ãã¡ã¤ã¢ã»ã¢ã¤ã¯ä»å¹´7æããAPT10ãï¼å¥åï¼MenuPassï¼ã¨æãããã°ã«ã¼ãã«ãããæ¥æ¬ã®ã¡ãã£ã¢æ¥çãæ¨çã«ããã¢ã¯ãã£ããã£ãæ¤ç¥ã»é»æ¢ãã¾ãããAPT10ã¯ããã¡ã¤ã¢ã»ã¢ã¤ã2009å¹´ãã追跡ãã¦ããä¸å½ã®ãµã¤ãã¼ã»ã¹ãã¤ã»ã°ã«ã¼ãã§ãããã¾ã§ãæ¥æ¬ã®ä¼æ¥ã»çµç¹ãæ¨çã¨ãã¦ãã¾ãããä»åã®æ»æãã£ã³ãã¼ã³ã§ã¯ãUPPERCUTããã¯ãã¢ãã¤ã³ã¹ãã¼ã«ãããæªæããææ¸ãæ·»ä»ããã¹ãã¢ãã£ãã·ã³ã°ã»ã¡ã¼ã«ããæ¥æ¬ã®ã¡ãã£ã¢æ¥çã«ããããã¾ãã¾ãªä¼æ¥ã»å£ä½ã«éä»ããã¾ããããã®ããã¯ãã¢ã¯ãã³ãã¥ããã£ã§ã¯ANEL ã®åã§ç¥ããã¦ãããææ°ãã¼ã¸ã§ã³ãçºè¡¨ãããã¾ã§ã¯ããã¼ã¿çã¾ãã¯RCï¼ãªãªã¼ã¹åè£çï¼ã®å½¢ã§æä¾ããã¦ãã¾ãããæ¬ããã°ã§ã¯ããã¼ã¸ã§ã³éã®æ´æ°å 容ãå·®ç°ã«ã¤ãã¦åæãã¦ãã¾ãã æ»æã®æ¦è¦ æåã®æ»æãã¯ãã«ã§ã¯ãæªæããVBAãã¯ããæ ¼ç´ããMicrosoft
Summary Cisco Talos has identified a highly targeted campaign against 13 iPhones which appears to be focused on India. The attacker deployed an open-source mobile device management (MDM) system to control enrolled devices. At this time, we don't know how the attacker managed to enroll the targeted devices. Enrollment could be done through physical access to the devices, or most likely by using soc
2018å¹´1æ17æ¥é ãæé¨ç§å¦çã«å½è£ ããä¸æ£ãªã¡ã¼ã«ãéä¿¡ããã¦ãããã¨ãä¸é¨ã§ç¢ºèªããã¦ãã¾ã[1]ããã®ã¡ã¼ã«ã«ã¯URLãè¨è¼ããã¦ãããã¢ã¯ã»ã¹ããã¨ãã«ã¦ã¨ã¢TSCookieããã¦ã³ãã¼ãããã¾ãããï¼ãã¬ã³ããã¤ã¯ã社ã¯ãã®ãã«ã¦ã¨ã¢ãPLEADã¨å¼ãã§ãã¾ã[2]ãPLEADã¯ãæ»æãã£ã³ãã¼ã³åã¨ãã¦ä½¿ããããã¨ããããããããã§ã¯ãã®ãã«ã¦ã¨ã¢ãTSCookieã¨è¨è¼ãã¾ããï¼TSCookieã¯ã2015å¹´é ãã確èªããã¦ãããBlackTech[3]ã¨å¼ã°ããæ»æã°ã«ã¼ãã¨ã®é¢é£ãçããã¦ãã¾ããJPCERT/CCã§ã¯ãã®ãã«ã¦ã¨ã¢ã使ç¨ããæ»æã°ã«ã¼ãããéå»ã«æ¥æ¬ã®çµç¹ãã¿ã¼ã²ããã«æ¨çåæ»æãè¡ã£ã¦ãããã¨ã確èªãã¦ãã¾ãã ä»åã¯ãTSCookieã®è©³ç´°ã«ã¤ãã¦ç´¹ä»ãã¾ãã TSCookieã®æ¦è¦ å³1ã¯ãTSCookieå®è¡æã®åä½ã®æµãã示ãã¦ãã¾ãã å³
ååã®åæã»ã³ã¿ã¼ã ãã ã§ã¯æ»æã°ã«ã¼ãBlackTech[1]ã使ç¨ãã¦ããã¨èãããããã«ã¦ã¨ã¢TSCookie ã«ã¤ãã¦ç´¹ä»ãã¾ããããã®æ»æã°ã«ã¼ãã¯ãã®ä»ã«ãPLEADã¨å¼ã°ãããã«ã¦ã¨ã¢ã使ç¨ãããã¨ãåãã£ã¦ãã¾ããï¼PLEADã¯è¤æ°ã®ãã«ã¦ã¨ã¢ç¨®å¥åï¼TSCookieãå«ãï¼ã¨ãã®ãã«ã¦ã¨ã¢ã使ç¨ããæ»æãã£ã³ãã¼ã³åã¨ãã¦ä½¿ç¨ããã¦ãã¾ã[2]ãããã§ã¯PLEADãTSCookieã¨ã¯ç°ãªããã«ã¦ã¨ã¢ç¨®å¥åã¨ãã¦ä½¿ç¨ãã¾ããï¼PLEADã«ã¯RATã¿ã¤ãã¨ããã¦ã³ãã¼ãã¿ã¤ãï¼ä»¥éãPLEADãã¦ã³ãã¼ãã¨è¨è¼ããï¼ãåå¨ãã¾ããRATã¿ã¤ãã¯è¤æ°ã®ã³ãã³ããæã¡ãå½ä»¤ãåä¿¡ãããã¨ã«ãã£ã¦åä½ãã¾ããï¼è©³ããã¯ãLAC社ãå ¬éãã¦ããããã°[3]ã®ãæ»ææå£3ããã覧ãã ãããï¼PLEADãã¦ã³ãã¼ãã¯ãTSCookieã¨åããã¢ã¸ã¥ã¼ã«ããã¦ã³ãã¼ãããã¡ã¢ãªä¸ã§å®è¡
ãã«ã¦ã¨ã¢ã®ä¸ã«ã¯ãã«ããã©ãããã©ã¼ã ã§åä½ãããã¨ãæå³ãã¦ä½æããããã®ãåå¨ãããã®éã«ä½¿ç¨ãããããã°ã©ãã³ã°è¨èªã¨ãã¦ä»£è¡¨çãªãã®ãJavaã§ãããã¨ãã°ã以ååæã»ã³ã¿ã¼ã ããã§ç´¹ä»ããAdwindã¯Javaã§ä½æããããã«ã¦ã¨ã¢ã§ãWindows以å¤ã®OSã§ãåä½ãã¾ãããåç¥ã®éããJava以å¤ã«ããã«ããã©ãããã©ã¼ã ã§åä½ãããã¨ãæ³å®ããããã°ã©ãã³ã°è¨èªã¯åå¨ããGolangããã®ï¼ã¤ã§ããJavaã§ä½æããããã«ã¦ã¨ã¢ã«æ¯ã¹ãã¨å°ãªãã§ãããGolangã§ä½æããããã®ã確èªããã¦ãã¾ãããã¨ãã°ãLinuxã«ææãããã«ã¦ã¨ã¢ã¨ãã¦æåãªMiraiãã³ã³ããã¼ã©ã¼ã«ã¯Golangã使ç¨ããã¦ãã¾ãã ä»åã¯ãJPCERT/CC ã§ç¢ºèªãããã«ã¦ã¨ã¢WellMessã«ã¤ãã¦ç´¹ä»ãã¾ããWellMessã¯ãGolangã§ä½æãããã¯ãã¹ã³ã³ãã¤ã«ã«ãã£ã¦Linux
Award-winning news, views, and insight from the ESET security community Certificates stolen from Taiwanese tech-companies misused in Plead malware campaign D-Link and Changing Information Technologies code-signing certificates stolen and abused by highly skilled cyberespionage group focused on East Asia, particularly Taiwan ESET researchers have discovered a new malware campaign misusing stolen di
éå¶è æ å ±æ¬ãµã¤ãã¯ãæ¥æ¬æ大ç´æå·è³ç£åå¼æã»è²©å£²æãããããã³ã¯ããéå¶ããããããã³ã¤ã³(Bitcoin)ããããã¯ãã§ã¼ã³ãæå·è³ç£(ä»®æ³é貨)ã«é¢ããç¥èãä¸çä¸ã®ææ°ã®ãããã¯ã¹ãæå 端ã®æè¡ãããã¸ã§ã¯ããè¦å¶ãç¸å ´ãªã©ãæå·è³ç£æè³ã®ãã³ãã«ãªããå½¹ç«ã¡æ å ±ãçºä¿¡ããã¡ãã£ã¢ã§ãã éèåºã®ãã¼ã ãã¼ã¸ã«è¨è¼ãããæå·è³ç£äº¤ææ¥è ãåãæ±ãæå·è³ç£ï¼ä»®æ³é貨ï¼ã¯ãå½è©²æå·è³ç£äº¤ææ¥è ã®èª¬æã«åºã¥ãã è³é決æ¸æ³ä¸ã®å®ç¾©ã«è©²å½ãããã¨ã確èªãããã®ã«ããã¾ããã éèåºã»è²¡åå±ãããããã®æå·è³ç£ï¼ä»®æ³é貨ï¼ã®ä¾¡å¤ãä¿è¨¼ããããæ¨å¥¨ãããã®ã§ã¯ããã¾ããã æå·è³ç£ï¼ä»®æ³é貨ï¼ã¯ãå¿ ãããè£ä»ãã¨ãªãè³ç£ãæã¤ãã®ã§ã¯ããã¾ãããæå·è³ç£ï¼ä»®æ³é貨ï¼ã®åå¼ãè¡ãéã«ã¯ã以ä¸ã®æ³¨æç¹ã«ãçæãã ããã ï¼æå·è³ç£ï¼ä»®æ³é貨ï¼ãå©ç¨ããéã®æ³¨æç¹ï¼æå·è³ç£ï¼ä»®æ³é貨ï¼ã¯ãæ¥æ¬åã
The Process Doppelgänging technique was first presented in December 2017 at the BlackHat conference. Since the presentation several threat actors have started using this sophisticated technique in an attempt to bypass modern security solutions. In April 2018, we spotted the first ransomware employing this bypass technique â SynAck ransomware. It should be noted that SynAck is not new â it has been
Petya/NotPetya (aka EternalPetya), made headlines in June, due to itâs massive attack on Ukraine. Today, we noted an outbreak of a similar-looking malware, called BadRabbit, probably prepared by the same authors. Just like the previous edition, BadRabbit has an infector allowing for lateral movements, using SMB to propagate laterally. Unlike NotPetya, it doesnât use EternalBlue and is more widely
å é±å¼ç¤¾ã§ã¯ãé²è¡è£ åã«é¢é£ãã調æ»å ±åãå½è£ ããããã¥ã¡ã³ãã使ã£ãæ»æã観測ãã¾ãããçæ§ã«æ³¨æåèµ·ãä¿ãç®çã§ã調æ»ã®ä¸é¨ãå ±æãããã¨æãã¾ãã é²è¡è£ åã«é¢é£ãã調æ»å ±åãå½è£ ããããã¥ã¡ã³ãã¯ãå³1ã®ããã«ãWORDãPDFãå½è£ ããäºéæ¡å¼µåã®ãã¡ã¤ã«ã§ãããããã¡ã¼ã«ã«æ·»ä»ãããããã¡ã§æ¨çä¼æ¥ã«é éãããã¨è¦ããã¾ãã å³1ãWORDãPDFã§é²è¡é¢é£ã®èª¿æ»å ±åæ¸ãå½è£ ããEXEãã¡ã¤ã« SHA256 (PDFå½è£ ãã¡ã¤ã«) : dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643 SHA256 (DOCå½è£ ãã¡ã¤ã«) : 42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced [åä½æ¦è¦] ãã¡ã¤ã«ãå®è¡ããå ´åãWORD
ãµã¤ãã¼æ»æè éå£ãBlackTechï¼ãã©ãã¯ããã¯ï¼ãã¯ãå°æ¹¾ãä¸å¿ã¨ããæ±ã¢ã¸ã¢å°åã§ãµã¤ãã¼è«å ±æ´»åããæ»æè éå£ã§ãæ¥æ¬ãé¦æ¸¯ã§ã®æ´»åã確èªããã¦ãã¾ããå½¼ããå©ç¨ããã³ãã³ã&ã³ã³ããã¼ã«ï¼C&Cï¼ãµã¼ãã® Mutex ããã¡ã¤ã³åãããBlackTech ã®ç®çã¯æ¨çè ãææããæè¡ã®çªåã«ããã¨æ¨æ¸¬ããã¦ãã¾ãã BlackTech ãå©ç¨ããææ³ãªã©ã®å¤åã追跡ããã¨ãããå¥ã ã®ãµã¤ãã¼è«å ±æ´»åã ã¨æããã¦ããããPLEADï¼ããªã¼ãï¼ãããShrouded Crossbowï¼ã·ã¥ã©ã¦ãã£ããã»ã¯ãã¹ãã¦ï¼ãããWaterbearï¼ã¦ã©ã¼ã¿ã¼ãã¢ï¼ãã®éã«ãããå ±éç¹ãæµ®ãã³ä¸ãã£ã¦ãã¾ããã æ¬è¨äºã§ã¯ãåæ»æãã£ã³ãã¼ã³ã®æå£ãæ¯è¼ããå©ç¨ããããã¼ã«ã解æããçµæå¤æãã3ã¤ã®æ»æãã£ã³ãã¼ã³ãåä¸ã®æ»æéå£ã«ãã£ã¦å®è¡ããããã¨ã示ãå ±éç¹ã«ã¤ãã¦è§£èª¬ãã¾ãã â
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}