An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader | Google Cloud Blog
北æœé®®ã®ãƒãƒƒã‚«ãƒ¼ã‚°ãƒ«ãƒ¼ãƒ—ãŒChromeã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã€ŒCVE-2022-0609ã€ã‚’悪用ã—ã¦ã„ãŸã¨åˆ¤æ˜Ž
北æœé®®æ”¿åºœã®æ”¯æ´ã‚’å—ã‘ãŸãƒãƒƒã‚«ãƒ¼ãŒã€Chromeã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±(ãœã„ã˜ã‚ƒã)性「CVE-2022-0609ã€ã‚’悪用ã—ã¦ã€ã‚¢ãƒ¡ãƒªã‚«ã‚’æ‹ ç‚¹ã¨ã™ã‚‹ãƒ‹ãƒ¥ãƒ¼ã‚¹ãƒ¡ãƒ‡ã‚£ã‚¢ã‚„ITã€ä»®æƒ³é€šè²¨ã€é‡‘èžã‚µãƒ¼ãƒ“スãªã©å¹…広ã„æ¥ç•Œã§åƒã数百人ã®ã‚³ãƒ³ãƒ”ューターã«ãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚’感染ã•ã›ã‚ˆã†ã¨ã—ãŸã¨ã€GoogleãŒæœ¨æ›œæ—¥ã«ç™ºè¡¨ã—ã¾ã—ãŸã€‚ Countering threats from North Korea https://blog.google/threat-analysis-group/countering-threats-north-korea/ North Korean hackers unleashed Chrome 0-day exploit on hundreds of US targets | Ars Technica https://arstechnica.com/information-technology
Countering threats from North Korea
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus. We observed the campaigns targeting U.S. based organizations spanning news media, IT, cryptocurrency and fintech indust
GoogleãŒã€Œãƒã‚·ã‚¢æ”¿åºœç³»ãƒãƒƒã‚«ãƒ¼ãŒiOSã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã‚’çªã„ã¦ãƒ¨ãƒ¼ãƒãƒƒãƒ‘ã®æ”¿åºœé–¢ä¿‚者を攻撃ã—ã¦ã„ãŸã€ã¨å ±å‘Š
Googleã®è„…å¨åˆ†æžã‚°ãƒ«ãƒ¼ãƒ—ãŒæ–°ãŸã«Chromeã§2種ã€Internet Explorerã§1種ã€WebKit(Safari)ã§1種ã®è¨ˆ4種ã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã«ã¤ã„ã¦è©³ç´°ã‚’公開ã—ã¾ã—ãŸã€‚ã“ã®4種ã®ä¸ã§ã‚‚WebKitã®è„†å¼±æ€§ã¯ã€Œãƒã‚·ã‚¢æ”¿åºœã®æ”¯æ´ã‚’å—ã‘ã¦ã„ã‚‹å¯èƒ½æ€§ã®ã‚ã‚‹ãƒãƒƒã‚«ãƒ¼ãŒç”¨ã„ãŸã€ã¨ã®ã“ã¨ã§ã€å ±é“å„社ã«ã‚ˆã£ã¦ã²ã¨ãã‚大ããå ±ã˜ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ How we protect users from 0-day attacks https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/ iOS zero-day let SolarWinds hackers compromise fully updated iPhones | Ars Technica https://arstechnica.com/g
Update on campaign targeting security researchers
In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers. On March 17th, the same actors behind those attacks set up a new website with associated social media profiles for a fake company called “SecuriElite.†The new website claims the company is an offensive security company loc
北æœé®®ã®ãƒãƒƒã‚«ãƒ¼ãŒChromeã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã‚’利用ã—ã¦è¡Œã£ãŸæ”»æ’ƒã«ã¤ã„ã¦MicrosoftãŒãƒ¬ãƒãƒ¼ãƒˆã‚’公開
北æœé®®æ”¿åºœã®æ”¯æ´ã‚’å—ã‘ã‚‹ã¨ã¿ã‚‰ã‚Œã‚‹ãƒãƒƒã‚«ãƒ¼é›†å›£ãŒã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã‚’æ¨™çš„ã«æ”»æ’ƒã‚’è¡Œã£ã¦ã„ãŸã“ã¨ã‚’2021å¹´1月25æ—¥ã«GoogleãŒå ±å‘Šã—ã¾ã—ãŸã€‚ã“ã®æ”»æ’ƒãŒã©ã®ã‚ˆã†ã«è¡Œã‚ã‚ŒãŸã®ã‹ã«ã¤ã„ã¦MicrosoftãŒèª¿æŸ»ã‚’è¡Œã„ã€ãƒ¬ãƒãƒ¼ãƒˆã‚’発表ã—ã¦ã„ã¾ã™ã€‚ ZINC attacks against security researchers - Microsoft Security https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/ Microsoft: DPRK hackers 'likely' hit researchers with Chrome exploit https://www.bleepingcomputer.com/news/security/mic
北æœé®®ãƒãƒƒã‚«ãƒ¼ã€SNS経由ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã‚’æ¨™çš„ã«--グーグルãŒæ³¨æ„å–šèµ·
Googleã¯ç±³å›½æ™‚é–“1月25æ—¥ã€åŒ—æœé®®æ”¿åºœã®æ”¯æ´ã‚’å—ã‘ã‚‹ãƒãƒƒã‚«ãƒ¼é›†å›£ãŒã€è„†å¼±æ€§èª¿æŸ»ã«é–¢ã‚るサイãƒãƒ¼ã‚»ã‚ュリティ専門家らを標的ã«ã—ã¦ã„ã‚‹ã“ã¨ã‚’明らã‹ã«ã—ãŸã€‚ 攻撃ã¯Googleã®è„…å¨åˆ†æžã‚°ãƒ«ãƒ¼ãƒ—（TAG）ã«ã‚ˆã£ã¦ç™ºè¦‹ã•ã‚ŒãŸã€‚åŒã‚°ãƒ«ãƒ¼ãƒ—ã¯æŒç¶šçš„標的型攻撃（APT）ã®æ¤œå‡ºã‚’å°‚é–€ã¨ã™ã‚‹ã‚»ã‚ュリティãƒãƒ¼ãƒ ã 。 Googleã¯25æ—¥ã«å…¬è¡¨ã—ãŸTAGã®ãƒ¬ãƒãƒ¼ãƒˆã§ã€åŒ—æœé®®ã®ãƒãƒƒã‚«ãƒ¼ã‚‰ã¯Twitterã€LinkedInã€Telegramã€Discordã€Keybaseã¨ã„ã£ãŸå„種ソーシャルãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ä¸Šã§è¤‡æ•°ã®ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚’使用ã—ã€å½ã®äººç‰©ã‚’装ã£ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã‚‰ã«æŽ¥è§¦ã—ãŸã¨è¿°ã¹ãŸã€‚接触ã«é›»åメールãŒä½¿ã‚れる例もã‚ã£ãŸã¨ã—ã¦ã„る。 TAGã®ãƒ¬ãƒãƒ¼ãƒˆã«ã¯ã€åŒ—æœé®®ã®ãƒãƒƒã‚«ãƒ¼ãŒæƒ…å ±ã‚»ã‚ュリティã®å°‚門家らをãŠã³ã寄ã›ã¦ã ã¾ã™ãŸã‚ã«ä½¿ç”¨ã—ãŸã‚½ãƒ¼ã‚·ãƒ£ãƒ«ãƒ¡ãƒ‡ã‚£ã‚¢ä¸Šã®å½ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã®ãƒªãƒ³ã‚¯ä¸€è¦§ã‚‚記載ã•ã‚Œã¦ã„る。 北æœ
New campaign targeting security researchers
Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations. The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers which we will outline below.
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Internet Explorer 0-day exploited by North Korean actor APT37
{{#tags}}- {{label}}
{{/tags}}