Japan Security Analyst Conference 2023 (JSAC2023) held on Jan. 25-26 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis. This year, TeamT5 had two sessions during the event. 

One is TeamT5’s CTI Researcher Still Hsu gave a talk on “Brief History of MustangPanda and its PlugX Evolution”. He points out that Polaris/MustangPanda is continuing to evolve their TTPs. Frequent attacks are observed. Also, multiple campaigns focusing on a wide variety of targets.

The other session is presented by TeamT5’s research engineers Peter Syu and Jr-Wei Huang on the topic “Track Down Stealth Fileless Injection-based Nginx Backdoor in the Attack ”. The presentation focuses on Nginx, a widely used Web Server in the industry. During an incident response, they found a Nginx-based backdoor stored in the server, which used a previously unseen attack vector: Injection, to achieve the fileless effect, and we called the backdoor - NginxStealth and NginxSpy.

They introduced how the attacker gained initial access to the Nginx server, and how the malicious payload works. Furthermore, they explain how the backdoor NginxStealth and NginxSpy are skillfully hidden in the system in detail, and compare the techniques used by NginxStealth with the existing Nginx-based backdoors.

Finally, they developed a Nginx module based on the hook method of the NginxStealth. This module can list the addresses of the hook. If the address does not exist in the normal Nginx memory space or the module memory space, there is a high possibility that the Nginx process is injected with NginxStealth.

The slides of the speech can be downloaded on the official website. 

 

📌Brief History of MustangPanda and its PlugX Evolution

- Speaker: Still Hsu
- Slides (English Version): [Link](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_LT4.pdf)

 

📌Track Down Stealth Fileless Injection-based Nginx Backdoor in the Attack

- Speaker: Peter Syu, Jr-Wei Huang
- Slides (English Version): [Link](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_4_peter-jr-wei_en.pdf)


 

##About JSAC
Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC website](https://jsac.jpcert.or.jp/index.html).

 

*Image courtesy of [JSAC](https://jsac.jpcert.or.jp/index.html)

Japan Security Analyst Conference 2023

日本資安分析研討會 Japan Security Analyst Conference 2023 (JSAC2023) 於1月25-26日，採取實體與線上混和的方式舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件回應與分析的技術、知識。

本年度活動中，TeamT5 專業團隊成員共有2場演講，1場由威脅情資研究員 Still Hsu 分享駭客族群 MustangPanda 與其使用的惡意軟體 PlugX 之演進史。另1場則由研發工程師Peter Syu 和 Jr-Wei Huang ，針對 Nginx 後門程式進行深度剖析。

演講簡報現可於研討會官網下載。

 

📌 Brief History of MustangPanda and its PlugX Evolution

- 講者: Still Hsu
- 下載連結: [請點此](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_LT4.pdf)

 

📌Track Down Stealth Fileless Injection-based Nginx Backdoor in the Attack 

- 講者: Peter Syu, Jr-Wei Huang
- 下載連結: [請點此](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_4_peter-jr-wei_en.pdf)

 

##關於JSAC
日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。

更多資訊請見 [JSAC 官網](https://jsac.jpcert.or.jp/en/index.html)

 
*首圖來源: [JSAC](https://jsac.jpcert.or.jp/en/index.html)

日本資安分析師研討會 JSAC2023

Japan Security Analyst Conference 2022 (JSAC2022) held on Jan. 27-28 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis.

TeamT5's cybersecurity researcher Leon works with Japan analysts Yusuke Niwa(from ITOCHU Corporation) & Suguru Ishimaru(from Kaspersky Lab) on cyberattack analysis. They presented a joint speech on the topic of "LuoYu: Continuous Espionage Activities Targeting Japan with the new version of WinDealer in 2021". 

In the presentation, they shared case studies with examples of incidents related to Japan and provided an update of the LuoYu group, a deep analysis of WinDealer. Also they told Japanese companies that they need to be aware of these kinds of threats and take countermeasures against this campaign.

The slides of the speech can be downloaded on the official website. 

- English Version [Link](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf?utm_source=website&utm_medium=website)
- Japanese Version [Link](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_jp.pdf?utm_source=website&utm_medium=website) 

![JSAC2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644385623/JSAC_2022_pic_7ff0496220.png)
<center>The LuoYu Threat Group Overview</center>

## About JSAC2022

Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC2022 event website](https://jsac.jpcert.or.jp/en/index.html).


*Image courtesy of [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

Japan Security Analyst Conference 2022

日本資安分析研討會 Japan Security Analyst Conference 2022 (JSAC2022) 於1月27-28日，採取實體與線上混和的方式舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件回應與分析的技術、知識。

TeamT5 研究員 Leon 與日本研究員 Yusuke Niwa (ITOCHU Corporation)、Suguru Ishimaru ( Kaspersky Lab)，於本次活動共同分析 LuoYu 在2021的網路攻擊行動，其使用新版的WinDealer 惡意軟體，鎖定日本公司設於中國的辦公室。

演講簡報現可於研討會官網下載，下載連結[請點此](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf?utm_source=website&utm_medium=website) 

![JSAC2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644385623/JSAC_2022_pic_7ff0496220.png)
<center>攻擊族群 LouYu 概觀 </center>


## 關於JSAC 2022

日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。

更多資訊請見 [JSAC2022 官網](https://jsac.jpcert.or.jp/en/index.html)


*首圖來源: [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

日本資安分析師研討會 JSAC2022

Japan Security Analyst Conference（JSAC）2022が、1月27日から28日にオンサイトおよびオンラインの混合方式で開催されました。JPCERT/CC（一般社団法人JPCERTコーディネーションセンター）が主催する毎年恒例のイベントで、情報セキュリティアナリストに交流の機会を提供し、情報セキュリティインシデントへの対応、分析技術、知識などの共有が行われます。

今回のイベントで、TeamT5の研究員であるLeonは日本の研究員であるYusuke Niwa（ITOCHU Corporation）およびSuguru Ishimaru（Kaspersky Lab）と共同でLuoYuによる2021年のサイバー攻撃を分析しました。使用された新しいマルウェア「WinDealer」は、中国にある日本企業のオフィスをターゲットにしていました。

プレゼンテーションの内容がカンファレンスの公式ウェブサイトからダウンロードできるようになりました。ダウンロードはこちらをクリックしてください: [https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf)

![JSAC2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644385623/JSAC_2022_pic_7ff0496220.png)
<center>攻撃グループLouYuの概要</center>


## JSAC 2022について

JPCERT/CC（一般社団法人JPCERTコーディネーションセンター）は、サイバー攻撃によるインシデントは毎日発生しており、攻撃者の技術も変化し続けているとしています。絶え間なく変化するサイバー攻撃の技術や手法を分析して対応するため、エンジニアはスキルアップしなければなりません。しかし、日本ではエンジニア同士でインシデントの分析技術や知識を共有することがあまり行われません。情報セキュリティアナリストが一堂に会し、インシデントの対応方法に関する技術や専門性を共有することで、サイバー攻撃に対抗する個人および全体の力を強化できます。

Japan Security Analyst Conference（JSAC）は、この目標の達成を目指し、JPCERT/CCが一年に一度主催するサイバーセキュリティインシデントの分析および対応技術に関するカンファレンスです。今回のカンファレンスでは、現在および今後も変化し続けるサイバー攻撃に対応するため、日々セキュリティインシデントに対応しているエンジニアによる情報共有が促進されました。

詳細はJSAC2022の公式ウェブサイトをご参照ください:
[https://jsac.jpcert.or.jp/en/index.html](https://jsac.jpcert.or.jp/en/index.html)


*画像のソース: [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

Japan Security Analyst Conference（JSAC）2022

Events

##Introduction
Over the last few years, Network Attached Storage (NAS) has seen a dramatic increase in popularity, especially during the pandemic. It is now commonplace to see a NAS box in the office of most small or medium businesses. 
 
With the rise of these NAS servers, we have begun to see a huge increase in the number of DDNS domains associated with popular NAS providers such as Synology and QNAP. 
 
In fact, during our research, we were able to estimate that there were at least three million active NAS units from Synology available on the world wide web. QNAP, by contrast, had a much lower market share of only ten thousand. 


##More NAS Servers = More Attacks
Unsurprisingly, this increase in NAS servers has seen a corresponding increase in cyberattacks. Perhaps the most famous to date was the [Synolocke](www.synology.com/en-global/security/advisory/SynoLocker)r ransomware attack of 2014. 

And, in the last 12 months, we can see that QNAP has published at least 37 advisories marked with a severity level between Medium to Critical. Specifically, these mentioned several ransomware campaigns involving: -
 
[DeadBolt](https://www.qnap.com/en/security-advisory/qsa-22-24), [eCh0raix](https://www.qnap.com/go/security-advisory/qsa-21-18), [Checkmate](https://www.qnap.com/go/security-advisory/qsa-22-21). 
 
In addition, other types of malware or PUPs such as crypto miners and/or botnets were spotted on these systems.


 
![202210_CTI_blog_pic1.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic1.png)
 

Meanwhile, in the same timeframe, Synology had published around 18 advisories marked between Moderate to Critical. 

And, whilst it is clear that Synology NAS devices suffered from fewer security incidents than QNAP, they were still unfortunately targeted by ransomware gangs that abused the critical [Netatalk-related vulnerability](https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/).

 
![202210_CTI_blog_pic2.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic2.png)
 

##Xpenology AND QuickConnect
Unfortunately, Synology also had another issue to worry about - Xpenology, also known as 黑群暉 in the Taiwanese community. In a nutshell, this custom bootloader allows non-standard hardware to boot into Synology's Linux-based DSM (Disk Station Manager) system.

On top of Xpenology, Synology also had to worry about the emerging threat of QuickConnect abuse. 

QuickConnect allows the NAS to be opened to WAN without any additional port forwarding setup, and the NAS is assigned a custom subdomain under ```synology.me``` or other QuickConnect-related domains during this process. 

Normally, QuickConnect requires a matching combination between the NIC MAC address and the serial number in order to function. However, the community at large had figured out a way to generate the relevant credentials required to bypass this check a few years back, though most of them are likely patched by now.

 
![202210_CTI_blog_pic3.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic3.png)
 

##Suspicious Activity in NAS Servers
Why specifically does this matter, though? During our investigations against cases that were related to various Chinese adversaries, we found that some of the IP addresses related to the incidents were directly related to various Synology QuickConnect-related subdomains. 

For example, at some point in our investigation, we stumbled across the IP ```42.3.63[.]80```. This IP address was resolved to ```johndans[.]diskstation.me``` and ```ediskwang[.]synology.me``` shortly prior to the security incident. Both these subdomains had extremely suspicious DNS records, jumping in rapid succession between various IP addresses from China and Hong Kong. 

By following the relevant IP addresses, we realized some of the IP addresses resolved were previously discovered in other cases that were directly linked to various Chinese adversaries, such as Amoeba (APT41) and SLIME40 (FamousSparrow). Based on our internal research, we came to the conclusion that these subdomains were likely normal NAS servers taken hostage by the APTs.

 
![202210_CTI_blog_pic4_watermark.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic4_watermark.png)
 

The discovery we made above led us to speculate on other possibilities. What if a threat actor were to host their own Synology proxy stations using both of the attack vectors mentioned above? 

To validate our suspicion, we gathered around ~10,000 ```synology.me``` and ~5,000 ```myqnapcloud.com``` subdomains as our dataset and filtered them based on the following conditions,
- Is the NAS hosted on a known VPS ASN?
- Is the NAS subdomain seen traveling across various different country?
- Are multiple NAS subdomains resolving to the same IP addresses?

 
![202210_CTI_blog_pic5_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic5_watermark.jpg)
 

From the queries, we noticed there were indeed several suspicious-looking NAS DDNS subdomains. For instance, in the following example, the NAS was seen traveling between EU and the East Asian region for several years with the resolve record for each being as short as two days. The device was hosted between various cloud providers, such as xTom, Microsoft Azure, and DMIT Cloud.

 
![202210_CTI_blog_pic6_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic6_watermark.jpg)
 

In another instance, we noticed one of the NAS devices was traveling between Hong Kong, Singapore, Taiwan, and China at various IP addresses owned by cloud hosting providers such as Linode, AWS, Cloudflare, Microsoft Azure, and more. 

While we cannot conclusively attribute any of these NAS instances as necessarily “malicious” - as these instances could have simply be behind a network-wide VPN in some home solutions - we could at the very least mark them as relatively suspicious compared to the standard use cases of NAS DDNS.

 
![202210_CTI_blog_pic7_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic7_watermark.jpg)
 

##The Threat Landscape is Evolving. Makes sure you keep up.
To sum up this research, we have looked at the traditional threat landscape that is present in the NAS industry (e.g., ransomware, cryptominers, PUPs, etc.) and how it may evolve into another type of threat with the use of convenient features such as QuickConnect. 

One thing is clear.The threat landscape of NAS devices may still evolve over time. As such, we encourage our readers and our customers to regularly update their device firmware and to check if there are any irregularities with their home devices.

 
 

>本篇部落格首度發表於 HITCON PEACE 2022。
>本篇部落格為我們於 HITCON PEACE 2022 [「Your NAS is not my BOT」](https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/) 演講的精華摘要。
 - 觀賞完整演講影片(中文): [連結](https://youtu.be/joxEpQZDQhY)
 - 下載演講簡報(英文): [連結](https://hitcon.org/2022/slides/Your%20NAS%20is%20not%20my%20BOT.pdf)

 
 

*首圖來源: [Pexels](https://www.pexels.com/)

Protect Your NAS From Nasty Attacks (Your NAS is not my BOT)

##Introduction
Over the last few years, Network Attached Storage (NAS) has seen a dramatic increase in popularity, especially during the pandemic. It is now commonplace to see a NAS box in the office of most small or medium businesses. 
 
With the rise of these NAS servers, we have begun to see a huge increase in the number of DDNS domains associated with popular NAS providers such as Synology and QNAP. 
 
In fact, during our research, we were able to estimate that there were at least three million active NAS units from Synology available on the world wide web. QNAP, by contrast, had a much lower market share of only ten thousand. 


##More NAS Servers = More Attacks
Unsurprisingly, this increase in NAS servers has seen a corresponding increase in cyberattacks. Perhaps the most famous to date was the [Synolocker](www.synology.com/en-global/security/advisory/SynoLocker) ransomware attack of 2014. 

And, in the last 12 months, we can see that QNAP has published at least 37 advisories marked with a severity level between Medium to Critical. Specifically, these mentioned several ransomware campaigns involving: -
 
[DeadBolt](https://www.qnap.com/en/security-advisory/qsa-22-24), 
[eCh0raix](https://www.qnap.com/go/security-advisory/qsa-21-18), 
[Checkmate](https://www.qnap.com/go/security-advisory/qsa-22-21). 
 
In addition, other types of malware or PUPs such as crypto miners and/or botnets were spotted on these systems.


 
![202210_CTI_blog_pic1.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic1.png)
 

Meanwhile, in the same timeframe, Synology had published around 18 advisories marked between Moderate to Critical. 

And, whilst it is clear that Synology NAS devices suffered from fewer security incidents than QNAP, they were still unfortunately targeted by ransomware gangs that abused the critical [Netatalk-related vulnerability](https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/).

 
![202210_CTI_blog_pic2.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic2.png)
 

##Xpenology AND QuickConnect
Unfortunately, Synology also had another issue to worry about - Xpenology, also known as 黑群暉 in the Taiwanese community. In a nutshell, this custom bootloader allows non-standard hardware to boot into Synology's Linux-based DSM (Disk Station Manager) system.

On top of Xpenology, Synology also had to worry about the emerging threat of QuickConnect abuse. 

QuickConnect allows the NAS to be opened to WAN without any additional port forwarding setup, and the NAS is assigned a custom subdomain under ```synology.me``` or other QuickConnect-related domains during this process. 

Normally, QuickConnect requires a matching combination between the NIC MAC address and the serial number in order to function. However, the community at large had figured out a way to generate the relevant credentials required to bypass this check a few years back, though most of them are likely patched by now.

 
![202210_CTI_blog_pic3.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic3.png)
 

##Suspicious Activity in NAS Servers
Why specifically does this matter, though? During our investigations against cases that were related to various Chinese adversaries, we found that some of the IP addresses related to the incidents were directly related to various Synology QuickConnect-related subdomains. 

For example, at some point in our investigation, we stumbled across the IP ```42.3.63[.]80```. This IP address was resolved to ```johndans[.]diskstation.me``` and ```ediskwang[.]synology.me``` shortly prior to the security incident. Both these subdomains had extremely suspicious DNS records, jumping in rapid succession between various IP addresses from China and Hong Kong. 

By following the relevant IP addresses, we realized some of the IP addresses resolved were previously discovered in other cases that were directly linked to various Chinese adversaries, such as Amoeba (APT41) and SLIME40 (FamousSparrow). Based on our internal research, we came to the conclusion that these subdomains were likely normal NAS servers taken hostage by the APTs.

 
![202210_CTI_blog_pic4_watermark.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic4_watermark.png)
 

The discovery we made above led us to speculate on other possibilities. What if a threat actor were to host their own Synology proxy stations using both of the attack vectors mentioned above? 

To validate our suspicion, we gathered around ~10,000 ```synology.me``` and ~5,000 ```myqnapcloud.com``` subdomains as our dataset and filtered them based on the following conditions,
- Is the NAS hosted on a known VPS ASN?
- Is the NAS subdomain seen traveling across various different country?
- Are multiple NAS subdomains resolving to the same IP addresses?

 
![202210_CTI_blog_pic5_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic5_watermark.jpg)
 

From the queries, we noticed there were indeed several suspicious-looking NAS DDNS subdomains. For instance, in the following example, the NAS was seen traveling between EU and the East Asian region for several years with the resolve record for each being as short as two days. The device was hosted between various cloud providers, such as xTom, Microsoft Azure, and DMIT Cloud.

 
![202210_CTI_blog_pic6_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic6_watermark.jpg)
 

In another instance, we noticed one of the NAS devices was traveling between Hong Kong, Singapore, Taiwan, and China at various IP addresses owned by cloud hosting providers such as Linode, AWS, Cloudflare, Microsoft Azure, and more. 

While we cannot conclusively attribute any of these NAS instances as necessarily “malicious” - as these instances could have simply be behind a network-wide VPN in some home solutions - we could at the very least mark them as relatively suspicious compared to the standard use cases of NAS DDNS.

 
![202210_CTI_blog_pic7_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic7_watermark.jpg)
 

##The Threat Landscape is Evolving. Makes sure you keep up.
To sum up this research, we have looked at the traditional threat landscape that is present in the NAS industry (e.g., ransomware, cryptominers, PUPs, etc.) and how it may evolve into another type of threat with the use of convenient features such as QuickConnect. 

One thing is clear.The threat landscape of NAS devices may still evolve over time. As such, we encourage our readers and our customers to regularly update their device firmware and to check if there are any irregularities with their home devices.

 
 

>The research is first published in HITCON PEACE 2022.
>This blog is the key abstract of our speech in HITCON PEACE 2022, ["Your NAS is not my BOT"](https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/).
 - To watch the whole speech(in Mandarin): [link](https://youtu.be/joxEpQZDQhY)
 - To download the slide(in English): [link](https://hitcon.org/2022/slides/Your%20NAS%20is%20not%20my%20BOT.pdf)

 
 

*Image courtesy of [Pexels](https://www.pexels.com/)

##はじめに
過去数年間にわたり、ネットワークアタッチドストレージ（NAS）は、特にパンデミックの最中、急激に普及しました。今や、ほとんどの中小企業のオフィスで、NASボックスが見られるようになっています。 
 
NASサーバーが普及しつつあり、SynologyやQNAPなど、大手NASプロバイダーに関係するDDNSドメインの数が急激に伸びています。 
 
実際、今回の調査の結果、ワールドワイドウェブでは少なくとも300万台のSynology製NASユニットが稼働していると、当社は推定しています。一方、QNAPはわずか1万台と、極めて低い市場シェアに留まっています。


##NASサーバーの増加 = 攻撃の増加
当然のごとく、NASサーバーが増えるにつれ、サイバー攻撃も増加しています。これまでで最も有名な攻撃例は、2014年に起こった[Synolocker](www.synology.com/en-global/security/advisory/SynoLocker)ランサムウェア攻撃でしょう。 

また、過去12か月にわたり、QNAPは中程度から緊急までの深刻度レベルにマーキングされた警報を少なくとも37件、発しています。特に、以下の数種類のランサムウェア活動が報告されています。-
 
[DeadBolt](https://www.qnap.com/en/security-advisory/qsa-22-24)、
[eCh0raix](https://www.qnap.com/go/security-advisory/qsa-21-18)、
[Checkmate](https://www.qnap.com/go/security-advisory/qsa-22-21)。
 
加えて、仮想通貨のマイナーおよび/またはボットネットなど、他の種類のマルウェアやPUPも、これらシステムで報告されています。


 
![202210_CTI_blog_pic1.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic1.png)
 

Meanwhile, in the same timeframe, Synology had published around 18 advisories marked between Moderate to Critical. 

一方、同時期にSynologyは中程度から緊急までの深刻度レベルにマーキングされた警報を約18件、発しています。 
 
SynologyのNASデバイスはQNAPほどのセキュリティ侵害を受けていないことは明白ですが、それでも、重要な[Netatalk関連の脆弱性](https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/)を突いたランサムウェア集団の標的にされることは未だ免れていません。


 
![202210_CTI_blog_pic2.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic2.png)
 

##XpenologyとQuickConnect
残念なことに、Synologyはもう一つの問題を抱えていました。台湾のコミュニティでは黑群暉と呼ばれる、Xpenologyです。かいつまんで言えば、このカスタムブートローダーは規格外のハードウェアを使用して、SynologyのLinuxベースDSM（ディスクステーションマネージャー）システム内で起動できます。 
 
Xpenologyだけでなく、Synologyは新たなQuickConnect搾取にも対処しなければなりませんでした。 
 
QuickConnectはポートフォワーディング設定を追加せずにNASをWANへ開放します。この間に、NASは```synology.me```またはその他のQuickConnect関連のドメインへ割り当てられます。 
 
通常、QuickConnectが機能するにはNICのMACアドレスとシリアル番号の組み合わせが一致しなければなりません。しかし、コミュニティではこの検査をバイパスするために必要な認証の生成方法を数年前に見つけています。幸い、今ではそのほとんどにパッチが当てられたと考えられています。 



 
![202210_CTI_blog_pic3.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic3.png)
 

##NASサーバーでの疑わしい挙動
なぜ、これが特に問題になるのでしょう？中国発の様々な攻撃に関連した事例を調査した際、当社は攻撃に用いられるIPアドレスの一部は、Synology QuickConnect関連の様々なサブドメインと直接関係があることを発見しました。 
 
例えば、調査の過程で、当社はIPアドレス```42.3.63[.]80```を発見しています。このIPは、セキュリティ侵害が起こる直前に、```johndans[.]diskstation.me```と```ediskwang[.]synology.me```へ解決されています。どちらのサブドメインにも非常に疑わしいDNS記録があり、中国と香港における様々なIPアドレス間を素早く飛び交っています。 
 
関連のIPアドレスを追跡することで、解決されたIPアドレスの一部は、様々な中国発の攻撃に直接関わっていたことが判明した他の事例（Amoeba （APT41）やSLIME40（FamousSparrow）など）でも見つかっていたことを当社は突き止めました。社内調査に基づき、当社はこれらサブドメインがAPTによって人質に取られた通常のNASサーバーの可能性が高いと結論付けました。


 
![202210_CTI_blog_pic4_watermark.png](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic4_watermark.png)
 

この結論を元に、他の可能性についても検討しました。攻撃者が前述の攻撃方法の両方を用いて、自身でSynologyのプロキシステーションをホストした場合はどうなるのか？ 
 
この疑念を確かめるため、当社は約1万の```synology.me```サブドメインと約5千の```myqnapcloud.com```サブドメインをデータセットとして収集し、以下の条件に基づいてフィルタリングしました。
 
- NASは既知のVPS ASNでホストされているのか？
- NASサブドメインは様々な国にまたがって移動しているのか？
- 複数のNASサブドメインが同じIPアドレスを解決しているのか？

 
![202210_CTI_blog_pic5_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic5_watermark.jpg)
 

こうした問いを通じて、疑わしいNAS DDNSサブドメインが実際に数種類見つかっています。例えば、以下の例では、NASは欧州連合と東アジア地域の間を数年間にわたって移動しており、各地域での解決記録は最短で2日間でした。デバイスはxTom、Microsoft Azure、DMIT Cloudなど、様々なクラウドプロバイダーの間でホスティングされていました。

 
![202210_CTI_blog_pic6_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic6_watermark.jpg)
 

別の事例では、当社はNASデバイスの1台がLinode、AWS、Cloudflare、Microsoft Azureなどのクラウドホストプロバイダーが所有する様々なIPアドレスを利用し、香港、シンガポール、台湾、中国の間を移動していたことを突き止めています。 
 
これらは一部の家庭用ソリューションでネットワーク全体にかかるVPNの背後に存在していただけの可能性もあるため、こうしたNAS事例は必ずしも「悪意がある」と結論付けることはできませんが、NAS DDNSの標準的な利用方法と比べて、比較的疑いが高いとマーキングすることは可能です。


 
![202210_CTI_blog_pic7_watermark.jpg](https://uploads.teamt5.org/upload/original/202210_CTI_blog_pic7_watermark.jpg)
 

##脅威は今も拡大しています。遅れをとらないようにしてください。
本調査をまとめると、当社はNAS業界に存在する従来の脅威の種類（ランサムウェア、仮想通貨のマイナー、PUPなど）を調べ、QuickConnectなどの便利な機能を使用した別の種類の脅威へ発展する可能性を確認しました。 
 
1つ、確実に言えることがあります。NASデバイスに対する脅威の種類は広がり続けています。このため、読者や顧客の皆様には、デバイスのファームウェアを定期的にアップデートし、家庭内のデバイスに異常がないか、確認することを強く推奨いたします。


 
 

>本調査はHITCON PEACE 2022に初掲載されました。今回のブログ記事は、HITCON PEACE 2022での当社のスピーチ、[私のNASは他人のボットではない]（[https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/）を要約したものです。
- スピーチ全体（中国語）はこちらからご覧ください：[リンク](https://hitcon.org/2022/agenda/f50a60f5-057f-4df3-84d9-23e7d022ec40/)
- スライド（英語）はこちらからダウンロードください:[リンク](https://hitcon.org/2022/slides/Your%20NAS%20is%20not%20my%20BOT.pdf)


 
 

*画像のソース: [Pexels](https://www.pexels.com/)

NASを執拗な攻撃から保護（私のNASは他人のボットではない）

Technical Analysis

【日本セキュリティアナリストカンファレンス JSAC2024】
TeamT5が中国APTグループTeleBoyiを徹底分析


日本セキュリティアナリストカンファレンス2024 (JSAC2024)が1月25日～26日に開催されます。JPCERT/CCが主催する当イベントは、セキュリティアナリストが一堂に会し、インシデント対応や分析に関する技術的知識の共有を目的としています。

今回は、TeamT5脅威インテリジェンスチームの研究員であるYi-Chin Chuang氏とYu-Tung Chang氏が、「Unveiling TeleBoyi: Chinese APT Group Targeting Critical Infrastructure Worldwide ''」というタイトルで、中国APTグループTeleBoyiによる世界のインフラを標的にした攻撃や手口についての分析を発表します。

是非ご参加ください。

 
![jp_pic_japan-security-analyst-conference-2024.jpg](https://uploads.teamt5.org/upload/original/jp_pic_japan-security-analyst-conference-2024.jpg)
 

### JSAC2024について
- 日時：2024年1月25日〜1月26日
- 会場：日本 東京 御茶ノ水ソラシティカンファレンスセンター
- 公式ウェブサイト：https://jsac.jpcert.or.jp/en/index.html


サイバー攻撃は日常的に発生しており、攻撃者の手口は常に変化しています。 それらのインシデントを分析・対応するエンジニアは、日々変化するサイバー攻撃の手法に対応できるよう、スキルを向上させる必要があります。 しかし、日本ではインシデント分析・対応の技術や知識をエンジニア同士で共有する機会が少ないです。だからこそ、 セキュリティアナリストが一堂に会し、インシデント対応に関する技術的なノウハウを共有することで、サイバー攻撃に対する個人および全体の能力を強化することが望まれます。

そのため、一般社団法人JPCERTコーディネーションセンター（JPCERT/CC）では、サイバーセキュリティのイベント分析・対応技術の交流の場として、JSAC（Japan Security Analyst Conference）を毎年開催しています。 当カンファレンスでは、日々セキュリティインシデントに対応しているセキュリティアナリストたちが、進化し続けるサイバー攻撃の現状と将来について情報交換を行います。


 
*画像提供：JSAC

【日本セキュリティアナリストカンファレンス JSAC2024】 TeamT5が中国APTグループ TeleBoyi を徹底分析

This year, Japan Security Analyst Conference 2024(JSAC2024) will be held on Jan. 25-26 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis. 

TeamT5 will have one session during the event. Our CTI Researcher Yi-Chin Chuang and Yu-Tung Chang gave a speech on “Unveiling TeleBoyi: Chinese APT Group Targeting Critical Infrastructure Worldwide ''.

The speech introduces TeleBoyi, a Chinese-nexus APT that has not been disclosed previously. Based on our research findings, TeleBoyi shows a strong preference for targeting critical infrastructure, with a particular focus on the telecommunication sectors. The group has been active since at least 2014 and is currently still active. Their scope of targeting extends across numerous countries worldwide, including APAC, Americas, and Europe. 

The presentation also covers TeleBoyi’s Tactic Techniques and Procedures (TTPs) including their new weapons such as DoubleShell, TripleZero, and FakeWorker. Moreover, the presentation discusses overlapping TTPs with other notorious APT groups including Amoeba (APT41), DirtyFuxi (Earth Berberoka), and FamousSparrow. As the activities by TeleBoyi have not yet been documented, we believe the techniques and tactics disclosed in this presentation can help blue teams prevent, detect, and respond to Teleboyi's attacks more efficiently and effectively.

 
![en_pic_japan-security-analyst-conference-2024.jpg](https://uploads.teamt5.org/upload/original/en_pic_japan-security-analyst-conference-2024.jpg)
 

### About JSAC 2024
- Time: Jan. 25-26, 2024
- Venue: Ochanomizu Sora City Conference Center, Tokyo, Japan
- Website: https://jsac.jpcert.or.jp/en/index.html


Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.


 
*Image courtesy of JSAC

【Japan Security Analyst Conference】TeamT5 Will Give Speech on the Chinese APT Group - TeleBoyi

日本資安分析研討會 Japan Security Analyst Conference 2024 (JSAC2024) 將於1月25-26日舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件應變與分析的技術、知識。

本年度活動中，TeamT5 威脅情資團隊成員 Yi-Chin Chuang (威脅情資研究員) 與 Yu-Tung Chang (威脅情資研究員)共同發表一場演講，針對中國威脅族群 TeleBoyi 進行深度分析，探討其鎖定全球基礎設施的攻擊與手法。

歡迎蒞臨、聆聽本次演講。

 
![en_pic_japan-security-analyst-conference-2024.jpg](https://uploads.teamt5.org/upload/original/en_pic_japan-security-analyst-conference-2024.jpg)
 


### 關於JSAC 2024
- 時間: 2024/1/25-1/26
- 地點: 日本東京 Ochanomizu Sora City Conference Center
- 官網: https://jsac.jpcert.or.jp/en/index.html


日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。



 
*首圖來源: JSAC

日本資安分析師研討會 JSAC2023

關於JSAC

Related Post

日本資安分析師研討會 JSAC2022

Protect Your NAS From Nasty Attacks (Your NAS is not my BOT)

【日本資安分析師研討會 JSAC2024】TeamT5 將發表中國威脅族群 TeleBoyi 深度分析