{"id":103893,"date":"2018-12-12T18:00:44","date_gmt":"2018-12-13T02:00:44","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=103893"},"modified":"2020-03-30T17:41:45","modified_gmt":"2020-03-31T00:41:45","slug":"dear-joohn-sofacy-groups-global-campaign","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/","title":{"rendered":"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3"},"content":{"rendered":"<h2><a id=\"post-103893-dear-joohn-sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb-\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\"><\/a>\u6982\u8981<\/h2>\n<p>Cannon\u30c4\u30fc\u30eb\u306b\u95a2\u3059\u308b<a href=\"https:\/\/unit42.paloaltonetworks.jp\/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan\/\">\u4ee5\u524d\u306e\u30d6\u30ed\u30b0<\/a>\u3067\u793a\u5506\u3057\u305f\u3088\u3046\u306b\u3001Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411\u6708\u534a\u3070\u306b\u304b\u3051\u3066\u3001\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u6a5f\u95a2\u3084\u6c11\u9593\u7d44\u7e54\u3092\u7d99\u7d9a\u7684\u306b\u653b\u6483\u3057\u3066\u3044\u307e\u3059\u3002\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u4e00\u90e8\u3082\u6a19\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001\u6a19\u7684\u306e\u591a\u304f\u306fNATO\u52a0\u76df\u56fd\u3067\u3059\u3002\u653b\u6483\u3067\u306f\u3001\u4e3b\u306b\u5f0a\u793e\u304c<a href=\"https:\/\/unit42.paloaltonetworks.jp\/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan\/\">\u4ee5\u524d\u306b\u5206\u6790\u3057\u305f<\/a>Zebrocy\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u304c\u5229\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002<a href=\"https:\/\/www.welivesecurity.com\/2018\/11\/20\/sednit-whats-going-zebrocy\/\">ESET<\/a>\u306e\u5831\u544a\u306b\u3088\u308b\u3068\u3001\u6bd4\u8f03\u7684\u5c11\u6570\u306e\u914d\u4fe1\u6587\u66f8\u3067\u306f\u3001Cannon\u307e\u305f\u306fZebrocy Delphi\u306e\u4e9c\u7a2e\u304c\u914d\u4fe1\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u5f0a\u793e\u306f\u3001Zebrocy\u306e\u4f7f\u7528\u30922015\u5e74\u534a\u3070\u307e\u3067\u9061\u3063\u3066\u8ffd\u8de1\u3057\u3066\u3044\u305f\u305f\u3081\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306e\u5229\u7528\u983b\u5ea6\u304c\u5287\u7684\u306b\u5897\u52a0\u3057\u305f\u3053\u3068\u3092\u89b3\u6e2c\u3057\u3066\u3044\u307e\u3059\u3002Sofacy\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u9023\u3059\u308b\u4ed6\u306e\u30d0\u30c3\u30af\u30c9\u30a2 \u30c4\u30fc\u30eb\u3068\u6bd4\u8f03\u3057\u3066\u3001Zebrocy\u306f\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u3001\u306f\u308b\u304b\u306b\u5e83\u304f\u5229\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u30d6\u30ed\u30b0\u3067\u8a73\u3057\u304f\u8ff0\u3079\u308b\u4e00\u9023\u306e\u6d3b\u52d5\u306f\u3001\u5404\u914d\u4fe1\u6587\u66f8\u3067\u4e3b\u306bJoohn\u3068\u3044\u3046\u5171\u901a\u306e\u4f5c\u6210\u8005\u540d\u3092\u4f7f\u7528\u3057\u3066\u5c55\u958b\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u8208\u5473\u6df1\u3044\u5f0a\u793e\u306e\u6700\u521d\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u3001crash list(Lion Air Boeing 737).docx\u3068\u3044\u3046\u30d5\u30a1\u30a4\u30eb\u540d\u3092\u4f7f\u7528\u3057\u305f\u914d\u4fe1\u6587\u66f8\u3067\u3001Zebrocy\u30c4\u30fc\u30eb\u3092\u914d\u4fe1\u3057\u3066\u3044\u307e\u3057\u305f\u3002AutoFocus\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9 \u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u3068\u3001<a href=\"https:\/\/www.virustotal.com\">VirusTotal<\/a>\u304b\u3089\u53ce\u96c6\u3057\u305f\u30c7\u30fc\u30bf\u3092\u7d44\u307f\u308f\u305b\u3066\u6d3b\u7528\u3057\u3001\u30e1\u30bf\u30c7\u30fc\u30bf\u3067\u89b3\u6e2c\u3055\u308c\u305f\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u3068\u632f\u308b\u821e\u3044\u304b\u3089\u3001\u5f0a\u793e\u306fCannon\u30c4\u30fc\u30eb\u3092\u898b\u3064\u3051\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u591a\u6570\u306e\u65b0\u305f\u306a\u914d\u4fe1\u6587\u66f8\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3001\u6a19\u7684\u3082\u767a\u898b\u3067\u304d\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u653b\u6483\u3059\u3079\u3066\u306e\u653b\u6483\u30d9\u30af\u30c8\u30eb\u306f\u3001\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u3092\u4ecb\u3057\u3066\u3044\u308b\u3068\u601d\u308f\u308c\u3001\u306a\u308a\u3059\u307e\u3057\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u3084\u4ee5\u524d\u306b\u4fb5\u5bb3\u3055\u308c\u305f\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u306f\u306a\u304f\u3001\u6b63\u898f\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30d7\u30ed\u30d0\u30a4\u30c0\u306b\u767b\u9332\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30a2\u30ab\u30a6\u30f3\u30c8\u540d\u306f\u3001\u4e00\u898b\u3059\u308b\u3068\u3001\u6b63\u898f\u306e\u653f\u5e9c\u6a5f\u95a2\u306e\u540d\u524d\u3084\u3001\u4fe1\u983c\u3055\u308c\u305f\u4ed6\u306e\u7b2c\u4e09\u8005\u7d44\u7e54\u306b\u898b\u3048\u308b\u540d\u524d\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u914d\u4fe1\u6587\u66f8\u306f\u6a5f\u80fd\u7684\u306b\u306f\u3059\u3079\u3066\u4f3c\u3066\u304a\u308a\u3001Microsoft Word\u306e\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u6a5f\u80fd\u3092\u4f7f\u7528\u3057\u3066\u3001\u7b2c1\u6bb5\u968e\u306eC2\u304b\u3089\u60aa\u610f\u306e\u3042\u308b\u30de\u30af\u30ed\u3092\u53d6\u5f97\u3057\u3001\u6700\u7d42\u7684\u306b\u6700\u521d\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30ed\u30fc\u30c9\u3057\u3066\u5b9f\u884c\u3057\u307e\u3059\u3002\u914d\u4fe1\u6587\u66f8\u306e\u5927\u534a\u306b\u306f\u3001\u88ab\u5bb3\u8005\u306b\u30de\u30af\u30ed\u3092\u6709\u52b9\u5316\u3059\u308b\u3088\u3046\u306b\u6c42\u3081\u308b\u6c4e\u7528\u7684\u306a\u30eb\u30a2\u30fc(\u308f\u306a)\u753b\u50cf\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u4ed6\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u653b\u6483\u8005\u306f\u3001\u88ab\u5bb3\u8005\u3092\u8a98\u3063\u3066\u60aa\u610f\u306e\u3042\u308b\u6587\u66f8\u3092\u8d77\u52d5\u3055\u305b\u308b\u305f\u3081\u306b\u3001\u30eb\u30a2\u30fc\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u307f\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002<\/p>\n<p>\u5f0a\u793e\u306f\u30012018\u5e7410\u670817\u65e5\u304b\u30892018\u5e7411\u670815\u65e5\u306b\u304b\u3051\u3066\u5168\u90e8\u30679\u3064\u306e\u5175\u5668\u5316\u3055\u308c\u305f\u6587\u66f8\u3092\u508d\u53d7\u3057\u3001\u3053\u308c\u3089\u306e\u3059\u3079\u3066\u3067\u540c\u3058Joohn\u3068\u3044\u3046\u4f5c\u6210\u8005\u540d\u304c\u4f7f\u7528\u3055\u308c\u3001Zebrocy\u307e\u305f\u306fCannon\u306e\u3044\u305a\u308c\u304b\u306e\u4e9c\u7a2e\u304c\u914d\u4fe1\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u5f0a\u793e\u306e\u30c7\u30fc\u30bf\u30bb\u30c3\u30c8\u306e\u6a19\u7684\u7bc4\u56f2\u306f\u30014\u3064\u306e\u5927\u9678\u306b\u307e\u305f\u304c\u3063\u3066\u304a\u308a\u3001\u9023\u90a6\u653f\u5e9c\u30ec\u30d9\u30eb\u306e\u653f\u5e9c\u6a5f\u95a2\u304b\u3089\u5730\u65b9\u306e\u653f\u5e9c\u6a5f\u95a2\u307e\u3067\u5e83\u304f\u7db2\u7f85\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u53ce\u96c6\u3057\u305f\u30c7\u30fc\u30bf\u3092\u4f7f\u7528\u3057\u3066\u6642\u7cfb\u5217\u5206\u6790\u3092\u884c\u3063\u305f\u7d50\u679c\u3001Sofacy\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u308bDear Joohn\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u653b\u6483\u30bf\u30a4\u30df\u30f3\u30b0\u3084\u3001\u81ea\u52d5\u5316\u30c4\u30fc\u30eb\u3092\u7528\u3044\u305f\u3068\u601d\u308f\u308c\u308b\u653b\u6483\u306e\u4f5c\u6210\u65b9\u6cd5\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n<h3>\u653b\u6483\u306e\u8a73\u7d30<\/h3>\n<p>2018\u5e7410\u670817\u65e5\u304b\u3089\u3001\u5f0a\u793e\u306f\u3001\u4e16\u754c\u4e2d\u306e\u591a\u6570\u306e\u7d44\u7e54\u306b\u9001\u4fe1\u3055\u308c\u305f\u5408\u8a089\u3064\u306e\u914d\u4fe1\u6587\u66f8\u3092\u53ce\u96c6\u3057\u307e\u3057\u305f\u3002\u6a19\u7684\u306b\u306f\u3001\u5317\u7c73\u306e\u5916\u4ea4\u6a5f\u95a2\u3001\u30e8\u30fc\u30ed\u30c3\u30d1\u306e\u5916\u4ea4\u6a5f\u95a2\u3001\u3055\u3089\u306b\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u653f\u5e9c\u6a5f\u95a2\u306a\u3069\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u5317\u7c73\u3001\u30aa\u30fc\u30b9\u30c8\u30e9\u30ea\u30a2\u3001\u30e8\u30fc\u30ed\u30c3\u30d1\u306a\u3069\u3001\u4e16\u754c\u4e2d\u306e\u5730\u57df\u306e\u53f8\u6cd5\u5f53\u5c40\u3092\u6a19\u7684\u3068\u3057\u3066\u3044\u305f\u53ef\u80fd\u6027\u3092\u793a\u5506\u3059\u308b\u8a3c\u62e0\u3082\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u5f0a\u793e\u306e\u30c6\u30ec\u30e1\u30c8\u30ea\u3067\u306f\u3001NGO\u3001\u30de\u30fc\u30b1\u30c6\u30a3\u30f3\u30b0\u4f01\u696d\u3001\u533b\u7642\u696d\u754c\u306e\u7d44\u7e54\u3092\u6a19\u7684\u306b\u3057\u3066\u3044\u305f\u53ef\u80fd\u6027\u3082\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u653b\u6483\u306e\u653b\u6483\u30d9\u30af\u30c8\u30eb\u306f\u3001\u3059\u3079\u3066\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u3092\u4ecb\u3057\u3066\u304a\u308a\u3001\u30c1\u30a7\u30b3\u5171\u548c\u56fd\u3067\u4e00\u822c\u7684\u306aWeb\u30b5\u30fc\u30d3\u30b9 \u30d7\u30ed\u30d0\u30a4\u30c0\u3067\u3042\u308b\u30d5\u30ea\u30fc \u30e1\u30fc\u30eb \u30d7\u30ed\u30d0\u30a4\u30c0\u3001Seznam\u306b\u767b\u9332\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u4f8b\u3092\u56f31\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n<p><img width=\"1024\" height=\"712\"  class=\"wp-image-103896 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-54.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-54.png 1024w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-54-300x209.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-54-768x534.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-54-900x626.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-54-370x257.png 370w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f31 Dear Joohn\u653b\u6483\u3067\u914d\u4fe1\u3055\u308c\u305f\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u306e\u4f8b<\/em><\/span><\/p>\n<p>\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u3001Sofacy\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u88ab\u5bb3\u8005\u306b\u5175\u5668\u5316\u3055\u308c\u305f\u6587\u66f8\u3092\u8d77\u52d5\u3055\u305b\u308b\u3088\u3046\u306b\u4ed5\u5411\u3051\u308b\u4e0a\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u540d\u306b\u91cd\u70b9\u3092\u7f6e\u3044\u3066\u3044\u305f\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u30c8\u30d4\u30c3\u30af\u306f\u3001\u6b27\u5dde\u9023\u5408\u304b\u3089\u306e\u82f1\u56fd\u306e\u8131\u9000\u3001\u30e9\u30a4\u30aa\u30f3\u30a8\u30a2610\u4fbf\u589c\u843d\u4e8b\u6545\u304b\u3089\u3001\u30a4\u30b9\u30e9\u30a8\u30eb\u3067\u306e\u6700\u8fd1\u306e\u30ed\u30b1\u30c3\u30c8\u5f3e\u653b\u6483\u307e\u3067\u3055\u307e\u3056\u307e\u3067\u3059\u3002\u5f0a\u793e\u304c\u53ce\u96c6\u3067\u304d\u305f\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u5168\u30ea\u30b9\u30c8\u3092\u88681\u306b\u793a\u3057\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u540d\u306f\u3001\u88ab\u5bb3\u8005\u306b\u3042\u308f\u305b\u3066\u5de7\u5999\u306b\u4f5c\u6210\u3055\u308c\u3066\u3044\u308b\u3068\u601d\u308f\u308c\u307e\u3059\u304c\u3001\u6587\u66f8\u306e\u5b9f\u969b\u306e\u30eb\u30a2\u30fc \u30b3\u30f3\u30c6\u30f3\u30c4\u306f\u3001\u56f32\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u306f\u308b\u304b\u306b\u6c4e\u7528\u7684\u3067\u3059\u3002<\/p>\n<p>&nbsp;<\/p>\n<p><img width=\"500\" height=\"530\"  class=\"wp-image-103898 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-55.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-55.png 500w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-55-283x300.png 283w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-55-370x392.png 370w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f32 \u6c4e\u7528\u7684\u306a\u30eb\u30a2\u30fc\u753b\u50cf<\/em><\/span><\/p>\n<p>2018\u5e7411\u6708\u3001\u653b\u6483\u8005\u306f\u6226\u7565\u3092\u8ee2\u63db\u3057\u3001\u5175\u5668\u5316\u3055\u308c\u305f\u6587\u66f8\u306b\u5bfe\u3057\u3066\u6c4e\u7528\u7684\u3067\u306a\u3044\u30eb\u30a2\u30fc \u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u5b9f\u88c5\u3057\u59cb\u3081\u307e\u3057\u305f\u3002\u5f0a\u793e\u306f\u73fe\u6642\u70b9\u3067NATO\u52a0\u76df\u56fd\u3092\u4e3b\u306b\u6a19\u7684\u3068\u3057\u305f3\u3064\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u53ce\u96c6\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u56f33\u306e\u3068\u304a\u308a\u3001\u305d\u308c\u305e\u308c\u7570\u306a\u308b\u30eb\u30a2\u30fc\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"500\" height=\"500\"  class=\"wp-image-103900 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-56.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-56.png 500w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-56-300x300.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-56-150x150.png 150w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-56-370x370.png 370w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f33 \u6a19\u7684\u578b\u30eb\u30a2\u30fc \u30b3\u30f3\u30c6\u30f3\u30c4<\/em><\/span><\/p>\n<p>\u6587\u66f8\u306e1\u3064\u3067\u306f\u3001NATO EOD\u306e\u6a19\u7ae0\u3068\u6a19\u7684\u306e\u56fd\u3092\u793a\u5506\u3059\u308b\u30c6\u30ad\u30b9\u30c8\u3092\u542b\u3080\u96e3\u8aad\u5316\u3055\u308c\u305f\u6587\u66f8\u306e\u3088\u3046\u306a\u3082\u306e\u304c\u88ab\u5bb3\u8005\u306b\u8868\u793a\u3055\u308c\u307e\u3059\u3002\u6587\u66f8\u3092\u5c55\u958b\u3059\u308b\u3068\u3001\u96e3\u8aad\u5316\u3055\u308c\u3066\u3044\u306a\u3044\u753b\u50cf\u306f\u3001\u6a19\u7684\u56fd\u306eNATO\u30ef\u30fc\u30af\u30b7\u30e7\u30c3\u30d7\u306b\u95a2\u3059\u308b\u30ab\u30d0\u30fc \u30da\u30fc\u30b8\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3042\u3063\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u4ed6\u306e2\u3064\u306e\u6587\u66f8\u306f\u76f8\u4e92\u306b\u9177\u4f3c\u3057\u3066\u3044\u308b\u30eb\u30a2\u30fc\u3067\u3001\u6a19\u7684\u306b\u6587\u5b57\u5316\u3051\u3057\u305f\u30c6\u30ad\u30b9\u30c8\u3092\u63d0\u793a\u3057\u3001\u88ab\u5bb3\u8005\u306b\u6587\u66f8\u3092\u6b63\u3057\u304f\u8868\u793a\u3059\u308b\u65b9\u6cd5\u3092\u6307\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u8208\u5473\u6df1\u3044\u3053\u3068\u306b\u3001\u6587\u66f8\u306e1\u3064\u306f\u30ed\u30b7\u30a2\u8a9e\u3067\u6307\u793a\u304c\u8a18\u8f09\u3055\u308c\u3066\u304a\u308a\u3001\u30ed\u30b7\u30a2\u8a9e\u304c\u4f7f\u7528\u3055\u308c\u308b\u56fd\u3092\u6a19\u7684\u3068\u3057\u3066\u3044\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u5175\u5668\u5316\u3055\u308c\u305f\u5404\u6587\u66f8\u306f\u3001\u653b\u6483\u3067\u540c\u3058\u6226\u7565\u3092\u7528\u3044\u3066\u3044\u307e\u3057\u305f\u3002\u6587\u66f8\u3092\u958b\u304f\u3068\u3001Microsoft Word\u306e\u6a5f\u80fd\u3092\u5229\u7528\u3057\u3066\u3001\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u304c\u53d6\u5f97\u3055\u308c\u3001\u60aa\u610f\u306e\u3042\u308b\u30de\u30af\u30ed\u6587\u66f8\u304c\u30ed\u30fc\u30c9\u3055\u308c\u307e\u3059(\u56f34\u53c2\u7167)\u3002<\/p>\n<p>&nbsp;<\/p>\n<p><img width=\"500\" height=\"303\"  class=\"wp-image-103902 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-57.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-57.png 500w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-57-300x182.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-57-370x224.png 370w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f34 Microsoft Word\u306b\u3088\u308b\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/em><\/span><\/p>\n<p>\u6587\u66f8\u304c\u958b\u304b\u308c\u305f\u6642\u70b9\u3067C2\u30b5\u30fc\u30d0\u30fc\u304c\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u5834\u5408\u3001\u60aa\u610f\u306e\u3042\u308b\u30de\u30af\u30ed\u306e\u53d6\u5f97\u306b\u6210\u529f\u3057\u3001\u540c\u3058Microsoft Word\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u30de\u30af\u30ed\u304c\u30ed\u30fc\u30c9\u3055\u308c\u307e\u3059\u3002\u88ab\u5bb3\u8005\u306b\u306f\u3001\u60aa\u610f\u306e\u3042\u308b\u30de\u30af\u30ed\u6587\u66f8\u3068\u3068\u3082\u306b\u3001\u300cEnable Content(\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u6709\u52b9\u5316\uff09\u300d\u3092\u6c42\u3081\u308b\u6307\u793a\u304c\u8868\u793a\u3055\u308c\u307e\u3059(\u56f35\u53c2\u7167)\u3002C2\u30b5\u30fc\u30d0\u30fc\u304c\u3053\u306e\u6642\u70b9\u3067\u30a2\u30af\u30c6\u30a3\u30d6\u3067\u306a\u3044\u5834\u5408\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u306f\u5931\u6557\u3057\u307e\u3059\u3002\u30de\u30af\u30ed\u304c\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u306a\u3044\u305f\u3081\u3001\u88ab\u5bb3\u8005\u306b\u300cEnable Content(\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u6709\u52b9\u5316\uff09\u300d\u3092\u6c42\u3081\u308b\u6307\u793a\u306f\u8868\u793a\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\n<p><img width=\"500\" height=\"354\"  class=\"wp-image-103904 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-58.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-58.png 500w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-58-300x212.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-58-370x262.png 370w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f35 \u30e6\u30fc\u30b6\u30fc\u306b\u300cEnable Content(\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u6709\u52b9\u5316\uff09\u300d\u3092\u30af\u30ea\u30c3\u30af\u3055\u305b\u3066\u30de\u30af\u30ed\u3092\u5b9f\u884c\u3055\u305b\u3088\u3046\u3068\u3059\u308b\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u6587\u66f8<\/em><\/span><\/p>\n<h3>\u30af\u30e9\u30b9\u30bf\u5316<\/h3>\n<p>10\u6708\u304a\u3088\u307311\u6708\u306e\u4e00\u9023\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u914d\u4fe1\u6587\u66f8\u306b\u306f\u591a\u304f\u306e\u985e\u4f3c\u70b9\u304c\u3042\u308a\u307e\u3057\u305f(\u88681\u53c2\u7167)\u3002\u3053\u308c\u306b\u3088\u3063\u3066\u3001\u5f0a\u793e\u306f\u3001\u6d3b\u52d5\u3092\u30af\u30e9\u30b9\u30bf\u5316\u3067\u304d\u307e\u3057\u305f\u3002\u7279\u7b46\u3059\u3079\u304d\u3053\u3068\u306f\u3001Joohn\u3068\u3044\u3046\u4f5c\u8005\u540d\u304c\u5404\u914d\u4fe1\u6587\u66f8\u3067\u7e70\u308a\u8fd4\u3057\u4f7f\u7528\u3055\u308c\u3066\u3044\u305f\u3053\u3068\u3067\u3059\u300211\u6708\u306e\u30b0\u30eb\u30fc\u30d7\u3067\u306f\u308f\u305a\u304b\u306a\u9038\u8131\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u53ce\u96c6\u3057\u305f3\u3064\u306e\u30b5\u30f3\u30d7\u30eb\u3067\u3001\u6700\u7d42\u5909\u66f4\u8005\u30d5\u30a3\u30fc\u30eb\u30c9\u3067\u306f\u4f9d\u7136\u3068\u3057\u3066Joohn\u306e\u4f5c\u8005\u540d\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u305f\u3082\u306e\u306e\u3001\u4f5c\u6210\u8005\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u306eUSER\/user\u3068\u3044\u3046\u4f5c\u6210\u8005\u540d\u306b\u623b\u3063\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30cf\u30c3\u30b7\u30e5<\/strong><\/td>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td><strong>\u4f5c\u6210\u8005<\/strong><\/td>\n<td><strong>\u6700\u7d42\u5909\u66f4\u8005<\/strong><\/td>\n<td><strong>\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3<\/strong><\/td>\n<td><strong>\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u30cf\u30c3\u30b7\u30e5<\/strong><\/td>\n<\/tr>\n<tr>\n<td>c20e5d56b3..<\/td>\n<td>1500029.docx<\/td>\n<td>Joohn<\/td>\n<td>Joohn<\/td>\n<td>185.203.118[.]198<\/td>\n<td>86bb3b00bc..<\/td>\n<\/tr>\n<tr>\n<td>abfc14f7f7..<\/td>\n<td>Passport.docx<\/td>\n<td>Joohn<\/td>\n<td>Joohn<\/td>\n<td>185.203.118[.]198<\/td>\n<td>86bb3b00bc..<\/td>\n<\/tr>\n<tr>\n<td>40318f3593..<\/td>\n<td>DN_325_170428_DEA Basic Narcotics Investigation Course invitation.docx<\/td>\n<td>Joohn<\/td>\n<td>Joohn<\/td>\n<td>145.249.105[.]165<\/td>\n<td>2da5a388b8..<\/td>\n<\/tr>\n<tr>\n<td>5749eb9d7b..<\/td>\n<td>2018_10_13_17_15_21.docx<\/td>\n<td>Joohn<\/td>\n<td>Joohn<\/td>\n<td>145.249.105[.]165<\/td>\n<td>0d7b945b9c..<\/td>\n<\/tr>\n<tr>\n<td>2cfc4b3686..<\/td>\n<td>crash list(Lion Air Boeing 737).docx<\/td>\n<td>Joohn<\/td>\n<td>Joohn<\/td>\n<td>188.241.58[.]170<\/td>\n<td>f1e2bceae8..<\/td>\n<\/tr>\n<tr>\n<td>af77e845f1..<\/td>\n<td>\u0417\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u0435.docx<\/td>\n<td>Joohn<\/td>\n<td>Joohn<\/td>\n<td>188.241.58[.]170<\/td>\n<td>fc69fb278e..<\/td>\n<\/tr>\n<tr>\n<td>34bdb5b364..<\/td>\n<td>Rocket attacks on Israel.docx<\/td>\n<td>user<\/td>\n<td>Joohn<\/td>\n<td>109.248.148[.]42<\/td>\n<td>ed8f52cdfc..<\/td>\n<\/tr>\n<tr>\n<td>79bd5f3486..<\/td>\n<td>201811131257.docx<\/td>\n<td>USER<\/td>\n<td>Joohn<\/td>\n<td>109.248.148[.]42<\/td>\n<td>b9f3af84a6..<\/td>\n<\/tr>\n<tr>\n<td>77ff53211b..<\/td>\n<td>Brexit 15.11.2018.docx<\/p>\n<p>&nbsp;<\/p>\n<p>DIP 89 OIC Condemns 14 Nov Attacks.docx<\/p>\n<p>15.11 attacks.docx<\/td>\n<td>USER<\/td>\n<td>Joohn<\/td>\n<td>109.248.148[.]42<\/td>\n<td>&lt;\u4e0d\u660e&gt;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88681 Dear Joohn\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u78ba\u8a8d\u3055\u308c\u305f\u914d\u4fe1\u6587\u66f8<\/em><\/span><\/p>\n<p>\u88681\u306e\u914d\u4fe1\u6587\u66f8\u306b\u3088\u3063\u3066\u53d6\u5f97\u3055\u308c\u308b\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u6587\u66f8\u3082\u3001\u6587\u5b57\u5217xxx\u3092\u4f7f\u7528\u3057\u3066\u5171\u901a\u306e\u4f5c\u6210\u8005\u540d\u3092\u793a\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u88682\u306f\u3001\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u914d\u4fe1\u6587\u66f8\u306b\u3088\u3063\u3066\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u308b\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30ec\u30dd\u30fc\u30c8\u306e\u8868\u304a\u3088\u3073\u30c6\u30ad\u30b9\u30c8\u3067\u306f\u3001\u8aad\u307f\u3084\u3059\u3055\u3092\u8003\u616e\u3057\u3066\u3001SHA256\u30cf\u30c3\u30b7\u30e5\u306e\u77ed\u7e2e\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u30b5\u30f3\u30d7\u30eb\u3092\u53c2\u7167\u3057\u3066\u3044\u307e\u3059\u3002\u30cf\u30c3\u30b7\u30e5\u5168\u4f53\u304a\u3088\u3073\u30e1\u30bf\u30c7\u30fc\u30bf\u306f\u3001CSV\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u3067<a href=\"https:\/\/github.com\/pan-unit42\/iocs\/blob\/master\/dearjoohn\/dearjoohn_iocs.csv\">\u3053\u3061\u3089<\/a>\u304b\u3089\u5165\u624b\u3067\u304d\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30cf\u30c3\u30b7\u30e5<\/strong><\/td>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td><strong>\u4f5c\u6210\u8005<\/strong><\/td>\n<td><strong>\u4f5c\u6210\u65e5<\/strong><\/td>\n<td><strong>\u6700\u7d42\u5909\u66f4\u65e5<\/strong><\/td>\n<td><strong>\u30db\u30b9\u30c8IP<\/strong><\/td>\n<\/tr>\n<tr>\n<td>f1e2bceae8..<\/td>\n<td>office.dotm<\/td>\n<td>xxx<\/td>\n<td>10\/31\/18 10:52<\/td>\n<td>10\/31\/18 10:52<\/td>\n<td>188.241.58[.]170<\/td>\n<\/tr>\n<tr>\n<td>86bb3b00bc..<\/td>\n<td>Note_template.dotm<\/td>\n<td>xxx<\/td>\n<td>10\/17\/18 05:35<\/td>\n<td>10\/17\/18 05:35<\/td>\n<td>185.203.118[.]198<\/td>\n<\/tr>\n<tr>\n<td>2da5a388b8..<\/td>\n<td>release.dotm<\/td>\n<td>xxx<\/td>\n<td>10\/25\/18 07:06<\/td>\n<td>10\/25\/18 07:06<\/td>\n<td>145.249.105[.]165<\/td>\n<\/tr>\n<tr>\n<td>0d7b945b9c..<\/td>\n<td>message_template.dotm<\/td>\n<td>xxx<\/td>\n<td>10\/23\/18 13:55<\/td>\n<td>10\/23\/18 13:55<\/td>\n<td>145.249.105[.]165<\/td>\n<\/tr>\n<tr>\n<td>fc69fb278e..<\/td>\n<td>documents.dotm<\/td>\n<td>xxx<\/td>\n<td>11\/01\/18 05:00<\/td>\n<td>11\/01\/18 05:06<\/td>\n<td>188.241.58[.]170<\/td>\n<\/tr>\n<tr>\n<td>ed8f52cdfc..<\/td>\n<td>templates.dotm<\/td>\n<td>xxx<\/td>\n<td>11\/13\/18 10:52<\/td>\n<td>11\/13\/18 10:52<\/td>\n<td>109.248.148[.]42<\/td>\n<\/tr>\n<tr>\n<td>b9f3af84a6..<\/td>\n<td>attachedTemplate.dotm<\/td>\n<td>xxx<\/td>\n<td>11\/15\/18 05:35<\/td>\n<td>11\/15\/18 05:35<\/td>\n<td>109.248.148[.]42<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88682 Dear Joohn\u914d\u4fe1\u6587\u66f8\u3067\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u308b\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8<\/em><\/span><\/p>\n<p>\u88681\u306b\u793a\u3057\u305f\u3068\u304a\u308a\u3001\u914d\u4fe1\u6587\u66f8\u306f\u3001\u4ee5\u4e0b\u306eIP\u30a2\u30c9\u30ec\u30b9\u306e4\u53f0\u306eC2\u30b5\u30fc\u30d0\u30fc\u304b\u3089\u500b\u3005\u306e\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li>203.118[.]198<\/li>\n<li>249.105[.]16<\/li>\n<li>241.58[.]170<\/li>\n<li>248.148[.]42<\/li>\n<\/ul>\n<p>\u3053\u308c\u3089\u306e\u6700\u521d\u306eC2 IP\u30a2\u30c9\u30ec\u30b9\u306f\u3001\u5f8c\u306b\u7b2c1\u6bb5\u968e\u306eZebrocy\u30da\u30a4\u30ed\u30fc\u30c9\u307e\u305f\u306fCannon\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30ed\u30fc\u30c9\u3059\u308b\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3060\u3051\u3067\u306a\u304f\u3001\u7b2c1\u6bb5\u968e\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u81ea\u4f53\u306eC2\u30b5\u30fc\u30d0\u30fc\u3082\u30db\u30b9\u30c8\u3057\u3066\u3044\u307e\u3057\u305f\u3002Dear Joohn\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u4f7f\u7528\u3055\u308c\u305f\u3059\u3079\u3066\u306eC2\u306fIP\u30d9\u30fc\u30b9\u3067\u3001\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u8abf\u3079\u3066\u3082\u3001\u4ee5\u524d\u306eZebrocy\u307e\u305f\u306fSofacy\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3068\u306e\u91cd\u5927\u306a\u91cd\u8907\u3084\u95a2\u4fc2\u6027\u306f\u8a8d\u3081\u3089\u308c\u307e\u305b\u3093\u3067\u3057\u305f\u3002Dear Joohn\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u308f\u304b\u308a\u3084\u3059\u304f\u56f3\u3067\u8868\u3059\u3068\u3001\u56f36\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p><img width=\"1651\" height=\"917\"  class=\"wp-image-103906 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-11.jpeg\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11.jpeg 1651w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11-300x167.jpeg 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11-1024x569.jpeg 1024w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11-768x427.jpeg 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11-1536x853.jpeg 1536w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11-900x500.jpeg 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-11-370x206.jpeg 370w\" sizes=\"(max-width: 1651px) 100vw, 1651px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f3 6 \u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u306e\u76f8\u95a2\u56f3\u00a0<\/em><\/span><\/p>\n<p>\u5f0a\u793e\u306f\u3001\u53ce\u96c6\u3057\u305f\u30c7\u30fc\u30bf\u306b\u57fa\u3065\u3044\u3066\u6d3b\u52d5\u306e\u6642\u7cfb\u5217\u3092\u4f5c\u6210\u3057\u307e\u3057\u305f\u3002\u88683\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3092\u4f7f\u7528\u3057\u3066\u3001\u653b\u6483\u65e5\u306f10\u6708\u4e2d\u65ec\u304b\u3089\u5f8c\u534a\u300111\u6708\u534a\u3070\u306e2\u3064\u306e\u6ce2\u306b\u5bc6\u96c6\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f(\u56f37\u53c2\u7167)\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td><strong>\u4f5c\u6210\u65e5<\/strong><\/td>\n<td><strong>\u6700\u7d42\u5909\u66f4\u65e5<\/strong><\/td>\n<td><strong>\u521d\u56de\u89b3\u6e2c\u65e5<\/strong><\/td>\n<td><strong>\u5408\u8a08\u6642\u9593(\u65e5\u6570)<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Passport.docx<br \/>\ninstruction.docx<\/td>\n<td>9\/11\/18 04:22<\/td>\n<td>10\/13\/18 08:21<\/td>\n<td>10\/18\/18 07:38<\/td>\n<td>37.1<\/td>\n<\/tr>\n<tr>\n<td>DN_325_170428_DEA\u2026invitation.docx<\/td>\n<td>9\/11\/18 04:22<\/td>\n<td>10\/13\/18 08:21<\/td>\n<td>10\/25\/18 08:15<\/td>\n<td>44.12<\/td>\n<\/tr>\n<tr>\n<td>crash list(Lion Air Boeing 737).docx<br \/>\n\u0411\u0443\u0440\u0445\u0430\u043d\u043e\u0432.docx<\/td>\n<td>9\/11\/18 04:22<\/td>\n<td>10\/13\/18 08:21<\/td>\n<td>11\/01\/18 06:50<\/td>\n<td>51.1<\/td>\n<\/tr>\n<tr>\n<td>\u0417\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u0435.docx<\/td>\n<td>9\/11\/18 04:22<\/td>\n<td>10\/13\/18 08:21<\/td>\n<td>11\/01\/18 11:41<\/td>\n<td>51.3<\/td>\n<\/tr>\n<tr>\n<td>1500029.docx<\/td>\n<td>10\/18\/18 06:59<\/td>\n<td>10\/18\/18 07:00<\/td>\n<td>10\/18\/18 08:47<\/td>\n<td>0.4<\/td>\n<\/tr>\n<tr>\n<td>2018_10_13_17_15_21.docx<\/td>\n<td>10\/18\/18 06:59<\/td>\n<td>10\/18\/18 07:00<\/td>\n<td>10\/24\/18 07:38<\/td>\n<td>6.2<\/td>\n<\/tr>\n<tr>\n<td>Rocket attacks on Israel.docx<\/td>\n<td>11\/13\/18 12:17<\/td>\n<td>11\/13\/18 10:46<\/td>\n<td>11\/14\/18 05:14<\/td>\n<td>0.7<\/td>\n<\/tr>\n<tr>\n<td>Brexit 15.11.2018.docx<br \/>\nDIP 89 OIC Condemns 14 Nov Attacks.docx<br \/>\n15.11 attacks.docx<\/td>\n<td>11\/14\/18 14:17<\/td>\n<td>11\/15\/18 04:50<\/td>\n<td>11\/15\/18 06:28<\/td>\n<td>0.8<\/td>\n<\/tr>\n<tr>\n<td>201811131257.docx<\/td>\n<td>11\/14\/18 14:33<\/td>\n<td>11\/15\/18 04:50<\/td>\n<td>11\/15\/18 12:31<\/td>\n<td>0.9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88683 \u914d\u4fe1\u6587\u66f8\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7(\u3059\u3079\u3066\u5354\u5b9a\u4e16\u754c\u6642)<\/em><\/span><\/p>\n<p><img width=\"4381\" height=\"1889\"  class=\"wp-image-103908 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-59.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59.png 4381w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-300x129.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-1024x442.png 1024w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-768x331.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-1536x662.png 1536w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-2048x883.png 2048w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-900x388.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-59-370x160.png 370w\" sizes=\"(max-width: 4381px) 100vw, 4381px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f37 Dear Joohn\u306e\u6642\u7cfb\u5217<\/em><\/span><\/p>\n<p>\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u306b\u57fa\u3065\u3044\u3066\u30014\u3064\u306e\u914d\u4fe1\u6587\u66f8\u304c\u3001\u6700\u521d\u306b2018\u5e749\u670811\u65e54\u664222\u5206(\u5354\u5b9a\u4e16\u754c\u6642)\u306b\u4f5c\u6210\u3055\u308c\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u307e\u305f\u3001\u3053\u306e4\u3064\u306e\u6587\u66f8\u306f\u3001\u3059\u3079\u3066\u540c\u3058\u65e5\u6642\u306e2018\u5e7410\u670813\u65e58\u664221\u5206\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u30023\u3064\u306e\u7570\u306a\u308bC2\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u5404\u914d\u4fe1\u6587\u66f8\u5185\u306b\u7d44\u307f\u8fbc\u307e\u308c\u3066\u3044\u308b\u4e00\u65b9\u3067\u3001\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u304c\u307e\u3063\u305f\u304f\u540c\u3058\u3067\u3042\u308b\u3053\u3068\u306f\u3001\u81ea\u52d5\u5316\u30c4\u30fc\u30eb\u304c\u4f7f\u7528\u3055\u308c\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002Phishery\u306a\u3069\u3001\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3 \u30d9\u30fc\u30b9\u306e\u4fb5\u5165\u30c6\u30b9\u30c8 \u30c4\u30fc\u30eb\u30ad\u30c3\u30c8\u3092\u4f7f\u7528\u3059\u308c\u3070\u3001\u7c21\u5358\u306a\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\u3067\u3001\u540c\u3058\u6642\u9593\u306b\u7570\u306a\u308b\u5165\u529b\u3067\u8907\u6570\u306e\u6587\u66f8\u3092\u751f\u6210\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u3053\u306e\u6642\u70b9\u304b\u3089\u3001\u6700\u521d\u306b\u6587\u66f8\u304c\u89b3\u6e2c\u3055\u308c\u308b\u307e\u3067\u3001\u5e73\u57472\u9031\u9593\u306e\u9593\u9694\u304c\u3042\u308a\u307e\u3057\u305f\u30024\u3064\u306e\u6587\u66f8\u5168\u4f53\u3067\u306f\u3001\u6700\u521d\u306b\u4f5c\u6210\u3055\u308c\u3066\u304b\u3089\u653b\u6483\u307e\u3067\u3001\u5e73\u5747\u7d0446\u65e5\u9593\u304b\u304b\u3063\u3066\u3044\u307e\u3059\u3002Dear Joohn\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u653b\u6483\u304c\u30e2\u30b8\u30e5\u30fc\u30eb\u65b9\u5f0f\u3067\u3042\u308b\u3053\u3068\u304b\u3089\u3001\u6700\u521d\u306e\u4f5c\u6210\u304b\u3089\u653b\u6483\u307e\u3067\u306e\u6642\u9593\u304c\u975e\u5e38\u306b\u9577\u3044\u3053\u3068\u306f\u3001\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3001\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3082\u958b\u767a\u3059\u308b\u5fc5\u8981\u304c\u3042\u3063\u305f\u305f\u3081\u306b\u3001\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5c55\u958b\u3059\u308b\u6e96\u5099\u306b\u6642\u9593\u304c\u304b\u304b\u3063\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3082\u30461\u3064\u306e\u8003\u3048\u3089\u308c\u308b\u30b7\u30ca\u30ea\u30aa\u306f\u3001\u653b\u6483\u8005\u304c\u7279\u5b9a\u306e\u671f\u9593\u306b\u653b\u6483\u3092\u5b9f\u884c\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u305f\u3068\u3044\u3046\u53ef\u80fd\u6027\u3067\u3059\u3002\u6642\u7cfb\u5217\u304b\u3089\u660e\u767d\u306a\u306e\u306f\u3001\u6a19\u7684\u3068\u306a\u3063\u3066\u3044\u308b2\u3064\u306e\u660e\u78ba\u306a\u671f\u9593\u304c\u3042\u308b\u3053\u3068\u3067\u30011\u3064\u306f2018\u5e7410\u6708\u4e2d\u65ec\u304b\u3089\u5f8c\u534a\u306b\u304b\u3051\u3066\u3001\u3082\u30461\u3064\u306f2018\u5e7411\u6708\u534a\u3070\u3067\u3059\u3002\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u304c\u9032\u884c\u3059\u308b\u306b\u3064\u308c\u3066\u3001Dear Joohn\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u6d3b\u52d5\u30b9\u30d4\u30fc\u30c9\u304c\u901f\u304f\u306a\u308a\u3001\u6587\u66f8\u4f5c\u6210\u304b\u3089\u6700\u521d\u306b\u89b3\u6e2c\u3055\u308c\u308b\u307e\u3067\u306e\u5408\u8a08\u6642\u9593\u304c\u5e73\u5747\u7d042\u65e5\u9593\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u63d0\u4f9b\u3055\u308c\u305f\u914d\u4fe1\u6587\u66f8\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3068\u3001\u88682\u306b\u793a\u3059\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u6587\u66f8\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3092\u6bd4\u8f03\u3059\u308b\u3068\u3001\u653b\u6483\u307e\u3067\u306e\u6642\u9593\u304c\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u6700\u7d42\u5909\u66f4\u6642\u3068\u76f4\u63a5\u76f8\u95a2\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u6587\u66f8\u304c\u6700\u5f8c\u306b\u5909\u66f4\u3055\u308c\u305f\u6642\u9593\u3068\u914d\u4fe1\u6587\u66f8\u304c\u6700\u521d\u306b\u5b9f\u969b\u306b\u89b3\u6e2c\u3055\u308c\u305f\u6642\u9593\u306b\u306f\u3001\u5e73\u574713.8\u6642\u9593\u306e\u9593\u9694\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u3053\u3068\u304b\u3089\u3001\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306f\u3001\u6bb5\u968e\u7684\u306a\u4f5c\u696d\u3067\u3042\u308b\u3068\u5f0a\u793e\u306f\u8003\u3048\u3066\u3044\u307e\u3059\u3002\u3064\u307e\u308a\u3001\u6700\u521d\u306b\u6587\u66f8\u3092\u4f5c\u6210\u3057\u3001C2\u3068\u306e\u901a\u4fe1\u7528\u306b\u6587\u66f8\u3092\u5909\u66f4\u3057\u3001\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u6587\u66f8\u3092\u751f\u6210\u3057\u3066\u304b\u3089\u3001\u5b9f\u969b\u306e\u653b\u6483\u304c\u958b\u59cb\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u3057\u304b\u3057\u3001\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3092\u4f7f\u7528\u3057\u305f\u5206\u6790\u304c\u5e38\u306b\u78ba\u5b9f\u3067\u3042\u308b\u3068\u306f\u304b\u304e\u308a\u307e\u305b\u3093\u3002Rocket attacks on Israel.docx (SHA256: 34bdb5b364..)\u3068\u3044\u3046\u5f0a\u793e\u304c\u8abf\u3079\u305f\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u6587\u66f8\u306b\u306f\u3001\u4e00\u8cab\u6027\u306e\u306a\u3044\u4f5c\u6210\u65e5\u3068\u6700\u7d42\u5909\u66f4\u65e5\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u304c\u542b\u307e\u308c\u3066\u304a\u308a\u3001\u6700\u7d42\u5909\u66f4\u65e5\u304c\u4f5c\u6210\u65e5\u3088\u308a<em>\u524d<\/em>\u306e\u65e5\u4ed8\u3067\u3057\u305f\u3002\u3053\u308c\u306b\u3064\u3044\u3066\u306f\u3001\u3042\u308b\u30b7\u30b9\u30c6\u30e0\u3067\u6587\u66f8\u304c\u5909\u66f4\u3055\u308c\u3066\u304b\u3089\u3001\u5f8c\u306b\u5225\u306e\u30b7\u30b9\u30c6\u30e0\u306b\u30b3\u30d4\u30fc\u3055\u308c\u305f\u3068\u8aac\u660e\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3067\u3059\u3002\u3053\u306e\u5834\u5408\u306f\u3001\u4f5c\u6210\u65e5\u304c\u6700\u7d42\u5909\u66f4\u65e5\u3088\u308a\u5f8c\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u6587\u66f8\u306f\u3001\u4f5c\u6210\u8005\u540d\u3068\u3057\u3066Joohn\u3067\u306f\u306a\u304fuser\/USER\u304c\u4f7f\u7528\u3055\u308c\u300111\u6708\u4e2d\u65ec\u306b\u89b3\u6e2c\u3055\u308c\u305f\u30af\u30e9\u30b9\u30bf\u306e\u521d\u671f\u306e\u3082\u306e\u3067\u3059\u3002\u3053\u306e\u3053\u3068\u306f\u3001\u30b7\u30b9\u30c6\u30e0\u9593\u3067\u6587\u66f8\u304c\u30b3\u30d4\u30fc\u3055\u308c\u305f\u3068\u3044\u3046\u4eee\u8aac\u3092\u3055\u3089\u306b\u88cf\u4ed8\u3051\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3>\u30da\u30a4\u30ed\u30fc\u30c9<\/h3>\n<p>\u3053\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u914d\u4fe1\u6587\u66f8\u3067\u306f\u3001\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u304c\u30ed\u30fc\u30c9\u3055\u308c\u3001\u305d\u306e\u30de\u30af\u30ed\u306b\u3088\u3063\u3066\u3055\u307e\u3056\u307e\u306a\u7b2c1\u6bb5\u968e\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u307e\u3057\u305f\u3002Cannon\u30c4\u30fc\u30eb\u306f\u660e\u3089\u304b\u306b\u4f8b\u5916\u3067\u3059\u304c\u3001\u7b2c1\u6bb5\u968e\u306e\u30c4\u30fc\u30eb\u306f\u3059\u3079\u3066Zebrocy\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u4e9c\u7a2e\u3067\u3059\u3002\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u914d\u4fe1\u3055\u308c\u305fZebrocy\u4e9c\u7a2e\u306f\u3001Delphi\u3001C#\u3001VB.NET\u3092\u542b\u3080\u3055\u307e\u3056\u307e\u306a\u8a00\u8a9e\u3067\u8a18\u8ff0\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u3067\u914d\u4fe1\u3055\u308c\u305f\u7b2c1\u6bb5\u968e\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u3001\u88684\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>SHA256<\/strong><\/td>\n<td><strong>\u30b3\u30f3\u30d1\u30a4\u30eb\u65e5<\/strong><\/td>\n<td><strong>\u4e9c\u7a2e<\/strong><\/td>\n<td><strong>C2<\/strong><\/td>\n<\/tr>\n<tr>\n<td>5173721f30..<\/td>\n<td>10\/23\/18<\/td>\n<td>C# Zebrocy<\/td>\n<td>145.249.105[.]165<\/td>\n<\/tr>\n<tr>\n<td>61a1f3b4fb..<\/td>\n<td>11\/1\/18<\/td>\n<td>C# Cannon<\/td>\n<td>sahro.bella7[at]post.cz<\/td>\n<\/tr>\n<tr>\n<td>6ad3eb8b56..<\/td>\n<td>6\/19\/92<\/td>\n<td>Delphi Zebrocy<\/td>\n<td>188.241.58[.]170<\/td>\n<\/tr>\n<tr>\n<td>9a0f00469d..<\/td>\n<td>10\/25\/18<\/td>\n<td>C# Zebrocy<\/td>\n<td>145.249.105[.]165<\/td>\n<\/tr>\n<tr>\n<td>b41480d685..<\/td>\n<td>6\/19\/92<\/td>\n<td>Delphi Zebrocy<\/td>\n<td>109.248.148[.]42<\/td>\n<\/tr>\n<tr>\n<td>c91843a69d..<\/td>\n<td>6\/19\/92<\/td>\n<td>Delphi Zebrocy<\/td>\n<td>185.203.118[.]198<\/td>\n<\/tr>\n<tr>\n<td>e5aece694d..<\/td>\n<td>11\/13\/18<\/td>\n<td>VB.NET Zebrocy<\/td>\n<td>109.248.148[.]42<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88684 \u95a2\u9023\u3059\u308b\u653b\u6483\u3067\u914d\u4fe1\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9<\/em><\/span><\/p>\n<p>\u3053\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u914d\u4fe1\u3055\u308c\u305fZebrocy\u306eDelphi\u4e9c\u7a2e\u306f\u3001\u4ee5\u524d\u306e<a href=\"https:\/\/unit42.paloaltonetworks.jp\/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan\/\">2018\u5e746\u6708\u306b\u516c\u958b\u3055\u308c\u305fZebrocy\u8abf\u67fb<\/a>\u3067\u8aac\u660e\u3057\u305fDelphi\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u306b\u975e\u5e38\u306b\u3088\u304f\u4f3c\u3066\u3044\u307e\u3059\u3002\u3053\u306eDelphi\u4e9c\u7a2e\u306f\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u3053\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u914d\u4fe1\u3055\u308c\u305fC#\u304a\u3088\u3073VB.NET\u4e9c\u7a2e\u306f\u3053\u308c\u307e\u3067\u672a\u78ba\u8a8d\u306e\u3082\u306e\u3067\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3067\u8208\u5473\u6df1\u3044\u70b9\u306f\u3001\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u914d\u4fe1\u3055\u308c\u305f\u3059\u3079\u3066\u306eDelphi\u30da\u30a4\u30ed\u30fc\u30c9\u304cUPX\u3067\u5727\u7e2e\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u305d\u306e\u4ed6\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u4e00\u5207\u5727\u7e2e\u3055\u308c\u3066\u3044\u306a\u304b\u3063\u305f\u3053\u3068\u3067\u3059\u3002\u7279\u5b9a\u306e\u7406\u7531\u3092\u63a8\u6e2c\u3059\u308b\u3053\u3068\u3057\u304b\u3067\u304d\u307e\u305b\u3093\u304c\u3001\u304a\u305d\u3089\u304f\u3001Zebrocy\u306eDelphi\u4e9c\u7a2e\u306f\u78ba\u8a8d\u3055\u308c\u3066\u304a\u308a\u3001\u5e83\u304f\u5206\u6790\u3055\u308c\u3066\u3044\u308b\u305f\u3081\u3001\u56de\u907f\u624b\u6bb5\u3092\u5897\u3084\u3059\u305f\u3081\u306bSofacy\u306fDelphi\u4e9c\u7a2e\u306e\u307f\u3092\u5727\u7e2e\u3057\u305f\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n<p>\u8ffd\u52a0\u306eCannon\u30b5\u30f3\u30d7\u30eb\u3092\u53ce\u96c6\u304a\u3088\u3073\u5206\u6790\u3059\u308b\u3053\u3068\u3067\u3001Delphi\u3067\u8a18\u8ff0\u3055\u308c\u305fCannon\u4e9c\u7a2e\u3068\u601d\u308f\u308c\u308b\u3082\u306e\u3082\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002Sofacy\u304cZebrocy\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u4e9c\u7a2e\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u8907\u6570\u306e\u8a00\u8a9e\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3053\u3068\u306f\u308f\u304b\u3063\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u30b0\u30eb\u30fc\u30d7\u306f\u540c\u69d8\u306b\u8907\u6570\u306e\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u8a00\u8a9e\u3067Cannon\u306e\u8ffd\u52a0\u306e\u4e9c\u7a2e\u3092\u4f5c\u6210\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u305f\u3088\u3046\u3067\u3059\u3002<\/p>\n<h3>C# Cannon<\/h3>\n<p>\u5f0a\u793e\u306e<a href=\"https:\/\/unit42.paloaltonetworks.jp\/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan\/\">Cannon\u30c4\u30fc\u30eb\u3092\u7d39\u4ecb\u3057\u305f\u6700\u521d\u306e\u30d6\u30ed\u30b0<\/a>\u4ee5\u964d\u3001Cannon\u306e\u3088\u308a\u591a\u304f\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u53ce\u96c6\u3057\u3001\u305d\u306e\u8d77\u6e90\u306e\u7406\u89e3\u3092\u6df1\u3081\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002Cannon\u306e\u6700\u521d\u306e\u65e2\u77e5\u306e\u30b5\u30f3\u30d7\u30eb\u306f2018\u5e744\u670818\u65e5\u306b\u4f5c\u6210\u3055\u308c\u3001\u305d\u308c\u4ee5\u964d\u3001\u5c11\u306a\u304f\u3068\u30827\u3064\u306e\u8ffd\u52a0\u306e\u30b5\u30f3\u30d7\u30eb\u304c\u3042\u308b\u3088\u3046\u3067\u3059\u3002\u88685\u306b\u3001\u65e2\u77e5\u306eCannon\u30b5\u30f3\u30d7\u30eb\u3001\u305d\u308c\u305e\u308c\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u9593\u3001\u304a\u3088\u3073C2\u901a\u4fe1\u306b\u4f7f\u7528\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>SHA256<\/strong><\/td>\n<td><strong>\u30b3\u30f3\u30d1\u30a4\u30eb\u65e5<\/strong><\/td>\n<td><strong>C2\u30a2\u30ab\u30a6\u30f3\u30c8<\/strong><\/td>\n<td><strong>POP3S\u30a2\u30ab\u30a6\u30f3\u30c8<\/strong><\/td>\n<td><strong>SMTPS\u30a2\u30ab\u30a6\u30f3\u30c8<\/strong><\/td>\n<\/tr>\n<tr>\n<td>861b6bc1f9..<\/td>\n<td>4\/18\/18<\/td>\n<td>sym777.g<\/td>\n<td>kae.mezhnosh<\/td>\n<td>vebek.morozh30<\/p>\n<p>&nbsp;<\/p>\n<p>g0r7tsa45s<\/p>\n<p>marvel.polezha<\/td>\n<\/tr>\n<tr>\n<td>4405cfbf28..<\/td>\n<td>5\/14\/18<\/td>\n<td>sym777.g<\/td>\n<td>kae.mezhnosh<\/td>\n<td>vebek.morozh30<\/p>\n<p>&nbsp;<\/p>\n<p>g0r7tsa45s<\/p>\n<p>marvel.polezha<\/td>\n<\/tr>\n<tr>\n<td>174effcdee..<\/td>\n<td>6\/15\/18<\/td>\n<td>sym777.g<\/td>\n<td>kae.mezhnosh<\/td>\n<td>vebek.morozh30<\/p>\n<p>&nbsp;<\/p>\n<p>g0r7tsa45s<\/p>\n<p>marvel.polezha<\/td>\n<\/tr>\n<tr>\n<td>a23261e2b6..<\/td>\n<td>6\/22\/18<\/td>\n<td>sym777.g<\/td>\n<td>kae.mezhnosh<\/td>\n<td>vebek.morozh30<\/p>\n<p>&nbsp;<\/p>\n<p>g0r7tsa45s<\/p>\n<p>marvel.polezha<\/td>\n<\/tr>\n<tr>\n<td>651d5aab82..<\/td>\n<td>10\/19\/18<\/td>\n<td>sym777.g<\/td>\n<td>kae.mezhnosh<\/td>\n<td>vebek.morozh30<\/p>\n<p>&nbsp;<\/p>\n<p>g0r7tsa45s<\/p>\n<p>marvel.polezha<\/td>\n<\/tr>\n<tr>\n<td>68df0f924c..<\/td>\n<td>10\/22\/18<\/td>\n<td>sym777.g<\/td>\n<td>kae.mezhnosh<\/td>\n<td>vebek.morozh30<\/p>\n<p>&nbsp;<\/p>\n<p>g0r7tsa45s<\/p>\n<p>marvel.polezha<\/td>\n<\/tr>\n<tr>\n<td>61a1f3b4fb..<\/td>\n<td>11\/1\/18<\/td>\n<td>sahro.bella7<\/td>\n<td>trala.cosh2<\/td>\n<td>Bishtr.cam47<\/p>\n<p>&nbsp;<\/p>\n<p>Lobrek.chizh<\/p>\n<p>Cervot.woprov<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88685 \u53ce\u96c6\u3055\u308c\u305fC# Cannon\u30b5\u30f3\u30d7\u30eb<\/em><\/span><\/p>\n<p>\u6700\u521d\u306e\u30d6\u30ed\u30b0\u3067\u8ff0\u3079\u305f\u3068\u304a\u308a\u3001C2\u3068\u3057\u3066\u52d5\u4f5c\u3059\u308b\u653b\u6483\u8005\u5236\u5fa1\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u306fsahro.bella7[at]post.cz\u3067\u3057\u305f\u304c\u3001\u4ee5\u524d\u306eCannon\u306e\u5168\u30b5\u30f3\u30d7\u30eb\u3067\u306fsym777.g[at]post.cz\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u4ee5\u524d\u306eCannon\u306e\u5168\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u653b\u6483\u8005\u304b\u3089\u96fb\u5b50\u30e1\u30fc\u30eb\u3092<em>\u53d7\u4fe1<\/em>\u3059\u308b\u305f\u3081\u306bkae.mezhnosh\u3068\u3044\u3046\u30a2\u30ab\u30a6\u30f3\u30c8\u540d\u3092\u4f7f\u7528\u3059\u308b\u4e00\u65b9\u3001\u30a2\u30ab\u30a6\u30f3\u30c8vebek.morozh30, g0r7tsa45s\u304a\u3088\u3073marvel.polezha\u3092\u4f7f\u7528\u3057\u3066\u653b\u6483\u8005\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092<em>\u9001\u4fe1<\/em>\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>Cannon\u306e\u4ee5\u524d\u306e\u5206\u6790\u3067\u30ec\u30dd\u30fc\u30c8\u3057\u305f\u3068\u304a\u308a\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306fPOP3S\u3092\u4f7f\u7528\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3001\u30b7\u30b9\u30c6\u30e0\u306b\u4fdd\u5b58\u3057\u3066\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u7279\u5b9a\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3057\u307e\u3059\u3002\u5206\u6790\u3057\u305f\u6700\u521d\u306e\u30b5\u30f3\u30d7\u30eb\u306fauddevc.txt\u3068\u3044\u3046\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u63a2\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u4ed6\u306eCannon\u30b5\u30f3\u30d7\u30eb\u306f\u4ee3\u308f\u308a\u306b\u6b21\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u3092\u63a2\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"193\" height=\"82\"  class=\"wp-image-103910 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-60.png\" \/><\/p>\n<h3>Delphi Cannon<\/h3>\n<p>\u8ffd\u52a0\u306eCannon\u30b5\u30f3\u30d7\u30eb\u3092\u63a2\u3057\u3066\u3044\u308b\u3068\u304d\u306b\u3001C2\u901a\u4fe1\u7528\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4f7f\u7528\u3059\u308b\u5225\u306e\u30c4\u30fc\u30eb\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u6700\u521d\u306b\u767a\u898b\u3055\u308c\u305f\u4e00\u81f4\u70b9\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u540dwmssl.exe\u3067\u3059\u3002\u3053\u308c\u306f\u3001Cannon\u304c2\u756a\u76ee\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u3001wmssl.txt\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u79fb\u52d5\u3059\u308b\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u540d\u3068\u898b\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>\u6700\u521d\u306e\u5206\u6790\u3067\u306f\u3001\u95a2\u4fc2\u6027\u304c\u8584\u3044\u53ef\u80fd\u6027\u304c\u793a\u3055\u308c\u307e\u3057\u305f\u304c\u3001\u3055\u3089\u306bDelphi Cannon\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u53ce\u96c6\u3057\u305f\u5f8c\u3001\u8ffd\u52a0\u306e\u95a2\u4fc2\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u88686\u306b\u3001<a href=\"https:\/\/www.welivesecurity.com\/2018\/11\/20\/sednit-whats-going-zebrocy\/\">ESET\u306e\u8abf\u67fb<\/a>\u3067\u8aac\u660e\u3057\u305f\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u975e\u5e38\u306b\u3088\u304f\u4f3c\u305f\u30b5\u30f3\u30d7\u30eb215f7c08c2..\u3092\u542b\u3081\u3001\u5f0a\u793e\u304c\u53ce\u96c6\u3057\u305fDelphi Cannon\u30b5\u30f3\u30d7\u30eb\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>SHA256<\/strong><\/td>\n<td><strong>\u30b3\u30f3\u30d1\u30a4\u30eb\u65e5<\/strong><\/td>\n<td><strong>C2\u96fb\u5b50\u30e1\u30fc\u30eb<\/strong><\/td>\n<td><strong>POP3S\u30a2\u30ab\u30a6\u30f3\u30c8<\/strong><\/td>\n<td><strong>SMTPS\u30a2\u30ab\u30a6\u30f3\u30c8<\/strong><\/td>\n<\/tr>\n<tr>\n<td>5a02d4e5f6..<\/td>\n<td>1\/23\/18<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/td>\n<td>heatlth500@ambcomission[.]com<\/td>\n<td>trash023@ambcomission[.]com<\/td>\n<td>trasler22@ambcomission[.]com<\/td>\n<\/tr>\n<tr>\n<td>d06be83a40..<\/td>\n<td>2\/21\/18<\/td>\n<td>heatlth500@ambcomission[.]com<\/td>\n<td>trash023@ambcomission[.]com<\/td>\n<td>trasler22@ambcomission[.]com<\/td>\n<\/tr>\n<tr>\n<td>78adc8e5e4..<\/td>\n<td>2\/28\/18<\/td>\n<td>heatlth500@ambcomission[.]com<\/td>\n<td>trash023@ambcomission[.]com<\/td>\n<td>trasler22@ambcomission[.]com<\/td>\n<\/tr>\n<tr>\n<td>054c5aa73d..<\/td>\n<td>3\/3\/18<\/td>\n<td>heatlth500@ambcomission[.]com<\/td>\n<td>trash023@ambcomission[.]com<\/td>\n<td>trasler22@ambcomission[.]com<\/td>\n<\/tr>\n<tr>\n<td>cac630c11c..<\/td>\n<td>4\/18\/18<\/td>\n<td>N\/A<\/td>\n<td>N\/A<\/td>\n<td>N\/A<\/td>\n<\/tr>\n<tr>\n<td>ecc5805898..<\/td>\n<td>5\/4\/18<\/td>\n<td>heatlth500@ambcomission[.]com<\/td>\n<td>trash023@ambcomission[.]com<\/td>\n<td>trasler22@ambcomission[.]com<\/td>\n<\/tr>\n<tr>\n<td>215f7c08c2..<\/td>\n<td>6\/14\/18<\/td>\n<td>rishit333@ambcomission[.]com<\/td>\n<td>tomasso25@ambcomission[.]com<\/td>\n<td>kevin30@ambcomission[.]com<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88686 \u53ce\u96c6\u3055\u308c\u305fDelphi Cannon\u30b5\u30f3\u30d7\u30eb<\/em><\/span><\/p>\n<p>\u88686\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u9593\u306f\u3001Cannon\u306eDelphi\u4e9c\u7a2e\u304c\u5f53\u521d\u30ec\u30dd\u30fc\u30c8\u3055\u308c\u305f\u30d0\u30fc\u30b8\u30e7\u30f3\u3088\u308a\u524d\u304b\u3089\u5b58\u5728\u3059\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u6700\u521d\u306e\u65e2\u77e5\u306eDelphi\u30b5\u30f3\u30d7\u30eb\u304c2018\u5e741\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u3066\u3044\u308b\u306e\u306b\u5bfe\u3057\u3066\u3001\u6700\u521d\u306e\u65e2\u77e5\u306eCannon\u30b5\u30f3\u30d7\u30eb\u306f2018\u5e744\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u3066\u3044\u308b\u305f\u3081\u3067\u3059\u3002Cannon\u306eDelphi\u4e9c\u7a2e\u306f\u3001C2\u901a\u4fe1\u7528\u306b\u6b63\u898f\u306eWeb\u30d9\u30fc\u30b9\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u305b\u3093\u3002\u4ee3\u308f\u308a\u306b\u3001\u653b\u6483\u8005\u6240\u6709\u306e\u30c9\u30e1\u30a4\u30f3ambcomission[.]com\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u4f7f\u7528\u3092\u9078\u629e\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001<a href=\"https:\/\/threatconnect.com\/blog\/finding-nemohost-fancy-bear-infrastructure\/\">ThreatConnect<\/a>\u3067\u30ec\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u3068\u304a\u308a\u3001\u3088\u308a\u5927\u898f\u6a21\u306aSofacy\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3078\u306e\u30c9\u30e1\u30a4\u30f3 \u30ea\u30f3\u30af\u3092\u5236\u5fa1\u3057\u3066\u3044\u307e\u3057\u305f\u3002Delphi Cannon\u306f\u3001Cannon\u3068\u540c\u69d8\u306bC2\u901a\u4fe1\u306e\u305f\u3081\u306bPOP3S\u3068SMTPS\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u3057\u304b\u3057\u3001Seznam\u306a\u3069\u306e\u6b63\u898f\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30d7\u30ed\u30d0\u30a4\u30c0\u30fc\u3067\u306f\u306a\u304f\u3001\u9632\u5fa1\u62c5\u5f53\u8005\u304c\u5bb9\u6613\u306b\u30d6\u30ed\u30c3\u30af\u3067\u304d\u308b\u653b\u6483\u8005\u6240\u6709\u306e\u30c9\u30e1\u30a4\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u307b\u307c\u9593\u9055\u3044\u306a\u304f\u3001\u9632\u5fa1\u304c\u3088\u308a\u5bb9\u6613\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>Delphi\u4e9c\u7a2e\u306e\u6700\u53e4\u306e\u65e2\u77e5\u306e\u30b5\u30f3\u30d7\u30eb(SHA256: 5a02d4e5f6\u2026)\u306f\u3001\u3053\u306eDelphi Cannon\u3068Cannon\u3068\u306e\u9593\u306b\u306f\u308b\u304b\u306b\u5f37\u3044\u3064\u306a\u304c\u308a\u3092\u793a\u3057\u307e\u3057\u305f\u3002\u3064\u307e\u308a\u3001\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3001\u6587\u5b57\u5217Running place\u306b\u4ed8\u52a0\u3055\u308c\u305f\u5b9f\u884c\u30d7\u30ed\u30bb\u30b9\u306e\u30d1\u30b9\u3092\u542b\u3081\u3066\u3001C2\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u3078\u9001\u4fe1\u3057\u307e\u3059\u3002inf\u30e1\u30bd\u30c3\u30c9\u306e\u56f38\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8(Cannon \u30b5\u30f3\u30d7\u30eb(SHA256: 4405cfbf28\u2026)\u5185)\u306f\u3001\u7279\u306bRunningPlace\u304a\u3088\u3073LogicalDrives\u30d8\u30c3\u30c0\u30fc\u6587\u5b57\u5217\u3092\u542b\u3080\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4ecb\u3057\u3066C2\u3078\u3068\u7a83\u53d6\u3055\u308c\u3001\u53ce\u96c6\u3055\u308c\u305f\u60c5\u5831\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"500\" height=\"201\"  class=\"wp-image-103912 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-61.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-61.png 500w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-61-300x121.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-61-370x149.png 370w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f38 Cannon\u3067\u4f7f\u7528\u3055\u308c\u305finf\u30e1\u30bd\u30c3\u30c9<\/em><\/span><\/p>\n<p>2\u3064\u306eCannon\u4e9c\u7a2e\u3092\u6bd4\u8f03\u3057\u305f\u3068\u304d\u306b\u3001Delphi Cannon\u30b5\u30f3\u30d7\u30eb(SHA256: 5a02d4e5f6\u2026)\u5185\u3067\u3001\u53ce\u96c6\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u3067C2\u3078\u9001\u4fe1\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u306e\u30d8\u30c3\u30c0\u30fc\u6587\u5b57\u5217\u3068\u3057\u3066Running place\u3068Logical_Drivers\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30e1\u30bd\u30c3\u30c9\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002\u5b8c\u5168\u4e00\u81f4\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u56f39\u306f\u3001\u3053\u306e\u3088\u3046\u306a\u985e\u4f3c\u3057\u3066\u3044\u308b\u30d8\u30c3\u30c0\u30fc\u6587\u5b57\u5217\u3092\u793a\u3057\u3066\u304a\u308a\u30012\u3064\u306e\u4e9c\u7a2e\u304c\u5b9f\u969b\u306b\u95a2\u9023\u3057\u3066\u3044\u308b\u3068\u3044\u3046\u4eee\u8aac\u3092\u88cf\u4ed8\u3051\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"500\" height=\"346\"  class=\"wp-image-103918 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-62.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-62.png 500w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-62-300x208.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-62-370x256.png 370w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f39 Delphi Cannon\u3068Cannon\u306e\u985e\u4f3c\u70b9<\/em><\/span><\/p>\n<p>\u88686\u306b\u793a\u3055\u308c\u3066\u3044\u308b\u3088\u3046\u306b\u3001Delphi Cannon\u30b5\u30f3\u30d7\u30eb\u306e1\u3064(SHA256: cac630c11c..)\u306b\u306f\u3001\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u304c\u306a\u304f\u3001C2\u6a5f\u80fd\u3092\u5099\u3048\u3066\u3044\u306a\u3044\u3088\u3046\u3067\u3059\u3002\u4ee3\u308f\u308a\u306b\u3001\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306fta.bin\u3068\u3044\u3046\u540d\u524d\u306e\u30d5\u30a1\u30a4\u30eb\u304b\u3089\u300c\u30bf\u30b9\u30af\u300d\u3092\u8aad\u307f\u53d6\u308a\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001\u5225\u306e\u4e0d\u660e\u306e\u30c4\u30fc\u30eb\u304c\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u8fbc\u307f\u3001C2\u6a5f\u80fd\u3092\u51e6\u7406\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u3001\u8208\u5473\u6df1\u3044\u3053\u3068\u306b\u3001\u3053\u306e\u7279\u5b9a\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u540c\u3058\u30ea\u30bd\u30fc\u30b9\u540d(L30)\u3092\u6301\u3061\u3001C2\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u3057\u3066heatlth500@ambcomission[.]com\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u88686\u306e\u4ed6\u306e\u30b5\u30f3\u30d7\u30eb\u3068\u540c\u3058\u6697\u53f7\u5316\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9(ecc5805898..\u306a\u3069)\u3092\u542b\u3093\u3067\u3044\u307e\u3059\u3002\u3057\u304b\u3057\u3001\u30ea\u30bd\u30fc\u30b9\u3078\u30a2\u30af\u30bb\u30b9\u3057\u305f\u308a\u3001\u305d\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u5fa9\u53f7\u3057\u305f\u308a\u3059\u308b\u30b3\u30fc\u30c9\u306f\u4e00\u5207\u542b\u307e\u308c\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n<h3>VB.NET Zebrocy\u4e9c\u7a2e<\/h3>\n<p>VB.NET\u4e9c\u7a2e(SHA256: e5aece694d..)\u306f\u4ed6\u306e\u65e2\u77e5\u306eZebrocy\u4e9c\u7a2e\u306b\u975e\u5e38\u306b\u3088\u304f\u4f3c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306b\u306f\u3001C2\u30d3\u30fc\u30b3\u30f3\u3068\u3057\u3066\u4f7f\u7528\u3059\u308bURL\u5185\u306b\u30b9\u30c8\u30ec\u30fc\u30b8 \u30dc\u30ea\u30e5\u30fc\u30e0 \u30b7\u30ea\u30a2\u30eb\u756a\u53f7\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002C2\u30d3\u30fc\u30b3\u30f3\u306f\u3001Scripting.FileSystemObject\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001Environment.SpecialFolder.LocalApplicationData\u306b\u683c\u7d0d\u3055\u308c\u305f\u30d1\u30b9\u304b\u3089GetDriveName\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u53d6\u5f97\u3055\u308c\u307e\u3059\u3002\u6b21\u306b\u3001GetDriveName\u95a2\u6570\u304b\u3089\u53d6\u5f97\u3055\u308c\u305f\u30b9\u30c8\u30ec\u30fc\u30b8 \u30dc\u30ea\u30e5\u30fc\u30e0\u3092\u4f7f\u7528\u3057\u3066\u3001GetDrive\u3092\u547c\u3073\u51fa\u3057\u3001\u30b9\u30c8\u30ec\u30fc\u30b8 \u30c7\u30d0\u30a4\u30b9\u306eSerialNumber\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001VB.NET\u4e9c\u7a2e\u306f\u3001\u4ed6\u306eZebrocy\u4e9c\u7a2e\u3068\u540c\u69d8\u306b\u3001\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u3001\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3068\u5b9f\u884c\u30d7\u30ed\u30bb\u30b9\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">systeminfo &amp; tasklist<\/span><\/p>\n<p>C2\u30b5\u30fc\u30d0\u30fc\u3078\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3001\u5b9f\u884c\u30d7\u30ed\u30bb\u30b9\u3001\u304a\u3088\u3073\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308bURL\u306f\u3001\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">hxxp:\/\/109.248.148[.]42\/agr-enum\/progress-inform\/cube.php?res=[serial number]<\/span><\/p>\n<p>Zebrocy\u306eVB.NET\u4e9c\u7a2e\u306f\u3001\u4e0a\u8a18URL\u3078\u306eHTTP POST\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u53ce\u96c6\u3057\u305f\u30c7\u30fc\u30bf\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u53ce\u96c6\u3055\u308c\u305f\u30c7\u30fc\u30bf\u306f\u3001\u6b21\u306e\u3088\u3046\u306b\u69cb\u9020\u5316\u3055\u308c\u305fHTTP POST\u30c7\u30fc\u30bf\u5185\u306b\u542b\u307e\u308c\u307e\u3059(\u30a2\u30f3\u30d1\u30b5\u30f3\u30c9\"&amp;\"\u306e\u524d\u5f8c\u306e\u30b9\u30da\u30fc\u30b9\u306b\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044)\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">data=[system information and running processes] &amp; arg=[screenshot in BMP format]<\/span><\/p>\n<h3>C# Zebrocy\u4e9c\u7a2e<\/h3>\n<p>Zebrocy\u306eC#\u4e9c\u7a2e\u306f\u3001\u6a5f\u80fd\u306b\u95a2\u3057\u3066\u306f\u4ed6\u306e\u4e9c\u7a2e\u306b\u4f3c\u3066\u3044\u307e\u3059\u304c\u3001\u8aac\u660e\u3059\u308b\u4fa1\u5024\u304c\u3042\u308b\u8907\u6570\u306e\u56fa\u6709\u306a\u5c5e\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u4ed6\u306eZebrocy\u30c4\u30fc\u30eb\u3068\u540c\u69d8\u306b\u3001C#\u4e9c\u7a2e\u306f\u30b9\u30c8\u30ec\u30fc\u30b8 \u30dc\u30ea\u30e5\u30fc\u30e0 \u30b7\u30ea\u30a2\u30eb\u756a\u53f7\u3092\u53ce\u96c6\u3057\u3001C2\u30b5\u30fc\u30d0\u30fc\u3078\u306e\u30a2\u30a6\u30c8\u30d0\u30a6\u30f3\u30c9 \u30d3\u30fc\u30b3\u30f3\u3067\u4f7f\u7528\u3057\u307e\u3059\u3002\u3053\u306e\u7279\u5b9a\u306e\u4e9c\u7a2e\u3067\u306f\u3001\u30c4\u30fc\u30eb\u306fWindows API\u95a2\u6570GetVolumeInformation\u3092\u4f7f\u7528\u3057\u3066C:\u30c9\u30e9\u30a4\u30d6\u306e\u30b7\u30ea\u30a2\u30eb\u756a\u53f7\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u3053\u306eZebrocy\u4e9c\u7a2e\u306f\u3001JPEG\u5f62\u5f0f\u3067C2\u30b5\u30fc\u30d0\u30fc\u3078\u9001\u4fe1\u3059\u308b\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3082\u64ae\u308a\u307e\u3059\u3002<\/p>\n<p>\u4f7f\u7528\u3055\u308c\u305f\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u8a00\u8a9e\u4ee5\u5916\u3067\u3001\u3053\u306eZebrocy\u4e9c\u7a2e\u3067\u6700\u3082\u6ce8\u76ee\u3059\u3079\u304d\u5909\u66f4\u306f\u3001\u30c4\u30fc\u30eb\u304c\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3068\u5b9f\u884c\u30d7\u30ed\u30bb\u30b9\u3092\u53ce\u96c6\u3059\u308b\u65b9\u6cd5\u3067\u3059\u3002systeminfo\u304a\u3088\u3073tasklist\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u7528\u3059\u308b\u4ee3\u308f\u308a\u306b\u3001Zebrocy\u306eC#\u4e9c\u7a2e\u306fWMI\u30af\u30a8\u30ea\u30fc\u3092\u4f7f\u7528\u3057\u3066\u3053\u306e\u60c5\u5831\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002\u30c4\u30fc\u30eb\u306f\u3001\u4ee5\u4e0b\u306eWMI\u30af\u30a8\u30ea\u306e\u30ea\u30b9\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<ul>\n<li>wmic logicaldisk get Caption, Description,VolumeSerialNumber,Size,FreeSpace<\/li>\n<li>wmic diskdrive get Model, SerialNumber<\/li>\n<li>wmic computersystem get Manufacturer, Model, Name, SystemTypec<\/li>\n<li>wmic os get Caption, OSArchitecture, OSLanguage,SystemDrive,MUILanguages<\/li>\n<li>wmic process get Caption,ExecutablePath<\/li>\n<\/ul>\n<p>C2\u30b5\u30fc\u30d0\u30fc\u3078\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3001\u5b9f\u884c\u30d7\u30ed\u30bb\u30b9\u3001\u304a\u3088\u3073\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308bURL\u306f\u3001\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">hxxp:\/\/145.249.105[.]165\/resource-store\/stockroom-center-service\/check.php?fm=[serial number]<\/span><\/p>\n<p>Zebrocy\u306eC#\u4e9c\u7a2e\u306f\u3001\u4e0a\u8a18URL\u3078\u306eHTTP POST\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u53ce\u96c6\u3057\u305f\u30c7\u30fc\u30bf\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u53ce\u96c6\u3055\u308c\u305f\u30c7\u30fc\u30bf\u306f\u3001\u6b21\u306e\u3088\u3046\u306b\u69cb\u9020\u5316\u3055\u308c\u305fHTTP POST\u30c7\u30fc\u30bf\u5185\u306b\u542b\u307e\u308c\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">spp=[system information from WMI queries] &amp;spvg=[screenshot in JPEG format]<\/span><\/p>\n<h2>\u7d50\u8ad6<\/h2>\n<p>Sofacy\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u540c\u69d8\u306e\u6226\u7565\u3068\u6280\u6cd5\u3067\u3001\u4e16\u754c\u4e2d\u306e\u7d44\u7e54\u3092\u653b\u6483\u3057\u7d9a\u3051\u3066\u3044\u307e\u3059\u3002\u5f0a\u793e\u306f\u300110\u6708\u5f8c\u534a\u304b\u308911\u6708\u306b\u304b\u3051\u3066\u3001\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4ecb\u3057\u3066\u653b\u6483\u3092\u4ed5\u639b\u3051\u3066\u3044\u308b\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u3092\u89b3\u5bdf\u3057\u307e\u3057\u305f\u3002\u591a\u304f\u306e\u5834\u5408\u3001\u30d5\u30a1\u30a4\u30eb\u540d\u306b\u6700\u65b0\u306e\u30cb\u30e5\u30fc\u30b9\u3092\u5229\u7528\u3057\u3066\u3001\u53d7\u4fe1\u8005\u304c\u60aa\u610f\u306e\u3042\u308b\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u304f\u3088\u3046\u306b\u8a98\u5c0e\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u30b0\u30eb\u30fc\u30d7\u306f\u660e\u3089\u304b\u306b\u3001\u653b\u6483\u306e\u7b2c1\u6bb5\u968e\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u3057\u3066\u3001Zebrocy\u306a\u3069\u306e\u30b7\u30f3\u30d7\u30eb\u306a\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3092\u597d\u3093\u3067\u3044\u307e\u3059\u3002\u307e\u305f\u3001VB.NET\u3084C#\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3067\u3001Zebrocy\u306e\u65b0\u3057\u3044\u4e9c\u7a2e\u3092\u958b\u767a\u3057\u7d9a\u3051\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u904e\u53bb\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067Cannon\u30c4\u30fc\u30eb\u306e\u7570\u306a\u308b\u4e9c\u7a2e\u3082\u5229\u7528\u3057\u3066\u304d\u305f\u3088\u3046\u3067\u3059\u3002<\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001\u4ee5\u4e0b\u306b\u3088\u3063\u3066\u3053\u306e\u30d6\u30ed\u30b0\u3067\u8aac\u660e\u3057\u305f\u653b\u6483\u304b\u3089\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u8aac\u660e\u3057\u305f\u3059\u3079\u3066\u306e\u914d\u4fe1\u6587\u66f8\u3068\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001WildFire\u3067\u60aa\u610f\u304c\u3042\u308b\u3068\u5224\u65ad\u3055\u308c\u691c\u51fa\u3055\u308c\u307e\u3059\uff61<\/li>\n<li>Traps\u306f\u3001\u30de\u30af\u30ed\u3092\u542b\u3080\u6587\u66f8\u3092\u300c\u691c\u51fa\u3057\u305f\u4e0d\u5be9\u306a\u30de\u30af\u30ed\u300d\u3068\u3057\u3066\u30d6\u30ed\u30c3\u30af\u3057\u307e\u3059\uff61<\/li>\n<li>\u00a0C2\u306eURL\u306f\u3001\u30b3\u30de\u30f3\u30c9&amp;\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u3068\u3057\u3066\u5206\u985e\u3055\u308c\u307e\u3059\uff61<\/li>\n<li>AutoFocus\u306e\u304a\u5ba2\u69d8\u306f\u3001<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.Zebrocy\">Zebrocy<\/a>\u304a\u3088\u3073<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.Cannon\">Cannon<\/a>\u30bf\u30b0\u3067\u3055\u3089\u306b\u8a73\u7d30\u3092\u628a\u63e1\u3067\u304d\u307e\u3059\uff61<\/li>\n<\/ul>\n<h2>IoC<\/h2>\n<h3>\u914d\u4fe1\u306e\u30cf\u30c3\u30b7\u30e5<\/h3>\n<ul>\n<li>2cfc4b3686511f959f14889d26d3d9a0d06e27ee2bb54c9afb1ada6b8205c55f<\/li>\n<li>c20e5d56b35992fe74e92aebb09c40a9ec4f3d9b3c2a01efbe761fa7921dd97f<\/li>\n<li>abfc14f7f708f662046bfcad81a719c71a35a8dc5aa111407c2c93496e52db74<\/li>\n<li>40318f3593bca859673827b88d65c5d2f0d80a76948be936a60bda67dff27be9<\/li>\n<li>5749eb9d7b8afa278be24a4db66f122aeb323eaa73a9c9e52d77ac3952da5e7d<\/li>\n<li>af77e845f1b0a3ae32cb5cfa53ff22cc9dae883f05200e18ad8e10d7a8106392<\/li>\n<li>34bdb5b364358a07f598da4d26b30bac37e139a7dc2b9914debb3a16311f3ded<\/li>\n<li>79bd5f34867229176869572a027bd601bd8c0bc3f56d37443d403a6d1819a7e5<\/li>\n<li>77ff53211bd994293400cb3f93e3d3df6754d8d477cb76f52221704adebad83a<\/li>\n<\/ul>\n<h3>\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u30cf\u30c3\u30b7\u30e5<\/h3>\n<ul>\n<li>f1e2bceae81ccd54777f7862c616f22b581b47e0dda5cb02d0a722168ef194a5<\/li>\n<li>86bb3b00bcd4878b081e4e4f126bba321b81a17e544d54377a0f590f95209e46<\/li>\n<li>2da5a388b891e42df4ed62cffbc167db2021e2441e6075d651ecc1d0ffd32ec8<\/li>\n<li>0d7b945b9c912d205974f44e3742c696b5038c2120ed4775710ed6d51fbc58ef<\/li>\n<li>fc69fb278e12fc7f9c49a020eff9f84c58b71e680a9e18f78d4e6540693f557d<\/li>\n<li>ed8f52cdfc5f4c4be95a6b2e935661e00b50324bee5fe8974599743ccfd8daba<\/li>\n<li>b9f3af84a69cd39e2e10a86207f8612dd2839873c5839af533ffbc45fc56f809<\/li>\n<\/ul>\n<h3>\u30ea\u30e2\u30fc\u30c8 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306eURL<\/h3>\n<ul>\n<li>hxxp:\/\/188.241.58[.]170\/live\/owa\/office.dotm<\/li>\n<li>hxxp:\/\/185.203.118[.]198\/documents\/Note_template.dotm<\/li>\n<li>hxxp:\/\/185.203.118[.]198\/documents\/Note_template.dotm<\/li>\n<li>hxxp:\/\/145.249.105[.]165\/doc\/temp\/release.dotm<\/li>\n<li>hxxp:\/\/145.249.105[.]165\/messages\/content\/message_template.dotm<\/li>\n<li>hxxp:\/\/188.241.58[.]170\/version\/in\/documents.dotm<\/li>\n<li>hxxp:\/\/109.248.148[.]42\/officeDocument\/2006\/relationships\/templates.dotm<\/li>\n<li>hxxp:\/\/109.248.148[.]42\/office\/thememl\/2012\/main\/attachedTemplate.dotm<\/li>\n<li>hxxp:\/\/109.248.148[.]42\/office\/thememl\/2012\/main\/attachedTemplate.dotm<\/li>\n<\/ul>\n<h3>Zebrocy\u306e\u30cf\u30c3\u30b7\u30e5<\/h3>\n<ul>\n<li>5173721f3054b92e6c0ff2a6a80e4741aa3639bc1906d8b615c3b014a7a1a8d7<\/li>\n<li>61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e<\/li>\n<li>6ad3eb8b5622145a70bec67b3d14868a1c13864864afd651fe70689c95b1399a<\/li>\n<li>9a0f00469d67bdb60f542fabb42e8d3a90c214b82f021ac6719c7f30e69ff0b9<\/li>\n<li>b41480d685a961ed033b932d9c363c2a08ad60af1d2b46d4f78b5469dc5d58e3<\/li>\n<li>c91843a69dcf3fdad0dac1b2f0139d1bb072787a1cfcf7b6e34a96bc3c081d65<\/li>\n<li>e5aece694d740ebcb107921e890cccc5d7e8f42471f1c4ce108ecb5170ea1e92<\/li>\n<\/ul>\n<h3>Zebrocy\u00a0C2\u306eURL<\/h3>\n<ul>\n<li>hxxp:\/\/188.241.58[.]170\/local\/s3\/filters.php<\/li>\n<li>hxxp:\/\/185.203.118[.]198\/en_action_device\/center_correct_customer\/drivers-i7-x86.php<\/li>\n<li>hxxp:\/\/145.249.105[.]165\/resource-store\/stockroom-center-service\/check.php<\/li>\n<li>hxxp:\/\/109.248.148[.]42\/agr-enum\/progress-inform\/cube.php<\/li>\n<\/ul>\n<h3>Cannon\u306e\u30cf\u30c3\u30b7\u30e5<\/h3>\n<ul>\n<li>861b6bc1f9869017c48930af5848930dd037fb70fc506d8a7e43e1a0dbd1e8cb<\/li>\n<li>4405cfbf28e0dfafa9ea292e494f385592383d2476a9c49d12596b8d22a63c47<\/li>\n<li>174effcdeec0b84c67d7dc23351418f6fa4825550d595344214cc746f1a01c1a<\/li>\n<li>a23261e2b693750a7009569df96ec4cf61e57acc9424c98d6fe1087ff8c659ce<\/li>\n<li>651d5aab82e53711563ce074c047cbaa0703931673fa3ad20933d6a63c5c3b12<\/li>\n<li>68df0f924ce79765573156eabffee3a7bb0fa972d2b67d12dd91dea3ec255d24<\/li>\n<li>61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e<\/li>\n<li>5a02d4e5f6d6a89ad41554295114506540f0876e7288464e4a70c9ba51d24f12<\/li>\n<li>d06be83a408f4796616b1c446e3637009d7691c131d121eb165c55bdd5ba50b4<\/li>\n<li>78adc8e5e4e86146317420fa3b2274c9805f6942c9973963467479cb1bbd4ead<\/li>\n<li>054c5aa73d6b6d293170785a82453446429c0efc742df75979b760682ac3026b<\/li>\n<li>cac630c11c4bf6363c067fbf7741eae0ec70238d9c5e60d41f3ed8f65b56c1d1<\/li>\n<li>ecc5805898e037c2ef9bc52ea6c6e59b537984f84c3d680c8436c6a38bdecdf4<\/li>\n<li>215f7c08c2e3ef5835c7ebc9a329b04b8d5215773b7ebfc9fd755d93451ce1ae<\/li>\n<\/ul>\n<h3>Cannon\u95a2\u9023\u306e\u96fb\u5b50\u30e1\u30fc\u30eb<\/h3>\n<ul>\n<li>sym777.g[at]post.cz<\/li>\n<li>kae.mezhnosh[at]post.cz<\/li>\n<li>vebek.morozh30[at]post.cz<\/li>\n<li>g0r7tsa45s[at]post.cz<\/li>\n<li>marvel.polezha[at]post.cz<\/li>\n<li>sahro.bella7[at]post.cz<\/li>\n<li>trala.cosh2[at]post.cz<\/li>\n<li>Bishtr.cam47[at]post.cz<\/li>\n<li>Lobrek.chizh[at]post.cz<\/li>\n<li>Cervot.woprov[at]post.cz<\/li>\n<li>heatlth500[at]ambcomission[.]com<\/li>\n<li>trash023[at]ambcomission[.]com<\/li>\n<li>trasler22[at]ambcomission[.]com<\/li>\n<li>rishit333[at]ambcomission[.]com<\/li>\n<li>tomasso25[at]ambcomission[.]com<\/li>\n<li>kevin30[at]ambcomission[.]com<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 Cannon\u30c4\u30fc\u30eb\u306b\u95a2\u3059\u308b\u4ee5\u524d\u306e\u30d6\u30ed\u30b0\u3067\u793a\u5506\u3057\u305f\u3088\u3046\u306b\u3001Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411<\/p>\n","protected":false},"author":25,"featured_media":103916,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4327,1974,4432,4433,4428],"tags":[6836,4569,6613,6825],"product_categories":[4443,4444,4343,4448],"coauthors":[934,935],"class_list":["post-103893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-top-cyberthreats","category-malware-ja","category-top-cyberthreats-ja","category-nation-state-cyberattacks-ja","category-threat-research-ja","tag-cannon","tag-espionage-ja","tag-sofacy-ja","tag-zebrocy-ja","product_categories-advanced-url-filtering-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr","product_categories-cortex-xdr-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3<\/title>\n<meta name=\"description\" content=\"Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411\u6708\u534a\u3070\u306b\u304b\u3051\u3066\u3001\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u6a5f\u95a2\u3084\u6c11\u9593\u7d44\u7e54\u3092\u7d99\u7d9a\u7684\u306b\u653b\u6483\u3057\u3066\u3044\u307e\u3059\u3002\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u4e00\u90e8\u3082\u6a19\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001\u6a19\u7684\u306e\u591a\u304f\u306fNATO\u52a0\u76df\u56fd\u3067\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3\" \/>\n<meta property=\"og:description\" content=\"Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411\u6708\u534a\u3070\u306b\u304b\u3051\u3066\u3001\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u6a5f\u95a2\u3084\u6c11\u9593\u7d44\u7e54\u3092\u7d99\u7d9a\u7684\u306b\u653b\u6483\u3057\u3066\u3044\u307e\u3059\u3002\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u4e00\u90e8\u3082\u6a19\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001\u6a19\u7684\u306e\u591a\u304f\u306fNATO\u52a0\u76df\u56fd\u3067\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2018-12-13T02:00:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-03-31T00:41:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/header-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"767\" \/>\n\t<meta property=\"og:image:height\" content=\"431\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Bryan Lee, Robert Falcone\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3","description":"Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411\u6708\u534a\u3070\u306b\u304b\u3051\u3066\u3001\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u6a5f\u95a2\u3084\u6c11\u9593\u7d44\u7e54\u3092\u7d99\u7d9a\u7684\u306b\u653b\u6483\u3057\u3066\u3044\u307e\u3059\u3002\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u4e00\u90e8\u3082\u6a19\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001\u6a19\u7684\u306e\u591a\u304f\u306fNATO\u52a0\u76df\u56fd\u3067\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/","og_locale":"ja_JP","og_type":"article","og_title":"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3","og_description":"Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411\u6708\u534a\u3070\u306b\u304b\u3051\u3066\u3001\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u6a5f\u95a2\u3084\u6c11\u9593\u7d44\u7e54\u3092\u7d99\u7d9a\u7684\u306b\u653b\u6483\u3057\u3066\u3044\u307e\u3059\u3002\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u4e00\u90e8\u3082\u6a19\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001\u6a19\u7684\u306e\u591a\u304f\u306fNATO\u52a0\u76df\u56fd\u3067\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/","og_site_name":"Unit 42","article_published_time":"2018-12-13T02:00:44+00:00","article_modified_time":"2020-03-31T00:41:45+00:00","og_image":[{"width":767,"height":431,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/header-1.png","type":"image\/png"}],"author":"Bryan Lee, Robert Falcone","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/"},"author":{"name":"Bryan Lee","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/7d78a8f5ae42058baeccf9ca6d6235e4"},"headline":"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3","datePublished":"2018-12-13T02:00:44+00:00","dateModified":"2020-03-31T00:41:45+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/"},"wordCount":9347,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/header-1.png","keywords":["Cannon","Espionage","Sofacy","Zebrocy"],"articleSection":["High Profile Threats","\u30de\u30eb\u30a6\u30a7\u30a2","\u4e3b\u306a\u30b5\u30a4\u30d0\u30fc\u8105\u5a01","\u56fd\u5bb6\u652f\u63f4\u578b\u30b5\u30a4\u30d0\u30fc\u653b\u6483","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/","name":"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/header-1.png","datePublished":"2018-12-13T02:00:44+00:00","dateModified":"2020-03-31T00:41:45+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/7d78a8f5ae42058baeccf9ca6d6235e4"},"description":"Sofacy\u30b0\u30eb\u30fc\u30d7(\u5225\u540dFancy Bear\u3001APT28\u3001STRONTIUM\u3001Pawn Storm\u3001Sednit)\u306f\u30012018\u5e7410\u6708\u534a\u3070\u304b\u30892018\u5e7411\u6708\u534a\u3070\u306b\u304b\u3051\u3066\u3001\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u6a5f\u95a2\u3084\u6c11\u9593\u7d44\u7e54\u3092\u7d99\u7d9a\u7684\u306b\u653b\u6483\u3057\u3066\u3044\u307e\u3059\u3002\u5143\u30bd\u30d3\u30a8\u30c8\u9023\u90a6\u8af8\u56fd\u306e\u4e00\u90e8\u3082\u6a19\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001\u6a19\u7684\u306e\u591a\u304f\u306fNATO\u52a0\u76df\u56fd\u3067\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#primaryimage","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/header-1.png","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/header-1.png","width":767,"height":431},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/dear-joohn-sofacy-groups-global-campaign\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"Dear Joohn: Sofacy\u30b0\u30eb\u30fc\u30d7\u306e\u30b0\u30ed\u30fc\u30d0\u30eb \u30ad\u30e3\u30f3\u30da\u30fc\u30f3"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/7d78a8f5ae42058baeccf9ca6d6235e4","name":"Bryan Lee","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/9213e49ea48b7676660bac40d05c9e3e","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Bryan Lee"},"url":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/author\/bryanlee\/"}]}},"_links":{"self":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/103893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=103893"}],"version-history":[{"count":3,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/103893\/revisions"}],"predecessor-version":[{"id":105655,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/103893\/revisions\/105655"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/103916"}],"wp:attachment":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=103893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=103893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=103893"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=103893"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=103893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}