacks and cyber espionage for a long time. As not many people focus on this area, our research results are even more valuable and help many people and organizations around the world, especially in the US, Japan, and Korea.

Then, we made our reports of cyber threat intelligence into a solution – ThreatVision, a portal to see through the chaos. In 2017, we developed ThreatSonar which is an engine to hunt down intruders. It helps clients to defend against cyberattacks. When others can’t catch malicious cyberattacks – we can.

Since we established, we consider cyber threat intelligence research as the most important task. We have published more than 30 research papers in international cybersecurity seminars and conferences, including Black Hat Asia, SANS Institute – CTI Summit, Virus Bulletin (VT), and CodeBlue. Our findings are recognized by many clients, including one of the top five international banks, top telecom and business groups in Japan, and governmental critical infrastructures in Taiwan.

### Can you tell us a little bit about what you do? What challenges do you help navigate?

Our mission is to become the best partner to defend against advanced persistent threats (APTs).

Clients are facing two challenges:

1. While attackers know a lot about clients, our clients know a little about what they’re facing.
2. Clients don’t have sufficient technology to defend against attackers.

To help a client beat ransomware and cyber espionage, we provide three types of solutions:

1. **Threat Intelligence** – let clients know the enemies well and plan defense strategies.
2. **Defense Technology **– let clients be equipped with good tools in order to hunt down the enemies.
3. **Professional Service** – we work with clients to help them deal with various cyber threats.

### You often emphasize the importance of proactive threat hunting. Can you briefly describe this practice?

Traditionally, the idea of cybersecurity protection is to do multi-layered defense. However, the current problem is that enterprises don’t know whether attackers are already on the intranet.

So, we suggest that “proactive threat hunting” is a better idea for cyber protection nowadays. It means enterprises use our tool ThreatSonar Anti-Ransomware to do active and aggressive scans on logs from SIEM (security information and event management). Enterprises can even apply new screening rules on previous logs to discover previous malicious activities.

### How do you think the recent global events influenced the ways in which threat actors operate?

Looking into cyber attackers' behaviors, you can see that cyberattacks are effective and their impacts are bigger than ever. These impacts can be categorized into two types – one is leaking important information, while the other is data sabotage and ransom.

We observe that more operations with more power are conducted by many countries. Countries are also focusing on information operations (InfoOps). They invest more resources in public opinion operations, social media operations, and media operations. Their goal is to achieve impacts with certain purposes.

Recently, Ukraine conducts such operations really well. It indicates that if there are wars or disputes between counties in the future, such InfoOps will be common scenes.

### In the age of frequent cyberattacks, do you think small businesses and big enterprises require the same security measures?

In fact, it’s unlikely that small businesses apply the same cybersecurity measures as big enterprises. Our suggestion is for small businesses to use the same cybersecurity framework and ideas as big enterprises do. And small businesses shall prioritize each task and start with the most important parts.

We found that the most challenges that small businesses are not willing to invest in are cybersecurity measures. However, it’s important to do that in order to make business operations go smoothly.

### Since ransomware is one of your main fields of focus, could you give us a few tips on what should and shouldn't be done in the event of such an attack?

I advise companies to do defense in four steps:

1. **Threat awareness** – catch up on the latest cyber intelligence to understand the potential threats.

2. **Before attack** – deploy tools and measures to be prepared, e.g. backup your data and deploy anti-ransomware solutions.

3. **During attack** – have tools to see attacks that are happening (which means to make attacks visible); if there are attacks happening, enterprises shall have response measures.

4. **After attack** – companies shall have a standard operation procedure (SOP) on how to recover files and services. If companies prepare well, they may return to normal operations within a day; otherwise, they may still be shut down for a week, or even have to pay a ransom. Companies shall prepare for a negotiation. Some professional teams can help with that and lower the ransom amount.

Other things one should and shouldn't do:

1. Should – backup your files and patch up security

2. Shouldn't – threaten attackers

### In your opinion, what are the worst cybersecurity habits that make companies attractive targets for ransomware hackers?

Do not provoke actors! They are more capable than you think. Companies shouldn’t claim themselves as 100% secured or unhackable as tall trees catch much wind. For ransomware prevention, the most important thing is to do backups and put them offline.

### What new threats do you think the public should be ready to take on in the next few years? What security tools should be implemented by every internet user?

Firstly, there will be more ransomware attacks. The reason is that attackers are protected and hidden behind various technologies, such as the dark web (run on Tor), cryptocurrencies, and secured instant messengers. And victims are willing to pay to get files back. It makes ransomware attacks a profitable business.

The second threat is that countries will invest more in cyberattacks, including developing cyber weapons, increasing the power of cyberattacks, and recruiting more talents.

We suggest enterprises and government units invest more in cybersecurity in order to defend against the threats mentioned above. We think the key is cyber threat intelligence rather than tools. When enterprises and government units know more about attackers, they can defend better. As the old saying goes – know the enemy and know yourself in a hundred battles, and you will never be in peril.

### Share with us, what’s next for TeamT5?
We hope to increase our influence through cyber threat intelligence research. We believe our experience, research, and technology shared with more people can help them deal with APT threats.

【Cybernews 專訪】TeamT5 執行長蔡松廷表示企業不宜宣稱自身100%不會被駭入

## TeamT5 接受鏡新聞採訪，說明駭客攻擊對象與手法

TeamT5 杜浦數位安全執行長蔡松廷(TT)接受鏡新聞採訪，說明駭客攻擊關鍵基礎設施的範圍與影響，並分析駭客族群阿米巴 Amoeba (國際又稱 APT41)、畫皮 Huapi 的攻擊對象與手法；更說明這類使用惡意軟體的攻擊，目的不僅是掌握情資，也可能在真正戰爭、甚或特定時間點，發動癱瘓攻擊，影響民生。

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/R5xWjEbwKcU?start=147" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</center>

【鏡新聞】引爆恐慌快狠準　駭客轉攻基礎建設

>Our CTI analysts comment on Pangu Lab’s report regarding a 2013 exploit to Bloomberg. This is an expert of Bloomberg's article. Read more at [Bloomberg](https://www.bloomberg.com/news/articles/2022-02-24/chinese-report-on-suspected-nsa-hack-shows-beijing-pushing-back)

For years, Washington has accused Beijing of instigating cyberattacks against the US. and its allies. Now, a Chinese cybersecurity firm says it has identified hacking within China by a group linked to the National Security Agency, hinting at a rethink of how Beijing handles its geopolitical rival. 

Chinese officials and companies like Huawei Technologies Co. have often responded to U.S. accusations in the past by declaring America the worst cyber-offender of all, pointing in particular to Edward Snowden’s revelations about U.S. espionage.

But this week, Pangu Lab said it discovered U.S.-sponsored hacking activity on Chinese soil. It said it found malware in domestic IT systems it claims was created by hacking group Equation, which is “generally believed” to be linked to the U.S. National Security Agency. In a report issued Feb. 23 and covered by the Communist Party-backed Global Times, Pangu Lab said the malware, called Bvp47, had been discovered within “a key Chinese department” in 2013 and 2015. Pangu Lab claimed the malware infiltrated systems to monitor and track key institutions in 45 countries around the world, including U.S. allies, in a campaign that lasted 10 years.

……

Taiwanese cybersecurity firm TeamT5 said that while Pangu Lab’s report was “one of the most detailed and in-depth forensic investigations published by Chinese cybersecurity firms,” it was curious that they chose a decade-old case to dissect.

“In the future, we think there will be more and more similar attribution reports by Chinese cybersecurity firms being leveraged by the Chinese state media to conduct propaganda campaigns,” analysts at TeamT5 wrote.
 
 
*Image courtesy of [Pixabay](https://pixabay.com/)

【Bloomberg】Chinese Report on Suspected NSA Hack Shows Beijing Pushing Back

>TeamT5 資安威脅情資分析師團隊接受彭博社(Bloomberg)訪問，針對中國盤古實驗室(Pangu Lab)揭露他們在2013年所發現的後門程式Bvp 47之報告，進行評論與分析。本文為摘錄，完整文章請見 [Bloomberg](https://www.bloomberg.com/news/articles/2022-02-24/chinese-report-on-suspected-nsa-hack-shows-beijing-pushing-back)

For years, Washington has accused Beijing of instigating cyberattacks against the US. and its allies. Now, a Chinese cybersecurity firm says it has identified hacking within China by a group linked to the National Security Agency, hinting at a rethink of how Beijing handles its geopolitical rival. 

Chinese officials and companies like Huawei Technologies Co. have often responded to U.S. accusations in the past by declaring America the worst cyber-offender of all, pointing in particular to Edward Snowden’s revelations about U.S. espionage.

But this week, Pangu Lab said it discovered U.S.-sponsored hacking activity on Chinese soil. It said it found malware in domestic IT systems it claims was created by hacking group Equation, which is “generally believed” to be linked to the U.S. National Security Agency. In a report issued Feb. 23 and covered by the Communist Party-backed Global Times, Pangu Lab said the malware, called Bvp47, had been discovered within “a key Chinese department” in 2013 and 2015. Pangu Lab claimed the malware infiltrated systems to monitor and track key institutions in 45 countries around the world, including U.S. allies, in a campaign that lasted 10 years.

……

Taiwanese cybersecurity firm TeamT5 said that while Pangu Lab’s report was “one of the most detailed and in-depth forensic investigations published by Chinese cybersecurity firms,” it was curious that they chose a decade-old case to dissect.

“In the future, we think there will be more and more similar attribution reports by Chinese cybersecurity firms being leveraged by the Chinese state media to conduct propaganda campaigns,” analysts at TeamT5 wrote.

 
 
*首圖來源: [Pixabay](https://pixabay.com/)

【Bloomberg 採訪報導】Chinese Report on Suspected NSA Hack Shows Beijing Pushing Back

Japan Security Analyst Conference 2022 (JSAC2022) held on Jan. 27-28 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis.

TeamT5's cybersecurity researcher Leon works with Japan analysts Yusuke Niwa(from ITOCHU Corporation) & Suguru Ishimaru(from Kaspersky Lab) on cyberattack analysis. They presented a joint speech on the topic of "LuoYu: Continuous Espionage Activities Targeting Japan with the new version of WinDealer in 2021". 

In the presentation, they shared case studies with examples of incidents related to Japan and provided an update of the LuoYu group, a deep analysis of WinDealer. Also they told Japanese companies that they need to be aware of these kinds of threats and take countermeasures against this campaign.

The slides of the speech can be downloaded on the official website. 

- English Version [Link](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf?utm_source=website&utm_medium=website)
- Japanese Version [Link](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_jp.pdf?utm_source=website&utm_medium=website) 

![JSAC2022_pic.png](https://legacy-uploads.teamt5.org/JSAC_2022_pic_7ff0496220.png)
<center>The LuoYu Threat Group Overview</center>

## About JSAC2022

Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC2022 event website](https://jsac.jpcert.or.jp/en/index.html).


*Image courtesy of [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

Japan Security Analyst Conference 2022

日本資安分析研討會 Japan Security Analyst Conference 2022 (JSAC2022) 於1月27-28日，採取實體與線上混和的方式舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件回應與分析的技術、知識。

TeamT5 研究員 Leon 與日本研究員 Yusuke Niwa (ITOCHU Corporation)、Suguru Ishimaru ( Kaspersky Lab)，於本次活動共同分析 LuoYu 在2021的網路攻擊行動，其使用新版的WinDealer 惡意軟體，鎖定日本公司設於中國的辦公室。

演講簡報現可於研討會官網下載，下載連結[請點此](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf?utm_source=website&utm_medium=website) 

![JSAC2022_pic.png](https://legacy-uploads.teamt5.org/JSAC_2022_pic_7ff0496220.png)
<center>攻擊族群 LouYu 概觀 </center>


## 關於JSAC 2022

日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。

更多資訊請見 [JSAC2022 官網](https://jsac.jpcert.or.jp/en/index.html)


*首圖來源: [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

日本資安分析師研討會 JSAC2022

Japan Security Analyst Conference（JSAC）2022が、1月27日から28日にオンサイトおよびオンラインの混合方式で開催されました。JPCERT/CC（一般社団法人JPCERTコーディネーションセンター）が主催する毎年恒例のイベントで、情報セキュリティアナリストに交流の機会を提供し、情報セキュリティインシデントへの対応、分析技術、知識などの共有が行われます。

今回のイベントで、TeamT5の研究員であるLeonは日本の研究員であるYusuke Niwa（ITOCHU Corporation）およびSuguru Ishimaru（Kaspersky Lab）と共同でLuoYuによる2021年のサイバー攻撃を分析しました。使用された新しいマルウェア「WinDealer」は、中国にある日本企業のオフィスをターゲットにしていました。

プレゼンテーションの内容がカンファレンスの公式ウェブサイトからダウンロードできるようになりました。ダウンロードはこちらをクリックしてください: [https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf)

![JSAC2022_pic.png](https://legacy-uploads.teamt5.org/JSAC_2022_pic_7ff0496220.png)
<center>攻撃グループLouYuの概要</center>


## JSAC 2022について

JPCERT/CC（一般社団法人JPCERTコーディネーションセンター）は、サイバー攻撃によるインシデントは毎日発生しており、攻撃者の技術も変化し続けているとしています。絶え間なく変化するサイバー攻撃の技術や手法を分析して対応するため、エンジニアはスキルアップしなければなりません。しかし、日本ではエンジニア同士でインシデントの分析技術や知識を共有することがあまり行われません。情報セキュリティアナリストが一堂に会し、インシデントの対応方法に関する技術や専門性を共有することで、サイバー攻撃に対抗する個人および全体の力を強化できます。

Japan Security Analyst Conference（JSAC）は、この目標の達成を目指し、JPCERT/CCが一年に一度主催するサイバーセキュリティインシデントの分析および対応技術に関するカンファレンスです。今回のカンファレンスでは、現在および今後も変化し続けるサイバー攻撃に対応するため、日々セキュリティインシデントに対応しているエンジニアによる情報共有が促進されました。

詳細はJSAC2022の公式ウェブサイトをご参照ください:
[https://jsac.jpcert.or.jp/en/index.html](https://jsac.jpcert.or.jp/en/index.html)


*画像のソース: [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

Japan Security Analyst Conference（JSAC）2022

In 2022 event, TeamT5’s cyber threat intelligence analysts Che Chang and Silvia Yeh present their research of 2 Chinese InfoOp campaigns in 2020/2021 (#StopXinjiangRumours and #PatriotGoverningHongKong) by using the Adversarial Misinformation and Influence Tactics and Techniques framework at CTI Summit.

The slides of the speech can be downloaded on the official website.
➡ [Download Link](https://www.sans.org/presentations/clip-addiction-a-threat-intelligence-approach-to-video-based-chinese-infoops/?utm_source=website&utm_medium=website)

The video is on the official channel now. 
➡ [Video Link](https://youtu.be/I2gMDEYo2Bo)

![CTI Summit 2022_pic.png](https://legacy-uploads.teamt5.org/CTI_Summit_2022_pic_4b601987f1.png)
<center>Diamond Model of Video-Based InfoOps Analysis</center>


## About CTI Summit

CTI Summit is organized by SANS Institute annually. It’s an international event that gathers experts to give talks. And it provides opportunities for professionals to connect and network with the threat intel community.


*Image courtesy of [SANS Institute](https://www.sans.org/apac/)

TeamT5 Presents Latest Analysis on Information Operation on CTI Summit 2022 

TeamT5 威脅情資分析師 Che Chang 與 Silvia Yeh 於今年度 CTI Summit 演講。本次演講從威脅情資的角度，分析2020~2021期間，充斥於網路社群空間的短影片，如何被用來作為中國資訊作戰(information operation)的武器。 

演講簡報現可於官網下載，連結[請點此](https://www.sans.org/presentations/clip-addiction-a-threat-intelligence-approach-to-video-based-chinese-infoops/?utm_source=website&utm_medium=website)

演講影片現可於 Youtube 觀賞，連結[請點此](https://youtu.be/I2gMDEYo2Bo)

![CTI Summit 2022_pic.png](https://legacy-uploads.teamt5.org/CTI_Summit_2022_pic_4b601987f1.png)
<center>資訊作戰之分析模型</center>




## 關於 CTI Summit
CTI Summit 由國際知名的資安研暨及學術教育組織 SANS Institute 主辦，為資訊安全專家、稽核員、網管系統管理人員等資安界專業人士，提供資訊安全教育課程與技術研討會。

*首圖來源: [SANS Institute](https://www.sans.org/apac/)

TeamT5 於 CTI Summit 2022 分享最新威脅情資研究

2022 年寒假，大受好評的「TeamT5 Security Camp 資安培訓營」二度登場！從 1 月18~19 日及1月25~27日，共五天的精彩課程，由專精於各領域的資訊安全研究員，透過一系列多元培訓課程與實作挑戰，帶大家體驗資安工作的日常工事。


「資安」是近年來熱門職缺之一，但許多對資安領域有興趣、有志從事資安工作的同學們，面對種種資安職缺，卻不知道該如何選擇。TeamT5 杜浦數位安全作為台灣專精網路攻擊分析、漏洞研究的資安公司，希望透過持續舉辦的資安培訓營，提供來自業界的實戰經驗與資源，幫助同學快速探索資安領域的無限可能。


![2022 TeamT5 Security Camp_compressed (1).jpg](https://legacy-uploads.teamt5.org/2022_Team_T5_Security_Camp_compressed_1_9b58eb1522.jpg)
<center>圖1、TeamT5 Security Camp 資安培訓營結業式大合照</center>
<center>並很榮幸邀請到輔大資工系 許見章特聘教授(前排右一)、臺科大資管系 吳宗成特聘教授(前排右二)蒞臨指導</center>

## 資安培訓營上課實況

本次「TeamT5 Security Camp 資安培訓營」有四大亮點主題，包含威脅情資探究、惡意程式分析、系統底層防禦與攻擊手法、漏洞深度挖掘，帶領學員體驗資安研究員的工作日常。


第一週課程由講師 Still 實際帶著大家分析各樣程式，了解分析手法及技巧，進而帶到所謂威脅情資以及大名鼎鼎的 APT 攻擊，也分享各國駭客攻擊族群特有的攻擊手法，及 APT針對不同的行業，所採取的各種入侵方法。


第二週課程首先由講師 Zeze 帶大家一一拆解 勒索軟體的運作流程、啟動方式、自我檢查、保護、混淆手法，並現場實作，由同學直接寫出偵測這隻勒索軟體的YARA rule。
接著由講師 Will (a.k.a In0de) 解說 Windows PE Format，實作 DLL Injection、Process Hollowing 、 DLL Hijack，以及說明加殼的原理與各種 Anti-analysis 行為。以及由講師 Nick 分享漏洞挖掘技巧，針對超夯的物聯網裝置進行挖掘，過程中手把手帶大家了解什麼是弱點、漏洞及其成因，與物聯網裝置的各個攻擊面向。


![2022 TeamT5 Security Camp_compressed (3).JPG](https://legacy-uploads.teamt5.org/2022_Team_T5_Security_Camp_compressed_3_d8d6d57850.jpg)
<center>圖2、同學們專心上課，探索資安世界</center>


![2022 TeamT5 Security Camp_compressed (2).jpg](https://legacy-uploads.teamt5.org/2022_Team_T5_Security_Camp_compressed_2_b947bf058a.jpg)
<center>圖3、同學們熱烈討論實作內容</center>


本屆因應疫情，採取線上與實體共同進行，依舊不減同學們的熱情，碰撞出各種討論火花。 TeamT5 非常開心同學們能感受到資安研究的樂趣，也認識我們想打造一個更安全世界的熱情。


對資安培訓營、資安實習有興趣的同學們，歡迎追蹤我們的 [IG](https://www.instagram.com/lifeatteamt5/) ，獲得最新開課資訊及實習職缺 ! 
還可以追蹤我們的 [FB](https://www.facebook.com/TeamT5.org/)，了解我們最完整的資安威脅研究 !

TeamT5 Security Camp 資安培訓營 好評再開課

>発表日: 2022/2

TeamT5 情報セキュリティ インシデント対応チーム (TeamT5 CSIRT) は、主にお客様に情報セキュリティ インシデントの検出、通知、緊急対応サービスを提供し、その過程でお客様の IT および情報セキュリティ チームと緊密に連携し、お客様に情報を提供します。サイバー脅威に対処し、脅威の特定と防御を支援し、イベント中の検出と対応を実施し、イベント後の復旧サービスを強化するために必要な専門ツールと。

##連絡先
- email: teamt5_csirt@teamt5.org
- Public PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
```xsFNBGRwYlQBEADotdKNmMYwZm2WxP3jve6+o1PXKjZ9j6EG7SKe4Hqn1hgf
9OcEmgshJHp0sSqViNtQ1frXHC1ZyH4HT8m+j4SFChNdzJ0zMjRLGRBgEbol
SEwi+St346wJ1rdBR4hwDVXYNwL5l/vRACNYnP5DQvahrMOqycvO2+b6G+CS
qPadyoy9RfqzAJ8qVigUpteDDB+hD+wKJ1/1sTm4vF32r++TmFr/GFT1qw7q
2BMvo4oJeMRFuLkFOOm2dMK3kFPARTRGAr8MmNYeURtBzBF5vnHcGjb6MqEl
s1tBAFLeu06mOXMCs6EYBWPbTiBhA+4gZXiP2Mvd+IbW5GUSYvAcB020gawb
mwshU+AeT2SInlkXdIU272azqglzeg0iOZoitjxyzWRyiT8JNuyjJMzdw7lS
AsPGJz4MKbSABWdcfONr4aQmutRZaQV6RjIHHfQsu6rVKVHODfb2UBn801Iu
R8Q/eZyZIpp8HHolVn8MeyrAft1ngjJyYPVmHm7mYibV8ZhMTUe4OjRXMh4L
qENenJ8BzPVAa6+zkwNnQIoPt7u/C0YcszjQdOSml0J81byMje7Y4t1qce3A
uK2TXVaWimypWK8xAr7OZtWT/p0ZvWY07dy6NqgXZoqjSLm6mgzvJAf7alVu
C3w6TnWtd5PWkKCuIz/uIKZRlZKqLBGUpLXCcwARAQABzSZ0ZWFtdDVfY3Np
cnQgPHRlYW10NV9jc2lydEB0ZWFtdDUub3JnPsLBigQQAQgAPgWCZHBiVAQL
CQcICZBiuGOS4OlXIwMVCAoEFgACAQIZAQKbAwIeARYhBKpIvKyYFcEctEV2
p2K4Y5Lg6VcjAADZvw/+KYm1kTDJImTVxIYplty4pZ6OEJUPUbOOOQpDQGTW
nE6yPjUWu/n9PGl5SvIWLqVubvfwPtX39BtVae4upssFuE4ZBcD5LeTeXLnV
G6lcG2gT7jAl2t4EYdwQIATMvZsAV9V8XGtBUHOqicSc/xb9ouL8z68FSrV0
Oe67vTF2WZDVLlx2uY64HSAainytK6up3IOXyIWfHWt4fw4M8o53RrP5LImh
RC8ZW337gBTdcCQbCuKvAiwFg20GzM+quE/S3cxC0G8ABrSktgsmyLUMUEjl
W+ckE0Yuz3lesTZR/VAa/YjFzwo4FzPwK4HHNibeK+v8ePKDMX9bzEZXMDkq
ZrN0T6xmxqUTS6P1yxkX5HiQnjCX3KPEP77ck/kfDe8LQSUG/isYXHQzMAbP
PXW10qAXJgxbAKgwbp6GdmmdhI9mHofHG3N2JjUJQSzsooRzOebwWSVCy69c
gOJ7bdi4w+O0zAUp+QiC71AyNfhAXYw3e5P+vJWbOw39/TdLbH3UetoeQeqz
qMOFV/DmoRkfdWKTbHvsLxX7hlHbQgpoVVH1uR005Jbn8ru8wWArKTeFkG38
IzYUqZwFOSJQAvZTnx2cJupf/a+bxzBvNp1pIzCByQvIZUe4qSBlx8EZHL3H
2DiGKTysrVRgRj3PfFSny9HBtKsZ2PtjtrtghK6vrZ7OwU0EZHBiVAEQAMFl
u7pIsM17FxGlIlfg9mDSK4aUiTrlGfZUz4VqD44kew3YILH8t4oOiIWiSZT9
i3CtOGK4UVdYpYLjbGJU8lq9sLV7if0l67CqP9Ll6f6qcr8JrrDZUFW9G2Ft
jWSPutEJpxEqIY+657qJ9+1EwP4Lm6FuF2t1o1Mz29E2E0RgqZGTRu1SNgVX
wGie4H8zSeNAjJbY4bP/bpINtSn0wCCSz8mMs99RaH0xX6VRiyfBFgEhcibK
hbcqP2VKxrj96vm2iKCzQ911wEdqkBwIdt2zpJ1K+QsD+e8I3psosJicJv6Z
JVbKpRCHneDb/0TQuqdRdvfW0UvGRHvokTaZyR7DnoQ1b6l+MVyy8NSLlM1Z
BciJwzoL/XDRz0q5grwugSxuY2dbN7AbJ3q0mjPD5nRMMV8YjOgkTrMMPyNX
jZ6pwOgNRIJDj8FXkxNgDevgKN97Ex6sEO21o1p6gILbF7BicaskHa9DIhPC
YGPmgkITgJiPuJP1rf0tEs+JqP7XAMkrgkxT9/IZU47eqGfBUkCrLKYP83DI
OEgxWT2oqUYLhHPlbU40MkiwQHtU8epsBVLXT4vYVsc80RbsxgfJ+Nf0WUED
HyL+j+aEGP++KuQvNihovTu13dA31nV699azZQLhIQVc4ew2hPmUUz3NeKyb
kQmfzRB81XhjNjSoIju1ABEBAAHCwXYEGAEIACoFgmRwYlQJkGK4Y5Lg6Vcj
ApsMFiEEqki8rJgVwRy0RXanYrhjkuDpVyMAAJErD/wM1TL7B2sUetR1aSqf
sRayilJtQsNSsa3iTe+82x4jAlUbmPVwTmSzdFp0IjIt4vchCHiFVG7RvQZs
inYQ5vqVUwNU6UGunSQb93NPD3S21H5APKbLHngZ7njNuJusNljcpkl9xbob
ZFetoUqmTqu7jG8m9+TFJGVbyyaTfMSBXJzV401Jpqw/DV7gcZSdjpakSt7I
e9A2PQZ0ZQxu4JUyIkdF4bSjjypaRQy0XNEdplZpI50Kn1ABb7POVyCvcVkU
Qi55IN99/lija5ud5K+J9eKLrCDtfn+VfhEO0CUUesYdRRMC3Sx7kSX7B9+Y
zKgpAVA6rl3VHR3Xv2wCPWufX9mKQaNe2tzTOzi96XsKiktOT4robwjI1el1
pQGkK7Gn09uOQ4fQZaHPC98gh/CN6MUHy83wIMVKpuGLEL2X2FmUptnIwcXw
bGA+nfjtWNhC2+7O8Vm1DyS6+NIJ50s9oawzcliwLcvtSSAPx8+9qspLs6p6
Aoev0MJxBp5JzSc6txl5mUBy6A2+Z8fCPPTEbuVko8NStkq5r2tVM9q+O0qv
u2WyhbXoX7jvEtmiUYOqL0Z9XTCXttH85b2NmEZriGX4I44Ojbzw/KasqgXb
FDouIuHc9ExrEsIj1JKKV/CZnJFI28xltqrE5AD/O2I1OqZkWXa1uEeVsF2t
uBDvaw===1WUJ```

-----END PGP PUBLIC KEY BLOCK-----

TeamT5 CSIRT 正式設立

>Date: Feb., 2022

TeamT5 Computer Information Security Incident Response Team (TeamT5 CSIRT) mainly provides customers with information security incident detection, notification and emergency response services. During the process, it will closely cooperate with the customer's IT and information security teams, and provide customers with Information and professional tools needed to face cyber threats, assist in identifying and defending against threats, conduct detection and response during the event, and strengthen post-event recovery services. 

The relevant descriptions are as follows:
## Operations Management
TeamT5 has passed the ISO/IEC 27001:2013 version of the information security management system specification standard, and continues to operate the information security management system to ensure the confidentiality, integrity and availability of related business assets, and provide customers with maintenance and operation of the MDR service platform. And network, computer room management and related support services.

##Service customer group
The service targets include TeamT5 insiders, as well as corporate organizations that use TeamT5's detection and response management services (managed detection & response, MDR), and the customer base covers the governments of Taiwan, Northeast Asia, and Southeast Asia , finance, mass production, technology and other industries.

## Organization Authorization
In Taiwan, TeamT5 set Taipei head office and Kaohsiung office to be responsible for Taiwan and Southeast Asia business. In Japan, TeamT5 set Tokyo office to be in charge of local business. Relevant customer case handling needs are reported to Taipei head office to provide clientr service after authorization.

##Cotact Info
- email: teamt5_csirt@teamt5.org
- Public PGP key:
-----BEGIN PGP PUBLIC KEY BLOCK-----

```xsFNBGRwYlQBEADotdKNmMYwZm2WxP3jve6+o1PXKjZ9j6EG7SKe4Hqn1hgf
9OcEmgshJHp0sSqViNtQ1frXHC1ZyH4HT8m+j4SFChNdzJ0zMjRLGRBgEbol
SEwi+St346wJ1rdBR4hwDVXYNwL5l/vRACNYnP5DQvahrMOqycvO2+b6G+CS
qPadyoy9RfqzAJ8qVigUpteDDB+hD+wKJ1/1sTm4vF32r++TmFr/GFT1qw7q
2BMvo4oJeMRFuLkFOOm2dMK3kFPARTRGAr8MmNYeURtBzBF5vnHcGjb6MqEl
s1tBAFLeu06mOXMCs6EYBWPbTiBhA+4gZXiP2Mvd+IbW5GUSYvAcB020gawb
mwshU+AeT2SInlkXdIU272azqglzeg0iOZoitjxyzWRyiT8JNuyjJMzdw7lS
AsPGJz4MKbSABWdcfONr4aQmutRZaQV6RjIHHfQsu6rVKVHODfb2UBn801Iu
R8Q/eZyZIpp8HHolVn8MeyrAft1ngjJyYPVmHm7mYibV8ZhMTUe4OjRXMh4L
qENenJ8BzPVAa6+zkwNnQIoPt7u/C0YcszjQdOSml0J81byMje7Y4t1qce3A
uK2TXVaWimypWK8xAr7OZtWT/p0ZvWY07dy6NqgXZoqjSLm6mgzvJAf7alVu
C3w6TnWtd5PWkKCuIz/uIKZRlZKqLBGUpLXCcwARAQABzSZ0ZWFtdDVfY3Np
cnQgPHRlYW10NV9jc2lydEB0ZWFtdDUub3JnPsLBigQQAQgAPgWCZHBiVAQL
CQcICZBiuGOS4OlXIwMVCAoEFgACAQIZAQKbAwIeARYhBKpIvKyYFcEctEV2
p2K4Y5Lg6VcjAADZvw/+KYm1kTDJImTVxIYplty4pZ6OEJUPUbOOOQpDQGTW
nE6yPjUWu/n9PGl5SvIWLqVubvfwPtX39BtVae4upssFuE4ZBcD5LeTeXLnV
G6lcG2gT7jAl2t4EYdwQIATMvZsAV9V8XGtBUHOqicSc/xb9ouL8z68FSrV0
Oe67vTF2WZDVLlx2uY64HSAainytK6up3IOXyIWfHWt4fw4M8o53RrP5LImh
RC8ZW337gBTdcCQbCuKvAiwFg20GzM+quE/S3cxC0G8ABrSktgsmyLUMUEjl
W+ckE0Yuz3lesTZR/VAa/YjFzwo4FzPwK4HHNibeK+v8ePKDMX9bzEZXMDkq
ZrN0T6xmxqUTS6P1yxkX5HiQnjCX3KPEP77ck/kfDe8LQSUG/isYXHQzMAbP
PXW10qAXJgxbAKgwbp6GdmmdhI9mHofHG3N2JjUJQSzsooRzOebwWSVCy69c
gOJ7bdi4w+O0zAUp+QiC71AyNfhAXYw3e5P+vJWbOw39/TdLbH3UetoeQeqz
qMOFV/DmoRkfdWKTbHvsLxX7hlHbQgpoVVH1uR005Jbn8ru8wWArKTeFkG38
IzYUqZwFOSJQAvZTnx2cJupf/a+bxzBvNp1pIzCByQvIZUe4qSBlx8EZHL3H
2DiGKTysrVRgRj3PfFSny9HBtKsZ2PtjtrtghK6vrZ7OwU0EZHBiVAEQAMFl
u7pIsM17FxGlIlfg9mDSK4aUiTrlGfZUz4VqD44kew3YILH8t4oOiIWiSZT9
i3CtOGK4UVdYpYLjbGJU8lq9sLV7if0l67CqP9Ll6f6qcr8JrrDZUFW9G2Ft
jWSPutEJpxEqIY+657qJ9+1EwP4Lm6FuF2t1o1Mz29E2E0RgqZGTRu1SNgVX
wGie4H8zSeNAjJbY4bP/bpINtSn0wCCSz8mMs99RaH0xX6VRiyfBFgEhcibK
hbcqP2VKxrj96vm2iKCzQ911wEdqkBwIdt2zpJ1K+QsD+e8I3psosJicJv6Z
JVbKpRCHneDb/0TQuqdRdvfW0UvGRHvokTaZyR7DnoQ1b6l+MVyy8NSLlM1Z
BciJwzoL/XDRz0q5grwugSxuY2dbN7AbJ3q0mjPD5nRMMV8YjOgkTrMMPyNX
jZ6pwOgNRIJDj8FXkxNgDevgKN97Ex6sEO21o1p6gILbF7BicaskHa9DIhPC
YGPmgkITgJiPuJP1rf0tEs+JqP7XAMkrgkxT9/IZU47eqGfBUkCrLKYP83DI
OEgxWT2oqUYLhHPlbU40MkiwQHtU8epsBVLXT4vYVsc80RbsxgfJ+Nf0WUED
HyL+j+aEGP++KuQvNihovTu13dA31nV699azZQLhIQVc4ew2hPmUUz3NeKyb
kQmfzRB81XhjNjSoIju1ABEBAAHCwXYEGAEIACoFgmRwYlQJkGK4Y5Lg6Vcj
ApsMFiEEqki8rJgVwRy0RXanYrhjkuDpVyMAAJErD/wM1TL7B2sUetR1aSqf
sRayilJtQsNSsa3iTe+82x4jAlUbmPVwTmSzdFp0IjIt4vchCHiFVG7RvQZs
inYQ5vqVUwNU6UGunSQb93NPD3S21H5APKbLHngZ7njNuJusNljcpkl9xbob
ZFetoUqmTqu7jG8m9+TFJGVbyyaTfMSBXJzV401Jpqw/DV7gcZSdjpakSt7I
e9A2PQZ0ZQxu4JUyIkdF4bSjjypaRQy0XNEdplZpI50Kn1ABb7POVyCvcVkU
Qi55IN99/lija5ud5K+J9eKLrCDtfn+VfhEO0CUUesYdRRMC3Sx7kSX7B9+Y
zKgpAVA6rl3VHR3Xv2wCPWufX9mKQaNe2tzTOzi96XsKiktOT4robwjI1el1
pQGkK7Gn09uOQ4fQZaHPC98gh/CN6MUHy83wIMVKpuGLEL2X2FmUptnIwcXw
bGA+nfjtWNhC2+7O8Vm1DyS6+NIJ50s9oawzcliwLcvtSSAPx8+9qspLs6p6
Aoev0MJxBp5JzSc6txl5mUBy6A2+Z8fCPPTEbuVko8NStkq5r2tVM9q+O0qv
u2WyhbXoX7jvEtmiUYOqL0Z9XTCXttH85b2NmEZriGX4I44Ojbzw/KasqgXb
FDouIuHc9ExrEsIj1JKKV/CZnJFI28xltqrE5AD/O2I1OqZkWXa1uEeVsF2t
uBDvaw===1WUJ```
-----END PGP PUBLIC KEY BLOCK-----


TeamT5  CSIRT Officialy Establish

>公告日期: 2022年2月

杜浦數位安全電腦資安事件應變小組(TeamT5 CSIRT)主要提供客戶有關資安事件偵測、通報與應變處理服務，過程中會與客戶的IT及資安團隊進行密切配合，並於事前提供客戶面對網路威脅所需情訊及專業工具，協助辨識與防禦威脅，事中進行偵測與因應與事後復原強化等服務，有關說明如次：

##營運管理
杜浦數位安全通過 ISO/IEC 27001:2013 版資訊安全管理系統規範標準，持續運作資訊安全管理制度，以確保相關業務資產之機密性、完整性及可用性，提供(1)網路威脅情資分析 (2)資安事件應變、調查與分析 (3)客戶 MDR 服務平台之維運。

##服務客群
服務對象包含TeamT5杜浦數位安全內部人員，以及採用 TeamT5杜浦數位安全偵測與應變代管服務(managed detection & response, MDR)之企業組織，客群涵蓋了台灣地區及東北亞、東南亞地區政府、金融、傳產、科技等行業別。

##組織授權
TeamT5 杜浦數位安全於台灣地區有台北總公司及高雄辦公室負責台灣與東南亞業務，日本地區有東京辦公室負責當地業務，有關客戶案件處理需求均回報台北總公司經授權後，提供客戶服務。

##聯絡資訊
- email: teamt5_csirt@teamt5.org
- Public PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
```xsFNBGRwYlQBEADotdKNmMYwZm2WxP3jve6+o1PXKjZ9j6EG7SKe4Hqn1hgf
9OcEmgshJHp0sSqViNtQ1frXHC1ZyH4HT8m+j4SFChNdzJ0zMjRLGRBgEbol
SEwi+St346wJ1rdBR4hwDVXYNwL5l/vRACNYnP5DQvahrMOqycvO2+b6G+CS
qPadyoy9RfqzAJ8qVigUpteDDB+hD+wKJ1/1sTm4vF32r++TmFr/GFT1qw7q
2BMvo4oJeMRFuLkFOOm2dMK3kFPARTRGAr8MmNYeURtBzBF5vnHcGjb6MqEl
s1tBAFLeu06mOXMCs6EYBWPbTiBhA+4gZXiP2Mvd+IbW5GUSYvAcB020gawb
mwshU+AeT2SInlkXdIU272azqglzeg0iOZoitjxyzWRyiT8JNuyjJMzdw7lS
AsPGJz4MKbSABWdcfONr4aQmutRZaQV6RjIHHfQsu6rVKVHODfb2UBn801Iu
R8Q/eZyZIpp8HHolVn8MeyrAft1ngjJyYPVmHm7mYibV8ZhMTUe4OjRXMh4L
qENenJ8BzPVAa6+zkwNnQIoPt7u/C0YcszjQdOSml0J81byMje7Y4t1qce3A
uK2TXVaWimypWK8xAr7OZtWT/p0ZvWY07dy6NqgXZoqjSLm6mgzvJAf7alVu
C3w6TnWtd5PWkKCuIz/uIKZRlZKqLBGUpLXCcwARAQABzSZ0ZWFtdDVfY3Np
cnQgPHRlYW10NV9jc2lydEB0ZWFtdDUub3JnPsLBigQQAQgAPgWCZHBiVAQL
CQcICZBiuGOS4OlXIwMVCAoEFgACAQIZAQKbAwIeARYhBKpIvKyYFcEctEV2
p2K4Y5Lg6VcjAADZvw/+KYm1kTDJImTVxIYplty4pZ6OEJUPUbOOOQpDQGTW
nE6yPjUWu/n9PGl5SvIWLqVubvfwPtX39BtVae4upssFuE4ZBcD5LeTeXLnV
G6lcG2gT7jAl2t4EYdwQIATMvZsAV9V8XGtBUHOqicSc/xb9ouL8z68FSrV0
Oe67vTF2WZDVLlx2uY64HSAainytK6up3IOXyIWfHWt4fw4M8o53RrP5LImh
RC8ZW337gBTdcCQbCuKvAiwFg20GzM+quE/S3cxC0G8ABrSktgsmyLUMUEjl
W+ckE0Yuz3lesTZR/VAa/YjFzwo4FzPwK4HHNibeK+v8ePKDMX9bzEZXMDkq
ZrN0T6xmxqUTS6P1yxkX5HiQnjCX3KPEP77ck/kfDe8LQSUG/isYXHQzMAbP
PXW10qAXJgxbAKgwbp6GdmmdhI9mHofHG3N2JjUJQSzsooRzOebwWSVCy69c
gOJ7bdi4w+O0zAUp+QiC71AyNfhAXYw3e5P+vJWbOw39/TdLbH3UetoeQeqz
qMOFV/DmoRkfdWKTbHvsLxX7hlHbQgpoVVH1uR005Jbn8ru8wWArKTeFkG38
IzYUqZwFOSJQAvZTnx2cJupf/a+bxzBvNp1pIzCByQvIZUe4qSBlx8EZHL3H
2DiGKTysrVRgRj3PfFSny9HBtKsZ2PtjtrtghK6vrZ7OwU0EZHBiVAEQAMFl
u7pIsM17FxGlIlfg9mDSK4aUiTrlGfZUz4VqD44kew3YILH8t4oOiIWiSZT9
i3CtOGK4UVdYpYLjbGJU8lq9sLV7if0l67CqP9Ll6f6qcr8JrrDZUFW9G2Ft
jWSPutEJpxEqIY+657qJ9+1EwP4Lm6FuF2t1o1Mz29E2E0RgqZGTRu1SNgVX
wGie4H8zSeNAjJbY4bP/bpINtSn0wCCSz8mMs99RaH0xX6VRiyfBFgEhcibK
hbcqP2VKxrj96vm2iKCzQ911wEdqkBwIdt2zpJ1K+QsD+e8I3psosJicJv6Z
JVbKpRCHneDb/0TQuqdRdvfW0UvGRHvokTaZyR7DnoQ1b6l+MVyy8NSLlM1Z
BciJwzoL/XDRz0q5grwugSxuY2dbN7AbJ3q0mjPD5nRMMV8YjOgkTrMMPyNX
jZ6pwOgNRIJDj8FXkxNgDevgKN97Ex6sEO21o1p6gILbF7BicaskHa9DIhPC
YGPmgkITgJiPuJP1rf0tEs+JqP7XAMkrgkxT9/IZU47eqGfBUkCrLKYP83DI
OEgxWT2oqUYLhHPlbU40MkiwQHtU8epsBVLXT4vYVsc80RbsxgfJ+Nf0WUED
HyL+j+aEGP++KuQvNihovTu13dA31nV699azZQLhIQVc4ew2hPmUUz3NeKyb
kQmfzRB81XhjNjSoIju1ABEBAAHCwXYEGAEIACoFgmRwYlQJkGK4Y5Lg6Vcj
ApsMFiEEqki8rJgVwRy0RXanYrhjkuDpVyMAAJErD/wM1TL7B2sUetR1aSqf
sRayilJtQsNSsa3iTe+82x4jAlUbmPVwTmSzdFp0IjIt4vchCHiFVG7RvQZs
inYQ5vqVUwNU6UGunSQb93NPD3S21H5APKbLHngZ7njNuJusNljcpkl9xbob
ZFetoUqmTqu7jG8m9+TFJGVbyyaTfMSBXJzV401Jpqw/DV7gcZSdjpakSt7I
e9A2PQZ0ZQxu4JUyIkdF4bSjjypaRQy0XNEdplZpI50Kn1ABb7POVyCvcVkU
Qi55IN99/lija5ud5K+J9eKLrCDtfn+VfhEO0CUUesYdRRMC3Sx7kSX7B9+Y
zKgpAVA6rl3VHR3Xv2wCPWufX9mKQaNe2tzTOzi96XsKiktOT4robwjI1el1
pQGkK7Gn09uOQ4fQZaHPC98gh/CN6MUHy83wIMVKpuGLEL2X2FmUptnIwcXw
bGA+nfjtWNhC2+7O8Vm1DyS6+NIJ50s9oawzcliwLcvtSSAPx8+9qspLs6p6
Aoev0MJxBp5JzSc6txl5mUBy6A2+Z8fCPPTEbuVko8NStkq5r2tVM9q+O0qv
u2WyhbXoX7jvEtmiUYOqL0Z9XTCXttH85b2NmEZriGX4I44Ojbzw/KasqgXb
FDouIuHc9ExrEsIj1JKKV/CZnJFI28xltqrE5AD/O2I1OqZkWXa1uEeVsF2t
uBDvaw===1WUJ```

-----END PGP PUBLIC KEY BLOCK-----


杜浦數位安全電腦資安事件應變小組正式運作

國際半導體展 SEMICON 於今日(12/28)盛大開展，TeamT5 杜浦數位安全於 SECPAAS主題館發表演講，提醒企業應時時防範勒索軟體，依循3大關鍵──掌握情資、有效偵測威脅和使用自動化管理工具，牢牢保護重要商業機密。

# 企業預防勒索軟體的3大關鍵為 -

- 掌握情資: 知識就是力量，企業應掌握最新、最正確的攻擊威脅資料，預知駭客可能入侵的手法、管道，以採取最好的防護策略。
- 有效偵測威脅: 根據真實案例和專家研究得出的情資，宜搭配 AI 驅動的辨識引擎，有效發掘企業資訊環境內潛藏的可疑軟體，即時拆除未爆彈。
-  使用自動化管理工具: 採用自動化管理工具，可大幅縮短反應時間，即時阻斷勒索攻擊、備份檔案，避免重要檔案無法開啟。若工具能根據企業的營運特性，量身打造防護對策，更為理想。

駭客手法持續精進，甚至會使用合法程式來掩護非法攻擊，企業更需要有工具偵測，才能阻擋入侵。TeamT5 建議企業立刻採取預防措施，確保營運順暢、客戶服務不中斷。

## **[關於 TeamT5 杜浦數位安全]**

TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
團隊具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。



![news&events_pic.jpg](https://legacy-uploads.teamt5.org/news_and_events_pic_bb73daf924.jpg)

TeamT5 杜浦數位安全於國際半導體展 SECPAAS主題館，由資深經理  Shawn 發表演講，提醒企業應時時防範勒索軟體



預防勒索軟體3大關鍵 杜浦數位安全於國際半導體展不藏私分享

TeamT5 於今年(2021)首次申請 ISO 27001 資訊安全管理系統認證。經過全體同仁數月的共同努力，在 9 月以零缺失通過驗證，並於12月4日由英國標準協會 BSI 台灣分公司洪詩嵐協理，頒授證書予 TeamT5 蔡松廷執行長。

TeamT5 一直以來都具備完善及嚴謹的資安管理系統與制度，此次透過國際標準之資安及隱私資訊管理制度，讓資安及隱私保護意識更深入企業文化中，展現 TeamT5 於資安防護的堅持，與守護客戶之決心。


![ISO 27001_photo.jpg](https://legacy-uploads.teamt5.org/ISO_27001_photo_a660399985.jpg)


英國標準協會 BSI 台灣分公司洪詩嵐協理(左一) 頒授證書予 TeamT5 蔡松廷執行長(右一)、Baleezo(右二)



TeamT5 獲 ISO/IEC 27001:2013 驗證，具備資安服務高標準

TeamT5 just received ISO/IEC 27001:2013 certification as we applied for it for the first time. After months of efforts from our colleagues, TeamT5 passed the verification with zero defects in September. On December 4th, senior manager Elaine Hong represented the British Standards Institution (BSI) - Taiwan branch, and awarded the certification to the CEO of TeamT5, TT Tsai.

TeamT5 has always been equipped with a comprehensive & rigorous cybersecurity management system. This time, through the international standard for information security and private data management system, the awareness of information security & privacy protection has been deepened in the corporate culture. It also demonstrates TeamT5’s  determination to protect our clients with high standards of cybersecurity.



![ISO 27001_photo.jpg](https://legacy-uploads.teamt5.org/ISO_27001_photo_a660399985.jpg)


Elaine Hong (at left) represented the British Standards Institution and awarded the certification to the CEO of TeamT5, TT Tsai (in the middle) & Baleezo (at right).



TeamT5 Receives ISO/IEC 27001:2013 Certification with Highest Information Security Protection Standard

TeamT5は、今年（2021年）初めてISO 27001情報セキュリティマネジメントシステム認証を申請しました。従業員一同の数か月にわたる努力により、9月にゼロディフェクトで試験に合格し、12月4日にBSI（英国規格協会）台湾支部の洪詩嵐協理より、TeamT5の蔡松廷執行長に証明書が授与されました。

TeamT5は常に完全かつ厳格な情報セキュリティマネジメントシステムおよび制度を備え、今回の国際基準の情報セキュリティおよびプライバシー情報マネジメントの制度により、情報セキュリティとプライバシー保護の意識をさらに深く企業文化に組み込み、TeamT5の情報セキュリティおよび顧客を守るという強い決意を示しています。



![ISO 27001_photo.jpg](https://legacy-uploads.teamt5.org/ISO_27001_photo_a660399985.jpg)


BSI（英国規格協会）台湾支部の洪詩嵐協理（左）、証明書を授与されるTeamT5の蔡松廷執行長（中央）、Baleezo（右）



TeamT5は ISO/IEC 27001：2013認証を取得し、高水準の情報セキュリティサービスを提供しています。

Winnti (APT41) 去年被美國 FBI 起訴，但他們並沒有消失，反而使用更新、更難被察覺的方法來突破資安防線。

TeamT5 針對 Winnti (APT41) 的完整研究成果，於台灣駭客年會 HITCON 2021分享。

本次演講簡報現可於官網下載: [連結](https://hitcon.org/2021/agenda/1abeaad2-5152-4468-91ac-d50a39dd7834/Winnti%20is%20Coming%20-%20Evolution%20after%20Prosecution.pdf)

![HITCON 2021_pic.png](https://legacy-uploads.teamt5.org/HITCON_2021_pic_ed282d9a3e.png)
<center>系列網路攻擊鎖定的產業類型</center>

TeamT5 於台灣駭客年會 HITCON 2021 分享 Winnti (APT41)及相關研究

Since Winnti (APT41) was sued by the FBI last year, the group has not disappeared. Instead, they have used more innovative and less well noticed techniques to evade detection by security products, such as:

- Avoiding memory detection through dll hollowing technique and one miscellaneous method.
- Using DPAPI to encrypt the real payload to make forensics more difficult.
- Abusing the certificate to hide the payload in a signed PE file.
- Using Cloudflare Worker to hide the real IP address.
- Using legitimate tools like InstallUtil to execute code and bypass application whitelisting.

In addition to malware that is known to be used by Winnti , we also found some newly developed malware. There are two new pieces of listening port malware, RBRAT and a Stone variant. We also found a shellcode-based backdoor, Natwalk, and the method it used to call the Windows API was also innovative, making the reversing more difficult.

The group is also more careful in their usage of C2. They use DNS tunneling extensively as well as Cloudflare Worker to hide their real C2 IP.

We have observed that Winnti targeted telecommunications companies, key medical institutions, governments, and major infrastructures in various countries in 2021.
The prosecution did not deter them, but instead prompted them to evolve their attack techniques, and make it harder for researchers to track and detect.

In this talk we provide more details about the campaigns of Winnti , including its innovative TTPs, newly developed malware, lateral movement techniques, and the strategies they used for C2 after they were sued by the FBI.

Slides of the talk can be downloaded on the official website : [Link](https://hitcon.org/2021/agenda/1abeaad2-5152-4468-91ac-d50a39dd7834/Winnti%20is%20Coming%20-%20Evolution%20after%20Prosecution.pdf)

![HITCON 2021_pic.png](https://legacy-uploads.teamt5.org/HITCON_2021_pic_ed282d9a3e.png)

<center>Target Industry by Winnti (APT41)</center>

Winnti is Coming! TeamT5 Shares APT Analysis Result in HITCON 2021

#### 想找資安實習嗎？想了解資安工作內容和差異嗎？或是應屆畢業生想於畢業前了解自己適合的角色嗎？

我們是 TeamT5 杜浦數位安全，專精於網路惡意入侵行為分析與追蹤與漏洞安全研究，為目前國內頂尖網路威脅情資研究團隊。

我們即將在明年（2022）寒假期間舉行五天的 TeamT5 Security Camp 資安培訓營，將帶著大家透過一系列的完整課程，快速了解每一個資安職位的工作內容，並且透過導師制度，讓大家不僅可以從中學習資安技術，更能接觸真實的實務案例哦！

## 資安培訓營內容

五天的 Security Camp 資安培訓營，您將接觸到：

- 初探威脅情資的奧秘
- 漏洞挖掘的深入體驗
- 資安事件處理的剖析
- 與系統底層一日邂逅

##上課日期（皆需實體到場）：
2022 年 1 月 18 日（二）、1 月 19 日（三）、1 月 25 日（二）、1 月 26 日（三）、1 月 27 日（四）

## 報名資格與費用：
- 報名資格：國內大專院校、碩士生
- 活動費用：免費

## 徵選方式：
 即日起至 12/2（四）前填寫筆試索取表單

題目索取表單 👉 https://bit.ly/3FiT3lz

## 活動諮詢窗口：

若有任何問題，歡迎來信 camp@teamt5.org


第二屆 TeamT5 Security Camp 資安培訓營～ 開跑囉 (報名截止)

惡意程式領域最大的國際會議 Virus Bulletin (VB) 為資安界年度盛事，由專業人士提供惡意軟體、惡意行為者和威脅情報的最新且最佳之研究。

TeamT5 惡意程式研究員們 Aragorn Tseng、Charles Li、Peter Syu 和 Tom Lai 於會議上分享 APT41 的相關研究，其就是大家所熟知的駭客組織 Winnti，分享內容包括他們使用的 TTPs、新攻擊手法，以及分析他們今年使用 C2 的策略。

本次演講摘要與影片現於會議官網公開，連結[請點此](https://vblocalhost.com/conference/presentations/evolution-after-prosecution-psychedelic-apt41/)

![VB2021_pic.png](https://legacy-uploads.teamt5.org/VB_2021_pic_b00b865f9d.png)

<center>2020-2021年期間，APT41 的後門程式</center>


*首圖來源: [Virus Bulletin](https://vblocalhost.com/conference/)

TeamT5 參與 Virus Bulletin 國際會議，分享 APT41 相關研究

Since APT41 was sued by the FBI last year, the group has not disappeared. Instead, they have used more innovative and less well noticed techniques to evade detection by security products, such as:

Avoiding memory detection through dll hollowing technique and one miscellaneous method.

Using DPAPI to encrypt the real payload to make forensics more difficult.
Abusing the certificate to hide the payload in a signed PE file.
Using Cloudflare Worker to hide the real IP address.
Using legitimate tools like InstallUtil to execute code and bypass application whitelisting.

In addition to malware that is known to be used by APT41, we also found some newly developed malware. There are two new pieces of listening port malware, RBRAT and a Stone variant. We also found a shellcode-based backdoor, DNHash, and the method it used to call the Windows API was also innovative, making the reversing more difficult.
The group is also more careful in their usage of C2. They use DNS tunneling extensively as well as Cloudflare Worker to hide their real C2 IP.

We have observed that APT41 targeted telecommunications companies, key medical institutions, governments, and major infrastructures in various countries in 2021.
The prosecution did not deter them, but instead prompted them to evolve their attack techniques, and make it harder for researchers to track and detect.

In this talk we will provide more details about the campaigns of APT41, including its innovative TTPs, newly developed malware, lateral movement techniques, and the strategies they used for C2 after they were sued by the FBI. We will also propose some methods to prevent their latest attack techniques.

The speech was given by researchers - Aragorn Tseng , Charles Li, Peter Syu, and Tom Lai.

Slides & video of the speech can be accessed on the official website : [Link](https://vblocalhost.com/conference/presentations/evolution-after-prosecution-psychedelic-apt41)

![VB2021_pic.png](https://legacy-uploads.teamt5.org/VB_2021_pic_b00b865f9d.png)

<center>APT41’s Backdoor during 2020-2021</center>

**About Virus Bulletin**
Virus Bulletin is a world-renowned international conference. It features the latest and best research on malware, malicious actors and threat intelligence annually.

*Image courtesy of [Virus Bulletin](https://vblocalhost.com/conference/)

TeamT5 Attends Virus Bulletin Event to Share Our In-Depth Research on APT41

The biggest information security conference in Japan, CODE BLUE 2021, will be held in hybrid style in Tokyo, both virtual and on-site, on October 19th and 20th. During the COVID-19 pandemic, cybersecurity matters more than ever. As a Taiwan-based cybersecurity company dedicated to combating cyber threats, TeamT5 is proud to support, sponsor and participate in this top international cybersecurity event in Asia.
 
This year, we will be giving workshops on topics of cyber threat intelligence, threat hunting, and ransomware protection. Join us for the exclusive workshops at CODE BLUE 2021 and enjoy an active interchange of ideas with us! (*Note: TeamT5 workshops are all by registration.)
 
Moreover, our cyber threat analysts Che Chang and Silvia Yeh will again be presenting at Law & Policy track, sharing their latest study on Chinese InfoOps at this year’s virtual conference.
 
See below for highlights of our events at CODE BLUE 2021.

## Speech

- **Law & Policy | Clip Addiction: A Study of Video-Based Chinese InfoOps with Threat Intelligence**

China’s Information Operations (InfoOps) continue to proliferate in cyberspace. TeamT5 cyber threat analysts Che Chang and Silvia Yeh will present their research on China’s video-based InfoOps across social media platforms.

![infoops_twitter.png](https://legacy-uploads.teamt5.org/infoops_twitter_d624cf406f.png)

 

## TeamT5 Workshop

This year, TeamT5 and our partners, Macnica and Terilogy Worx Corporation, co-host a series of virtual workshops at CODE BLUE 2021. Our CEO Sung-ting Tsai (TT) and Cyber Threat Intelligence team will discuss topics on ransomware prevention and our research on APT attacks in Japan. Come join us!

### Workshop I: Strategy Overview of Ransomware Defense

Ransomware has become one of the top cyber security risks that could not be ignored by C-level executives. The threat actors are savvy and their attack techniques keep evolving. TeamT5 observes significant incidents keep happening and their impact is huge.

In this workshop, we will introduce what makes ransomware so difficult to defend, and as defenders, how to develop your defense plan. Through the real case studies dissecting ransomware attack techniques and procedures, we will discuss countermeasures for each attack phase and show you how to combat ransomware threats at the earliest stage.

- **Location**: via Microsoft Teams.

![ransom_twitter.png](https://legacy-uploads.teamt5.org/ransom_twitter_7bfbb0912e.png)

 

### Workshop II: APT Attacks in Japan

In this workshop, TeamT5 cyber threat researcher will cover the latest attack methods adopted by Chinese APT groups, and illustrate possible threats Japan may face.
 
Furthermore, we will show you how TeamT5’s threat intelligence platform, ThreatVision, can help you forecast threat risks and deploy cybersecurity defense in advance.
 
Our partner, Macnica, will also present recent threat research on Japan. This workshop will provide you with a full landscape of the threat intelligence trends in Japan and how you can avoid their attacks by effectively applying threat intelligence to your business.

- **Location**: via Microsoft Teams.

![apt_twitter.png](https://legacy-uploads.teamt5.org/apt_twitter_9fd752e842.png)


 

### What is CODE BLUE?

CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.
 
More information on CODE BLUE 2021 [Official Website](https://codeblue.jp/2021/en/).

 

*Image courtesy of [CODE BLUE](https://codeblue.jp/2021/en/).

【TeamT5 x CODE BLUE 2021】Because Security Matters

日本最大の情報セキュリティ会議、CODE BLUE 2021が、東京にて10月19日と20日、バーチャルとオンサイトのハイブリッド形式で開催されます。COVID-19パンデミックにおいて、サイバーセキュリティの重要性はかつてなく高まりました。サイバー脅威に対抗する台湾発のサイバーセキュリティ専門企業として、TeamT5はこのアジア最大のサイバーセキュリティイベントをスポンサーとして支援し、参加できることを誇りに思います。
 
今年、当社はサイバー脅威のインテリジェンス、脅威の検出、ランサムウェアに対する保護のトピックで、ワークショップを開催します。CODE BLUE 2021独自のワークショップにご参加いただき、活発な意見交換を行いましょう！（注意：TeamT5のワークショップにはすべて登録が必要です。）
 
さらに、今年度のバーチャルカンファレンスでは、当社のサイバー脅威アナリスト、Che ChangとSilvia Yehが法律とプライバシーのトラックで再び講演を行い、中国のInfoOpsに関する最新の調査成果を発表します。
 
CODE BLUE 2021における当社イベントについて手短に紹介します。

## 講演

- **法律とポリシー | 動画中毒：動画ベースの中国発InfoOpsに対する脅威インテリジェンスを活用した調査結果**

中国の情報操作（InfoOps）がサイバー世界で猛威を振るい続けています。TeamT5のサイバー脅威アナリスト、Che ChangとSilvia Yehが、中国がソーシャルメディアの各プラットフォームで仕掛けている、動画ベースのInfoOpsに関する調査を発表します。

![infoops_twitter.png](https://legacy-uploads.teamt5.org/infoops_twitter_d624cf406f.png)

 

## TeamT5 のワークショップ

今年度、TeamT5とパートナー企業、MacnicaとTerilogy Worx Corporationは、CODE BLUE 2021で一連のバーチャルワークショップを開催します。当社のCEO、Sung-ting Tsai（TT）とサイバー脅威インテリジェンスのチームが、ランサムウェア対策と日本でのAPT攻撃に関する当社の調査結果について話し合います。ぜひご参加ください！

### ワークショップI：ランサムウェア対策戦略の概要

このワークショップでは、ランサムウェアの対策を難しくしている理由と、対策を行う側として、防衛プランを策定する方法を紹介します。実例を元にランサムウェアの攻撃テクニックとその手口を解説し、攻撃の各段階での防御策と、可能な限り早期にランサムウェア攻撃に対抗する方法をお見せします。

このワークショップでは、ランサムウェアの対策を難しくしている理由と、対策を行う側として、防衛プランを策定する方法を紹介します。実例を元にランサムウェアの攻撃テクニックとその手口を解説し、攻撃の各段階での防御策と、可能な限り早期にランサムウェア攻撃に対抗する方法をお見せします。

- **開催場所**：Microsoft Teamsを使用したオンライン

![ransom_twitter.png](https://legacy-uploads.teamt5.org/ransom_twitter_7bfbb0912e.png)

 

### ワークショップII：日本におけるAPT攻撃

このワークショップでは、TeamT5のサイバー脅威研究者が中国のAPTグループが用いる最新の攻撃手法を明らかにし、日本が直面する可能性のある脅威をお見せします。
 
さらに、TeamT5の脅威インテリジェンスプラットフォーム、ThreatVisionを用いて、脅威のリスクを予測して事前にサイバーセキュリティ対策を導入しやすくする方法を示します。
 
当社のパートナー、Macnicaが、日本での脅威に関する最近の調査を発表します。このワークショップは日本での脅威インテリジェンス状況の全容を明らかにし、脅威インテリジェンスを業務へ効果的に組み込んで攻撃を回避する方法を紹介します。

- **開催場所**：Microsoft Teamsを使用したオンライン

![apt_twitter.png](https://legacy-uploads.teamt5.org/apt_twitter_9fd752e842.png)


 

### CODE BLUEとは？

CODE BLUE is Japan's largest international information security CODE BLUEは日本最大の国際情報セキュリティ会議です。CODE（技術）を使用し、BLUE（大洋）を超えて人々をつなげることで、インターネット世界をよりよくすることを目指します。毎年、世界最高レベルの専門家や研究者が一堂に会し、最新の調査結果を発表して最先端のトピックについて話し合います。情報セキュリティの課題を解決するために、すべての参加者が情報を交換して協力し合う場です。
 
詳細情報は [CODE BLUE 2021](https://codeblue.jp/2021/)の公式ウェブサイトをご覧ください。

 

*画像のソース: [CODE BLUE](https://codeblue.jp/2021/)

【TeamT5 x CODE BLUE 2021】セキュリティは常に重要です

文／黃彥棻

日本內容農場網站在中秋連假前夕，先在日本境內分享中國內容農場不實消息，指控臺灣政府教唆專精 APT 與假新聞研究的臺灣資安公司 TeamT5，以網路釣魚手法，非法蒐集日本民眾個資，相關資訊也在日本社交媒體以及臺灣臉書粉專持續傳播。稍有不慎，可能將單純的假新聞操弄事件升級為影響臺日政府友好的國安事件。

[點此閱讀完整報導](https://www.ithome.com.tw/news/146834)

 

 *圖片來源：[Freepik](https://www.freepik.com)

【iThome】中國認知作戰新手法！鎖定臺灣資安公司製造假新聞，挑撥臺日政府關係

TeamT5 found one content farm published a disinformation article accusing TeamT5 of conducting phishing attacks against the Japanese government and Japanese tech companies. The actor abused the mechanism of the content farm business for spreading baseless evidence to discredit TeamT5 and the Taiwanese government.

In this clarification, TeamT5 declares that the above-mentioned disinformation are by no means true. TeamT5 has never engaged in any cyber-attacks, and will not accept any commissions to conduct cyber-attacks.

This disinformation attack is in line with the tactics, techniques, and procedures (TTPs) of state-sponsored information operation that has been observed closely by us. The article is highly possible to be written by non-native Japanese speakers due to the multiple grammar mistakes and many Chinese characters. TeamT5 has shared all the above information with the law enforcement in both Taiwan and Japan. The further detail of this attack is now under investigation.

Since the start of TeamT5, we have been helping our clients and partners to defend against all kinds of cyberattacks. We do not and will never use our resources and products to conduct any cyberattacks. If you require further information, please contact <pr@teamt5.org>.

 

*Image courtesy of [Freepik](https://www.freepik.com/)

Clarification on Malicious Disinformation Targeting TeamT5

正值中秋連假之際，某特定內容農場開始散播關於 TeamT5 的謠言。該謠言以日文撰寫，其內容指稱TeamT5 對日本政府與各大日本企業進行釣魚攻擊並大量收集個人資訊云云。

TeamT5 在此嚴正聲明，前開網路謠言絶非事實，TeamT5 從未從事任何網路攻擊的行動，更不會接受任何客戶委託進行網路攻擊之行為。

TeamT5 追查後發現，該造謠者係利用內容農場商業模式讓該不實內容於中文和日文的內容農場偕同轉發。但該內容不僅偽造釣魚信件的截圖，其內更有大量日文文法錯誤與錯字，還有許多中文詞彙假冒在其中，種種跡象均顯示該謠言撰稿者係偽冒成日文母語人士撰寫日文新聞稿。

初步分析後，TeamT5 情資團隊認為這起謠言的手法符合我們過往研究的國家級駭客散播不實新聞的戰術、技術和流程（Tactics, Techniques, and Procedures, TTPs）。目前 TeamT5 已將相關分析與證據備份，並已通報請台日雙邊的調查單位協助偵查。

謹再次重申，TeamT5 自創立以來，協助所有的客戶與夥伴阻擋各類網路威脅。我們過去、現在以及未來都不會主動發起或接受委託從事任何網路攻擊活動。

> Contact: <PR@teamt5.org>

 

*圖片來源：[Freepik](https://www.freepik.com/)

TeamT5 杜浦數位安全針對假新聞攻擊之澄清

TeamT5（以下、当社）は、ある特定のコンテンツファームが、当社が日本政府及び日本国内のIT企業に対してフィッシング攻撃を行い、個人情報を大量に収集しているとの事実に反する偽情報を流布していることを発見いたしました。該当の偽情報は、コンテンツファーム・ビジネスの仕組みを熟知し、悪用する行為者によって、当社および台湾政府の名誉もしくは信用を毀損することを目的に配布されたものです。

本声明を通じて、当社は、該当記事によって流布された内容が事実無根のものであり、一切事実ではないことをお伝えいたします。当社はこれまでいかなるサイバー攻撃にも関与したことはなく、また、第三者からサイバー攻撃の依頼を請け負ったこともありません。

今回のディスインフォメーション攻撃は、当社がこれまで観測してきた国家主導の情報工作の戦術、技術、手順（TTPs）と合致するものです。この記事には複数の文法上の誤りや中国語（簡体字）の利用などが確認できることから、日本語を母語としない筆者によって記述された可能性が高く、日本人になりすまして投稿されたものと考えられます。当社は、事態の全容解明に向け、すべての情報を台湾及び日本の法執行機関に提供し、引き続き調査を進めております。

創業以来、当社は、あらゆる種類のサイバー攻撃からクライアントの皆様やパートナー各社様の安全確保に貢献し、セキュリティ対策強化の一助となるよう努めてまいりました。当社が、当社の製品及びリソースを用いてサイバー攻撃を実施、或いは請け負ったことはなく、今後もありません。

本件に関するご質問等につきましては次のメールアドレス（<pr@teamt5.org>）までお問い合わせくださいますようお願い申し上げます。

 

*Image courtesy of [Freepik](https://www.freepik.com/)

当社に関する偽情報の流布及び誹謗中傷への対応について

本資料轉載自 [CIO IT 經理人](https://www.cio.com.tw/) | 採訪／施鑫澤・文／林裕洋

## ThreatSonar 搭配 ThreatVision 雙劍合璧

> 勒索軟體與 APT 攻擊手法非常類似，企業唯有全面性解決，並在防堵威脅時同步擬定執行策略，才能讓人員更有效進行處理。

 

根據 TeamT5 杜浦數位安全威脅情資研究團隊觀察，REvil 駭客組織從去年（2020）開始所進行的一連串國內外資安重大威脅事件的動作來看，透過加密勒索軟體的攻擊手法是全球所關注且警覺到此狀況不容小覷。從今年上半年累計統計至七月份遭受 REvil 勒索軟體攻擊的受害對象浮出檯面上的至少有五、六起事件發生，對於尚未浮出台面的受害事件還不知道有多少。

以台灣為例，向來位居全球領導地位的高科技製造業，以往由於行事低調，甚少被駭客組織注意，近兩年駭客組織逐漸將勒索軟體的工具目標鎖定台灣高科技製造業，因此市場上陸續多家業者傳出遭遇勒索軟體攻擊的事件，且被駭客要求支付天價的高額贖金，甚至部分駭客組織為了脅迫受害企業支付贖金，將所竊取部分重要機敏的資料在地下市場公開，迫使讓企業進入支付贖金。根據資安專家進行事後調查發現，遭到同一個駭客組織採用REvil勒索軟體攻擊的受害業者多數為大型跨國企業，一旦這些企業受害其對於企業營運的影響面則會相當顯著，也因此勒索軟體的攻擊成為國內外大企業在面臨資安部署的防禦上最為之戒慎恐懼的一環。

TeamT5 杜浦數位安全創辦人兼執行長蔡松廷指出，若是以事件處理的角度來看，勒索軟體與 APT 進階持續性威脅（Advanced Persistent Threat, APT）攻擊手法非常類似，唯一不同之處是駭客組織藉著勒索軟體攻擊進行勒索受害者並且以獲得一定高額贖金為目標。蔡松廷強調面對勒索軟體、APT 等攻擊手法，企業唯有以全面性思維規畫並在威脅攻擊之際，同步擬定與執行防堵策略，甚或精準部署防護策略捷足先登避免攻擊事件的發生。

蔡松廷進一步強調，以目前 TeamT5 杜浦數位安全所推出的勒索軟體全面防禦策略，採用能有效偵測出 APT 針對型攻擊的 ThreatSonar 威脅狩獵解決方案與目前企業現有的資安解決方案，兩者相互合作中強化與增進企業資安全面部署的完備。

 

## 技術、經驗兼具 提供全方位服務

專精於網路惡意入侵行為分析與追蹤的 TeamT5 杜浦數位安全是台灣頂尖網路威脅情資研究機構之一，憑藉著豐富網駭情資研究與擁有世界級研發團隊全面致力於端點資安防護解決方案（Endpoint Protection Solutions）的開發、提供高度機器學習能力（Machine Learning）與人工智慧（AI）端點惡意程式鑑識系統 - ThreatSonar 外，也深入從事各類資安事件處理與調查服務，讓國內企業能享有最即時的技術支援與顧問諮詢服務。

蔡松廷表示目前公司的威脅情資分析團隊成員平均擁有十年以上的惡意程式與 APT 研究經歷，再加上語言及文化優勢，所以 TeamT5 杜浦數位安全對亞太地區的 APT 駭客族群有著深入瞭解與研究，尤其針對來自中國的 APT 攻擊，我們掌握更多作案細節與手法且具備事件後續追查的優勢，至於核心技術團隊部分，則精通底層作業系統分析、深度逆向分析與先進安全技術，因為具備專業技術與研究能力，加上積極研發最新的偵測方式，因此 ThreatSonar 威脅狩獵解決方案是具備穩定性、精準偵測攻擊者的威脅功能機制。

資安事件防護除了事前緊密的防禦外，對於即時資安事件發生當下或事後所需要進行迅速應變且適當策略與反應，這塊部署拼圖對於企業也是關注的一塊，有了此策略將可以大幅降低不論是人力、金額或是商譽的損失。蔡松廷表示，以 TeamT5 杜浦數位安全來說也有一個長年經驗豐富的 IR（Incident Response 事件應變）鑑識團隊，長期研究與解析駭客族群入侵行為並且具備處理第一線國內外資安事件的經驗，當資安事件發生時，TeamT5 IR 鑑識團隊可以快速完成企業受駭現場與歷史軌跡的綜整分析，並且發掘出攻擊者的入侵過程與手法，提供事件處理深入的分析及建議，進一步協助企業進行復原與改善。

 

## APT 威脅狩獵方案 ThreatSonar 功能強悍

面對日趨複雜與氾濫的 APT 攻擊，TeamT5 杜浦數位安全推出的 ThreatSonar 威脅狩獵解決方案可提供進階的威脅獵捕方案，協助企業覺察環境中可疑威脅。ThreatSonar 具備入侵威脅評估的功能，結合數位鑑識與行為模型技術，可快速偵測與鎖定異常行為，辨識環境中的入侵威脅，以圖形視覺化方式呈現威脅事件，更有效幫助企業進行資安事件追蹤與關聯。

在威脅事件回應方面，ThreatSonar 具備情資驅動特性與自動調查功能，可主動發現符合駭客族群常用 TTPs 的隱藏威脅，提升資安事件調查效率，至於託管式偵測與回應服務部分，ThreatSonar 可持續觀察端點的風險狀況，並由專家團隊協助進行入侵威脅通報、抑制與回應處理，強化企業的資安事件應變能力。

「大部份資安產品從預防角度出發，但仍抵擋不住攻擊者，企業依然持續遭受入侵威脅。」蔡松廷解釋：「ThreatSonar 以 TeamT5 杜浦數位安全團隊長期研究的威脅情資為核心進行研發，內建超過 100 種惡意行為指標與上千種已知後門特徵，協助企業掌握攻擊者在受駭階段中的入侵軌跡。」

 

## 掌握威脅情資 ThreatVision 不容錯過

TeamT5 杜浦數位安全提供 APT 防禦方案之外，也提供 ThreatVision 雙向平台，ThreatVision 是介面直觀、易操作的強大情資資料庫，協助企業洞悉駭客活動，提升企業威脅防禦能量，讓企業可藉此獲取情資專家針對特殊個案的獨特分析報告。ThreatVision 平台提供沙箱動態分析、關鍵字搜尋、APT 威脅情資庫、自動化 API 等服務，還有專業人員線上諮詢回應威脅情資問題，提供威脅情資與樣本關鍵字搜尋，以滿足企業威脅風險調查需求。

蔡松廷表示，ThreatVision 是我們聚焦亞太地區的全球駭客追蹤調查，長期追蹤各類型產業為目標的 APT 駭客族群的成果，能提供豐富的開源威脅情資分析服務，協助企業降低威脅風險，同時平台可辨認與追蹤超過 100 個攻擊族群與上千個惡意程式家族，因此是企業掌握最新情資的最佳管道。

【CIO Taiwan】TeamT5 杜浦數位安全 雙管齊下助企業抵禦威脅

[This is an expert of the article. Read more at [CNN](https://edition.cnn.com/2021/07/23/tech/taiwan-china-cybersecurity-intl-hnk/index.html)]

In an exclusive interview with CNN last month, Taiwan's Foreign Minister Joseph Wu accused China of using military intimidation, disinformation campaigns and cyberattacks to undermine the Taiwanese population's trust in their own government.

"They want to shape Taiwanese people's cognition that Taiwan is very dangerous, and Taiwan cannot do without China," he said. "[But] Taiwan has some very good capability in dealing with cyberattacks. And that is because of our long experience dealing with the cyber activities initiated by the Chinese side."

Chien, the Taiwanese cybersecurity department leader, said the self-governing island has been subject to tens of millions of attacks monthly, a trend the government has recorded for at least the last few years.

But he said Taiwan has been able to defend against most attempts and serious breaches resulting in stolen data or paralyzed services numbered about 10 over the last year.
Chien declined to go into specific details about those attacks, and was willing only to cite successful hacks of Taiwan's education system, which resulted in student data being stolen.

Even if a cyber intrusion is resolved, such attacks can have long-term consequences because of the kind of information that attackers can gain access to, according to Tsai Sung-ting, CEO of Team T5, a Taiwanese cybersecurity solution provider.

"We frequently observe that after they compromise an organization, the first thing is to steal the emails and documents," he said. "So even after you clean the infection this time, they may come back next month or a few months later. So I will say the threat is persistent."

![CNN interview.jpg](https://legacy-uploads.teamt5.org/CNN_interview_cc255becfc.jpg)

<center>Tsai Sung-ting, CEO of Taiwanese cybersecurity solution provider Team T5 </center>


*Banner courtesy of [Pixabay](https://pixabay.com/photos/china-graffiti-nation-flag-2704112/)

【CNN】How Taiwan is trying to defend against a cyber 'World War III'

中國對台灣的認知作戰，引起國際媒體關注，美國 CNN 記者強調，中國針對台灣的資訊心理戰，才是中國攻擊台灣的主要戰場。

CNN 報導指出，台灣每個月都遭受2千萬次網路攻擊，從國防、金融到基礎設施都可能是攻擊目標。

報導採訪幾位台灣資安專家，TeamT5 執行長蔡松廷（TT）表示，中國對台發動的假新聞與網路資訊戰，才是最大的「威脅」，後果恐怕比核武攻擊還要嚴重。

- 台灣媒體轉載報導(中文): https://youtu.be/siPdTRQgqo4
- CNN報導(英文): https://edition.cnn.com/2021/07/23/tech/taiwan-china-cybersecurity-intl-hnk/index.html


![CNN interview.jpg](https://legacy-uploads.teamt5.org/CNN_interview_cc255becfc.jpg)

<center>TeamT5 執行長蔡松廷（TT）受訪畫面</center>


*首圖來源: [Pixabay](https://pixabay.com/photos/china-graffiti-nation-flag-2704112/)

【CNN 採訪報導】探究中國認知作戰

The North Korean APT group CloudDragon, also known as Kimsuky, continues to target South Korean governments and organizations. TeamT5 has been actively monitoring this threat actor and we recently discovered CloudDragon abusing VPN zero-day vulnerability to launch a new attack against South Korean entities.

## TeamT5's Vulnerability Research Results

TeamT5 recently discovered two malicious samples circulating in South Korea, and both samples are installers of a newly identified backdoor which we named MemzipRAT. With further investigation, we believe this attack was aiming at a South Korean company in the aerospace sector. The company is part of a top 10 conglomerate in South Korea, whose business includes aerospace, chemicals, financial services, IT, etc. 

In fact, CloudDragon has been accused of using VPN vulnerabilities to attack numerous entities recently, including Korean government agencies. According to TeamT5’s threat intelligence, we hold high confidence that the above malware to be follow-up attacks of the disclosed attack campaign conducted by CloudDragon. As the exploitation starts from a popular VPN system, these campaigns might lead to massive attacks and damage in the near future. And TeamT5 will keep taking careful attention to CloudDragon's recent campaign for it might end up a severe supply chain attack.

 

*Image courtesy of [Pixabay](https://pixabay.com/illustrations/north-korea-dprk-korea-juche-asia-1151137/)

Another CloudDragon attack abusing VPN zero-day vulnerability to target South Korean entities

北韓 APT 攻擊族群 CloudDragon（又名為 Kimsuky）持續針對南韓政府與組織發動攻擊。 TeamT5 長期持續關注此駭客族群，發現 CloudDragon 近期利用 VPN 零時差漏洞（zero-day vulnerability）對南韓發動另一波新的攻擊。

## TeamT5 漏洞研究結果

根據 TeamT5 近期研究，我們發現了兩個攻擊南韓的惡意程式樣本，與我們最新發現的後門程式 MemzipRAT 有高度關聯，皆為其安裝程式。我們推測這一波攻擊是針對南韓某航太產業公司而來，該受駭公司為南韓前十大企業之一，業務範圍涵蓋航太、化學、金融、IT 服務等。攻擊者利用一尚未揭露的 VPN 伺服器漏洞，駭進目標環境並部署惡意程式。

最近多起針對韓國的攻擊，包括南韓政府研究單位受駭，也疑似為 CloudDragon 透過 VPN 服務漏洞展開的入侵行動。根據 TeamT5 掌握的相關情資，我們有高度信心認為，這次攻擊使用的新後門程式為 CloudDragon VPN 攻擊的後續利用。我們推測，攻擊者將持續利用此知名 VPN 系統漏洞，發動更大型、損害更嚴重的攻擊，未來也不排除轉變為供應鏈攻擊的可能。

 

*圖片來源：[Pixabay](https://pixabay.com/illustrations/north-korea-dprk-korea-juche-asia-1151137/)

北韓駭客組織再次利用 VPN 零時差漏洞對南韓航太產業發動攻擊

文／羅正漢

關於 REvil 勒索軟體與其背後組織的來歷與特性，資安業者 TeamT5 近期統整多方面曝光資訊，讓國內對於此攻擊族群可以有更深入的瞭解。該組織採 RaaS 模式經營、最多擁有 80 個合作夥伴，且整體族群手法多元。

[點此閱讀完整報導](https://www.ithome.com.tw/news/144900)

【臺灣資安大會直擊】近期臺灣大型企業接連傳出遭 REvil 攻擊，TeamT5 徹底剖析

文／羅正漢

為了增進大眾對於 APT 攻擊族群的認識，長期進行駭客追蹤研究的 TeamT5 杜浦數位安全，藉由藝術博物館（MOMA）作品介紹的形式，讓參觀者能夠感到興趣，並簡單認識這些 APT 族群的特性。

[點此閱讀完整報導](https://www.ithome.com.tw/news/144717?fbclid=IwAR3EmZoOA_HlreIov_84clZasdSfEH7HqPTZldHK39raXBd6pwgkmYsnw4U)

【臺灣資安大會直擊】TeamT5 出奇招，將抽象的 APT 駭客組織化身展覽作品

TeamT5 長期致力於網路威脅研究，特別專精進階持續性滲透攻擊(Advanced Persistent Threat, APT)之研究。

TeamT5 威脅情資分析師 Linda Kuo 與惡意程式研究員 DuckLL Liao 於本年度 HITBSecConf，以「The Phishermen: Dissecting Phishing Techniques of CloudDragon APT」為主題，基於具體案例，說明北韓駭客組織的 CloudDragon 網路攻擊行動。

本次演講簡報與影片現可於官網觀看。

- 演講摘要: [連結](https://conference.hitb.org/hitbsecconf2021ams/sessions/the-phishermen-dissecting-phishing-techniques-of-clouddragon-apt/)
- 演講簡報: [連結](https://conference.hitb.org/hitbsecconf2021ams/materials/)
- 演講影片: [連結](https://youtu.be/Dv2_DK3tRgI)

![HITBSecConf_2021_pic.png](https://legacy-uploads.teamt5.org/HITB_Sec_Conf_2021_pic_348feb6445.png)
<center>攻擊手法</center>

**關於HITBSecConf **

HITBSecConf 全稱為 Hack In The Box Security Conference，旨在討論新世代的電腦安全問題，透過為期兩天的培訓和多軌同步進行的會議，促進思想交流。每年定期於吉隆坡(馬來西亞)與阿姆斯特丹(荷蘭)舉辦，2021會議因新冠肺炎疫情，為線上舉辦。

*首圖來源: [HITBSecConf](https://conference.hitb.org/hitbsecconf2021ams/)

TeamT5 參與亞歐最大資安會議 HITBSecConf，說明北韓駭客組織 APT 攻擊手法

TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. 

Our senior threat intelligence analyst Linda Kuo & senior threat intelligence researcher DuckLL Liao presented their research in HITBSecConf 2021. On the topic of "The Phishermen: Dissecting Phishing Techniques of CloudDragon APT", they prepare real cases and in-depth analysis on CloudDragon APT’s various phishing techniques. Some of the personal data collected in previous stage can be reused as baits, followed by CloudDragon;s proprietary backdoor BabyShark and AppleSeed. Thorough technical analysis on the process and malware will be illustrated clearly in the presentation. Windows is not the only platform the group manipulates. We also observed them spreading to android system and managing to approach their targets via different methods.

More details of the speech can be found on the official website.

- Speech Summary: [Link](https://conference.hitb.org/hitbsecconf2021ams/sessions/the-phishermen-dissecting-phishing-techniques-of-clouddragon-apt/)
- Speech slides: [Link](https://conference.hitb.org/hitbsecconf2021ams/materials/)
- Speech Video: [Link](https://youtu.be/Dv2_DK3tRgI)

![HITBSecConf_2021_pic.png](https://legacy-uploads.teamt5.org/HITB_Sec_Conf_2021_pic_348feb6445.png)
<center>phishing process</center>

**About HITBSecConf**

HITBSecConf or the Hack In The Box Security Conference is an annual event for security researchers and professionals around the world. It aims for gathering the discussion and dissemination of next generation computer security issues during two days of training and multi-track conference.

The event is held annually in Kuala Lumpur, Malaysia and Amsterdam in The Netherlands. Due to COVID-19, 2021 event was held online.

*Image courtesy of [HITBSecConf](https://conference.hitb.org/hitbsecconf2021ams/)

TeamT5 Attends HITBSecConf and Illustrate North Korea Hacker Group’s APTs

一年一度的 CYBERSEC 2021 臺灣資安大會於 5 月 4 日至 6 日在南港展覽二館圓滿落幕，TeamT5 杜浦數位安全（以下簡稱 TeamT5）今年以三大重點參展：「最佳夥伴」、「對抗勒索」、「情資決勝」，在網路攻擊不斷轉型、進化的今日，TeamT5 將成為您最可靠的盟友，共同對抗網路威脅。

![AX1_9828.jpg](https://legacy-uploads.teamt5.org/AX_1_9828_23b4ad3bf5.jpg)
_TeamT5 杜浦數位安全提供對抗勒索攻擊的最佳解方，以及研究量能最豐富的威脅情資，幫助企業對抗網路威脅_

 

## TeamT5 獨家推出對抗勒索攻擊的防護解方

面對近年來國際間頻繁發生的加密勒索資安事件，攻擊手法與目標對象逐漸轉型，使得勒索攻擊成為當前企業最擔憂的網路威脅。TeamT5 長年研究、追蹤進階持續性攻擊（Advanced Persistent Threat, APT），在本次資安大會上，我們獨家公開全新升級的 ThreatSonar 威脅補網，提出對抗勒索攻擊的防護解方。

![AX0_6835.jpg](https://legacy-uploads.teamt5.org/AX_0_6835_790f9537f0.jpg)
_TeamT5 首席架構師 Nanika 向大家介紹 ThreatSonar 全面升級的勒索防堵策略_

 

## TeamT5 提出「勒索全面防堵」策略

TeamT5 提出「勒索全面防堵」策略，我們的 ThreatSonar 威脅狩獵解決方案，能夠有效偵測 APT 針對型攻擊，與既有資安解決方案互補而非取代，成為企業在資安攻防的強力守護神。以事件處理的角度來看，勒索軟體與 APT 攻擊事件幾近相同，唯一不同之處在於攻擊者會藉此勒索受害者、獲取贖金，唯有全面性解決，才能讓人員更有效進行處理，在防堵的同時擬定執行策略。

![P_20210506_133205.jpg](https://legacy-uploads.teamt5.org/P_20210506_133205_1805110f15.jpg)
_TeamT5 技術長暨首席分析師 Charles 與 IR 專家 Zha0，介紹利用威脅情資掌握攻擊者動向的重要性，以達到超前部署的防護_

 
## TeamT5 台灣資安大會參展亮點

此外，今年最受矚目的參展亮點還有「TeamT5 MoMA 攻擊族群博物館」，以及 TeamT5 獨家打造的「1337 Operation」搜索實境遊戲。蔡英文總統與各部會長官也親臨攤位參觀，由 TeamT5 執行長蔡松廷（ TT）帶領導覽，介紹我們如何以更貼近、淺顯易懂的方式，將神秘的駭客攻擊族群具象化為藝術品。更特別的是，我們將攻擊族群博物館連結搜索實境遊戲關卡，以逼真的勒索軟體事件調查遊戲情境，讓玩家實際體驗企業受害與追查駭客的過程。

![經濟部工業局提供.jpg](https://legacy-uploads.teamt5.org/_e8ae0b779f.jpg)
_執行長蔡松廷向蔡英文總統與各部會長官們導覽「TeamT5 MoMA 攻擊族群博物館」，介紹我們如何透過將抽象的攻擊族群具象化為藝術品的方式，讓大家更深入了解 APT 族群的特性。（圖片來源：[經濟部工業局](https://www.facebook.com/moeaidb/photos/pcb.1996144607216335/1996143887216407)授權使用）_

![IMG_0462.JPG](https://legacy-uploads.teamt5.org/IMG_0462_fb0cf9e235.jpg)
_TeamT5 獨家設計的搜索實境遊戲，只要一支手機，玩家就可以化身探員，實際體驗追查駭客的過程_

 

## TeamT5 台灣資安大會展攤與活動獲得好評
為期三天的展會中，TeamT5 透過大會多場精彩議程、CyberLAB 技術課程，以及我們精心策劃的攤位主題限定講座，帶給所有前來參展的來賓充實的技術分享與交流。兩場 TeamT5 專家座談「資安海外拓展交流」和「難纏的勒索軟體與對抗經驗」，也邀請多位資安專家與研究人員到場分享相關經驗與知識，獲得許多與會來賓的正向回饋。

![IMG_0336.JPG](https://legacy-uploads.teamt5.org/IMG_0336_5c72d3f9f7.jpg)
![AX0_7203.jpg](https://legacy-uploads.teamt5.org/AX_0_7203_f8a4840a25.jpg)
_TeamT5 獨家邀請到多位資安專家，在兩場攤位限定專家座談中，和大家分享資安海外拓展以及勒索軟體的對抗經驗，吸引許多參展來賓參與討論交流_