Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks | Microsoft Security Blog
Who is Moonstone Sleet? Moonstone Sleet is a threat actor behind a cluster of malicious activity that Microsoft assesses is North Korean state-aligned and uses both a combination of many tried-and-true techniques used by other North Korean threat actors and unique attack methodologies. When Microsoft first detected Moonstone Sleet activity, the actor demonstrated strong overlaps with Diamond Sleet
北æœé®®ã®ã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªã‚°ãƒ«ãƒ¼ãƒ—「APT37ã€ãŒInternet Explorerã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã‚’çªã攻撃を行ã£ã¦ã„ãŸã¨åˆ¤æ˜Ž
Googleã®è„…å¨åˆ†æžã‚°ãƒ«ãƒ¼ãƒ—(TAG)ãŒã€ã€ŒAPT37ã€ã€ŒReaperã€ã¨ã„ã†ã‚³ãƒ¼ãƒ‰ãƒãƒ¼ãƒ ã§å‘¼ã°ã‚Œã‚‹åŒ—æœé®®ã®ã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªã‚°ãƒ«ãƒ¼ãƒ—ãŒ2022å¹´10月ã«Internet Explorerã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±(ãœã„ã˜ã‚ƒã)性を悪用ã—ã¦æ”»æ’ƒã—ã¦ã„ãŸã“ã¨ã‚’çªãæ¢ã‚ãŸã¨ç™ºè¡¨ã—ã¾ã—ãŸã€‚ã“ã®æ”»æ’ƒã¯ã€2022å¹´11月ã®ã‚»ã‚ュリティ更新プãƒã‚°ãƒ©ãƒ をインストールã—ã¦ã„ãªã„Windows 7以é™ã‚ã‚‹ã„ã¯Windows Server 2008以é™ã‚’æ載ã—ãŸãƒžã‚·ãƒ³ã‚’対象ã¨ã—ã¦ã„ã‚‹ã¨ã®ã“ã¨ã§ã™ã€‚ Internet Explorer 0-day exploited by North Korean actor APT37 https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37/
Windows Updateクライアント悪用ã—ã¦ãƒžãƒ«ã‚¦ã‚§ã‚¢ã«æ„ŸæŸ“ã•ã›ã‚‹æ”»æ’ƒç¢ºèª
Malwarebytes Labsã®è„…å¨ã‚¤ãƒ³ãƒ†ãƒªã‚¸ã‚§ãƒ³ã‚¹ãƒãƒ¼ãƒ ã¯1月27æ—¥(米国時間)ã€ã€ŒNorth Korea's Lazarus APT leverages Windows Update client, GitHub in latest campaignã€ã«ãŠã„ã¦ã€ã€ŒLazarusã€ã®åã§çŸ¥ã‚‰ã‚Œã‚‹ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã‚°ãƒ«ãƒ¼ãƒ—ã«ã‚ˆã‚‹æ–°ã—ã„攻撃ã‚ャンペーンãŒç¢ºèªã•ã‚ŒãŸã¨ä¼ãˆãŸã€‚ã“ã®ã‚ャンペーンã¯ã€Windows Updateを悪用ã—ã¦æ‚ªæ„ã®ã‚るペイãƒãƒ¼ãƒ‰ã‚’実行ã™ã‚‹ç‚¹ãŒå¤§ããªç‰¹å¾´ã§ã€ã‚»ã‚ュリティ検出メカニズムをãƒã‚¤ãƒ‘スã™ã‚‹æ–°ã—ã„手法ã¨ã—ã¦æ³¨æ„を呼ã³ã‹ã‘ã¦ã„る。 Lazarusã¯åŒ—æœé®®ã®æ”¯æ´ã‚’å—ã‘ã¦ã„ã‚‹ã¨ã•ã‚Œã¦ã„るサイãƒãƒ¼æ”»æ’ƒã‚°ãƒ«ãƒ¼ãƒ—ã®ç·ç§°ã§ã€ã€ŒAPT38 ã€ã‚„「Hidden Cobraã€ã¨ã„ã£ãŸå称ã§ã‚‚知られã¦ã„る。今回発見ã•ã‚ŒãŸæ–°ã—ã„攻撃ã‚ャンペーンã¯ã€Lockheed Martin社ã«ãªã‚Šã™ã¾ã—
ä¸å›½ãƒ»ã‚¤ãƒ©ãƒ³ãƒ»åŒ—æœé®®ãƒ»ãƒˆãƒ«ã‚³ã®æ”¯æ´ã‚’å—ã‘ãŸãƒãƒƒã‚ン​​ググループãŒLog4jã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã€ŒLog4Shellã€ã‚’悪用ã—ã¦ã„ã‚‹ã¨MicrosoftãŒç™ºè¡¨
2021å¹´12月14æ—¥ã€MicrosoftãŒJavaã®Log4jライブラリã«å˜åœ¨ã—ã¦ã„ãŸãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã‚’å¯èƒ½ã«ã™ã‚‹ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã€ŒLog4Shellã€ãŒä¸å›½ãƒ»ã‚¤ãƒ©ãƒ³ãƒ»åŒ—æœé®®ãƒ»ãƒˆãƒ«ã‚³ã«é–¢é€£ã™ã‚‹æ”¿åºœç³»ãƒãƒƒã‚ンググループã«ã‚ˆã£ã¦ç”¨ã„られるã“ã¨ã‚’確èªã—ãŸã¨ç™ºè¡¨ã—ã¾ã—ãŸã€‚ã•ã‚‰ã«åŒæ—¥ã«ã¯ã‚¢ãƒ¡ãƒªã‚«ã®ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ュリティ・インフラストラクãƒãƒ£ã‚»ã‚ュリティåº(CISA)ãŒè¡Œæ”¿å„çœã«å¯¾ã—ã¦Log4Shellã®ä¿®æ£ãƒ‘ッãƒã‚’12月24æ—¥ã¾ã§ã«é©ç”¨ã™ã‚‹ã‚ˆã†ã«é€šé”を出ã—ã¾ã—ãŸã€‚ Guidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation - Microsoft Security Blog https://www.microsoft.com/security/blog/2021/12/11/guida
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability | Microsoft Security Blog
January 10, 2022 recap – The Log4j vulnerabilities represent a complex and high-risk situation for companies across the globe. This open-source component is widely used across many suppliers’ software and services. By nature of Log4j being a component, the vulnerabilities affect not only applications that use vulnerable libraries, but also any services that use these applications, so customers may
GoogleãŒã€Œãƒã‚·ã‚¢æ”¿åºœç³»ãƒãƒƒã‚«ãƒ¼ãŒiOSã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã‚’çªã„ã¦ãƒ¨ãƒ¼ãƒãƒƒãƒ‘ã®æ”¿åºœé–¢ä¿‚者を攻撃ã—ã¦ã„ãŸã€ã¨å ±å‘Š
Googleã®è„…å¨åˆ†æžã‚°ãƒ«ãƒ¼ãƒ—ãŒæ–°ãŸã«Chromeã§2種ã€Internet Explorerã§1種ã€WebKit(Safari)ã§1種ã®è¨ˆ4種ã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã«ã¤ã„ã¦è©³ç´°ã‚’公開ã—ã¾ã—ãŸã€‚ã“ã®4種ã®ä¸ã§ã‚‚WebKitã®è„†å¼±æ€§ã¯ã€Œãƒã‚·ã‚¢æ”¿åºœã®æ”¯æ´ã‚’å—ã‘ã¦ã„ã‚‹å¯èƒ½æ€§ã®ã‚ã‚‹ãƒãƒƒã‚«ãƒ¼ãŒç”¨ã„ãŸã€ã¨ã®ã“ã¨ã§ã€å ±é“å„社ã«ã‚ˆã£ã¦ã²ã¨ãã‚大ããå ±ã˜ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ How we protect users from 0-day attacks https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/ iOS zero-day let SolarWinds hackers compromise fully updated iPhones | Ars Technica https://arstechnica.com/g
北æœé®®ã®ãƒãƒƒã‚«ãƒ¼ãŒChromeã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã‚’利用ã—ã¦è¡Œã£ãŸæ”»æ’ƒã«ã¤ã„ã¦MicrosoftãŒãƒ¬ãƒãƒ¼ãƒˆã‚’公開
北æœé®®æ”¿åºœã®æ”¯æ´ã‚’å—ã‘ã‚‹ã¨ã¿ã‚‰ã‚Œã‚‹ãƒãƒƒã‚«ãƒ¼é›†å›£ãŒã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã‚’æ¨™çš„ã«æ”»æ’ƒã‚’è¡Œã£ã¦ã„ãŸã“ã¨ã‚’2021å¹´1月25æ—¥ã«GoogleãŒå ±å‘Šã—ã¾ã—ãŸã€‚ã“ã®æ”»æ’ƒãŒã©ã®ã‚ˆã†ã«è¡Œã‚ã‚ŒãŸã®ã‹ã«ã¤ã„ã¦MicrosoftãŒèª¿æŸ»ã‚’è¡Œã„ã€ãƒ¬ãƒãƒ¼ãƒˆã‚’発表ã—ã¦ã„ã¾ã™ã€‚ ZINC attacks against security researchers - Microsoft Security https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/ Microsoft: DPRK hackers 'likely' hit researchers with Chrome exploit https://www.bleepingcomputer.com/news/security/mic
北æœé®®ã¨ãƒã‚·ã‚¢ã€ã‚³ãƒãƒŠãƒ¯ã‚¯ãƒãƒ³é–‹ç™ºçµ„ç¹”ãªã©ã«ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒ--マイクãƒã‚½ãƒ•ãƒˆå ±å‘Š
å°åˆ·ã™ã‚‹ メールã§é€ã‚‹ テã‚スト HTML é›»åæ›¸ç± PDF ダウンãƒãƒ¼ãƒ‰ テã‚スト é›»åæ›¸ç± PDF クリップã—ãŸè¨˜äº‹ã‚’Myページã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ ãƒã‚·ã‚¢ã¨åŒ—æœé®®ã®ãƒãƒƒã‚«ãƒ¼ãŒãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã‚’ä¼ã¦ã€æ–°åž‹ã‚³ãƒãƒŠã‚¦ã‚¤ãƒ«ã‚¹ã®ãƒ‘ンデミックã‹ã‚‰æŠœã‘出ãã†ã¨ã—ã¦ã„ã‚‹ã¨ã„ã†ã€‚MicrosoftãŒç±³å›½æ™‚é–“11月13æ—¥ã«æ˜Žã‚‰ã‹ã«ã—ãŸã€‚åŒç¤¾ã¯ã€ä¸–ç•Œä¸ã®è£½è–¬ä¼šç¤¾ã‚„新型コãƒãƒŠã‚¦ã‚¤ãƒ«ã‚¹ã®ãƒ¯ã‚¯ãƒãƒ³ç ”究者ã«å¯¾ã™ã‚‹ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã‚ャンペーンを検知ã—ãŸã¨ã—ã¦ã€è©³ç´°ãªæƒ…å ±ã‚’å…¬é–‹ã—ãŸã€‚å„国政府ã«å¯¾å¿œã‚’促ã™ã“ã¨ãŒç‹™ã„ã 。 æ»è€…æ•°ã¨æ„ŸæŸ“者数ã®å¢—åŠ ãŒç¶šãä¸ã€æ–°åž‹ã‚³ãƒãƒŠã‚¦ã‚¤ãƒ«ã‚¹ã®ãƒ‘ンデミックã¯å†¬ã«ä¸€æ®µã¨æ‚ªåŒ–ã™ã‚‹ã¨äºˆæƒ³ã•ã‚Œã¦ã„る。マスクã®ç€ç”¨ã‚„ソーシャルディスタンスãªã©ã®å¯¾ç–ã§æ„ŸæŸ“者数を減らã™ã“ã¨ã¯å¯èƒ½ã ãŒã€ç ”究者ã¯ã‚ˆã‚Šæ’ä¹…çš„ãªãƒ‘ンデミックã®è§£æ±ºç–ã¨ãªã‚‹å¯èƒ½æ€§ã®ã‚るワクãƒãƒ³ã®é–‹ç™ºã‚’急ã„ã§ã„る。 Pfizerã¯11月9æ—¥ã€é–‹ç™ºä¸ã®ãƒ¯ã‚¯ãƒ
Cyberattacks targeting health care must stop - Microsoft On the Issues
All Microsoft Global Microsoft 365 Teams Copilot Windows Surface Xbox Deals Small Business Support Software Windows Apps AI Outlook OneDrive Microsoft Teams OneNote Microsoft Edge Skype PCs & Devices Computers Shop Xbox Accessories VR & mixed reality Certified Refurbished Trade-in for cash Entertainment Xbox Game Pass Ultimate PC Game Pass Xbox games PC and Windows games Movies & TV Business Micro
MicrosoftãŒå·®ã—æ¢ã‚ã—ãŸã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªã‚°ãƒ«ãƒ¼ãƒ—Thalliumã®50ドメインã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2019å¹´12月30æ—¥ã€Microsoftã¯åŒ—æœé®®é–¢ä¿‚ã¨ã¿ã‚‰ã‚Œã‚‹ã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªã‚°ãƒ«ãƒ¼ãƒ—ãŒä¿æœ‰ã—ã¦ã„ãŸ50ドメインã®å·®ã—æ¢ã‚訴訟を起ã“ã—ãŸã“ã¨ã‚’ブãƒã‚°ã‚’通ã˜ã¦ç™ºè¡¨ã—ã¾ã—ãŸã€‚日本もターゲットã«å«ã¾ã‚Œã¦ãŠã‚Šã€å›½å†…メディア*1ã§ã‚‚å ±ã˜ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ã“ã“ã§ã¯é–¢é€£ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ å–り組ã¿ã¯ä»Šå›žã§4例目 Microsoftã¯æ¬¡ã®è¨˜äº‹ã§ä»Šå›žã®å–り組ã¿ã«ã¤ã„ã¦ç™ºè¡¨ã€‚ blogs.microsoft.com 記事ä¸ã§ã¯æ¬¡ã®å†…容ãŒè¨€åŠã•ã‚Œã¦ã„る。 今回対象ã¨ãªã£ãŸã®ã¯ã€ŒThalliumã€ã¨ã—ã¦MSãŒè˜åˆ¥ã—ã¦ã„るグループã§ã€èƒŒå¾Œã«åŒ—æœé®®ãŒé–¢é€£ã—ã¦ã„ã‚‹ã¨ã¿ã¦ã„る。 ã“ã®ã‚°ãƒ«ãƒ¼ãƒ—ãŒç‹™ã£ãŸã®ã¯å¤§åŠãŒã‚¢ãƒ¡ãƒªã‚«ã€éŸ“国ã€æ—¥æœ¬ã€‚政府ã€ã‚·ãƒ³ã‚¯ã‚¿ãƒ³ã‚¯ã€å¤§å¦ã€äººæ¨©æ´»å‹•ã€æ ¸æ‹¡æ•£å•é¡Œç‰ã«é–¢é€£ã™ã‚‹çµ„ç¹”ã€äººç‰©ãŒå¯¾è±¡ã¨ãªã£ã¦ã„ãŸã€‚ ã“ã®å–り組ã¿ã¯ä»Šå›žã§4例目。éŽåŽ»ã«ä¸å›½ï¼ˆBarium）ã€ãƒã‚·ã‚¢ï¼ˆStrontium）ã€ã‚¤ãƒ©ãƒ³ï¼ˆPhosph
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability | Microsoft Security Blog
Microsoft Takes North Korean Hacking Group Thallium to Court
{{#tags}}- {{label}}
{{/tags}}