{"id":106818,"date":"2016-01-24T17:00:11","date_gmt":"2016-01-25T01:00:11","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=106818"},"modified":"2020-04-27T00:41:39","modified_gmt":"2020-04-27T07:41:39","slug":"scarlet-mimic-years-long-espionage-targets-minority-activists","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/","title":{"rendered":"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5"},"content":{"rendered":"<h2>\u6982\u8981<\/h2>\n<p>\u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9 \u30cd\u30fc\u30e0\u304c\u4ed8\u3051\u3089\u308c\u305f\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u308b\u4e00\u9023\u306e\u653b\u6483\u306b\u3064\u3044\u3066\u8abf\u67fb\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u306f4\u5e74\u4ee5\u4e0a\u524d\u304b\u3089\u59cb\u307e\u308a\u3001\u305d\u306e\u6a19\u7684\u306e\u9078\u3073\u65b9\u306e\u30d1\u30bf\u30fc\u30f3\u304b\u3089\u3001\u653b\u6483\u8005\u306e\u4e3b\u8981\u76ee\u7684\u306f\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u306b\u95a2\u3059\u308b\u60c5\u5831\u53ce\u96c6\u3067\u3042\u308b\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u653f\u5e9c\u95a2\u4fc2\u8005\u3068\u653b\u6483\u3092\u76f4\u63a5\u7d50\u3073\u3064\u3051\u308b\u8a3c\u62e0\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u3053\u306e\u653b\u6483\u6d3b\u52d5\u304b\u3089\u5f97\u3089\u308c\u305f\u60c5\u5831\u306f\u3001\u6a19\u7684\u306b\u95a2\u3057\u3066\u4e2d\u56fd\u653f\u5e9c\u304c\u8868\u660e\u3057\u3066\u3044\u308b\u59ff\u52e2\u3068\u307b\u307c\u540c\u3058\u52d5\u6a5f\u3092\u62b1\u304f\u5358\u72ec\u307e\u305f\u306f\u8907\u6570\u306e\u30b0\u30eb\u30fc\u30d7\u304c\u95a2\u4e0e\u3057\u3066\u3044\u308b\u3068\u3044\u3046\u898b\u65b9\u3092\u88cf\u4ed8\u3051\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u672c\u30ec\u30dd\u30fc\u30c8\u3067\u306f\u3001Scarlet Mimic\u304c\u5c0e\u5165\u3059\u308b\u30c4\u30fc\u30eb\u3001\u6226\u8853\u3001\u30a4\u30f3\u30d5\u30e9\u3092\u660e\u3089\u304b\u306b\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u672c\u8105\u5a01\u306b\u5bfe\u3059\u308b\u8a8d\u8b58\u3092\u9ad8\u3081\u3001\u4e88\u9632\u5bfe\u7b56\u3068\u691c\u51fa\u5bfe\u7b56\u3092\u5c0e\u5165\u3059\u308b\u3053\u3068\u3067\u3001Scarlet Mimic\u306b\u3088\u308b\u653b\u6483\u6d3b\u52d5\u306e\u6210\u529f\u7387\u3092\u4e0b\u3052\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002\u3069\u306e\u653b\u6483\u304c\u3069\u306e\u7d44\u7e54\u306b\u5bfe\u3057\u3066\u6210\u529f\u3057\u305f\u304b\u3001\u79c1\u305f\u3061\u306e\u8996\u70b9\u304b\u3089\u306f\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u305b\u3093\u3002\u3057\u304b\u3057\u3001Scarlet Mimic\u304c\u5c0e\u5165\u3059\u308b\u30c4\u30fc\u30eb\u304c\u9577\u5e74\u306b\u308f\u305f\u308a\u958b\u767a\u3055\u308c\u3066\u304d\u3066\u3044\u308b\u3053\u3068\u304b\u3089\u3001\u6d3b\u52d5\u4e2d\u306e\u653b\u6483\u8005\u306e\u4e2d\u306b\u306f\u653b\u6483\u6d3b\u52d5\u306b\u6210\u529f\u3059\u308b\u8005\u304c\u4e00\u5b9a\u5272\u5408\u3044\u308b\u3053\u3068\u304c\u4f3a\u3048\u307e\u3059\u3002\u79c1\u305f\u3061\u306e\u5206\u6790\u304b\u3089\u3001Scarlet Mimic\u304cPC\u304b\u3089\u30e2\u30d0\u30a4\u30eb \u30c7\u30d0\u30a4\u30b9\u3078\u3068\u30b9\u30d1\u30a4\u6d3b\u52d5\u3092\u5e83\u3052\u59cb\u3081\u3001\u6226\u8853\u3092\u9032\u5316\u3055\u305b\u3066\u3044\u308b\u3053\u3068\u3082\u898b\u53d7\u3051\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>\u3055\u307e\u3056\u307e\u306a\u500b\u4eba\u3084\u30b0\u30eb\u30fc\u30d7\u304c\u30b5\u30a4\u30d0\u30fc \u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5\u306e\u6a19\u7684\u306b\u306a\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002\u30b5\u30a4\u30d0\u30fc \u30b9\u30d1\u30a4\u306e\u88ab\u5bb3\u8005\u3068\u3057\u3066\u3001\u4e00\u822c\u7684\u306b\u306f\u653f\u5e9c\u6a5f\u95a2\u307e\u305f\u306f\u30cf\u30a4\u30c6\u30af\u4f01\u696d\u304c\u6700\u3082\u3088\u304f\u77e5\u3089\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u30b9\u30d1\u30a4\u6d3b\u52d5\u306b\u610f\u6b32\u7684\u306a\u653b\u6483\u8005\u304c\u591a\u304f\u306e\u60c5\u5831\u6e90\u304b\u3089\u60c5\u5831\u306e\u53ce\u96c6\u306b\u52aa\u3081\u3066\u3044\u308b\u3068\u8a8d\u8b58\u3059\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n<p>Scarlet Mimic\u306b\u3088\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u308b\u653b\u6483\u306f\u3001\u4e3b\u306b\u30a6\u30a4\u30b0\u30eb\u3084\u30c1\u30d9\u30c3\u30c8\u306e\u6d3b\u52d5\u5bb6\u3084\u3001\u305d\u306e\u601d\u60f3\u306b\u95a2\u5fc3\u306e\u3042\u308b\u4eba\u7269\u3092\u4e3b\u306a\u6a19\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002\u30c1\u30d9\u30c3\u30c8\u793e\u4f1a\u3068\u3001\u4e3b\u306b\u4e2d\u56fd\u5317\u897f\u90e8\u306b\u5c45\u4f4f\u3059\u308b\u30c1\u30e5\u30eb\u30af\u7cfb\u30a4\u30b9\u30e9\u30e0\u6559\u5f92\u306e\u5c11\u6570\u6c11\u65cf\u3067\u3042\u308b\u30a6\u30a4\u30b0\u30eb\u65cf\u306f\u3001\u3069\u3061\u3089\u3082\u904e\u53bb10\u5e74\u9593\u306b\u8907\u6570\u306e\u9ad8\u5ea6\u306a\u653b\u6483\u306e\u6a19\u7684\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u4e21\u8005\u306b\u306f\u4e2d\u83ef\u4eba\u6c11\u5171\u548c\u56fd(PRC)\u653f\u5e9c\u3068\u306e\u7dca\u5f35\u95a2\u4fc2\u306e\u6b74\u53f2\u304c\u3042\u308a\u307e\u3059\u304c\u3001\u4e2d\u56fd\u3068Scarlet Mimic\u3092\u7d50\u3073\u3064\u3051\u308b\u8a3c\u62e0\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>Scarlet Mimic\u653b\u6483\u306f\u30ed\u30b7\u30a2\u3068\u30a4\u30f3\u30c9\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u95a2\u3057\u3066\u3082\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u3053\u308c\u3089\u306e\u653f\u5e9c\u6a5f\u95a2\u306f\u6d3b\u52d5\u5bb6\u3084\u30c6\u30ed\u6d3b\u52d5\u306e\u8ffd\u8de1\u306b\u95a2\u4e0e\u3057\u3066\u3044\u307e\u3059\u3002Scarlet Mimic\u306b\u3088\u308b\u5404\u653b\u6483\u306e\u6b63\u78ba\u306a\u6a19\u7684\u306f\u5206\u304b\u308a\u307e\u305b\u3093\u304c\u3001\u305d\u308c\u3089\u306e\u591a\u304f\u306f\u4e0a\u8ff0\u306e\u30d1\u30bf\u30fc\u30f3\u306b\u5f93\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>Scarlet Mimic\u653b\u6483\u306f\u4e3b\u306b\u300cFakeM\u300d\u3068\u3044\u3046\u540d\u524d\u306eWindows\u30d0\u30c3\u30af\u30c9\u30a2\u306e\u5229\u7528\u3092\u4e2d\u5fc3\u306b\u636e\u3048\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f2013\u5e74\u306bTrend Micro\u306b\u3088\u3063\u3066\u306f\u3058\u3081\u3066\u8aac\u660e\u3055\u308c\u3001\u305d\u306e\u4e3b\u306a\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9 \u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u901a\u4fe1\u304c\u691c\u51fa\u3092\u56de\u907f\u3059\u308b\u305f\u3081\u306bWindows Messenger\u3084Yahoo! Messenger\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u901a\u4fe1\u3092\u6a21\u5023\u3057\u3066\u3044\u305f\u305f\u3081FakeM\u3068\u547d\u540d\u3055\u308c\u307e\u3057\u305f\u3002\u79c1\u305f\u3061\u306fFakeM\u306e2\u3064\u306e\u5f8c\u7d99\u4e9c\u7a2e\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u304c\u3001FakeM\u306f2013\u5e74\u306b\u5b58\u5728\u304c\u660e\u3089\u304b\u306b\u3055\u308c\u3066\u4ee5\u6765\u3001\u5927\u5e45\u306b\u5909\u66f4\u3055\u308c\u307e\u3057\u305f\u3002\u307e\u305f9\u7a2e\u985e\u306e\u300c\u30ed\u30fc\u30c0\u30fc (loader)\u300d\u578b\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u3082\u7279\u5b9a\u3057\u307e\u3057\u305f\u304c\u3001\u3053\u308c\u306fScarlet Mimic\u304c\u30b7\u30b9\u30c6\u30e0\u306b\u611f\u67d3\u3059\u308b\u969b\u306b\u691c\u51fa\u3092\u56de\u907f\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>Scarlet Mimic\u306f\u3001FakeM\u306e\u4e9c\u7a2e\u3068\u3068\u3082\u306b\u3001Mac OS X\u3068Android\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b7\u30b9\u30c6\u30e0\u3092\u6a19\u7684\u3068\u3059\u308b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3082\u5c0e\u5165\u3057\u3066\u3044\u307e\u3059\u3002\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9 \u30b3\u30f3\u30c8\u30ed\u30fc\u30eb(C2)\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u5206\u6790\u306b\u3088\u308a\u3001\u79c1\u305f\u3061\u306f\u3053\u3046\u3057\u305f\u653b\u6483\u3092Scarlet Mimic\u3068\u95a2\u9023\u4ed8\u3051\u307e\u3057\u305f\u3002<\/p>\n<p>\u653b\u6483\u8005\u306e\u671b\u3093\u3067\u3044\u308b\u30c7\u30fc\u30bf\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3053\u3068\u3067\u500b\u4eba\u304c\u611f\u67d3\u3057\u3066\u3057\u307e\u3046\u3088\u3046\u3001Scarlet Mimic\u306f\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u3068\u6c34\u98f2\u307f\u5834\u578b\u653b\u6483(\u6700\u5927\u9650\u306e\u52b9\u679c\u3092\u72d9\u3063\u305fWeb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3)\u306e\u4e21\u65b9\u3092\u5c0e\u5165\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u3046\u3057\u305f\u6226\u8853\u3092\u4f7f\u3063\u3066\u3001\u653b\u6483\u8005\u306f\u4e8b\u524d\u306b\u7279\u5b9a\u3057\u3066\u304a\u3044\u305f\u500b\u4eba(\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0)\u3060\u3051\u3067\u306a\u304f\u3001\u7279\u5b9a\u306e\u8a71\u984c\u306b\u95a2\u5fc3\u3092\u5bc4\u305b\u308b\u4e0d\u7279\u5b9a\u306e\u4eba\u305f\u3061(\u6c34\u98f2\u307f\u5834\u578b\u653b\u6483)\u3082\u76f4\u63a5\u6a19\u7684\u3068\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3067\u3059\u3002\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u653b\u6483\u306b\u304a\u3044\u3066\u3001Scarlet Mimic\u306f5\u3064\u306e\u7570\u306a\u308b\u8106\u5f31\u6027\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u3057\u304b\u3057\u591a\u304f\u306e\u5834\u5408\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306e\u8106\u5f31\u6027\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306f\u63a7\u3048\u3089\u308c\u3001\u81ea\u5df1\u89e3\u51cd(SFX) RAR\u30a2\u30fc\u30ab\u30a4\u30d6\u304c\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u30a2\u30fc\u30ab\u30a4\u30d6\u306fRight-to-Left Override\u6587\u5b57\u3092\u7528\u3044\u3066\u5b9f\u969b\u306e\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3092\u96a0\u3057\u3066\u304a\u308a\u3001\u3053\u308c\u306b\u3060\u307e\u3055\u308c\u3066\u88ab\u5bb3\u8005\u306f\u5b9f\u884c\u5f62\u5f0f\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u3044\u3066\u3057\u307e\u3044\u307e\u3059\u3002<\/p>\n<p>\u88ab\u5bb3\u8005\u306e\u611f\u67d3\u3092\u76ee\u7684\u3068\u3057\u3066\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u3092\u4f7f\u7528\u3059\u308b\u4ed6\u306e\u591a\u304f\u306e\u653b\u6483\u8005\u3068\u540c\u69d8\u306b\u3001Scarlet Mimic\u306f\u300c\u304a\u3068\u308a\u300d\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u983b\u7e41\u306b\u4f7f\u7528\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u6b63\u898f\u306e\u6587\u66f8\u3067\u3042\u308a\u3001\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u4ef6\u540d\u306b\u95a2\u9023\u3059\u308b\u30b3\u30f3\u30c6\u30f3\u30c4\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u30b7\u30b9\u30c6\u30e0\u304c\u611f\u67d3\u3057\u305f\u5f8c\u3067\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u304a\u3068\u308a\u6587\u66f8\u3092\u8868\u793a\u3057\u3066\u30e6\u30fc\u30b6\u30fc\u3092\u3060\u307e\u3057\u3066\u6709\u5bb3\u306a\u3053\u3068\u306f\u4f55\u3082\u751f\u3058\u3066\u3044\u306a\u3044\u3068\u4fe1\u3058\u8fbc\u307e\u305b\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u304a\u3068\u308a\u6587\u66f8\u306b\u3088\u308a\u3001\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u30c6\u30fc\u30de\u3084\u3001\u3068\u304d\u306b\u306f\u653b\u6483\u306e\u6a19\u7684\u3092\u7279\u5b9a\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u79c1\u305f\u3061\u304c\u3064\u3044\u6700\u8fd1\u7279\u5b9a\u3057\u305fScarlet Mimic\u653b\u6483\u306f2015\u5e74\u306b\u884c\u308f\u308c\u305f\u3082\u306e\u3067\u3042\u308a\u3001\u6a19\u7684\u3068\u306a\u3063\u305f\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u30a4\u30b9\u30e9\u30e0\u6559\u5f92\u306e\u6d3b\u52d5\u5bb6\u306b\u3082\u3001\u30ed\u30b7\u30a2\u653f\u5e9c\u3068\u30ed\u30b7\u30a2\u306e\u30a6\u30e9\u30b8\u30fc\u30df\u30eb \u30d7\u30fc\u30c1\u30f3\u5927\u7d71\u9818\u3078\u306e\u975e\u96e3\u306b\u95a2\u5fc3\u306e\u3042\u308b\u4eba\u305f\u3061\u306b\u3082\u3001\u91cd\u5927\u306a\u95a2\u5fc3\u3092\u5bc4\u305b\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u307e\u3067\u306e\u6a19\u7684\u306b\u57fa\u3065\u304f\u3068\u3001\u3053\u3046\u3057\u305f\u500b\u4eba\u306f\u6d3b\u52d5\u5bb6\u306e\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u3057\u3066\u6301\u3063\u3066\u3044\u305f\u60c5\u5831\u306b\u57fa\u3065\u3044\u3066\u6a19\u7684\u306b\u3055\u308c\u305f\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>\u4eca\u56de\u306e\u5206\u6790\u3067\u4f7f\u7528\u3057\u305f\u30c7\u30fc\u30bf\u306e\u4e3b\u8981\u306a\u60c5\u5831\u6e90\u306f\u3001\u4e16\u754c\u4e2d\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5206\u6790\u3059\u308bPalo Alto Networks\u00a0<a href=\"https:\/\/www.paloaltonetworks.com\/products\/technologies\/wildfire.html\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">WildFire<\/a>\u3067\u3059\u3002\u3053\u306e\u30b7\u30b9\u30c6\u30e0\u306f\u3001<a href=\"https:\/\/cyberthreatalliance.org\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9<\/a>\u306e\u30d1\u30fc\u30c8\u30ca\u30fc\u3092\u542b\u3080\u4ed6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d9\u30f3\u30c0\u30fc\u3068\u306e\u5171\u6709\u30d1\u30fc\u30c8\u30ca\u30fc\u30b7\u30c3\u30d7\u306b\u3088\u308a\u53ce\u96c6\u3055\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2 \u30b5\u30f3\u30d7\u30eb\u3082\u5206\u6790\u3057\u307e\u3059\u3002\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u6319\u52d5\u3084\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9 \u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306b\u57fa\u3065\u3044\u3066\u653b\u6483\u3092\u4e92\u3044\u306b\u95a2\u9023\u4ed8\u3051\u308b\u305f\u3081\u306b\u3001Palo Alto Networks\u00a0<a href=\"https:\/\/www.paloaltonetworks.com\/products\/platforms\/subscriptions\/autofocus.html\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">AutoFocus<\/a>\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3092\u6d3b\u7528\u3057\u307e\u3057\u305f\u3002AutoFocus\u30e6\u30fc\u30b6\u30fc\u306f\u3001Scarlet Mimic\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u3001\u3059\u3079\u3066\u4ee5\u4e0b\u306e\u30ea\u30f3\u30af\u3092\u4f7f\u7528\u3057\u3066\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<ul>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.PaloAlto-ScarletMimic\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">ScarletMimic<\/a><\/li>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.FakeM\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">FakeM<\/a><\/li>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.Psylo\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">Psylo<\/a><\/li>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.MobileOrder\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">MobileOrder<\/a><\/li>\n<\/ul>\n<h3>\u306f\u3058\u3081\u306b<\/h3>\n<p>\u79c1\u305f\u3061\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3084\u30b7\u30b9\u30c6\u30e0\u306b\u5bfe\u3059\u308b\u8105\u5a01\u3092\u3088\u304f\u77e5\u308c\u3070\u3001\u3055\u3089\u306b\u52b9\u679c\u7684\u306b\u8105\u5a01\u3092\u9632\u3050\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u672c\u30ec\u30dd\u30fc\u30c8\u306e\u76ee\u6a19\u306f\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u5b88\u308b\u7acb\u5834\u306e\u4eba\u304cScarlet Mimic\u3068\u547d\u540d\u3055\u308c\u305f\u30b0\u30eb\u30fc\u30d7\u304b\u3089\u306e\u653b\u6483\u306b\u3064\u3044\u3066\u7406\u89e3\u3092\u6df1\u3081\u308b\u306e\u3092\u304a\u624b\u4f1d\u3044\u3059\u308b\u3053\u3068\u3067\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u6d3b\u767a\u306b\u958b\u767a\u304c\u9032\u3081\u3089\u308c\u3066\u3044\u308b\u30d0\u30c3\u30af\u30c9\u30a2\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u4f7f\u3063\u3066\u5c11\u306a\u304f\u3068\u30824\u5e74\u9593\u653b\u6483\u3092\u884c\u3063\u3066\u3044\u307e\u3059\u3002\u4e3b\u306b\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u5c0e\u5165\u3057\u3066\u6a19\u7684\u3092\u611f\u67d3\u3055\u305b\u307e\u3057\u305f\u304c\u30012013\u5e74\u306e\u6c34\u98f2\u307f\u5834\u578b\u653b\u6483(\u6700\u5927\u9650\u306e\u52b9\u679c\u3092\u72d9\u3063\u305fWeb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3)\u306b\u3082\u95a2\u4e0e\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u308b\u653b\u6483\u306f\u3053\u308c\u307e\u3067\u516c\u306b\u5831\u9053\u3055\u308c\u3066\u304d\u307e\u3057\u305f\u304c\u3001\u307b\u3068\u3093\u3069\u306e\u5834\u5408\u3001\u307e\u3063\u305f\u304f\u5171\u901a\u70b9\u306e\u306a\u3044\u3001\u7d50\u3073\u3064\u304d\u306e\u306a\u3044\u4e8b\u4ef6\u3068\u3057\u3066\u6271\u308f\u308c\u307e\u3057\u305f\u3002\u79c1\u305f\u3061\u304c\u53ce\u96c6\u3057\u305f\u30c7\u30fc\u30bf\u3068\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u89e3\u6790\u3057\u305f\u3068\u3053\u308d\u3001\u3053\u3053\u3067\u89e3\u8aac\u3057\u3066\u3044\u308b\u653b\u6483\u306f\u3001\u5358\u72ec\u30b0\u30eb\u30fc\u30d7\u306e\u4ed5\u696d\u304b\u3042\u308b\u3044\u306f\u5358\u4e00\u306e\u4f7f\u547d\u3092\u5e2f\u3073\u305f\u5404\u30b0\u30eb\u30fc\u30d7\u304c\u5354\u529b\u3057\u3042\u3046\u30b0\u30eb\u30fc\u30d7\u96c6\u56e3\u306e\u4ed5\u696d\u3067\u3001\u4e2d\u56fd\u5317\u897f\u90e8\u5468\u8fba\u306b\u5c45\u4f4f\u3059\u308b\u5c11\u6570\u6c11\u65cf\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u3057\u3066\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3066\u3044\u305f\u3082\u306e\u3068Unit 42\u3067\u306f\u7768\u3093\u3067\u3044\u307e\u3059\u3002\u5f93\u6765\u3001Scarlet Mimic\u306f\u4e3b\u3068\u3057\u3066\u3053\u3046\u3057\u305f\u5c11\u6570\u6c11\u65cf\u30b0\u30eb\u30fc\u30d7\u306b\u6240\u5c5e\u3059\u308b\u500b\u4eba\u304a\u3088\u3073\u5c11\u6570\u6c11\u65cf\u30b0\u30eb\u30fc\u30d7\u652f\u63f4\u8005\u3092\u6a19\u7684\u3068\u3057\u3066\u304d\u307e\u3057\u305f\u304c\u3001\u6700\u8fd1\u3001\u79c1\u305f\u3061\u306f\u653f\u5e9c\u306e\u53cd\u30c6\u30ed\u30ea\u30b9\u30c8\u7d44\u7e54\u306e\u5185\u90e8\u3067\u50cd\u3044\u3066\u3044\u308b\u500b\u4eba\u3082\u6a19\u7684\u306b\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u3059\u8a3c\u62e0\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u6a19\u7684\u3068\u306a\u3063\u305f\u5c11\u6570\u6c11\u65cf\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u3059\u308b\u60c5\u5831\u306b\u63a5\u3057\u305f\u3053\u3068\u304c\u5143\u3067\u3053\u308c\u3089\u306e\u6a19\u7684\u304c\u9078\u3070\u308c\u305f\u306e\u3067\u306f\u306a\u3044\u304b\u3068\u3001\u79c1\u305f\u3061\u306f\u8003\u3048\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u4e0b\u8a18\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u306f\u3001\u9078\u3073\u629c\u304b\u308c\u305f\u653b\u6483\u306e\u3046\u3061\u79c1\u305f\u3061\u304c\u7279\u5b9a\u3057\u305f\u3082\u306e\u306b\u3064\u3044\u3066\u3001\u304a\u3088\u3073\u653b\u6483\u306e\u5bfe\u8c61\u3068\u306a\u308a\u3084\u3059\u3044\u306e\u306f\u3069\u3093\u306a\u4eba\u306a\u306e\u304b\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u307e\u3059\u3002\u653b\u6483\u8005\u304c\u5c0e\u5165\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2(FakeM\u3068\u3057\u3066\u77e5\u3089\u308c\u308b)\u306e\u6700\u65b0\u4e9c\u7a2e\u306b\u3064\u3044\u3066\u3001\u307e\u305f\u3001Scarlet Mimic\u304cAndroid\u3084OS X\u306e\u30c7\u30d0\u30a4\u30b9\u3092\u6a19\u7684\u306b\u3057\u3066\u3057\u307e\u3048\u308b\u305d\u306e\u4ed6\u95a2\u9023\u30c4\u30fc\u30eb\u306b\u3064\u3044\u3066\u3001\u8a73\u7d30\u306a\u5206\u6790\u3082\u3054\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u304c\u4ed5\u639b\u3051\u305f\u653b\u6483\u306f\u3001FakeM\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u95a2\u3059\u308b2013\u5e74\u306eTrend Micro\u306e\u30ec\u30dd\u30fc\u30c8\u306b\u3088\u308a\u3001\u5b58\u5728\u304c\u5e83\u304f\u77e5\u308c\u6e21\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u30ec\u30dd\u30fc\u30c8\u304c\u516c\u8868\u3055\u308c\u3066\u304b\u3089\u3001Scarlet Mimic\u306f\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u65b0\u305f\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u30922\u3064\u5c0e\u5165\u3057\u307e\u3057\u305f\u3002\u3055\u3089\u306b\u3001\u30b7\u30b9\u30c6\u30e0\u306b\u611f\u67d3\u3057\u3066\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u4ed5\u639b\u3051\u308b\u306e\u306b\u4f7f\u3046\u300c\u30ed\u30fc\u30c0\u30fc\u578b\u300d\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u30829\u500b\u3001\u500b\u5225\u306b\u5c0e\u5165\u3057\u307e\u3057\u305f\u3002<\/p>\n<h3>\u653b\u6483\u306e\u8a73\u7d30<\/h3>\n<p>\u79c1\u305f\u3061\u304cScarlet Mimic\u3068\u306e\u95a2\u9023\u3065\u3051\u3092\u3057\u305f\u653b\u6483\u306e\u5927\u591a\u6570\u306f\u56f31\u304c\u793a\u3059\u30d1\u30bf\u30fc\u30f3\u306b\u5f93\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 855px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_1.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_1.png\" alt=\"\u56f31: Scarlet Mimic\u304c\u5c0e\u5165\u3059\u308b\u300c\u304a\u3068\u308a\u3092\u4f34\u3046\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u300d\u653b\u6483\u306e\u30d1\u30bf\u30fc\u30f3\" width=\"855\" height=\"506\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f31: Scarlet Mimic\u304c\u5c0e\u5165\u3059\u308b\u300c\u304a\u3068\u308a\u3092\u4f34\u3046\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u300d\u653b\u6483\u306e\u30d1\u30bf\u30fc\u30f3<\/figcaption><\/figure>\n<\/div>\n<p>\u6a19\u7684\u3068\u306a\u308b\u30e6\u30fc\u30b6\u30fc\u306e\u8208\u5473\u3092\u305d\u305d\u308b\u4ef6\u540d\u3068\u672c\u6587\u3092\u4f7f\u7528\u3057\u305f\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\u304c\u653b\u6483\u8005\u306b\u3088\u308a\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306f\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u5c4a\u3051\u307e\u3059\u304c\u3001\u901a\u5e38\u3001\u3053\u306e\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306fMicrosoft Office\u306e\u8106\u5f31\u6027\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3057\u305f\u6587\u66f8\u30d5\u30a1\u30a4\u30eb\u3067\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u304c\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u304f\u3088\u3046\u306b\u8a98\u5c0e\u3059\u308b\u305f\u3081\u3001\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306b\u306f\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u5185\u5bb9\u306b\u95a2\u9023\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u540d\u304c\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u304c\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u3044\u3066\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u304c\u6210\u529f\u3057\u305f\u5834\u5408\u3001\u653b\u6483\u8005\u306b\u30a2\u30af\u30bb\u30b9\u3092\u63d0\u4f9b\u3059\u308b\u30d0\u30c3\u30af\u30c9\u30a2\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u30b7\u30b9\u30c6\u30e0\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u3001\u304a\u3068\u308a\u6587\u66f8\u304c\u88ab\u5bb3\u8005\u306b\u8868\u793a\u3055\u308c\u307e\u3059\u3002\u901a\u5e38\u3001\u304a\u3068\u308a\u6587\u66f8\u306f\u3001\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u304c\u958b\u304b\u308c\u305f\u3068\u304d\u306b\u30e6\u30fc\u30b6\u30fc\u304c\u898b\u308b\u3053\u3068\u3092\u60f3\u5b9a\u3057\u305f\u3001\u60aa\u610f\u306e\u306a\u3044\u5185\u5bb9\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u6a19\u7684\u30e6\u30fc\u30b6\u30fc\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3001\u304a\u3088\u3073\u507d\u88c5\u3055\u308c\u305f\u304b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3092\u53d7\u3051\u305f\u9001\u4fe1\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u306e\u591a\u304f\u306f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u3067\u624b\u306b\u5165\u308b\u60c5\u5831\u3067\u3059\u3002\u5916\u898b\u4e0a\u306e\u9001\u4fe1\u8005\u306f\u901a\u5e38\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u30c6\u30ad\u30b9\u30c8\u306b\u95a2\u9023\u3057\u305f\u4eba\u7269\u3067\u3042\u308b\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u304c\u3001\u305d\u308c\u304c\u9069\u5207\u306a\u3082\u306e\u3067\u3042\u308b\u5834\u5408\u3001\u76ee\u6a19\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306f\u76ee\u6a19\u306e\u7d44\u7e54\u3068\u9023\u52d5\u3057\u3066\u901a\u5e38\u30aa\u30f3\u30e9\u30a4\u30f3\u3067\u3082\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u304a\u3068\u308a\u6587\u66f8\u306f\u90e8\u5206\u7684\u306a\u3082\u306e\u3082\u30aa\u30f3\u30e9\u30a4\u30f3\u3067\u898b\u3064\u3051\u308b\u3053\u3068\u304c\u3067\u304d\u305a\u3001Scarlet Mimic\u306b\u3088\u308b\u4ee5\u524d\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u304b\u3089\u5165\u624b\u3057\u305f\u3082\u306e\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u653b\u6483\u8005\u306e\u591a\u304f\u306f\u3053\u306e\u7279\u5b9a\u30d1\u30bf\u30fc\u30f3\u3092\u5c0e\u5165\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u305d\u308c\u306f\u591a\u304f\u306e\u5834\u5408\u30e6\u30fc\u30b6\u30fc\u3078\u306e\u611f\u67d3\u306e\u8b66\u544a\u306a\u3057\u306b\u30e6\u30fc\u30b6\u30fc\u3092\u611f\u67d3\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u304b\u3089\u3067\u3059\u3002\u3053\u308c\u306f\u305f\u3068\u3048\u3070\u3001<a href=\"https:\/\/blog.paloaltonetworks.com\/2015\/06\/operation-lotus-blossom\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">Operation Lotus Blossom<\/a>\u3067\u653b\u6483\u8005\u306b\u3088\u3063\u3066\u5c0e\u5165\u3055\u308c\u305f\u30d1\u30bf\u30fc\u30f3\u3068\u307e\u3063\u305f\u304f\u540c\u3058\u3067\u3059\u3002<\/p>\n<p>\u79c1\u305f\u3061\u306fScarlet Mimic\u306b\u7531\u6765\u3059\u308b\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u6587\u66f8\u304c\u4ee5\u4e0b\u306e\u8106\u5f31\u6027\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li>CVE-2012-0158<\/li>\n<li>CVE-2010-3333<\/li>\n<li>CVE-2010-2883<\/li>\n<li>CVE-2010-2572<\/li>\n<li>CVE-2009-3129<\/li>\n<\/ul>\n<p>\u307e\u305f\u3001Scarlet Mimic\u304c\u591a\u6570\u306e\u30c4\u30fc\u30eb\u30ad\u30c3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u6587\u66f8\u3092\u4f5c\u6210\u3057\u3001\u305d\u306e\u4e2d\u306b\u4fb5\u5bb3\u3092\u53d7\u3051\u305f\u30b7\u30b9\u30c6\u30e0\u4e0a\u306bFakeM\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8 \u30b3\u30fc\u30c9\u3092\u4ed5\u8fbc\u3093\u3067\u3042\u308b\u3053\u3068\u3082\u5206\u304b\u3063\u3066\u3044\u307e\u3059\u3002Unit 42\u306f<a href=\"https:\/\/blog.paloaltonetworks.com\/2015\/05\/cmstar-downloader-lurid-and-enfals-new-cousin\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">MNKit<\/a>\u3001WingD\u3001Tran Duy Linh\u306e\u540d\u524d\u3067FakeM\u3092\u914d\u4fe1\u3059\u308b\u30c4\u30fc\u30eb\u30ad\u30c3\u30c8\u3092\u8ffd\u8de1\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30ad\u30c3\u30c8\u306f\u591a\u304f\u306e\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u3088\u3046\u306b\u898b\u53d7\u3051\u3089\u308c\u3001\u30ad\u30c3\u30c8\u306e\u4f7f\u7528\u3060\u3051\u3067\u306fScarlet Mimic\u306e\u6d3b\u52d5\u3092\u793a\u3059\u826f\u3044\u624b\u304c\u304b\u308a\u306b\u306f\u306a\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>\u307e\u305f\u591a\u304f\u306e\u5834\u5408\u3053\u308c\u3089\u8105\u5a01\u306e\u653b\u6483\u8005\u306f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u6587\u66f8\u3092\u307e\u3063\u305f\u304f\u4f7f\u7528\u3057\u3066\u304a\u3089\u305a\u3001\u5b9f\u969b\u306e\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3092\u96a0\u3059\u305f\u3081\u306bRight-to-Left Override\u6587\u5b57\u3092\u7528\u3044\u305f\u81ea\u5df1\u89e3\u51cd(SFX) RAR\u30a2\u30fc\u30ab\u30a4\u30d6\u3092\u9001\u4fe1\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070FakeM\u3092\u914d\u4fe1\u3059\u308b\u306e\u306b\u4f7f\u7528\u3055\u308c\u308b\u4ee5\u4e0b\u306e2\u3064\u306eSFX\u30a2\u30fc\u30ab\u30a4\u30d6\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306b\u306fRLO\u6587\u5b57(\u592a\u5b57)\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\"><i>Update about the status of Tenzin Delek Rinpoche\u2019ashes<b>%E2%80%AE<\/b>cod.scr<\/i><\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\"><i>tepsiliy mezmun.<b>\\xe2\\x80\\xae<\/b>txt.scr<\/i><\/span><\/p>\n<p>\u901a\u5e38\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306e\u8106\u5f31\u6027\u304c\u4f55\u3082\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3055\u308c\u306a\u3044\u5834\u5408\u3067\u3082\u653b\u6483\u8005\u306f\u304a\u3068\u308a\u6587\u66f8\u3092\u4ed8\u3051\u52a0\u3048\u3066\u304a\u304d\u307e\u3059\u3002\u307b\u3068\u3093\u3069\u306e\u304a\u3068\u308a\u6587\u66f8\u306b\u95a2\u3057\u3066\u3001\u305d\u306e\u5185\u5bb9\u306f\u958b\u653e\u578b\u306e\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u3067\u5165\u624b\u53ef\u80fd\u306e\u3088\u3046\u306b\u898b\u53d7\u3051\u3089\u308c\u3001\u653b\u6483\u8005\u306f\u901a\u5e38\u3053\u308c\u3089\u3092\u90e8\u5206\u7684\u306b\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n<p>\u6a19\u7684\u30e6\u30fc\u30b6\u30fc\u306e\u9001\u4fe1\u30a2\u30ab\u30a6\u30f3\u30c8\u3001\u304a\u3088\u3073\u507d\u88c5\u3055\u308c\u305f\u304b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3092\u53d7\u3051\u305f\u9001\u4fe1\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u591a\u304f\u306f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u3067\u624b\u306b\u5165\u308b\u60c5\u5831\u3067\u3059\u3002\u5916\u898b\u4e0a\u306e\u9001\u4fe1\u8005\u306f\u901a\u5e38\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u30c6\u30ad\u30b9\u30c8\u306b\u95a2\u9023\u3057\u305f\u4eba\u7269\u3067\u3042\u308b\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u304c\u3001\u305d\u308c\u304c\u9069\u5207\u306a\u3082\u306e\u3067\u3042\u308b\u5834\u5408\u3001\u76ee\u6a19\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306f\u76ee\u6a19\u306e\u7d44\u7e54\u3068\u9023\u52d5\u3057\u3066\u901a\u5e38\u30aa\u30f3\u30e9\u30a4\u30f3\u3067\u3082\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u304a\u3068\u308a\u6587\u66f8\u306f\u90e8\u5206\u7684\u306a\u3082\u306e\u3082\u30aa\u30f3\u30e9\u30a4\u30f3\u3067\u898b\u3064\u3051\u308b\u3053\u3068\u304c\u3067\u304d\u305a\u3001Scarlet Mimic\u306b\u3088\u308b\u4ee5\u524d\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u304b\u3089\u5165\u624b\u3057\u305f\u3082\u306e\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u304a\u3068\u308a\u6587\u66f8\u306e\u5168\u822c\u7684\u306a\u30c6\u30fc\u30de\u306f\u3001\u30a6\u30a4\u30b0\u30eb\u95a2\u9023\u3001\u53cd\u30d7\u30fc\u30c1\u30f3\u3001\u307e\u305f\u306f\u30a2\u30eb\u30ab\u30a4\u30c0\u306b\u95a2\u9023\u3057\u305f\u3082\u306e\u3067\u3057\u305f\u3002\u304a\u3068\u308a\u6587\u66f8\u306f\u591a\u304f\u306e\u5834\u5408\u3001\u6a19\u7684\u8005\u304c\u983b\u7e41\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3068\u601d\u308f\u308c\u308b\u30b7\u30f3\u30af\u30bf\u30f3\u30af\u3084\u4fe1\u983c\u3067\u304d\u308b\u30cb\u30e5\u30fc\u30b9\u306e\u60c5\u5831\u6e90\u304b\u3089\u30b3\u30d4\u30fc\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u4e00\u4f8b\u3068\u3057\u3066\u3001\u653b\u6483\u8005\u306f<a href=\"https:\/\/www.nytimes.com\/2015\/07\/22\/world\/asia\/chinese-police-are-said-to-seize-ashes-of-tibetan-monk-tenzin-delek-rinpoche.html?_r=0\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \"><i>New York Times<\/i>\u00a0\u306e\u8a18\u4e8b<\/a>(\u56f32)\u306e\u5185\u5bb9\u3092\u63b2\u8f09\u3055\u308c\u305f\u540c\u65e5\u306b\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_2.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_2.png\" alt=\"\u56f3 2: New York Times\u306e\u8a18\u4e8b\u304b\u3089\u62bd\u51fa\u3055\u308c\u305f\u304a\u3068\u308a\u6587\u66f8\" width=\"974\" height=\"461\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 2: New York Times\u306e\u8a18\u4e8b\u304b\u3089\u62bd\u51fa\u3055\u308c\u305f\u304a\u3068\u308a\u6587\u66f8<\/figcaption><\/figure>\n<\/div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_3.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_3.png\" alt=\"\u56f3 3: \u4e16\u754c\u30a6\u30a4\u30b0\u30eb\u4f1a\u8b70\u306e\u30d7\u30ec\u30b9\u30ea\u30ea\u30fc\u30b9\u3092\u4f7f\u7528\u3057\u305f\u304a\u3068\u308a\u6587\u66f8\" width=\"974\" height=\"477\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 3: \u4e16\u754c\u30a6\u30a4\u30b0\u30eb\u4f1a\u8b70\u306e\u30d7\u30ec\u30b9\u30ea\u30ea\u30fc\u30b9\u3092\u4f7f\u7528\u3057\u305f\u304a\u3068\u308a\u6587\u66f8<\/figcaption><\/figure>\n<p>\u56f33\u306f\u30a6\u30a4\u30b0\u30eb\u304a\u3088\u3073\u305d\u306e\u601d\u60f3\u306b\u8208\u5473\u306e\u3042\u308b\u4eba\u3092\u6a19\u7684\u3068\u3057\u3066\u4f7f\u7528\u3055\u308c\u305f\u3088\u308a\u4e00\u822c\u7684\u306a\u6587\u66f8\u3067\u3059\u3002\u8907\u6570\u306e\u653b\u6483\u3067\u4e16\u754c\u30a6\u30a4\u30b0\u30eb\u4f1a\u8b70\u306b\u95a2\u9023\u3059\u308b\u30d7\u30ec\u30b9\u30ea\u30ea\u30fc\u30b9\u3084\u305d\u306e\u4ed6\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u304c\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>\u6211\u3005\u306f2015\u5e747\u6708\u306bScarlet Mimic\u304c\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u6587\u66f8\u3092\u6301\u3061\u8fbc\u3093\u3067\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9\u30b9\u30ad\u30e3\u30f3\u30b5\u30fc\u30d3\u30b9\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u305f\u30e1\u30fc\u30eb\u5168\u6587\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u56f34\u3067\u306f\u3001\u30e1\u30fc\u30eb\u306e\u53d7\u4fe1\u8005\u306f\u30ed\u30b7\u30a2\u9023\u90a6\u4fdd\u5b89\u5e81 (FSB; \u30c9\u30e1\u30a4\u30f3\u306ffsb.ru) \u3067\u50cd\u3044\u3066\u3044\u308b\u500b\u4eba\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u30e1\u30fc\u30eb\u672c\u6587\u3067\u306f\u56fd\u969b\u30ae\u30e3\u30f3\u30b0\u304b\u3089\u306e\u8105\u8feb\u96fb\u8a71\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u306e\u652f\u63f4\u306b\u3064\u3044\u3066\u8a18\u8f09\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_4.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_4.png\" alt=\"\u56f3 4: FSB\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u5b9b\u306b\u9001\u3089\u308c\u305f\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\" width=\"974\" height=\"543\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 4: FSB\u306e\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u5b9b\u306b\u9001\u3089\u308c\u305f\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb<\/figcaption><\/figure>\n<\/div>\n<p>\u5225\u306e\u653b\u6483\u3067\u306f\u3001\u30a2\u30c9\u30eb\u30d5\u30fb\u30d2\u30c8\u30e9\u30fc\u3068\u30ed\u30b7\u30a2\u306e\u30d7\u30fc\u30c1\u30f3\u5927\u7d71\u9818\u3068\u3092\u6bd4\u8f03\u3057\u305f\u304a\u3068\u308a\u753b\u50cf (\u56f35) \u304c\u672a\u77e5\u306e\u6a19\u7684\u306b\u9001\u4fe1\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_5.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_5.png\" alt=\"\u56f3 5: \u304a\u3068\u308a\u6587\u66f8\u306b\u7528\u3044\u3089\u308c\u305f\u53cd\u30d7\u30fc\u30c1\u30f3\u306e\u753b\u50cf\" width=\"974\" height=\"958\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 5: \u304a\u3068\u308a\u6587\u66f8\u306b\u7528\u3044\u3089\u308c\u305f\u53cd\u30d7\u30fc\u30c1\u30f3\u306e\u753b\u50cf<\/figcaption><\/figure>\n<\/div>\n<p>\u3055\u3089\u306b\u5225\u306e\u30b1\u30fc\u30b9\u3067\u306f\u3001\u653b\u6483\u8005\u304c\u3042\u308b\u7d44\u7e54\u304b\u3089\u306e\u4f1a\u8b70\u901a\u77e5 (\u56f36a) \u3092\u4f7f\u7528\u3057\u3001\u300c\u30a4\u30b9\u30e9\u30e0\u6559\u56fd\u30a4\u30b9\u30e9\u30e0\u6559\u5b97\u6559\u4f1a\u8b70\u300d(\u56f36b) \u306b\u5bfe\u3059\u308b\u3082\u306e\u3068\u601d\u308f\u305b\u308b\u3088\u3046\u8868\u793a\u3092\u5909\u66f4\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u6587\u66f8\u3078\u306e\u5909\u66f4\u306f\u3001\u767b\u9332\u30d5\u30a9\u30fc\u30e0\u306b\u6587\u66f8\u306e\u4e0d\u6b63\u3092\u793a\u3059\u75d5\u8de1\u304c\u8907\u6570\u542b\u307e\u308c\u3066\u3044\u305f\u305f\u3081\u975e\u5e38\u306b\u8ca7\u5f31\u306a\u3082\u306e\u3067\u3057\u305f (\u56f36c)\u3002<\/p>\n<div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_6a.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_6a.png\" alt=\"\u56f3 6a: \u304a\u3068\u308a\u6587\u66f8\u3068\u3057\u3066\u7528\u3044\u3089\u308c\u305f\u5143\u306e\u6587\u66f8\" width=\"974\" height=\"264\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 6a: \u304a\u3068\u308a\u6587\u66f8\u3068\u3057\u3066\u7528\u3044\u3089\u308c\u305f\u5143\u306e\u6587\u66f8<\/figcaption><\/figure>\n<\/div>\n<div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_6b.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_6b.png\" alt=\"\u56f3 6b: \u304a\u3068\u308a\u6587\u66f8\u306b\u304a\u3044\u3066\u5909\u66f4\u3055\u308c\u305f\u30d8\u30c3\u30c0\u30fc\u304a\u3088\u3073\u554f\u3044\u5408\u308f\u305b\u5148\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\" width=\"974\" height=\"254\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 6b: \u304a\u3068\u308a\u6587\u66f8\u306b\u304a\u3044\u3066\u5909\u66f4\u3055\u308c\u305f\u30d8\u30c3\u30c0\u30fc\u304a\u3088\u3073\u554f\u3044\u5408\u308f\u305b\u5148\u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9<\/figcaption><\/figure>\n<\/div>\n<div>\n<figure style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-mimic_6c.png\" alt=\"\u56f3 6c: \u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u306f\u5909\u66f4\u3055\u308c\u305f\u304c\u5e74\u5ea6\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u306a\u3044\u304a\u3068\u308a\u6587\u66f8\u306e\u4e0b\u90e8\u3002\u30af\u30a4\u30c3\u30af\u691c\u7d22\u30aa\u30f3\u30e9\u30a4\u30f3\u306f\u3053\u308c\u3092\u8a50\u6b3a\u3067\u3042\u308b\u3068\u793a\u3057\u3066\u3044\u308b\" width=\"974\" height=\"428\" \/><figcaption class=\"wp-caption-text\">\u56f3 6c: \u96fb\u5b50\u30e1\u30fc\u30eb \u30a2\u30c9\u30ec\u30b9\u306f\u5909\u66f4\u3055\u308c\u305f\u304c\u5e74\u5ea6\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u306a\u3044\u304a\u3068\u308a\u6587\u66f8\u306e\u4e0b\u90e8\u3002\u30af\u30a4\u30c3\u30af\u691c\u7d22\u30aa\u30f3\u30e9\u30a4\u30f3\u306f\u3053\u308c\u3092\u8a50\u6b3a\u3067\u3042\u308b\u3068\u793a\u3057\u3066\u3044\u308b<\/figcaption><\/figure>\n<\/div>\n<p>\u79c1\u305f\u3061\u306f\u3053\u308c\u3089\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u500b\u3005\u306e\u304a\u3068\u308a\u6587\u66f8\u3092\u5408\u8a08\u306740\u500b\u4ee5\u4e0a\u53ce\u96c6\u3057\u307e\u3057\u305f\u304c\u3001\u3053\u308c\u306f\u4eca\u56de\u8a73\u8ff0\u3057\u305f\u3082\u306e\u3088\u308a\u3082\u306f\u308b\u304b\u306b\u6570\u304c\u4e0a\u56de\u308a\u307e\u3059\u3002<\/p>\n<p>Scarlet Mimic\u304c\u4e0a\u8a18\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30d1\u30bf\u30fc\u30f3\u3092\u3084\u3081\u305f\u4e8b\u4f8b\u304c\u4e00\u3064\u3042\u308a\u307e\u3059\u30022013\u5e74\u306b\u5f53\u8a72\u30b0\u30eb\u30fc\u30d7\u306f\u6700\u5927\u9650\u306e\u52b9\u679c\u3092\u72d9\u3063\u305fWeb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3068\u3057\u3066\u3082\u77e5\u3089\u308c\u308b\u6c34\u98f2\u307f\u5834\u578b\u653b\u6483\u3092\u5c0e\u5165\u3057\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u4f7f\u7528\u3057\u3066\u88ab\u5bb3\u8005\u3092\u611f\u67d3\u3055\u305b\u307e\u3057\u305f\u3002\u6c34\u98f2\u307f\u5834\u578b\u653b\u6483\u306f\u3001\u6a19\u7684\u306b\u3055\u308c\u305f\u88ab\u5bb3\u8005\u304c\u8a2a\u554f\u3059\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3092\u884c\u3046\u653b\u6483\u30d9\u30af\u30c8\u30eb\u3067\u3042\u308a\u3001\u88ab\u5bb3\u8005\u306e\u30b7\u30b9\u30c6\u30e0\u306b\u611f\u67d3\u3057\u3066\u30a2\u30af\u30bb\u30b9\u6a29\u3092\u5f97\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002<a href=\"https:\/\/community.websense.com\/blogs\/securitylabs\/archive\/2013\/08\/16\/tibetan-compromise.aspx\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">Websense<\/a>\u306e\u30d6\u30ed\u30b0\u306b\u3088\u308b\u3068\u3001\u8105\u5a01\u306e\u653b\u6483\u8005\u306fTibetan Alliance of Chicago\u306e\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3057\u3001Internet Explorer\u306e\u8106\u5f31\u6027(CVE-2012-4969)\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3059\u308b\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u63d0\u4f9b\u3057\u307e\u3057\u305f\u3002Microsoft\u304c2012\u5e749\u6708\u306b\u3053\u306e\u8106\u5f31\u6027\u306b\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u3066\u3044\u308b\u3053\u3068\u304b\u3089\u3001\u3053\u306e\u6c34\u98f2\u307f\u5834\u578b\u653b\u6483\u306f\u53e4\u3044\u8106\u5f31\u6027\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3092\u8868\u3057\u3066\u304a\u308a\u3001\u5f53\u8a72\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u304c\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u306e\u305f\u3081\u306b\u53e4\u3044\u8106\u5f31\u6027\u3092\u7d99\u7d9a\u7684\u306b\u4f7f\u7528\u3057\u3066\u3044\u308b\u3053\u3068\u3068\u5408\u81f4\u3057\u307e\u3059\u3002<\/p>\n<h3>\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u6982\u8981<\/h3>\n<p>2013\u5e741\u6708\u306bTrend Micro\u306e<a href=\"https:\/\/www.trendmicro.com\/cloud-content\/us\/pdfs\/security-intelligence\/white-papers\/wp-fakem-rat.pdf\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u767d\u66f8<\/a>\u3067\u521d\u3081\u3066\u8a71\u984c\u306b\u53d6\u308a\u4e0a\u3052\u3089\u308c\u307e\u3057\u305f\u304c\u3001FakeM\u306f\u305d\u308c\u305e\u308c\u306e\u6a5f\u80fd\u3092\u5b9f\u884c\u3059\u308b\u7570\u306a\u308b\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u4f7f\u7528\u3059\u308b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3059\u3002FakeM\u306e\u95a2\u6570\u30b3\u30fc\u30c9\u306f\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092\u57fa\u76e4\u3068\u3057\u3066\u304a\u308a\u3001\u30e1\u30e2\u30ea\u5185\u306b\u30ed\u30fc\u30c9\u3055\u308c\u3066\u5b9f\u884c\u3055\u308c\u308b\u305f\u3081\u306b\u5225\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u5fc5\u8981\u3068\u3057\u307e\u3059\u3002FakeM\u3092\u30ed\u30fc\u30c9\u3059\u308b\u306e\u306b\u4f7f\u7528\u3055\u308c\u308b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u7a2e\u985e\u306f\u8c4a\u5bcc\u3067\u3055\u307e\u3056\u307e\u3067\u3059\u304c\u3001\u4e00\u90e8\u306e\u3082\u306e\u306f\u305d\u308c\u4ee5\u5916\u306e\u3082\u306e\u306b\u6bd4\u3079\u8208\u5473\u3092\u5f15\u304b\u308c\u307e\u3059\u3002\u3053\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u306f\u3001\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u3064\u3044\u3066\u8003\u5bdf\u3057\u3001\u6b21\u3044\u3067FakeM\u81ea\u8eab\u306e\u9032\u5316\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u672c\u30bb\u30af\u30b7\u30e7\u30f3\u306e\u7de0\u3081\u304f\u304f\u308a\u3068\u3057\u3066\u3001FakeM\u306b\u95a2\u9023\u3057\u305f\u30c4\u30fc\u30eb\u3067Scarlet Mimic\u304c\u5229\u7528\u3059\u308b\u3082\u306e\u306b\u3064\u3044\u3066\u691c\u8a0e\u3057\u307e\u3059\u3002<\/p>\n<h4>\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/h4>\n<p>FakeM\u306f\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092\u57fa\u76e4\u3068\u3057\u3066\u3044\u308b\u306e\u3067\u3001FakeM\u3092\u30e1\u30e2\u30ea\u306b\u30ed\u30fc\u30c9\u3057FakeM\u306e\u95a2\u6570\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u5225\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u5fc5\u8981\u3068\u3057\u307e\u3059\u3002\u8105\u5a01\u306e\u653b\u6483\u8005\u306fFakeM\u3092\u30ed\u30fc\u30c9\u3059\u308b\u3055\u307e\u3056\u307e\u306a\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u591a\u6570\u958b\u767a\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u4e2d\u306b\u306f\u3044\u304f\u3076\u3093\u5358\u7d14\u306a\u3082\u306e\u3082\u3042\u308c\u3070\u3001\u691c\u77e5\u3092\u56de\u907f\u3059\u308b\u305f\u3081\u306b\u6975\u3081\u3066\u5de7\u5999\u306a\u6280\u6cd5\u3092\u4f7f\u3046\u3082\u306e\u3042\u308a\u307e\u3059\u3002Unit 42\u306f\u3001FakeM\u3092\u5b9f\u884c\u3059\u308b\u76ee\u7684\u3067Scarlet Mimic\u304c\u4f7f\u7528\u3057\u305f\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u4e0b\u8a18\u30ea\u30b9\u30c8\u3092\u8ffd\u8de1\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>CrypticConvo<\/li>\n<li>SkiBoot<\/li>\n<li>RaidBase<\/li>\n<li>FakeHighFive<\/li>\n<li>PiggyBack<\/li>\n<li>FullThrottle<\/li>\n<li>FakeFish<\/li>\n<li>BrutishCommand<\/li>\n<li>SubtractThis<\/li>\n<\/ul>\n<p>\u8105\u5a01\u306e\u653b\u6483\u8005\u306f\u306a\u3093\u3089\u304b\u306e\u7a2e\u985e\u306e\u30d3\u30eb\u30c0\u30fc \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u7d44\u307f\u8fbc\u3093\u3067\u3044\u308b\u3088\u3046\u3067\u3059\u3002\u3053\u306e\u30d3\u30eb\u30c0\u30fc \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u3042\u308c\u3070\u3001\u8105\u5a01\u306e\u653b\u6483\u8005\u306fFakeM\u3092\u5b9f\u884c\u3059\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u8fc5\u901f\u306b\u4f5c\u6210\u3001\u8a2d\u5b9a\u3001\u5c0e\u5165\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u79c1\u305f\u3061\u304c\u3053\u306e\u3088\u3046\u306b\u78ba\u4fe1\u3057\u3066\u3044\u308b\u306e\u306f\u3001FakeM\u3092\u5b9f\u884c\u3059\u308b\u591a\u304f\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b\u304c\u307e\u3063\u305f\u304f\u540c\u3058\u3067\u3001\u88681\u306e\u4f8b\u3067\u5206\u304b\u308b\u3088\u3046\u306b\u3001C2\u30b5\u30fc\u30d0\u304c\u7570\u306a\u3063\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002\u3053\u306e\u3053\u3068\u304b\u3089\u3001\u653b\u6483\u8005\u304c\u5358\u4e00\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u30b3\u30f3\u30d1\u30a4\u30eb\u3057\u3001\u30d3\u30eb\u30c0\u30fc \u30c4\u30fc\u30eb\u3092\u7528\u3044\u3066\u500b\u3005\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u30aa\u30f3\u30c7\u30de\u30f3\u30c9\u3067\u8a2d\u5b9a\u3057\u305f\u3053\u3068\u304c\u4f3a\u3048\u307e\u3059\u3002<\/p>\n<p>\u79c1\u305f\u3061\u306f\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u4f7f\u3063\u3066FakeM\u30b5\u30f3\u30d7\u30eb\u306e\u958b\u767a\u306b\u95a2\u3059\u308b\u4e00\u822c\u7684\u306a\u6642\u7cfb\u5217\u3092\u793a\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001FakeM\u304c\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092\u57fa\u76e4\u3068\u3057\u3066\u3044\u3066\u6709\u7528\u306a\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3092\u542b\u3093\u3067\u3044\u306a\u3044\u304b\u3089\u3067\u3059\u3002\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u306fFakeM\u306e\u5229\u7528\u3068\u5fc5\u305a\u3057\u3082\u5bfe\u5fdc\u3057\u307e\u305b\u3093\u304c\u3001\u3053\u306e\u30ed\u30fc\u30c0\u30fc\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b\u3092\u6642\u7cfb\u5217\u3067\u30d7\u30ed\u30c3\u30c8\u3059\u308b\u3068\u8208\u5473\u6df1\u3044\u50be\u5411\u304c\u898b\u3048\u3066\u304d\u307e\u3059\u3002\u56f37\u306b\u304a\u3051\u308b\u6642\u7cfb\u5217\u306e\u6563\u5e03\u56f3\u304b\u3089\u3001\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304a\u3088\u3073\u305d\u308c\u3092\u5b9f\u884c\u3059\u308bFakeM\u4e9c\u7a2e\u306b\u95a2\u3059\u308b\u65e2\u77e5\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b\u304c\u5206\u304b\u308a\u307e\u3059\u3002<\/p>\n<table width=\"574\">\n<tbody>\n<tr>\n<td width=\"130\"><b>SHA256<\/b><\/td>\n<td width=\"127\"><b>\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b<\/b><\/td>\n<td width=\"200\"><b>\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/b><\/td>\n<td width=\"117\"><b>C2\u30c9\u30e1\u30a4\u30f3<\/b><\/td>\n<\/tr>\n<tr>\n<td width=\"130\">5182dc8667432d76a<br \/>\n276dc4f864cdfcef3e4<br \/>\n81783ebaf46d3b139<br \/>\n7080b798f4a<\/td>\n<td width=\"127\">2013-09-13 08:02:58<\/td>\n<td width=\"200\">CrypticConvo<\/td>\n<td width=\"117\">opero.spdns[.]org, firefox.spdns[.]de<\/td>\n<\/tr>\n<tr>\n<td width=\"130\">5dade00db195087aa<br \/>\n336ce190b5fd1c2299<br \/>\n2c49556c623b42a9f7<br \/>\n42d73241a7f<\/td>\n<td width=\"127\">2013-09-13 08:02:58<\/td>\n<td width=\"200\">CrypticConvo<\/td>\n<td width=\"117\">intersecurity.firewall-gateway[.]com<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div><\/div>\n<div style=\"text-align: center;\"><em><span style=\"font-size: 10pt;\">\u88681: \u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b\u306f\u5171\u6709\u3059\u308b\u304c\u8a2d\u5b9a\u306b\u304a\u3051\u308bC2\u30c9\u30e1\u30a4\u30f3\u304c\u7570\u306a\u3063\u3066\u3044\u308b2\u3064\u306e\u30b5\u30f3\u30d7\u30eb<\/span><\/em><\/div>\n<div>\n<figure style=\"width: 532px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-7.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-7.png\" alt=\"\u56f3 7: FakeM\u3068\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u3092\u6642\u7cfb\u5217\u306b\u3057\u305f\u3082\u306e\" width=\"532\" height=\"397\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f3 7: FakeM\u3068\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u3092\u6642\u7cfb\u5217\u306b\u3057\u305f\u3082\u306e<\/figcaption><\/figure>\n<\/div>\n<p>\u3053\u306e\u6642\u7cfb\u5217\u304b\u3089\u30012009\u5e74\u304b\u30892014\u5e74\u306e\u306f\u3058\u3081\u306e\u6570\u304b\u6708\u307e\u3067\u3001\u653b\u6483\u8005\u304c\u540c\u6642\u306b\u30ed\u30fc\u30c0\u30fc\u3092\u3044\u304f\u3064\u304b\u6d3b\u767a\u306b\u958b\u767a\u3057\u3066\u3044\u305f\u3053\u3068\u304c\u4f3a\u3048\u307e\u3059\u30022014\u5e74\u7b2c1\u56db\u534a\u671f\u3092\u904e\u304e\u308b\u3068\u3001\u653b\u6483\u8005\u305f\u3061\u306f\u53e4\u3044\u30ed\u30fc\u30c0\u30fc\u306e\u958b\u767a\u3092\u3084\u3081\u3066FakeFish\u3001BrutishCommand\u3001SubtractThis\u3092\u63a1\u7528\u3057\u305f\u3088\u3046\u3067\u3059\u3002\u3053\u308c\u306f\u653b\u6483\u8005\u304c\u53e4\u3044\u30ed\u30fc\u30c0\u30fc\u3092\u4f7f\u3044\u7d9a\u3051\u306a\u304f\u306a\u308b\u3068\u3044\u3046\u3053\u3068\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u653b\u6483\u8005\u304c\u65b0\u578b\u30ed\u30fc\u30c0\u30fc\u3042\u308b\u3044\u306f\u65b0\u305f\u306b\u958b\u767a\u3055\u308c\u305f\u30ed\u30fc\u30c0\u30fc\u3092\u6700\u65b0\u7248\u30d3\u30eb\u30c0\u30fc \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u7d44\u307f\u5165\u308c\u7d9a\u3051\u308b\u3053\u3068\u3092\u4f3a\u308f\u305b\u308b\u3082\u306e\u3067\u3059\u3002<\/p>\n<p>\u3053\u306e\u6642\u7cfb\u5217\u306f\u3001FakeM\u306e\u958b\u767a\u8005\u304cTrend Micro\u306eFakeM\u306b\u95a2\u3059\u308b<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/hiding-in-plain-sight-the-fakem-remote-access-trojan\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u30d6\u30ed\u30b0<\/a>\u304a\u3088\u3073<a href=\"https:\/\/www.trendmicro.com\/cloud-content\/us\/pdfs\/security-intelligence\/white-papers\/wp-fakem-rat.pdf\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u767d\u66f8<\/a>\u306e\u516c\u8868\u306b\u53cd\u5fdc\u3057\u305f\u53ef\u80fd\u6027\u3082\u793a\u3057\u3066\u3044\u307e\u3059\u3002Trend Micro\u306f2013\u5e741\u670817\u65e5(\u56f37\u306e\u8d64\u3044\u7dda)\u306bFakeM\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u95a2\u3059\u308b\u81ea\u793e\u306e\u5206\u6790\u3092\u516c\u8868\u3057\u3001FakeM\u306e\u5143\u306e\u4e9c\u7a2e\u306b\u3064\u3044\u3066\u89e3\u8aac\u3057\u307e\u3057\u305f\u3002\u305d\u306e\u5f8c\u307e\u3082\u306a\u304f\u3001FakeM\u306e\u5143\u306e\u4e9c\u7a2e\u306f\u6642\u7cfb\u5217\u304b\u3089\u5916\u308c\u3001\u4ee3\u308f\u308a\u306bSSL\u304a\u3088\u3073\u72ec\u81eaSSL\u306e\u4e9c\u7a2e\u304c\u63a1\u7528\u3055\u308c\u307e\u3057\u305f\u3002FakeM\u958b\u767a\u8005\u304c\u81ea\u5206\u305f\u3061\u306e\u30c4\u30fc\u30eb\u306e\u5b58\u5728\u304c\u660e\u3089\u304b\u306b\u3055\u308c\u305f\u306e\u3092\u898b\u3066\u3068\u308b\u3068\u3001\u653b\u6483\u306b\u304a\u3051\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u3057\u3066\u4f7f\u3044\u7d9a\u3051\u308b\u305f\u3081\u3001\u691c\u77e5\u3092\u56de\u907f\u3059\u308b\u76ee\u7684\u3067\u3053\u308c\u306b\u5bfe\u5fdc\u3057\u305f\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u958b\u767a\u8005\u304c\u7279\u306bTrend Micro\u306e\u767a\u8868\u5185\u5bb9\u306b\u9650\u5b9a\u3057\u3066\u53cd\u5fdc\u3057\u305f\u306e\u304b\u3069\u3046\u304b\u306f\u4e0d\u660e\u3067\u3059\u304c\u3001\u81ea\u5206\u305f\u3061\u306e\u30c4\u30fc\u30eb\u304c\u30a2\u30f3\u30c1\u30a6\u30a3\u30eb\u30b9\u306b\u3088\u3063\u3066\u691c\u51fa\u3055\u308c\u308b\u5272\u5408\u304c\u9ad8\u304f\u306a\u308a\u3001\u305d\u306e\u7d50\u679c\u30c4\u30fc\u30eb\u306e\u767a\u899a\u3092\u62db\u304f\u3053\u3068\u306b\u306a\u3063\u3066\u53cd\u5fdc\u3057\u305f\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u5177\u4f53\u7684\u306a\u304d\u3063\u304b\u3051\u304c\u4f55\u3067\u3042\u308c\u3001\u3053\u306e\u53cd\u5fdc\u304b\u3089FakeM\u8105\u5a01\u306e\u653b\u6483\u8005\u304c\u691c\u51fa\u3084\u7279\u5b9a\u3055\u308c\u308b\u306e\u3092\u56de\u907f\u3057\u3001\u653b\u6483\u6d3b\u52d5\u3092\u7d99\u7d9a\u3059\u308b\u305f\u3081\u9032\u5316\u3057\u305f\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u6642\u7cfb\u5217\u3067\u4e3b\u8981\u90e8\u5206\u304b\u3089\u96e2\u308c\u3066\u3044\u308b\u3082\u306e\u304c1\u3064\u76ee\u7acb\u3061\u307e\u3059\u3002\u5177\u4f53\u7684\u306b\u306f\u30012009\u5e749\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305fFakeHighFive\u30b5\u30f3\u30d7\u30eb\u3067\u3001\u3053\u308c\u306fFakeM SSL\u30b5\u30f3\u30d7\u30eb\u3092\u30ed\u30fc\u30c9\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b\u306f\u6b63\u3057\u304f\u306a\u3044\u3082\u306e\u3068\u79c1\u305f\u3061\u306f\u78ba\u4fe1\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u305d\u308c\u306f\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u7528\u306eC2\u30c9\u30e1\u30a4\u30f3(\u5177\u4f53\u7684\u306b\u306fpress.ufoneconference[.]com)\u304c\u8105\u5a01\u306e\u653b\u6483\u8005\u306b\u3088\u3063\u30662013\u5e742\u6708\u306b\u767b\u9332\u3055\u308c\u305f\u304b\u3089\u3067\u3059\u30022013\u5e742\u6708\u306e\u5f53\u8a72C2\u30c9\u30e1\u30a4\u30f3\u306e\u767b\u9332\u306f\u3001FakeM SSL\u306e\u4ed6\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b\u3068\u5408\u81f4\u3057\u3001\u3053\u306e\u3053\u3068\u304b\u3089\u79c1\u305f\u3061\u306f2009\u5e749\u6708\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u304c\u6539\u3056\u3093\u3055\u308c\u305f\u304b\u6b63\u3057\u304f\u306a\u3044\u3001\u3042\u308b\u3044\u306f\u305d\u306e\u4e21\u65b9\u3067\u3042\u308b\u3068\u7d50\u8ad6\u3065\u3051\u307e\u3057\u305f\u3002<\/p>\n<p>\u95a2\u9023\u306e\u3042\u308b\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac(CrypticConvo\u3001PiggyBack\u3001FullThrottle\u3001FakeHighFive\u3002FakeFish\u304a\u3088\u3073RaidBase\u306a\u3069)\u306e\u307b\u3068\u3093\u3069\u306f\u3001\u6697\u53f7\u5316\u6e08\u307f\u306eFakeM\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092(PE\u30ea\u30bd\u30fc\u30b9\u307e\u305f\u306f\u57cb\u3081\u8fbc\u307f\u30c7\u30fc\u30bf\u306e\u3069\u3061\u3089\u304b\u3089)\u30ed\u30fc\u30c9\u3059\u308b\u7a0b\u5ea6\u306e\u3053\u3068\u306f\u884c\u3044\u3001\u7d50\u679c\u3068\u3057\u3066\u5f97\u3089\u308c\u305f\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u95a2\u9023\u306e\u3042\u308b\u5225\u306e\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac(SubtractThis\u3001BrutishCommand\u304a\u3088\u3073SkiBoot\u306a\u3069)\u306f\u3001\u691c\u8a0e\u3059\u308b\u3060\u3051\u306e\u4fa1\u5024\u306e\u3042\u308b\u3001\u3055\u3089\u306b\u5de7\u5999\u306a\u6280\u6cd5\u3092\u63a1\u7528\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h4><b>SubtractThis<\/b><\/h4>\n<p>SubtractThis\u30ed\u30fc\u30c0\u30fc\u306f\u3001\u975e\u5e38\u306b\u512a\u308c\u305f\u624b\u6cd5\u3092\u8868\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30ed\u30fc\u30c0\u30fc\u306f\u3001\u30e1\u30a4\u30f3\u6a5f\u80fd\u306e\u5b9f\u884c\u3092\u9045\u3089\u305b\u308b\u305f\u3081\u306b\u4f7f\u7528\u3057\u3066\u3044\u308b\u624b\u6cd5\u3001\u7279\u306b\u30e6\u30fc\u30b6\u30fc\u306b\u30de\u30a4\u30ca\u30b9(\u201c-\u201c)\u30ad\u30fc\u3092\u62bc\u3059\u3088\u3046\u306b\u8981\u6c42\u3059\u308b\u624b\u6cd5\u306b\u57fa\u3065\u3044\u3066\u3001\u3053\u306e\u540d\u524d\u304c\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002SubtractThis\u306f\u3001\u6b21\u306e\u624b\u9806\u3067\u3053\u306e\u624b\u6cd5\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<ol>\n<li>LoadAcceleratorsA\u95a2\u6570\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u30de\u30a4\u30ca\u30b9\u6587\u5b57\u201c-\u201c\u306e\u4eee\u60f3\u9375\u3092\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002\u4f8b: LoadAcceleratorsA(hInstance, VK_SUBTRACT);<\/li>\n<li>SetTimer\u95a2\u6570\u3092\u547c\u3073\u51fa\u3057\u3066\u3001LB_FINDSTRING Windows\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u767a\u751f\u6642\u306b\u547c\u3073\u51fa\u3055\u308c\u308b\u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u95a2\u6570\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u4f8b: SetTimer(0, LB_FINDSTRING_, 10000u, TimerFunc);<\/li>\n<li>Windows\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306b\u3001GetMessageA\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u8d77\u52d5\u3059\u308b\u9023\u7d9a\u30eb\u30fc\u30d7\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/li>\n<li>TranslateAcceleratorA\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u53d7\u4fe1\u3057\u305fWindows\u30e1\u30c3\u30bb\u30fc\u30b8\u304cVK_SUBTRACT \u201c-\u201c\u3067\u3042\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/li>\n<li>\u30e6\u30fc\u30b6\u30fc\u304c\u30de\u30a4\u30ca\u30b9\u201c-\u201c\u30ad\u30fc\u3092\u5165\u529b\u3057\u305f\u5834\u5408\u306f\u3001SetTimer\u95a2\u6570\u306b\u8a2d\u5b9a\u3055\u308c\u305f\u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u95a2\u6570\u3092\u547c\u3073\u51fa\u3057\u307e\u3059\u3002<\/li>\n<\/ol>\n<p>\u3053\u306e\u624b\u6cd5\u306b\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u306e\u4ecb\u5728\u304c\u5fc5\u8981\u3067\u3059\u3002\u305d\u308c\u306b\u3088\u308a\u3001\u30b5\u30f3\u30c9\u30dc\u30c3\u30af\u30b9\u3067\u306e\u5206\u6790\u3092\u3088\u308a\u56f0\u96e3\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h4>BrutishCommand<\/h4>\n<p>BrutishCommand\u30ed\u30fc\u30c0\u30fc\u306f\u3001\u975e\u5e38\u306b\u8208\u5473\u6df1\u3044\u65b9\u6cd5\u3067\u3001FakeM\u95a2\u6570\u30b3\u30fc\u30c9\u3092\u5fa9\u53f7\u5316\u3057\u307e\u3059\u3002\u3053\u306e\u30ed\u30fc\u30c0\u30fc\u306e\u30e1\u30a4\u30f3\u95a2\u6570\u306f\u3001\u305d\u308c\u306b\u6e21\u3055\u308c\u308b\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3\u5f15\u6570\u3092\u78ba\u8a8d\u3057\u3001\u4f55\u3082\u5b58\u5728\u3057\u306a\u3044\u5834\u5408\u306f0\uff5e9\u306e\u9593\u306e\u4e71\u6570\u3092\u53d6\u5f97\u3057\u3001\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3\u5f15\u6570\u3068\u3057\u3066\u3053\u306e\u4e71\u6570\u3092\u4f7f\u7528\u3057\u3001\u540c\u3058\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u3057\u3066\u65b0\u3057\u3044\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<p>\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306b\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u5f15\u6570\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u305d\u306e\u5024\u3092\u30cf\u30c3\u30b7\u30e5 \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306b\u304b\u3051\u3001\u305d\u306e\u30cf\u30c3\u30b7\u30e5\u30920x20E3EEBA\u3068\u6bd4\u8f03\u3057\u307e\u3059\u3002\u5024\u304c\u9759\u7684\u306a\u30cf\u30c3\u30b7\u30e5\u3068\u4e00\u81f4\u3059\u308b\u3068\u3001\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306f\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3\u5f15\u6570\u3092\u4f7f\u7528\u3057\u30662\u756a\u76ee\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u3053\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u57cb\u3081\u8fbc\u307e\u308c\u305fFakeM\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092\u5fa9\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u5fa9\u53f7\u5316\u9375\u3068\u3057\u3066\u4f7f\u7528\u3059\u308b\u5024\u3092\u751f\u6210\u3057\u307e\u3059\u3002\u57fa\u672c\u7684\u306b\u306f\u7dcf\u5f53\u308a\u653b\u6483\u3067\u3001\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3\u3067\u63d0\u4f9b\u3055\u308c\u308b\u6b63\u3057\u3044\u5024\u3067\u5b9f\u884c\u3055\u308c\u308b\u307e\u3067\u3001\u4f55\u5ea6\u3082\u81ea\u8eab\u3092\u518d\u5b9f\u884c\u3057\u3066\u5fa9\u53f7\u5316\u9375\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002Unit 42\u3067\u306f\u3001\u3053\u306e\u624b\u6cd5\u304c\u4ed6\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3000\u30d5\u30a1\u30df\u30ea\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u306e\u3092\u898b\u305f\u3053\u3068\u304c\u3042\u308a\u307e\u305b\u3093\u3002\u3053\u308c\u306f\u3001\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u5206\u6790\u307e\u305f\u306f\u30c7\u30d0\u30c3\u30b0\u3092\u8a66\u307f\u308b\u969b\u306e\u5384\u4ecb\u306a\u969c\u5bb3\u3092\u3082\u305f\u3089\u3057\u307e\u3059\u3002<\/p>\n<h4>SkiBoot \u30ed\u30fc\u30c0\u30fc<\/h4>\n<p>SkiBoot\u306f\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u30de\u30b9\u30bf\u30fc \u30d6\u30fc\u30c8 \u30ec\u30b3\u30fc\u30c9(MBR)\u3092\u8aad\u307f\u53d6\u308a\u3001FakeM\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u3092\u5fa9\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3059\u308bXOR\u9375\u3092\u5224\u5225\u3057\u307e\u3059\u3002\u3053\u306e\u6a5f\u80fd\u306f\u3001ReadFile\u95a2\u6570\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u201c\\\\.\\PHYSICALDRIVE0\u201d\u304b\u3089512\u30d0\u30a4\u30c8\u3092\u8aad\u307f\u53d6\u308a\u3001\u7279\u306b\u3001MBR\u306e\u6700\u7d42\u30d0\u30a4\u30c8\u3092\u6697\u53f7\u5316\u9375\u3068\u3057\u3066\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002MBR\u306e\u6700\u7d42\u30d0\u30a4\u30c8\u306f\u201c\\xAA\u201d\u3001\u3064\u307e\u308a2\u756a\u76ee\u306e\u30d0\u30a4\u30c8\u306e\u201c\\x55\\xAA\u201d\u3067\u3001MBR\u306e\u30d6\u30fc\u30c8 \u30b7\u30b0\u30cd\u30c1\u30e3\u90e8\u5206\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u30ed\u30fc\u30c0\u30fc\u306e\u4e9c\u7a2e\u306e1\u3064\u306f\u3001ReadFile\u3092\u4f7f\u7528\u3059\u308b\u4ee3\u308f\u308a\u306b\u3001ID_CMD\u5236\u5fa1\u30b3\u30fc\u30c9\u3092\u4f7f\u7528\u3057\u3066\u3044\u308bDeviceIOControl\u3092\u4f7f\u7528\u3057\u3066MBR\u3092\u8aad\u307f\u53d6\u308a\u3001\u7279\u5b9a\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u3001\u5fa9\u53f7\u5316\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u5185\u306e\u6697\u53f7\u5316\u30c6\u30ad\u30b9\u30c8\u306e\u5404\u30d0\u30a4\u30c8\u3092\u5de1\u56de\u3055\u305b\u308b\u5024\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002DeviceIOControl\u306e\u4f7f\u7528\u304c\u91cd\u8981\u3068\u306a\u308b\u306e\u306f\u3001VMware\u30cf\u30a4\u30d1\u30fc\u30d0\u30a4\u30b6\u304c\u3053\u306eAPI\u30b3\u30fc\u30eb\u306bMBR\u3067\u306f\u306a\u304f\u7a7a\u306e\u30d0\u30c3\u30d5\u30a1\u3067\u5fdc\u7b54\u3059\u308b\u4e00\u65b9\u3001Virtualbox\u30cf\u30a4\u30d1\u30fc\u30d0\u30a4\u30b6\u306f\u6b63\u3057\u304fMBR\u3092\u8fd4\u3059\u305f\u3081\u3067\u3059\u3002\u3053\u306e\u30ed\u30fc\u30c0\u30fc\u3067\u306f\u3001\u7279\u306b\u3001VMware\u691c\u51fa\u624b\u6cd5\u3068\u3057\u3066DeviceIOControl API\u95a2\u6570\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002\u3053\u308c\u306f\u3001\u958b\u767a\u8005\u304cVmware\u30cf\u30a4\u30d1\u30fc\u30d0\u30a4\u30b6\u3084\u4eee\u60f3\u30de\u30b7\u30f3\u3092\u56de\u907f\u3059\u308b\u624b\u7acb\u3066\u306b\u7cbe\u901a\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3>\u9032\u5316\u3059\u308b FakeM: \u4e9c\u7a2e<\/h3>\n<p>2013\u5e74\u306b\u6700\u521d\u306b\u767a\u899a\u3057\u3066\u4ee5\u6765\u3001FakeM\u306e\u4f5c\u6210\u8005\u306f\u3001FakeM\u30b3\u30fc\u30c9\u30d9\u30fc\u30b9\u3092\u7d99\u7d9a\u7684\u306b\u5909\u66f4\u3057\u3066\u304d\u3066\u304a\u308a\u3001\u305d\u306e\u7d50\u679c\u3001\u8907\u6570\u306e\u4e9c\u7a2e\u304c\u751f\u307e\u308c\u3066\u3044\u307e\u3059\u3002FakeM\u306e\u3055\u307e\u3056\u307e\u306a\u4e9c\u7a2e\u306e\u8a73\u7d30\u3092\u8ff0\u3079\u308b\u524d\u306b\u3001\u3055\u307e\u3056\u307e\u306a\u7e70\u308a\u8fd4\u3057\u5168\u4f53\u3092\u901a\u3058\u3066\u5b58\u7d9a\u3057\u3066\u3044\u308b\u591a\u6570\u306e\u985e\u4f3c\u70b9\u3092\u53d6\u308a\u4e0a\u3052\u307e\u3059\u3002FakeM\u304c\u9032\u5316\u3059\u308b\u9593\u3082\u3001\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u306f\u5909\u66f4\u3055\u308c\u3066\u304a\u3089\u305a\u3001\u56f38\u306b\u793a\u3059\u3068\u304a\u308a\u3001\u5404\u4e9c\u7a2e\u306b\u30e2\u30b8\u30e5\u30fc\u30eb\u5f0f\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u304c\u5b58\u5728\u3057\u307e\u3059\u3002FakeM\u306e\u30e1\u30a4\u30f3 \u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001\u30ad\u30fc\u30ed\u30ac\u30fc\u307e\u305f\u306f\u6a5f\u5bc6\u30d5\u30a1\u30a4\u30eb\u306e\u53ce\u96c6\u306a\u3069\u306e\u57cb\u3081\u8fbc\u307f\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u8d77\u52d5\u3059\u308b\u5f79\u5272\u3092\u62c5\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u30e1\u30a4\u30f3 \u30e2\u30b8\u30e5\u30fc\u30eb\u306fC2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3057\u3001C2\u30b5\u30fc\u30d0\u306b\u3088\u3063\u3066\u767a\u884c\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u3092\u51e6\u7406\u3059\u308b\u5f79\u5272\u3082\u62c5\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-8.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-8.png\" alt=\"\u56f38: FakeM\u306e\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\" width=\"975\" height=\"430\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f38: FakeM\u306e\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3<\/figcaption><\/figure>\n<\/div>\n<p>FakeM\u306e\u4e9c\u7a2e\u306f\u3059\u3079\u3066\u3001C2\u30b5\u30fc\u30d0\u3068\u306e\u901a\u4fe1\u3092\u958b\u59cb\u3057\u3001C2\u306e\u5fdc\u7b54\u3067\u30b3\u30de\u30f3\u30c9\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u307e\u305f\u3001FakeM\u306e\u4e9c\u7a2e\u306f\u3059\u3079\u3066\u3001\u88682\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u540c\u3058\u6a5f\u80fd\u3092\u6301\u3064\u5171\u901a\u306e\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9\u3092\u5171\u6709\u3057\u3066\u3044\u307e\u3059\u3002\u9650\u5b9a\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9 \u30bb\u30c3\u30c8\u306f\u30010x211\u30b3\u30de\u30f3\u30c9\u3068\u3068\u3082\u306bC2\u30b5\u30fc\u30d0\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u308b\u8ffd\u52a0\u306e\u30a2\u30bb\u30f3\u30d6\u30ea \u30b3\u30fc\u30c9\u306b\u3088\u3063\u3066\u3001FakeM\u306e\u6a5f\u80fd\u304c\u53d6\u5f97\u3055\u308c\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002Trend Micro\u306eFakeM\u306e\u521d\u671f\u5206\u6790\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u8005\u306f\u3001\u8ffd\u52a0\u30b3\u30fc\u30c9\u3092\u914d\u4fe1\u3057\u3066\u5b9f\u884c\u3057\u3001\u30b7\u30a7\u30eb \u30b3\u30de\u30f3\u30c9\u306e\u5b9f\u884c\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u7a83\u76d7\u3001\u753b\u9762\u306e\u30ad\u30e3\u30d7\u30c1\u30e3\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306a\u3069\u306e\u3055\u3089\u306a\u308b\u6a5f\u80fd\u3092\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<table border=\"0\" width=\"444\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"bottom\" width=\"84\"><b>\u30b3\u30de\u30f3\u30c9<\/b><\/td>\n<td valign=\"bottom\" width=\"360\"><b>\u8aac\u660e<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">0x211<\/td>\n<td valign=\"bottom\" width=\"360\">C2\u304b\u3089\u30a2\u30bb\u30f3\u30d6\u30ea \u30b3\u30fc\u30c9\u3092\u76f4\u63a5\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">0x212<\/td>\n<td valign=\"bottom\" width=\"360\">\u30a2\u30a4\u30c9\u30eb\u300230\u79d2\u9593\u30b9\u30ea\u30fc\u30d7\u305b\u305a\u3001\u5373\u5ea7\u306b\u5225\u306e\u30b3\u30de\u30f3\u30c9\u306e\u53d7\u4fe1\u3092\u8a66\u307f\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">0x213<\/td>\n<td valign=\"bottom\" width=\"360\">C2\u3068\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u7d42\u4e86\u3059\u308b\u305f\u3081\u306e\u30d5\u30e9\u30b0\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u3001C2\u3068\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u5f37\u5236\u7684\u306b\u518d\u78ba\u7acb\u3055\u305b\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">0x214<\/td>\n<td valign=\"bottom\" width=\"360\">\u30d7\u30ed\u30bb\u30b9\u3092\u7d42\u4e86\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u88682: FakeM\u306e\u3059\u3079\u3066\u306e\u4e9c\u7a2e\u5185\u306e\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9<\/em><\/span><\/div>\n<p>\u3053\u3053\u307e\u3067\u3001FakeM\u306e\u4e9c\u7a2e\u9593\u306e\u5171\u901a\u6027\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u307e\u3057\u305f\u3002\u4ee5\u964d\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u306f\u3001FakeM\u306e\u7279\u5b9a\u306e\u4e9c\u7a2e\u306b\u3064\u3044\u3066\u8a73\u3057\u304f\u8aac\u660e\u3057\u307e\u3059\u3002Unit 42\u306f\u3001FakeM\u306e\u3055\u307e\u3056\u307e\u306a\u4e9c\u7a2e\u3092\u3001\u9577\u5e74\u306b\u308f\u305f\u308a\u5287\u7684\u306b\u5909\u5316\u3057\u3066\u304d\u305f\u3001C2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u65b9\u6cd5\u306b\u57fa\u3065\u3044\u3066\u5206\u985e\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h4><b>\u30aa\u30ea\u30b8\u30ca\u30eb\u306eFakeM<\/b><\/h4>\n<p>FakeM\u306e\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u4e9c\u7a2e\u306f\u3001C2\u30b5\u30fc\u30d0\u3078\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30d3\u30fc\u30b3\u30f3\u3092\u751f\u6210\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u591a\u304f\u306e\u5834\u5408\u3001\u6b63\u898f\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u305f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u7d1b\u308c\u8fbc\u3080\u305f\u3081\u306e\u624b\u6bb5\u3068\u306a\u308b\u300132\u30d0\u30a4\u30c8\u30d8\u30c3\u30c0\u3067\u59cb\u307e\u308a\u307e\u3059\u3002FakeM\u306e\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u4e9c\u7a2e\u306b\u306f\u3001\u3053\u306e32\u30d0\u30a4\u30c8 \u30d8\u30c3\u30c0\u30fc\u306b\u7d9a\u304d\u3001\u201cYHCRA\u201d\u306eXOR\u9375\u3068\u3001\u5404XOR\u64cd\u4f5c\u9593\u3067\u306e\u30d3\u30c3\u30c8 \u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u30ab\u30b9\u30bf\u30e0\u6697\u53f7\u5316\u3092\u7528\u3044\u3066\u6697\u53f7\u5316\u3055\u308c\u305f\u30c7\u30fc\u30bf\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/p>\n<p>\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u4e9c\u7a2e\u306b\u306f\u30012013\u5e74\u306bTrend Micro\u306b\u3088\u3063\u3066\u767a\u898b\u3055\u308c\u516c\u958b\u3055\u308c\u305fFakeM\u304c\u542b\u307e\u308c\u307e\u3059\u3002FakeM\u306e\u4f5c\u6210\u8005\u306f\u3001\u6700\u521d\u306b\u3001MSN\u3084Yahoo!\u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc\u306a\u3069\u306e\u6b63\u898f\u306e\u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u305f\u304b\u306e\u3088\u3046\u306b\u898b\u305b\u304b\u3051\u308b\u3053\u3068\u3067\u3001C2\u901a\u4fe1\u306e\u691c\u51fa\u3092\u56de\u907f\u3057\u3088\u3046\u3068\u8a66\u307f\u307e\u3059\u3002\u56f39\u306810\u306f\u3001\u6700\u521d\u306e32\u30d0\u30a4\u30c8\u306bMSN\u307e\u305f\u306fYahoo!\u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u305f\u6b63\u898f\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u4f3c\u305f\u30c7\u30fc\u30bf\u3092\u542b\u3081\u308b\u3053\u3068\u3067\u3001\u3053\u308c\u3089\u306e\u30c1\u30e3\u30c3\u30c8 \u30d7\u30ed\u30b0\u30e9\u30e0\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u898b\u305b\u304b\u3051\u3088\u3046\u3068\u3057\u3066\u3044\u308bFakeM\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-9.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-9.png\" alt=\"\u56f39: C2\u901a\u4fe1\u306b\u507d\u306eMSN\u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u4f7f\u7528\u3057\u3066\u3044\u308bFakeM\" width=\"975\" height=\"275\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f39: C2\u901a\u4fe1\u306b\u507d\u306eMSN\u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u4f7f\u7528\u3057\u3066\u3044\u308bFakeM<\/figcaption><\/figure>\n<\/div>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-10.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-10.png\" alt=\"\u56f310: C2\u901a\u4fe1\u306b\u507d\u306eYahoo! \u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc\u3092\u4f7f\u7528\u3057\u3066\u3044\u308bFakeM\" width=\"975\" height=\"277\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f310: C2\u901a\u4fe1\u306b\u507d\u306eYahoo! \u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc\u3092\u4f7f\u7528\u3057\u3066\u3044\u308bFakeM<\/figcaption><\/figure>\n<\/div>\n<p>\u30c1\u30e3\u30c3\u30c8 \u30d7\u30ed\u30b0\u30e9\u30e0\u306e\u30a8\u30df\u30e5\u30ec\u30fc\u30c8\u306b\u52a0\u3048\u3001FakeM\u3067\u306f\u300132\u30d0\u30a4\u30c8 \u30d8\u30c3\u30c0\u30fc\u5185\u306bHTML\u30b3\u30fc\u30c9\u3082\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u56f311\u3067\u308f\u304b\u308b\u3068\u304a\u308a\u3001\u30d3\u30fc\u30b3\u30f3\u306e\u69cb\u9020\u5168\u4f53\u306f\u5909\u308f\u3089\u305a\u3001\u552f\u4e00\u306e\u76f8\u9055\u306f\u3001\u30d8\u30c3\u30c0\u30fc\u306bHTML\u30bf\u30b0\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u70b9\u3067\u3059\u3002\u30d8\u30c3\u30c0\u30fc\u5185\u306eHTML\u30c7\u30fc\u30bf\u306b\u3088\u3063\u3066\u3001Unit 42\u306fMalware.lu\u306b\u3088\u3063\u3066\u516c\u958b\u3055\u308c\u305f<a href=\"https:\/\/malware.lu\/assets\/files\/articles\/RAP002_APT1_Technical_backstage.1.0.pdf\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u30db\u30ef\u30a4\u30c8\u30da\u30fc\u30d1\u30fc<\/a>\u306b\u8fbf\u308a\u7740\u304d\u307e\u3057\u305f\u3002\u305d\u3053\u3067\u306f\u3001FakeM\u306e\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u4e9c\u7a2e\u306eMSN\u3001Yahoo\u3001\u304a\u3088\u3073HTML\u30d0\u30fc\u30b8\u30e7\u30f3\u306f\u3059\u3079\u3066\u3001\u653b\u6483\u8005\u304c\u30b5\u30f3\u30d7\u30eb\u3092\u4f5c\u6210\u3057\u3001\u611f\u67d3\u30b7\u30b9\u30c6\u30e0\u3092\u5236\u5fa1\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3059\u308b\u5171\u901a\u306e\u30b5\u30fc\u30d0 \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u5171\u6709\u3057\u3066\u3044\u308b\u3068\u63a8\u5bdf\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-11.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-11.png\" alt=\"\u56f311: C2\u30d8\u30c3\u30c0\u30fc\u5185\u306eFakeM HTML\u30bf\u30b0\" width=\"975\" height=\"272\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f311: C2\u30d8\u30c3\u30c0\u30fc\u5185\u306eFakeM HTML\u30bf\u30b0<\/figcaption><\/figure>\n<\/div>\n<p>2013\u5e7410\u6708\u306b\u3001FireEye\u306f\u3001C2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u6700\u521d\u306e32\u30d0\u30a4\u30c8\u3067\u507d\u306e\u30e1\u30c3\u30bb\u30f3\u30b8\u30e3\u30fc\u307e\u305f\u306fHTML\u30c7\u30fc\u30bf\u3092\u4f7f\u7528\u305b\u305a\u3001\u4ee3\u308f\u308a\u306b\u3001\u56f312\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u30d1\u30b1\u30c3\u30c8\u306e\u3053\u306e\u90e8\u5206\u3092\u57cb\u3081\u308b\u305f\u3081\u306b4\u3064\u306e\u53cd\u5fa9\u3059\u308b\u30d0\u30a4\u30c8\u3092\u4f7f\u7528\u3057\u305fFakeM\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u3064\u3044\u3066\u306e<a href=\"https:\/\/www.fireeye.com\/blog\/threat-research\/2013\/10\/evasive-tactics-terminator-rat.html\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u30d6\u30ed\u30b0<\/a>\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002Unit 42\u306f\u3001\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u4e9c\u7a2e\u3067\u3053\u306e\u3053\u3068\u3092\u8ffd\u8de1\u3057\u307e\u3057\u305f\u3002\u30c7\u30fc\u30bf\u3092\u6697\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u540c\u3058\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304b\u3001\u305d\u3046\u3067\u306a\u3051\u308c\u3070\u3001\u6700\u521d\u306e32\u30d0\u30a4\u30c8\u3078\u306e\u5909\u66f4\u306e\u4f8b\u5916\u3092\u4f34\u3046\u3001MSN\u3001Yahoo\u3001\u304a\u3088\u3073HTML\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u5171\u901a\u306e\u69cb\u9020\u304c\u5171\u6709\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-12.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-12.png\" alt=\"\u56f312: 4\u3064\u306e\u53cd\u5fa9\u3059\u308b\u30d0\u30a4\u30c8\u3092\u4f34\u3046FakeM C2\u30d3\u30fc\u30b3\u30f3\" width=\"975\" height=\"272\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f312: 4\u3064\u306e\u53cd\u5fa9\u3059\u308b\u30d0\u30a4\u30c8\u3092\u4f34\u3046FakeM C2\u30d3\u30fc\u30b3\u30f3<\/figcaption><\/figure>\n<\/div>\n<h4>FakeM SSL<\/h4>\n<p>FakeM\u306e\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u4e9c\u7a2e\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u5206\u6790\u3092\u5b9f\u884c\u3059\u308b\u4e2d\u3067\u3001\u65e2\u77e5\u306eFakeM\u901a\u4fe1\u30d7\u30ed\u30c8\u30b3\u30eb\u3068\u4e00\u81f4\u3057\u306a\u3044\u30de\u30eb\u30a6\u30a7\u30a2 \u30b5\u30f3\u30d7\u30eb\u306eC2\u30b5\u30fc\u30d0\u3092\u30db\u30b9\u30c8\u3057\u3066\u3044\u305f\u30c9\u30e1\u30a4\u30f3\u3068\u306e\u5171\u6709\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002Palo Alto Networks WildFire\u306f\u3001\u3053\u308c\u3089\u306e\u95a2\u4fc2\u3059\u308bC2\u30c9\u30e1\u30a4\u30f3\u3001\u3064\u307e\u308a\u3001Secure Sockets Layer (SSL)\u3092\u4f7f\u7528\u3057\u3066C2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3057\u3066\u3044\u305f\u3059\u3079\u3066\u306e\u30c9\u30e1\u30a4\u30f3\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u591a\u6570\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u5206\u6790\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u751f\u6210\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u3092\u5224\u5225\u3059\u308b\u305f\u3081\u306b\u3001Unit 42\u306f\u3001\u3053\u308c\u3089\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u5206\u6790\u3057\u3001\u95a2\u6570\u30b3\u30fc\u30c9\u304c\u30aa\u30ea\u30b8\u30ca\u30eb\u306eFakeM\u4e9c\u7a2e\u3068\u540c\u3058\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>\u3053\u306e\u767a\u898b\u306f\u3001FakeM\u306e\u4f5c\u6210\u8005\u304c\u3001SSL\u3092\u4f7f\u7528\u3057\u3066C2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3059\u308b\u305f\u3081\u306b\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u65b0\u3057\u3044\u30b3\u30fc\u30c9\u3092\u5c0e\u5165\u3057\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002C2\u30c1\u30e3\u30cd\u30eb\u306e\u6025\u6fc0\u306a\u5909\u5316\u306b\u57fa\u3065\u304d\u3001\u65b0\u3057\u3044\u4e9c\u7a2e\u540d\u304c\u4ed8\u3051\u3089\u308c\u3001\u79c1\u305f\u3061\u306f\u305d\u308c\u3092\u201cFakeM SSL\u201d\u3068\u547c\u3076\u3053\u3068\u306b\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u5206\u6790\u4e2d\u306b\u306f\u3001\u52d5\u4f5c\u53ef\u80fd\u306aC2\u30b5\u30fc\u30d0\u304c\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u3092\u5b8c\u4e86\u3057SSL\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u78ba\u7acb\u3059\u308b\u69d8\u5b50\u306f\u898b\u3089\u308c\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u4e2d\u306b\u3001FakeM SSL\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u30b5\u30f3\u30d7\u30eb\u304c1\u7a2e\u985e\u306e\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u3057\u304b\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u306a\u3044\u3088\u3046\u306b\u898b\u305b\u304b\u3051\u3066\u3044\u308b\u304c\u300136\u7a2e\u985e\u306e\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u30b5\u30fc\u30d0\u306b\u901a\u77e5\u3057\u307e\u3059\u3002Unit 42\u306f\u3001FakeM SSL\u4e9c\u7a2e\u5185\u306e\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u304c\u3001\u9375\u4ea4\u63db\u306bDiffie-Hellman\u3092\u4f7f\u7528\u3057\u3001C2\u901a\u4fe1\u306e\u6697\u53f7\u5316\u306bRC4\u6697\u53f7\u5316\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3068\u78ba\u4fe1\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h4>FakeM\u30ab\u30b9\u30bf\u30e0SSL<\/h4>\n<p>2015\u5e747\u6708\u306b\u3001Scarlet Mimic\u306f\u3001VirusTotal\u306e\u3059\u3079\u3066\u306e\u30a2\u30f3\u30c1\u30a6\u30a3\u30eb\u30b9 \u30d9\u30f3\u30c0\u30fc\u306b\u3088\u3063\u3066\u672a\u691c\u51fa\u3060\u3063\u305f\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u76ee\u7684\u3067\u3001\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30ed\u30b7\u30a2\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u914d\u4fe1\u3057\u307e\u3057\u305f\u3002\u6a19\u7684\u306e\u6ce8\u76ee\u5ea6\u304c\u9ad8\u304f\u3001\u30a2\u30f3\u30c1\u30a6\u30a3\u30eb\u30b9\u306b\u3088\u308b\u691c\u51fa\u304c\u6b20\u843d\u3057\u3066\u3044\u305f\u305f\u3081\u3001Unit 42\u306f\u6025\u3044\u3067\u7dbf\u5bc6\u306a\u5206\u6790\u3092\u884c\u3044\u3001FakeM\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u3082\u30461\u3064\u306e\u65b0\u305f\u306a\u4e9c\u7a2e\u3092\u898b\u3064\u3051\u307e\u3057\u305f\u3002\u3053\u306e\u4e9c\u7a2e\u306b\u306f\u3001\u305d\u306e\u901a\u4fe1\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u3061\u306a\u3093\u3067\u540d\u524d\u3092\u4ed8\u3051\u307e\u3057\u305f(FakeM\u30ab\u30b9\u30bf\u30e0SSL)\u3002<\/p>\n<p>\u3053\u306e\u65b0\u3057\u3044FakeM\u306e\u4e9c\u7a2e\u306f\u3001\u305d\u308c\u4ee5\u524d\u306e\u3082\u306e\u3068\u540c\u3058\u95a2\u6570\u30b3\u30fc\u30c9\u3092\u5171\u6709\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u3053\u3053\u3067\u3082\u3001C2\u3068\u306e\u901a\u4fe1\u304c\u4ed6\u306e\u4e9c\u7a2e\u3068\u306f\u5927\u304d\u304f\u7570\u306a\u3063\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u4e9c\u7a2e\u3068C2\u30b5\u30fc\u30d0\u9593\u306e\u901a\u4fe1\u3067\u306f\u3001Unit 42\u304c\u78ba\u4fe1\u3057\u305f\u3082\u306e\u304c\u5229\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001SSL\u30b3\u30fc\u30c9\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306fFakeM SSL\u4e9c\u7a2e\u306b\u304b\u306a\u308a\u4f3c\u3066\u3044\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306f\u3001FakeM SSL\u3068\u540c\u69d8\u306b\u3001\u9375\u4ea4\u63db\u306bDiffie-Hellman\u3092\u4f7f\u7528\u3057\u3001RC4\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u304c\u3001C2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3055\u308c\u305f\u521d\u671f\u30d1\u30b1\u30c3\u30c8\u306b\u306fSSL\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u3092\u958b\u59cb\u3059\u308b\u305f\u3081\u306b\u5fc5\u8981\u306a\u201cclient hello\u201d\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u4ee3\u308f\u308a\u306b\u3001\u521d\u671f\u30d1\u30b1\u30c3\u30c8\u306f\u3001\u56f313\u306b\u793a\u3059\u3088\u3046\u306a\u30c7\u30fc\u30bf\u3092\u9001\u4fe1\u3057\u307e\u3057\u305f\u3002<\/p>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-13.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-13.png\" alt=\"\u56f313: FakeM\u30ab\u30b9\u30bf\u30e0SSL\u4e9c\u7a2e\u306e16\u9032\u30c0\u30f3\u30d7\" width=\"975\" height=\"271\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f313: FakeM\u30ab\u30b9\u30bf\u30e0SSL\u4e9c\u7a2e\u306e16\u9032\u30c0\u30f3\u30d7<\/figcaption><\/figure>\n<\/div>\n<p>FakeM\u306e\u3053\u306e\u4e9c\u7a2e\u306f\u3001\u901a\u4fe1\u3092\u6697\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3059\u308b\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u306b\u3064\u3044\u3066\u540c\u610f\u3059\u308b\u3001\u5f93\u6765\u306eSSL\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u307e\u3059\u3002FakeM\u30b3\u30fc\u30c9\u306f1\u3064\u306e\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u306e\u307f\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u305f\u3081\u3001SSL\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u306e\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u306e\u540c\u610f\u90e8\u5206\u306f\u7121\u95a2\u4fc2\u306b\u306a\u308a\u307e\u3059\u3002\u4ee3\u308f\u308a\u306b\u3001FakeM\u306f\u3001\u9375\u4ea4\u63db\u3057\u3066C2\u30b5\u30fc\u30d0\u3068\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u6709\u52b9\u306a\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u304c\u6b20\u3051\u3066\u3044\u308b\u305f\u3081\u3001\u3053\u306eC2\u30b9\u30c8\u30ea\u30fc\u30e0\u306e\u691c\u51fa\u306f\u56f0\u96e3\u306b\u306a\u308a\u307e\u3059\u3002\u30d1\u30b1\u30c3\u30c8\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3068C2\u9593\u3067\u9001\u4fe1\u3055\u308c\u3001\u30e9\u30f3\u30c0\u30e0\u306a\u30d0\u30a4\u30ca\u30ea \u30c7\u30fc\u30bf\u3092\u542b\u3080\u3053\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u304c\u78ba\u7acb\u3055\u308c\u308b\u304b\u3089\u3067\u3059\u3002\u307e\u305f\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30c7\u30d0\u30a4\u30b9\u306f\u3001\u691c\u51fa\u3067\u304d\u305a\u3001\u30c7\u30fc\u30bf\u306e\u6697\u53f7\u5316\u306b\u4f7f\u7528\u3055\u308c\u305f\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u3092\u5224\u5225\u3067\u304d\u306a\u3044\u305f\u3081\u3001SSL\u5fa9\u53f7\u5316\u3092\u5b9f\u884c\u3067\u304d\u307e\u305b\u3093\u3002\u4ee5\u4e0b\u306e\u56f314\u306f\u3001\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u624b\u9806\u3068\u5f8c\u7d9a\u306e\u30d3\u30fc\u30b3\u30f3\u304a\u3088\u3073\u30b3\u30de\u30f3\u30c9 \u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u8996\u899a\u7684\u306b\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<figure style=\"width: 975px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-14.png\" rel=\"wpdevart_lightbox\"><img  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet-14.png\" alt=\"\u56f314: \u9375\u4ea4\u63db\u3092\u542b\u3080\u30b7\u30b9\u30c6\u30e0\u3068C2\u30b5\u30fc\u30d0\u9593\u306e\u901a\u4fe1\" width=\"975\" height=\"694\" \/><\/a><figcaption class=\"wp-caption-text\">\u56f314: \u9375\u4ea4\u63db\u3092\u542b\u3080\u30b7\u30b9\u30c6\u30e0\u3068C2\u30b5\u30fc\u30d0\u9593\u306e\u901a\u4fe1<\/figcaption><\/figure>\n<\/div>\n<p>\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u306f\u9375\u4ea4\u63db\u306b\u3088\u3063\u3066\u958b\u59cb\u3055\u308c\u307e\u3059\u3002\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u9375(\u56f313\u306b\u793a\u3059\u3088\u3046\u306b\u3001128\u30d0\u30a4\u30c8\u306b\u30cc\u30eb \u30d0\u30a4\u30c8\u304c\u7d9a\u304f)\u3092\u4fdd\u5b58\u3059\u308b2048\u30d0\u30a4\u30c8 \u30d0\u30c3\u30d5\u30a1\u3092\u4f5c\u6210\u3057\u3001\u305d\u306e\u9375\u3092C2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3059\u308b\u3053\u3068\u3067\u958b\u59cb\u3055\u308c\u307e\u3059\u3002C2\u306f\u3001\u81ea\u8eab\u306e\u9375(128\u30d0\u30a4\u30c8\u306b\u30cc\u30eb\u5024\u304c\u7d9a\u304f)\u3067\u5fdc\u7b54\u3057\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u305d\u308c\u3092\u4fdd\u5b58\u3057\u3066\u3001\u305d\u308c\u4ee5\u964d\u306e\u901a\u4fe1\u3092\u6697\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3057\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u9375\u4ea4\u63db\u304c\u5b8c\u4e86\u3059\u308b\u3068\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u5225\u306e2048\u30d0\u30a4\u30c8 \u30d1\u30b1\u30c3\u30c8\u3092\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3057\u3066\u3001\u30b5\u30fc\u30d0\u306e\u9375\u306e\u53d7\u9818\u306b\u3064\u3044\u3066\u53d7\u4fe1\u78ba\u8a8d\u3057\u307e\u3059\u3002\u53d7\u4fe1\u78ba\u8a8d\u30d1\u30b1\u30c3\u30c8\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u30cc\u30eb\u5024\u3067\u57cb\u3081\u3089\u308c\u305f2048\u30d0\u30a4\u30c8 \u30d0\u30c3\u30d5\u30a1\u3092\u4f5c\u6210\u3057\u3001\u6587\u5b57\u5217\u201cws32.dll\u201d\u3092\u30aa\u30d5\u30bb\u30c3\u30c88\u306b\u30b3\u30d4\u30fc\u3057\u3001\u30b5\u30fc\u30d0\u306e\u9375\u3067\u30d0\u30c3\u30d5\u30a1\u3092\u6697\u53f7\u5316\u3057\u307e\u3059\u3002<\/p>\n<p>\u53d7\u4fe1\u78ba\u8a8d\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u5f8c\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u30ed\u30fc\u30ab\u30eb \u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3001\u305d\u308c\u3092C2\u30b5\u30fc\u30d0\u3078\u306e\u30d3\u30fc\u30b3\u30f3\u306b\u542b\u3081\u307e\u3059\u3002\u9375\u4ea4\u63db\u3067\u9001\u4fe1\u3055\u308c\u308b\u30d1\u30b1\u30c3\u30c8\u3068\u540c\u69d8\u306b\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u3088\u3063\u3066C2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3055\u308c\u308b\u30d3\u30fc\u30b3\u30f3\u306f2048\u30d0\u30a4\u30c8\u9577\u3067\u3059\u3002\u305f\u3060\u3057\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u3088\u3063\u3066\u53ce\u96c6\u3055\u308c\u305f\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u306f\u3001296\u30d0\u30a4\u30c8\u306e\u307f\u3067\u30012048\u30d0\u30a4\u30c8 \u30d0\u30c3\u30d5\u30a1\u3092\u57cb\u3081\u308b\u305f\u3081\u306b1752\u30d0\u30a4\u30c8\u306e\u30cc\u30eb\u5024\u304c\u7d9a\u304d\u307e\u3059\u3002\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u306f\u3001\u4ee5\u4e0b\u306b\u793a\u3059296\u30d0\u30a4\u30c8\u69cb\u9020\u306b\u6e96\u3058\u3066\u3044\u307e\u3059\u3002<\/p>\n<div>\n<p><img  class=\"aligncenter lozad\"  data-src=\"https:\/\/www.paloaltonetworks.jp\/content\/dam\/paloaltonetworks-com\/ja_JP\/Images\/blog\/scarlet_screen1.png\" \/><\/p>\n<\/div>\n<p>\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001C2\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u305f\u9375\u3092\u4f7f\u7528\u3057\u3066\u3053\u306e\u30c7\u30fc\u30bf\u3092\u6697\u53f7\u5316\u3057\u3001\u305d\u308c\u3092\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001C2\u304cFakeM\u30b3\u30de\u30f3\u30c9\u306e\u5fa9\u53f7\u5316\u3068\u89e3\u6790\u3092\u884c\u3044\u5fdc\u7b54\u3059\u308b\u306e\u3092\u5f85\u6a5f\u3057\u307e\u3059\u3002Unit 42\u306fC2\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u62bd\u51fa\u3067\u304d\u3066\u3044\u307e\u305b\u3093\u304c\u3001\u3044\u304f\u3064\u304b\u306eFakeM\u30ab\u30b9\u30bf\u30e0SSL\u30b5\u30f3\u30d7\u30eb\u306b\u306fC2\u30b5\u30fc\u30d0\u3068\u306e\u3084\u308a\u53d6\u308a\u306a\u3057\u3067\u5b9f\u884c\u3055\u308c\u308b\u57cb\u3081\u8fbc\u307f\u30d7\u30e9\u30b0\u30a4\u30f3\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001Unit 42\u306f\u3001\u88683\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u30aa\u30ea\u30b8\u30ca\u30eb\u306eFakeM\u30b5\u30fc\u30d0 \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304b\u3089\u3044\u304f\u3064\u304b\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u62bd\u51fa\u3067\u304d\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3059\u3079\u3066\u3001\u5909\u66f4\u3092\u307b\u3068\u3093\u3069\u52a0\u3048\u308b\u3053\u3068\u306a\u304fFakeM\u306e\u30ab\u30b9\u30bf\u30e0SSL\u4e9c\u7a2e\u3068\u9023\u643a\u52d5\u4f5c\u3059\u308b\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9 \u30d9\u30fc\u30b9\u306e\u30d7\u30e9\u30b0\u30a4\u30f3\u3067\u3059\u3002<\/p>\n<table border=\"0\" width=\"581\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"bottom\" width=\"216\"><b>MD5<\/b><\/td>\n<td valign=\"bottom\" width=\"130\"><b>\u30b5\u30a4\u30ba(\u30d0\u30a4\u30c8)<\/b><\/td>\n<td valign=\"bottom\" width=\"130\"><b>\u8aac\u660e<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">7a1410b2eceb99ec268b50e9371e74c1<\/td>\n<td valign=\"bottom\" width=\"130\">3724<\/td>\n<td valign=\"bottom\" width=\"135\">\u30d7\u30ed\u30bb\u30b9 \u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">092085e76512f071cab12f76ed09b348<\/td>\n<td valign=\"bottom\" width=\"130\">2412<\/td>\n<td valign=\"bottom\" width=\"135\">\u30b7\u30a7\u30eb \u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">8f4cbb78356cb672bf2566e44315eb96<\/td>\n<td valign=\"bottom\" width=\"130\">1768<\/td>\n<td valign=\"bottom\" width=\"135\">\u30d5\u30a1\u30a4\u30eb \u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">16ab40f84fc47bab2c7874bb3164c5b4<\/td>\n<td valign=\"bottom\" width=\"130\">2268<\/td>\n<td valign=\"bottom\" width=\"135\">\u30b9\u30af\u30ea\u30fc\u30f3 \u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">30337e99631a174d822dd3ea00a5f6cf<\/td>\n<td valign=\"bottom\" width=\"130\">2204<\/td>\n<td valign=\"bottom\" width=\"135\">Regedit\u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">1f3fbb789bcbe9186a50c4f4db269736<\/td>\n<td valign=\"bottom\" width=\"130\">1996<\/td>\n<td valign=\"bottom\" width=\"135\">\u30b5\u30fc\u30d3\u30b9 \u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">4313d9d5fc6a090e2abc41633cb2c1fd<\/td>\n<td valign=\"bottom\" width=\"130\">3196<\/td>\n<td valign=\"bottom\" width=\"135\">HostInfo\u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">fe75dff8b86dd8989d2ca00df19d51be<\/td>\n<td valign=\"bottom\" width=\"130\">2220<\/td>\n<td valign=\"bottom\" width=\"135\">KeyBoard\u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">3e184a7af74905f3d3acbec913252f72<\/td>\n<td valign=\"bottom\" width=\"130\">1884<\/td>\n<td valign=\"bottom\" width=\"135\">\u30b7\u30a7\u30eb \u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">b59e8751b9f61bd4f4b9b62de8242751<\/td>\n<td valign=\"bottom\" width=\"130\">3896<\/td>\n<td valign=\"bottom\" width=\"135\">OE Pwd\u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"216\">83ec457cba27e470404c942eb9242eeb<\/td>\n<td valign=\"bottom\" width=\"130\">2156<\/td>\n<td valign=\"bottom\" width=\"135\">U-Files\u30d7\u30e9\u30b0\u30a4\u30f3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em><span style=\"font-size: 10pt;\">\u88683: \u30aa\u30ea\u30b8\u30ca\u30eb\u306eFakeM\u4e9c\u7a2e\u306e\u30b5\u30fc\u30d0 \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304b\u3089\u62bd\u51fa\u3055\u308c\u305f\u30e2\u30b8\u30e5\u30fc\u30eb<\/span><\/em><\/p>\n<h3>FakeM\u30aa\u30ea\u30b8\u30ca\u30eb\u95a2\u9023: CallMe<\/h3>\n<p>CallMe\u306f\u3001Apple OSX\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b7\u30b9\u30c6\u30e0\u3067\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u8a2d\u8a08\u3055\u308c\u305f\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3059\u3002\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u30012013\u5e74\u306b\u30a6\u30a4\u30b0\u30eb\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u306b\u6a19\u7684\u578b\u653b\u6483\u3068\u3057\u3066\u914d\u4fe1\u3055\u308c\u3001FakeM\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u304c\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>2013\u5e742\u6708\u306b\u3001CallMe\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u3064\u3044\u3066\u3001<a href=\"https:\/\/www.alienvault.com\/open-threat-exchange\/blog\/cyber-espionage-campaign-against-the-uyghur-community-targeting-macosx-syst\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">AlienVault\u304c\u5206\u6790\u3092\u5b9f\u884c<\/a>\u3057\u3001\u305d\u308c\u304c\u00a0\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u3067\u30bd\u30fc\u30b9 \u30b3\u30fc\u30c9\u3092\u5165\u624b\u3067\u304d\u308bSOX\u30b7\u30a7\u30eb \u30c4\u30fc\u30eb\u3067\u3001Tiny Shell\u3068\u547c\u3070\u308c\u308b\u30c4\u30fc\u30eb\u306b\u57fa\u3065\u3044\u3066\u3044\u308b\u3053\u3068\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001AES\u3092\u4f7f\u7528\u3057\u3066C2\u30b5\u30fc\u30d0\u3068\u306e\u901a\u4fe1\u30c1\u30e3\u30cd\u30eb\u3092\u6697\u53f7\u5316\u3057\u307e\u3059\u3002\u88684\u306b\u793a\u3059\u3088\u3046\u306b\u3001C2\u30b5\u30fc\u30d0\u306f\u3001\u4fb5\u5bb3\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u30013\u3064\u306e\u30b3\u30de\u30f3\u30c9\u306e\u3044\u305a\u308c\u304b\u3092\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/p>\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"bottom\" width=\"70\">\u30b3\u30de\u30f3\u30c9<\/td>\n<td valign=\"bottom\" width=\"368\">\u8aac\u660e<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"70\">1<\/td>\n<td valign=\"bottom\" width=\"368\">\u30b7\u30b9\u30c6\u30e0\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3057\u3001\u305d\u308c\u3092C2\u30b5\u30fc\u30d0\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"70\">2<\/td>\n<td valign=\"bottom\" width=\"368\">C2\u30b5\u30fc\u30d0\u304b\u3089\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u30b7\u30b9\u30c6\u30e0\u306b\u914d\u7f6e\u3057\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u306f\u3001&lt;home\u30c7\u30a3\u30ec\u30af\u30c8\u30ea&gt;\/downloads\/\u306e\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u540d\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002&lt;\/home\u30c7\u30a3\u30ec\u30af\u30c8\u30ea&gt;<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"70\">3<\/td>\n<td valign=\"bottom\" width=\"368\">\u4fb5\u5bb3\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u3068\u3084\u308a\u53d6\u308a\u3059\u308b\u305f\u3081\u306e\u30ea\u30d0\u30fc\u30b9 \u30b7\u30a7\u30eb\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em><span style=\"font-size: 10pt;\">\u88684: CallMe OSX\u30de\u30eb\u30a6\u30a7\u30a2\u3067\u4f7f\u7528\u53ef\u80fd\u306a\u30b3\u30de\u30f3\u30c9<\/span><\/em><\/p>\n<p>FakeM\u3068CallMe\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907\u90e8\u5206\u306b\u306f\u3001\u201cgoogmail.org\u201d\u306e\u5b8c\u5168\u4fee\u98fe\u30c9\u30e1\u30a4\u30f3\u540d(FDQN)\u304c\u542b\u307e\u308c\u3001\u305d\u308c\u304cFakeM\u30b5\u30f3\u30d7\u30eb\u3068CallMe\u30b5\u30f3\u30d7\u30eb\u306e\u4e21\u65b9\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u653b\u6483\u8005\u304cMicrosoft Windows\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b7\u30b9\u30c6\u30e0\u3092\u5b9f\u884c\u3059\u308b\u88ab\u5bb3\u8005\u3092\u4fb5\u5bb3\u3067\u304d\u308b\u3060\u3051\u3067\u306a\u304f\u3001Apple\u306eOSX\u3092\u5b9f\u884c\u3059\u308b\u500b\u4eba\u3082\u6a19\u7684\u306b\u3067\u304d\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3>FakeM\u30ab\u30b9\u30bf\u30e0SSL\u95a2\u9023: Psylo<\/h3>\n<p>FakeM\u30ab\u30b9\u30bf\u30e0SSL\u4e9c\u7a2e\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u5206\u6790\u4e2d\u306b\u3001Unit 42\u306f\u3001FakeM\u3068\u201cPsylo\u201d\u3068\u3044\u3046\u540d\u524d\u306e\u4ee5\u524d\u306b\u672a\u5831\u544a\u306e\u3082\u30461\u3064\u306e\u65b0\u305f\u306a\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3068\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002Psylo\u306f\u3001\u653b\u6483\u8005\u304c\u4fb5\u5bb3\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u3068\u306e\u9593\u3067\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u304a\u3088\u3073\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305f\u308a\u3001\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u30b3\u30de\u30f3\u30c9\u3084\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u5b9f\u884c\u3057\u305f\u308a\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u30c4\u30fc\u30eb\u3067\u3059\u3002Psylo\u3068\u3044\u3046\u540d\u524d\u306f\u3001\u3053\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u6700\u521d\u306b\u5b9f\u884c\u3055\u308c\u305f\u3068\u304d\u306b\u4f5c\u6210\u3055\u308c\u308b\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9\u3001\u2018hnxlopsyxt\u2019\u304b\u3089\u306e\u30a2\u30ca\u30b0\u30e9\u30e0\u3067\u3059\u3002<\/p>\n<p>Psylo\u306f\u3001\u3069\u3061\u3089\u3082\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9 \u30d9\u30fc\u30b9\u3067\u3042\u308b\u70b9\u3067FakeM\u306b\u4f3c\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u305d\u308c\u3089\u306f\u985e\u4f3c\u306e\u69cb\u6210\u3068C2\u901a\u4fe1\u30c1\u30e3\u30cd\u30eb\u3092\u4fdd\u6301\u3057\u3066\u3044\u307e\u3059\u3002\u6b21\u306e2\u3064\u306e\u69cb\u6210\u69cb\u9020\u304b\u3089\u308f\u304b\u308b\u3068\u304a\u308a\u3001Psylo\u3068FakeM\u306e\u69cb\u6210\u306f\u3001C2\u4f4d\u7f6e\u306e\u30a2\u30ec\u30a4\u9577\u304c\u7570\u306a\u308b\u70b9\u4ee5\u5916\u306f\u540c\u3058\u3067\u3059\u3002<\/p>\n<table border=\"0\" width=\"444\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"bottom\" width=\"219\">struct psylo_c2_config {char[60] c2_host_1;char[60] c2_host_2;char[60] c2_host_3;DWORD c2_port_1;DWORD c2_port_2;DWORD c2_port_3;};<\/td>\n<td valign=\"bottom\" width=\"225\">struct fakem_customssl_c2_config {char[64] c2_host_1;char[64] c2_host_2;char[64] c2_host_3;DWORD c2_port_1;DWORD c2_port_2;DWORD c2_port_3;};<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f315: Psylo\u3068FakeM\u30ab\u30b9\u30bf\u30e0SSL\u3068\u306e\u69cb\u6210\u306e\u6bd4\u8f03<\/em><\/span><\/div>\n<p>\u3069\u3061\u3089\u3082SSL\u3092\u4f7f\u7528\u3057\u3066C2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3057\u3001\u5171\u901a\u306e\u30b3\u30fc\u30c9\u3092\u5171\u6709\u3057\u3066Diffie Hellman\u9375\u4ea4\u63db\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002\u79c1\u305f\u3061\u306f\u3001Psylo\u306eDiffie Hellman\u30b3\u30fc\u30c9\u3092FakeM\u30ab\u30b9\u30bf\u30e0SSL\u4e9c\u7a2e\u3068\u6bd4\u8f03\u3057\u3066\u3001\u305d\u308c\u3089\u304c\u975e\u5e38\u306b\u4f3c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u304c\u3001FakeM\u30b5\u30f3\u30d7\u30eb\u3067\u306f\u4e00\u90e8\u306e\u6a5f\u80fd\u304c\u30b5\u30d6\u95a2\u6570\u3067\u4fdd\u6301\u3055\u308c\u3066\u304a\u308a\u30012\u3064\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u30d0\u30a4\u30ca\u30ea\u3067\u6bd4\u8f03\u3059\u308b\u3053\u3068\u306f\u4e0d\u53ef\u80fd\u3067\u3057\u305f\u3002<\/p>\n<p>\u3082\u30461\u3064\u306e\u3061\u3087\u3063\u3068\u3057\u305f\u76f8\u9055\u306f\u3001Psylo\u3068FakeM\u304cSSL\u7528\u306b\u4e71\u6570\u3092\u751f\u6210\u3059\u308b\u65b9\u6cd5\u3067\u3059\u3002FakeM\u306fQueryPerformanceCounter\u3092\u4f7f\u7528\u3057\u3066\u4e71\u6570\u3092\u4f5c\u6210\u3057\u307e\u3059\u304c\u3001\u4e00\u65b9\u3001Psylo\u306fCryptGenRandom\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u3069\u3061\u3089\u3067\u751f\u6210\u3055\u308c\u305f\u4e71\u6570\u308268\u30d0\u30a4\u30c8\u9577\u3067\u3059\u3002\u8208\u5473\u6df1\u3044\u306e\u306f\u3001CryptGenRandom\u304cRtlGenRandom\u3092\u547c\u3073\u51fa\u3059\u70b9\u3067\u3059\u3002RtlGenRandom\u306f\u3001\u4ed6\u306e\u30b7\u30b9\u30c6\u30e0\u5c5e\u6027\u3068\u3068\u3082\u306bQueryPerformanceCounter\u3092\u4f7f\u7528\u3057\u3066\u4e71\u6570\u3092\u751f\u6210\u3057\u307e\u3059\u3002<\/p>\n<p>C2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3059\u308b\u5834\u5408\u3001Psylo\u306fHTTPS\u3068\u56fa\u6709\u306e\u30e6\u30fc\u30b6\u30fc \u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u307e\u3059(\u201c5.0\u201d\u3068\u201c(Windows\u201d\u306e\u9593\u306b\u30b9\u30da\u30fc\u30b9\u304c\u306a\u3044\u70b9\u306b\u6ce8\u610f)\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\"><i>Mozilla\/5.0(Windows NT 6.1; WOW64; rv:24.0) Gecko\/20100101 Firefox\/24.0<\/i><\/span><\/p>\n<p>Unit 42\u306f\u3001Psylo\u3092FakeM\u306e\u5225\u306e\u4e9c\u7a2e\u3060\u3068\u306f\u898b\u306a\u3057\u3066\u3044\u307e\u305b\u3093\u3002Psylo\u306fFakeM\u3068\u306f\u5927\u304d\u304f\u7570\u306a\u308b\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9\u3092\u4fdd\u6301\u3057\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002\u88685\u306f\u3001Psylo\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002FakeM\u3068\u6bd4\u8f03\u3059\u308b\u3068\u3001\u30e2\u30b8\u30e5\u30fc\u30eb\u6027\u304c\u4f4e\u304f\u3001\u3088\u308a\u591a\u304f\u306e\u57cb\u3081\u8fbc\u307f\u6a5f\u80fd\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u653b\u6483\u8005\u306f\u3001\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092FakeM\u306e\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u306e\u4ee3\u66ff\u3068\u3057\u3066\u4f5c\u6210\u3057\u305f\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<table border=\"0\" width=\"444\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"bottom\" width=\"84\"><b>\u30b3\u30de\u30f3\u30c9<\/b><\/td>\n<td valign=\"bottom\" width=\"360\"><b>\u8aac\u660e<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">0<\/td>\n<td valign=\"bottom\" width=\"360\">10\u79d2\u9593\u306e\u30a2\u30a4\u30c9\u30eb\u72b6\u614b\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">2<\/td>\n<td valign=\"bottom\" width=\"360\">\u3059\u3079\u3066\u306e\u30b9\u30c8\u30ec\u30fc\u30b8 \u30c7\u30d0\u30a4\u30b9\u3092\u5217\u6319\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">3<\/td>\n<td valign=\"bottom\" width=\"360\">\u7279\u5b9a\u306e\u6587\u5b57\u5217(%s*.*)\u3067\u59cb\u307e\u308b\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u691c\u7d22\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">5<\/td>\n<td valign=\"bottom\" width=\"360\">\u66f8\u304d\u8fbc\u3080\u305f\u3081\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u3059\u3067\u306b\u5b58\u5728\u3059\u308b\u5834\u5408\u306f\u305d\u308c\u3092\u524a\u9664\u3057\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u3092\u30b7\u30b9\u30c6\u30e0\u306b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u306b\u306f\u3001\u2018E\u2019 \u30b3\u30de\u30f3\u30c9\u3068\u7d44\u307f\u5408\u308f\u305b\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">E<\/td>\n<td valign=\"bottom\" width=\"360\">\u30c7\u30fc\u30bf\u3092C2\u304b\u3089\u20185\u2019\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u958b\u304b\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u8fbc\u307f\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u3092\u30b7\u30b9\u30c6\u30e0\u306b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u306b\u306f\u3001\u20185\u2019\u30b3\u30de\u30f3\u30c9\u3068\u7d44\u307f\u5408\u308f\u305b\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">6<\/td>\n<td valign=\"bottom\" width=\"360\">\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u53d6\u308a\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u3092C2\u306b\u52b9\u7387\u7684\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">7<\/td>\n<td valign=\"bottom\" width=\"360\">\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u524a\u9664\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">8<\/td>\n<td valign=\"bottom\" width=\"360\">WinExec\u3092\u4f7f\u7528\u3057\u3066\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u6210\u529f\u3057\u305f\u5834\u5408\u306f\u2018s\u2019\u3067\u3001\u4e0d\u6210\u529f\u306e\u5834\u5408\u306f\u2018r\u2019\u3067\u3001C2\u306b\u5fdc\u7b54\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"84\">9<\/td>\n<td valign=\"bottom\" width=\"360\">\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3002\u6307\u5b9a\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u304c\u3001System32\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30b7\u30b9\u30c6\u30e0 \u30d5\u30a1\u30a4\u30eb\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3068\u4e00\u81f4\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em><span style=\"font-size: 10pt;\">\u88685: FakeM\u3068\u5927\u304d\u304f\u7570\u306a\u308bPsylo\u306e\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9<\/span><\/em><\/p>\n<h3>MobileOrder: \u30e2\u30d0\u30a4\u30eb \u30c7\u30d0\u30a4\u30b9\u306e\u6b21\u306e\u958b\u62d3\u5206\u91ce<\/h3>\n<p>\u79c1\u305f\u3061\u306f\u3001\u3053\u306e\u30d6\u30ed\u30b0\u306b\u3064\u3044\u3066\u8abf\u67fb\u4e2d\u306b\u3001\u3055\u3089\u306b\u3001Psylo\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3068\u3001Android\u30e2\u30d0\u30a4\u30eb \u30c7\u30d0\u30a4\u30b9\u306e\u4fb5\u5bb3\u3092\u76ee\u7684\u3068\u3057\u305f\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3068\u306e\u9593\u306b\u91cd\u8907\u304c\u3042\u308b\u3053\u3068\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002Unit 42\u306f\u3001\u4f5c\u6210\u8005\u304c\u30a2\u30d7\u30ea\u5185\u306e\u30b3\u30de\u30f3\u30c9\u3092\u660e\u78ba\u306b\u547d\u4ee4(order)\u3068\u3057\u3066\u53c2\u7167\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u3053\u306e\u30e2\u30d0\u30a4\u30eb \u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092MobileOrder\u3068\u540d\u4ed8\u3051\u3001\u8ffd\u8de1\u3057\u3066\u3044\u307e\u3059\u3002FakeM\u3001Psylo\u3001\u304a\u3088\u3073MobileOrder\u9593\u306e\u63a5\u7d9a\u306f\u3001\u73fe\u5728\u3001Scarlet Mimic\u304c\u5f7c\u3089\u306e\u30b9\u30d1\u30a4\u6d3b\u52d5\u3092PC\u304b\u3089\u30e2\u30d0\u30a4\u30eb \u30c7\u30d0\u30a4\u30b9\u306b\u62e1\u5927\u3057\u3001\u6226\u8853\u306e\u5927\u304d\u306a\u8ee2\u63db\u3092\u56f3\u3063\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>MobileOrder\u306f\u3001\u6700\u521d\u306b\u3001\u81ea\u8eab\u3092\u30c7\u30d0\u30a4\u30b9\u7ba1\u7406\u8005\u3068\u3057\u3066\u767b\u9332\u3057\u3001\u901a\u5e38\u306e\u30e6\u30fc\u30b6\u30fc\u304c\u8a2d\u5b9a\u3067\u201cuninstall(\u30a2\u30f3\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb)\u201d\u3092\u30af\u30ea\u30c3\u30af\u3057\u305f\u3060\u3051\u3067\u306f\u3001\u305d\u308c\u3092\u30a2\u30f3\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3067\u304d\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001\u201cres\/raw\/rd.pdf\u201d\u304b\u3089\u306e\u57cb\u3081\u8fbc\u307fPDF\u30d5\u30a1\u30a4\u30eb\u3092SD\u30ab\u30fc\u30c9\u306e\u201c\/android\/9074ca3f18e201c204ec1d852264bb5432644ba46f54f361a146957.pdf\u201d\u306b\u30b3\u30d4\u30fc\u3057\u3001\u30e2\u30d0\u30a4\u30eb \u30c7\u30d0\u30a4\u30b9\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u306ePDF\u30d3\u30e5\u30fc\u30a2\u3092\u8d77\u52d5\u3057\u3066\u3001\u3053\u306ePDF\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a\u3057\u3001\u304a\u3068\u308a\u6587\u66f8\u3068\u3057\u3066\u52d5\u4f5c\u3055\u305b\u307e\u3059\u3002\u304a\u3068\u308a\u6587\u66f8\u306e\u8868\u793a\u5f8c\u3001\u80cc\u5f8c\u3067\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u306f\u3001\u6b21\u306e\u90e8\u5206\u3067\u69cb\u6210\u3055\u308c\u307e\u3059\u3002<\/p>\n<ol>\n<li><a href=\"https:\/\/lbs.amap.com\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">AMAP<\/a>\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308bAndroid\u5730\u7406\u7684\u4f4d\u7f6eSDK\u3002<\/li>\n<li>\u653b\u6483\u8005\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u6a5f\u80fd\u3092\u5b9f\u884c\u3059\u308b\u30b3\u30fc\u30c9\u3092\u958b\u767a\u3057\u307e\u3057\u305f\u3002<\/li>\n<\/ol>\n<p>\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001AMAP SDK\u3092\u4f7f\u7528\u3057\u3066\u3001GPS\u3001\u30e2\u30d0\u30a4\u30eb \u30cd\u30c3\u30c8\u30ef\u30fc\u30af(\u57fa\u5730\u5c40\u306a\u3069)\u3001WiFi\u304a\u3088\u3073\u305d\u306e\u4ed6\u306e\u60c5\u5831\u306b\u57fa\u3065\u304d\u3001\u611f\u67d3\u30c7\u30d0\u30a4\u30b9\u306e\u6b63\u78ba\u306a\u4f4d\u7f6e\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002MobileOrder\u306f\u3001C2\u30b5\u30fc\u30d0\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u308b\u547d\u4ee4\u3067\u52d5\u4f5c\u3057\u307e\u3059\u3002\u305d\u308c\u3089\u306f\u3001TCP\u30dd\u30fc\u30c83728\u3092\u4ecb\u3057\u3066\u901a\u4fe1\u3055\u308c\u307e\u3059\u3002\u3059\u3079\u3066\u306eC2\u901a\u4fe1\u306f\u3001\u9375\u201c1qazxcvbnm\u201d\u3067\u59cb\u307e\u308b5\u3064\u306eMD5\u30cf\u30c3\u30b7\u30e5\u3092\u8a08\u7b97\u3057\u3001\u53cd\u5fa9\u3054\u3068\u306bsalt\u5024\u201c.)1\/\u201d\u3092\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3067\u751f\u6210\u3055\u308c\u305f\u9375\u3092\u4f7f\u7528\u3057\u3066\u3001AES\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306b\u3088\u3063\u3066\u6697\u53f7\u5316\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>C2\u30b5\u30fc\u30d0\u306f\u3001MobileOrder\u304b\u3089\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u201c\u547d\u4ee4(order)\u201d\u3068\u3057\u3066\u53c2\u7167\u3059\u308b\u30b3\u30de\u30f3\u30c9\u3067\u5fdc\u7b54\u3057\u307e\u3059\u3002MobileOrder\u306b\u306f\u3001\u88686\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u304b\u306a\u308a\u5805\u7262\u306a\u30b3\u30de\u30f3\u30c9 \u30bb\u30c3\u30c8\u3092\u63d0\u4f9b\u3059\u308b\u6a5f\u80fd\u3068\u3068\u3082\u306b\u3001\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002C2\u30b5\u30fc\u30d0\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u308b\u30c7\u30fc\u30bf\u306e\u6700\u521d\u306e\u30d0\u30a4\u30c8\u306f\u3001\u547d\u4ee4\u756a\u53f7\u3067\u3059\u3002\u305d\u308c\u306b\u3001\u7279\u5b9a\u306e\u547d\u4ee4\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u5fc5\u8981\u306a\u6697\u53f7\u5316\u3055\u308c\u305f\u30c7\u30fc\u30bf\u304c\u7d9a\u304d\u307e\u3059\u3002<\/p>\n<table border=\"0\" width=\"461\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"bottom\" width=\"62\"><b>\u547d\u4ee4\u756a\u53f7<\/b><\/td>\n<td valign=\"bottom\" width=\"165\"><b>\u547d\u4ee4\u540d<\/b><\/td>\n<td valign=\"bottom\" width=\"234\"><b>\u6d3b\u52d5<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">18<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Folder_List<\/td>\n<td valign=\"bottom\" width=\"234\">\u30d5\u30a1\u30a4\u30eb\u306e\u540d\u524d\u3068\u5c5e\u6027\u3092\u6307\u5b9a\u3057\u305f\u30d1\u30b9\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">20<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Process_List<\/td>\n<td valign=\"bottom\" width=\"234\">\u3059\u3079\u3066\u306e\u5b9f\u884c\u4e2d\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u60c5\u5831\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">24<\/td>\n<td valign=\"bottom\" width=\"165\">Order_HostInfo<\/td>\n<td valign=\"bottom\" width=\"234\">\u30c7\u30d0\u30a4\u30b9\u60c5\u5831(IMEI\u3001IMSI\u3001SIM\u30ab\u30fc\u30c9 \u30b7\u30ea\u30a2\u30eb\u756a\u53f7\u3001\u96fb\u8a71\u756a\u53f7\u3001Android\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u30c7\u30d0\u30a4\u30b9\u88fd\u9020\u5143\u540d\u3001\u30c7\u30d0\u30a4\u30b9 \u30e2\u30c7\u30eb\u3001SD\u30ab\u30fc\u30c9 \u30b5\u30a4\u30ba\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30bf\u30a4\u30d7\u3001\u30c7\u30d0\u30a4\u30b9 \u30ed\u30c3\u30ad\u30f3\u30b0\u306e\u72b6\u6cc1\u3001\u56fd\u3001\u901a\u4fe1\u4e8b\u696d\u8005\u3001\u30bf\u30a4\u30e0\u30be\u30fc\u30f3\u3001\u8a00\u8a9e\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30ea\u30b9\u30c8\u3001\u30d6\u30e9\u30a6\u30b6 \u30d6\u30c3\u30af\u30de\u30fc\u30af\u306a\u3069)\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">26<\/td>\n<td valign=\"bottom\" width=\"165\">Order_FileDelete<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u524a\u9664<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">27<\/td>\n<td valign=\"bottom\" width=\"165\">Order_DownLoad<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092SD\u30ab\u30fc\u30c9\u306eAndroid\/data\/tmp\/\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">28<\/td>\n<td valign=\"bottom\" width=\"165\">Order_UpFile<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092C2\u30b5\u30fc\u30d0\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">51<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Sms<\/td>\n<td valign=\"bottom\" width=\"234\">\u9001\u53d7\u4fe1\u3057\u305f\u3059\u3079\u3066\u306eSMS\u30a2\u30c9\u30ec\u30b9\u3001\u30b3\u30f3\u30c6\u30f3\u30c4\u3001\u65e5\u4ed8\u3001\u6642\u523b\u3092C2\u30b5\u30fc\u30d0\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">52<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Contact<\/td>\n<td valign=\"bottom\" width=\"234\">\u3059\u3079\u3066\u306e\u9023\u7d61\u5148\u60c5\u5831\u3092C2\u30b5\u30fc\u30d0\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">53<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Call<\/td>\n<td valign=\"bottom\" width=\"234\">\u3059\u3079\u3066\u306e\u901a\u8a71\u5c65\u6b74\u60c5\u5831\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">54<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Camera_front_photo<\/td>\n<td valign=\"bottom\" width=\"234\">\u30c7\u30d0\u30a4\u30b9\u306e\u30d5\u30ed\u30f3\u30c8 \u30ab\u30e1\u30e9\u3067\u5199\u771f\u3092\u64ae\u5f71<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">56<\/td>\n<td valign=\"bottom\" width=\"165\">Order_SetSleepTime<\/td>\n<td valign=\"bottom\" width=\"234\">\u30b9\u30ea\u30fc\u30d7\u6642\u9593\u9593\u9694\u3092\u8a2d\u5b9a<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">57<\/td>\n<td valign=\"bottom\" width=\"165\">Order_SetOnline<\/td>\n<td valign=\"bottom\" width=\"234\">\u30b9\u30ea\u30fc\u30d7\u3092\u89e3\u9664<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">58<\/td>\n<td valign=\"bottom\" width=\"165\">Order_SetMediaRecorder<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u6642\u523b\u306b\u97f3\u58f0\u30ec\u30b3\u30fc\u30c0\u30fc\u3092\u958b\u59cb<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">59<\/td>\n<td valign=\"bottom\" width=\"165\">Order_GetLoc<\/td>\n<td valign=\"bottom\" width=\"234\">\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u696d\u8005\u3001MCC\u3001MNC\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30bf\u30a4\u30d7\u3001GSM\u30bb\u30eb \u30ed\u30b1\u30fc\u30b7\u30e7\u30f3\u3001CID\u3001LAS\u3001BSSS\u306a\u3069\u306e\u60c5\u5831\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3002\u3053\u306e\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30d0\u30a4\u30b9\u3092\u7279\u5b9a\u3002<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">60<\/td>\n<td valign=\"bottom\" width=\"165\">Order_GetGps<\/td>\n<td valign=\"bottom\" width=\"234\">GPS\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3\u3092AMAP SDK\u306b\u3088\u3063\u3066\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">61<\/td>\n<td valign=\"bottom\" width=\"165\">Order_SetTelRecorderOn<\/td>\n<td valign=\"bottom\" width=\"234\">\u901a\u8a71\u8a18\u9332\u3092\u6709\u52b9\u5316<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">62<\/td>\n<td valign=\"bottom\" width=\"165\">Order_SetTelRecorderOff<\/td>\n<td valign=\"bottom\" width=\"234\">\u901a\u8a71\u8a18\u9332\u3092\u7121\u52b9\u5316<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">81<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Install<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305fAPK\u30d5\u30a1\u30a4\u30eb\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u30b7\u30b9\u30c6\u30e0 \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u30b5\u30a4\u30ec\u30f3\u30c8\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3001\u307e\u305f\u306fC2\u30b3\u30de\u30f3\u30c9 \u30c7\u30fc\u30bf\u306b\u5f93\u3063\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">82<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Uninstall<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u30a2\u30f3\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">84<\/td>\n<td valign=\"bottom\" width=\"165\">Order_StartApp<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u8d77\u52d5<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">85<\/td>\n<td valign=\"bottom\" width=\"165\">Order_SendBroadcast<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305fAndroid\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3066\u3001\u305d\u306e\u4ed6\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u8d77\u52d5<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">86<\/td>\n<td valign=\"bottom\" width=\"165\">Order_Shell<\/td>\n<td valign=\"bottom\" width=\"234\">\u6307\u5b9a\u3055\u308c\u305f\u30b7\u30a7\u30eb \u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">87<\/td>\n<td valign=\"bottom\" width=\"165\">Order_OpenTrack<\/td>\n<td valign=\"bottom\" width=\"234\">AMAP SDK\u3067\u4f4d\u7f6e\u60c5\u5831\u306e\u8ffd\u8de1\u3092\u958b\u59cb<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">88<\/td>\n<td valign=\"bottom\" width=\"165\">Order_CloseTrack<\/td>\n<td valign=\"bottom\" width=\"234\">AMAP SDK\u3067\u4f4d\u7f6e\u60c5\u5831\u306e\u8ffd\u8de1\u3092\u505c\u6b62<\/td>\n<\/tr>\n<tr>\n<td valign=\"bottom\" width=\"62\">90<\/td>\n<td valign=\"bottom\" width=\"165\">Order_CheckScreen<\/td>\n<td valign=\"bottom\" width=\"234\">\u901a\u8a71\u753b\u9762\u304c\u958b\u3044\u3066\u3044\u308b\u304b\u3069\u3046\u304b(\u3064\u307e\u308a\u96fb\u8a71\u3092\u6240\u6709\u8005\u304c\u4f7f\u7528\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b)\u3092\u30c1\u30a7\u30c3\u30af<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em><span style=\"font-size: 10pt;\">\u88686: MobileOrder\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9<\/span><\/em><\/p>\n<h3><b>\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907\u3068\u95a2\u9023\u30c4\u30fc\u30eb<\/b><\/h3>\n<p>MobileOrder\u3001Psylo\u3001CallMe\u306a\u3069\u305d\u306e\u4ed6\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3068\u540c\u69d8\u306b\u3001\u5927\u534a\u306eFakeM\u4e9c\u7a2e\u304c\u4f7f\u7528\u3059\u308bC2\u30b5\u30fc\u30d0\u306b\u306f\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907\u304c\u3044\u304f\u3064\u304b\u3042\u308a\u307e\u3059\u3002\u4e00\u90e8\u306eFakeM\u4e9c\u7a2e\u3068\u3001Elirks\u3001Poison Ivy\u3001BiFrost\u306a\u3069\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u4f7f\u7528\u3057\u305f\u6614\u306a\u304c\u3089\u306e\u6d3b\u52d5(2009\u5e74\u5f53\u6642\u306e\u653b\u6483\u3067\u4f7f\u7528)\u306e\u9593\u306b\u3082\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u5171\u901a\u70b9\u304c\u3042\u308a\u307e\u3059\u3002C2\u30b5\u30fc\u30d0\u306e\u30db\u30b9\u30c8\u306b\u4f7f\u7528\u3055\u308c\u308b\u30c9\u30e1\u30a4\u30f3\u540d\u306f\u3001\u653b\u6483\u8005\u304c\u767b\u9332\u3057\u305f\u3082\u306e\u3068\u52d5\u7684DNS(DDNS)\u306e\u4e21\u65b9\u304c\u6df7\u5728\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u5927\u534a\u306e\u5834\u5408\u306f\u3001DDNS\u3067\u3059\u3002\u3053\u306eDDNS\u30c9\u30e1\u30a4\u30f3\u304cASN\u306e\u5c0f\u3055\u306a\u30b0\u30eb\u30fc\u30d7\u306b\u30ea\u30f3\u30af\u3055\u308c\u307e\u3059\u3002ASN\u306f\u591a\u304f\u306e\u5834\u5408\u3001FakeM\u4e9c\u7a2e\u306b\u7d50\u3073\u3064\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u5927\u534a\u306eFakeM MSN C2\u306f\u3001ASN 22781 (RBLHST \u2013 Reliablehosting.com).\u306b\u95a2\u9023\u3057\u305fIP\u30a2\u30c9\u30ec\u30b9\u306b\u89e3\u6c7a\u3055\u308c\u307e\u3059\u3002\u3057\u304b\u3057\u3001FakeM\u30ab\u30b9\u30bf\u30e0SSL\u4e9c\u7a2e\u3068\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u5171\u6709\u3059\u308bMSN\u30b5\u30f3\u30d7\u30eb\u30921\u3064\u3001\u308f\u305f\u3057\u305f\u3061\u306f\u767a\u898b\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u540c\u69d8\u306e\u91cd\u8907\u304c\u3001FakeM MSN\u3001FakeM HTML\u3001FakeM SSL\u9593\u306b\u3082\u5b58\u5728\u3057\u307e\u3059\u3002\u767b\u9332\u96fb\u5b50\u30e1\u30fc\u30eb(xsldmt@xj163[.]cn)\u304c\u3001C2\u3067\u4f7f\u7528\u3055\u308c\u308b\u4e00\u90e8\u306e\u30c9\u30e1\u30a4\u30f3\u306e\u767b\u9332\u306b\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f(yourturbe[.]org\u3001websurprisemail[.]com\u3001googmail[.]org)\u3002\u3053\u308c\u30893\u3064\u306e\u30c9\u30e1\u30a4\u30f3\u306e1\u3064\u306f\u3001FakeM MSN\u30b5\u30f3\u30d7\u30eb\u3067\u4f7f\u7528\u3055\u308c\u305f\u3068\u304d\u3068\u540c\u3058\u30bf\u30a4\u30df\u30f3\u30b0\u3067\u30012013 CallMe\u6d3b\u52d5\u3067\u3082\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f\u3002\u6a19\u7684\u3068\u304a\u3068\u308a\u306e\u30bf\u30a4\u30d7\u3082\u3001FakeM\u6d3b\u52d5\u3068\u4e00\u81f4\u3057\u307e\u3059\u3002<\/p>\n<p>\u4e00\u90e8\u306eFakeM MSN\u30b5\u30f3\u30d7\u30eb\u3068BiFrost\u304a\u3088\u3073Poison Ivy Trojan\u306e\u4e00\u90e8\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u9593\u306b\u306f\u3001PE\u30ea\u30bd\u30fc\u30b9\u306e\u91cd\u8907\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u7279\u5b9a\u306eBiFrost\u304a\u3088\u3073Poison Ivy\u30b5\u30f3\u30d7\u30eb\u3092\u4f5c\u6210\u3057\u305f\u958b\u767a\u8005\u3068\u540c\u3058\u958b\u767a\u8005\u304c\u3001FakeM MSN\u306e\u958b\u767a\u306b\u95a2\u308f\u3063\u3066\u3044\u308b\u3053\u3068\u3092\u610f\u5473\u3059\u308b\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002Unit 42\u306f\u3001RT_VERSION\u306e\u30ea\u30bd\u30fc\u30b9\u306b\u91cd\u8907\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306b\u306f\u3001\u4e0a\u8a183\u3064\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u5171\u6709\u3055\u308c\u308bPortable Executable (PE)\u30d5\u30a1\u30a4\u30eb\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3082\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u5171\u6709\u3055\u308c\u3066\u3044\u308bRT_VERSION\u30ea\u30bd\u30fc\u30b9(MD5: 55b7a118203a831cc69b37b785015c54)\u306b\u306f\u4ee5\u4e0b\u306e\u60c5\u5831\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">Comments: Release<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">CompanyName: Develop Team<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">FileDescription: Utility Application<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">FileVersion: 4.0<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">InternalName: Utility<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">LegalCopyright: Copyright (C) 2008<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">LegalTrademarks: DT.Inc<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">OriginalFilename: Utility.EXE<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">PrivateBuild: 4.0b<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">ProductName: Utility Application<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">ProductVersion: 4.0<\/span><\/p>\n<p>Elirks\u3001FakeM SSL\u3001Psylo\u3001MobileOrder\u9593\u306e\u91cd\u8907\u306f\u3001\u30c9\u30e1\u30a4\u30f3\u540d\u304b\u3089IP\u89e3\u6c7a\u306b\u3044\u305f\u308b\u307e\u3067\u3001\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9 \u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u5168\u4f53\u306b\u5b58\u5728\u3057\u307e\u3059\u3002\u3053\u308c\u30893\u3064\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u540c\u3058C2\u30c9\u30e1\u30a4\u30f3(\u7279\u306blenovositegroup[.]com\u3001ufoneconference[.]com\u3001websurprisemail[.]com)\u3092\u4f7f\u7528\u3057\u3066\u304a\u308a\u3001\u307e\u305f\u4e00\u90e8\u306e\u89e3\u6c7a\u3067\u306f118.193.212[.]12\u3001210.206.219[.]241\u300159.188.239[.]117\u304c\u91cd\u8907\u3057\u3066\u3044\u307e\u3059\u3002\u540c\u69d8\u306b\u3001\u4e00\u90e8\u306eFakeM Yahoo C2\u30c9\u30e1\u30a4\u30f3\u3001FakeM\u30ab\u30b9\u30bf\u30e0SSL C2\u30c9\u30e1\u30a4\u30f3\u3082\u3001IP\u306e\u89e3\u6c7a\u3067\u91cd\u8907\u3057\u3066\u3044\u307e\u3059(\u7279\u306b95.154.204[.]198)\u3002<\/p>\n<p>Scarlet Mimic\u3082\u3001\u5c11\u306a\u304f\u3068\u3082\u4e00\u90e8\u306eC2\u30b5\u30fc\u30d0\u3067\u60aa\u540d\u9ad8\u3044HTRAN\u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002HTRAN\u306f\u3001C2\u30b5\u30fc\u30d0\u306e\u672c\u5f53\u306e\u5834\u6240\u3092\u96a0\u853d\u3059\u308b\u305f\u3081\u306b\u653b\u6483\u8005\u304c\u4f7f\u7528\u3059\u308b\u30d7\u30ed\u30ad\u30b7 \u30c4\u30fc\u30eb\u3067\u3059\u3002\u653b\u6483\u8005\u306fHTRAN\u3092\u30b5\u30fc\u30d0\u3067\u5b9f\u884c\u3057\u3001\u305d\u306e\u30b5\u30fc\u30d0\u3068\u3084\u308a\u53d6\u308a\u3059\u308b\u3088\u3046\u306b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u304c\u3001HTRAN\u304c\u5b9f\u969b\u306eC2\u30b5\u30fc\u30d0\u304c\u5b58\u5728\u3059\u308b\u5834\u6240\u3068\u306f\u7570\u306a\u308b\u5225\u306e\u30b5\u30fc\u30d0\u306b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u9001\u4fe1\u3059\u308b\u3088\u3046\u306b\u653b\u6483\u8005\u306f\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u4f8b\u3048\u3070\u3001FakeM C2\u30c9\u30e1\u30a4\u30f3\u300cmuslim.islamhood[.]net\u300d<a name=\"_ftnref1\"><\/a><a href=\"https:\/\/blog.paloaltonetworks.com\/2016\/01\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#_ftn1\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \"><sup>[1]<\/sup><\/a>\u306f\u3001\u89e3\u6790\u306b\u3088\u3063\u3066\u3001IP\u30a2\u30c9\u30ec\u30b9\u300159.188.239.117\u306b\u89e3\u6c7a\u3055\u308c\u307e\u3059\u304c\u3001\u30b5\u30fc\u30d0\u306f\u4ee5\u4e0b\u306e\u30a8\u30e9\u30fc \u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u8fd4\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><i>[SERVER]connection to 68.71.35.135:8081 error<\/i><\/p>\n<p>\u3053\u306e\u30a8\u30e9\u30fc \u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u3001 59.188.239.117\u3067\u5b9f\u884c\u4e2d\u306eHTRAN\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c68.71.35.135\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u5b9f\u969b\u306eC2\u30b5\u30fc\u30d0\u306b\u63a5\u7d9a\u3067\u304d\u306a\u304b\u3063\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3>\u4ee5\u524d\u306e\u8cc7\u6599<\/h3>\n<p>\u3053\u306e\u30ec\u30dd\u30fc\u30c8\u5168\u4f53\u3092\u901a\u3058\u3066\u3001Unit42\u305d\u306e\u4ed6\u306b\u95a2\u308f\u3089\u305a\u3001\u8907\u6570\u306e\u4ee5\u524d\u306e\u30d6\u30ed\u30b0\u3084\u30db\u30ef\u30a4\u30c8\u30da\u30fc\u30d1\u30fc\u3092\u53c2\u7167\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u3001\u904e\u53bb\u306b\u3053\u306e\u8105\u5a01\u306e\u8981\u7d20\u3092\u6587\u66f8\u5316\u3057\u305f\u3082\u306e\u3067\u3059\u3002\u3053\u308c\u3089\u306e\u8cc7\u6599\u3060\u3051\u3067\u306a\u304f\u3001\u8aad\u8005\u306b\u3068\u3063\u3066\u4ee5\u4e0b\u306e\u8cc7\u6599\u3082\u6975\u3081\u3066\u8208\u5473\u6df1\u3044\u3082\u306e\u306b\u306a\u308b\u3067\u3057\u3087\u3046\u3002<\/p>\n<p>2014\u5e74\u3001Citizen Lab\u306f\u3001\u5e02\u6c11\u793e\u4f1a\u306b\u5bfe\u3059\u308b\u8105\u5a01\u306b\u95a2\u3057\u3066<a href=\"https:\/\/targetedthreats.net\/media\/2.2%20Extended%20Analysis-Cluster.pdf\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">1\u3064\u306e\u5831\u544a\u3092\u767a\u884c<\/a>\u3057\u307e\u3057\u305f\u3002\u5831\u544a\u306e\u4e2d\u3067\u3001\u3053\u308c\u3089\u306e\u653b\u6483\u306f\u3001Domain Name Family(DNF)\u3068\u547c\u3070\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>Kaspersky Lab\u306f\u3001\u30a6\u30a4\u30b0\u30eb\u3001\u30c1\u30d9\u30c3\u30c8\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u306b\u5bfe\u3059\u308b\u653b\u6483\u306b\u3064\u3044\u3066\u512a\u308c\u305f\u7814\u7a76\u3092\u884c\u3044\u307e\u3057\u305f\u30022013\u5e74\u3001\u5f7c\u3089\u306f<a href=\"https:\/\/securelist.com\/blog\/incidents\/35552\/android-trojan-found-in-targeted-attack-58\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">Android\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/a>\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u304c\u3001\u3053\u308c\u3089\u3082\u540c\u3058\u30b0\u30eb\u30fc\u30d7\u3092\u6a19\u7684\u306b\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u308f\u305f\u3057\u305f\u3061\u306e\u5206\u6790\u3067\u306f\u3001\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001\u4e0a\u8a18\u306eMobileOrder\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3068\u7570\u306a\u308a\u307e\u3059\u304c\u3001\u76ee\u7684\u306f\u307b\u307c\u540c\u3058\u3067\u3059\u3002<\/p>\n<p>2016\u5e741\u670812\u65e5\u3001Cylance\u306f\u3001<a href=\"https:\/\/blog.cylance.com\/puttering-into-the-future\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u30d6\u30ed\u30b0<\/a>\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30d6\u30ed\u30b0\u3067\u306f\u3001Mandiant\u304cAPT2\u3068\u547c\u3073\u3001CrowdStrike\u304c\u300c\u30d1\u30bf\u30fc\u30d1\u30f3\u30c0\u300d\u3068\u547c\u3093\u3060\u30b0\u30eb\u30fc\u30d7\u306b\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8 \u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u7d50\u3073\u3064\u3051\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u308bIP\u30a2\u30c9\u30ec\u30b9\u3068Scarlet Mimic\u306b\u304a\u3051\u308bIP\u30a2\u30c9\u30ec\u30b9\u306e\u9593\u306b\u308f\u305a\u304b\u306a\u91cd\u8907\u306f\u3042\u308a\u307e\u3059\u304c\u3001\u5f0a\u793e\u306e\u30c1\u30fc\u30e0\u306f\u3001\u3053\u308c\u3089\u306e\u30b0\u30eb\u30fc\u30d7\u304c\u540c\u3058\u3068\u7d50\u8ad6\u4ed8\u3051\u308b\u307e\u3067\u306b\u306f\u3044\u305f\u3063\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n<h2><b>\u7d50\u8ad6<\/b><\/h2>\n<p>Unit 42\u306b\u3088\u3063\u3066\u767a\u898b\u3055\u308c\u3001\u3053\u3053\u3067\u5171\u6709\u3055\u308c\u305f\u60c5\u5831\u306b\u3088\u3063\u3066\u3001Scarlet Mimic\u306f\u3001\u8cc7\u91d1\u529b\u304c\u8c4a\u5bcc\u3067\u9ad8\u5ea6\u306a\u6280\u8853\u529b\u3092\u6301\u3064\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u8005\u3068\u60f3\u5b9a\u3055\u308c\u307e\u3059\u3002Scarlet Mimic\u306f\u3001\u5c11\u306a\u304f\u3068\u30822009\u5e74\u4ee5\u964d\u3001\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u578b\u304a\u3088\u3073\u6c34\u98f2\u307f\u5834\u578b\u306e\u4e21\u65b9\u306e\u653b\u6483\u3092\u4f7f\u7528\u3057\u3066\u653b\u6483\u3092\u7d9a\u3051\u3066\u304a\u308a\u3001\u4f7f\u7528\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3082\u76ca\u3005\u9ad8\u5ea6\u5316\u3057\u3066\u3044\u307e\u3059\u3002\u3042\u305f\u3001\u8907\u6570\u306e\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u3068\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u3092\u653b\u6483\u3067\u304d\u308b\u3088\u3046\u306b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5c55\u958b\u3057\u3066\u3044\u307e\u3059\u3002\u660e\u3089\u304b\u306b\u9ad8\u5ea6\u306a\u6280\u8853\u3092\u6301\u3061\u306a\u304c\u3089\u3001\u30bf\u30a4\u30e0\u30ea\u30fc\u306a\u8a71\u984c\u3067\u8a98\u3044\u3092\u304b\u3051\u308b\u304a\u3068\u308a\u6587\u66f8\u306e\u5b8c\u6210\u5ea6\u306f\u3001\u4f7f\u7528\u8a00\u8a9e\u3092\u554f\u308f\u305a\u3001\u305d\u308c\u307b\u3069\u9ad8\u304f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>\u3053\u306e\u5206\u6790\u3067\u4f7f\u7528\u3057\u305f\u30c7\u30fc\u30bf\u306e\u4e3b\u8981\u306a\u30ea\u30bd\u30fc\u30b9\u306f\u3001Palo Alto Networks\u00a0<a href=\"https:\/\/www.paloaltonetworks.com\/products\/technologies\/wildfire.html\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">WildFire<\/a>\u3067\u3001\u4e16\u754c\u4e2d\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u3053\u306e\u30b7\u30b9\u30c6\u30e0\u306f\u3001<a href=\"https:\/\/cyberthreatalliance.org\/\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">\u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9<\/a>\u306b\u304a\u3051\u308b\u5f0a\u793e\u306e\u30d1\u30fc\u30c8\u30ca\u30fc\u306a\u3069\u306e\u3001\u4ed6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d9\u30f3\u30c0\u30fc\u3068\u306e\u30d1\u30fc\u30c8\u30ca\u30fc\u30b7\u30c3\u30d7\u5171\u6709\u3092\u901a\u3058\u3066\u53ce\u96c6\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2 \u30b5\u30f3\u30d7\u30eb\u3092\u6d3b\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u52d5\u4f5c\u3084\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9 \u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306b\u57fa\u3065\u3044\u305f\u653b\u6483\u306e\u95a2\u9023\u4ed8\u3051\u306b\u306f\u3001Palo Alto Networks\u00a0<a href=\"https:\/\/www.paloaltonetworks.com\/products\/platforms\/subscriptions\/autofocus.html\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">AutoFocus<\/a>\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u304c\u6d3b\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002AutoFocus\u30e6\u30fc\u30b6\u30fc\u306f\u3001Scarlet Mimic\u304a\u3088\u3073\u305d\u306e\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u95a2\u3059\u308b\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u3001\u4ee5\u4e0b\u306e\u30ea\u30f3\u30af\u3092\u4f7f\u7528\u3057\u3066\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<ul>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.PaloAlto-ScarletMimic\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">ScarletMimic<\/a><\/li>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.FakeM\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">FakeM<\/a><\/li>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.Psylo\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">Psylo<\/a><\/li>\n<li><a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.MobileOrder\" data-page-track=\"true\" data-page-track-value=\"company:160124_scarlet-mimic-years-long-espionage-targets-minority-activists: section: \">MobileOrder<\/a><\/li>\n<\/ul>\n<p>Palo Alto Networks\u306e\u304a\u5ba2\u69d8\u306f\u3001\u5f0a\u793e\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306e\u591a\u6570\u306e\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u3092\u901a\u3058\u3066\u3001Scarlet Mimic\u6d3b\u52d5\u304b\u3089\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>\u672c\u30ec\u30dd\u30fc\u30c8\u306b\u6319\u3052\u305f\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u8106\u5f31\u6027\u306b\u95a2\u3059\u308b\u8105\u5a01\u9632\u5fa1\u306e\u30b7\u30b0\u30cd\u30c1\u30e3\u3092\u4f7f\u7528\u3057\u3066\u3001\u914d\u4fe1\u6642\u306b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8 \u30d5\u30a1\u30a4\u30eb\u3092\u691c\u51fa\u3067\u304d\u307e\u3059\u3002<\/li>\n<li>\u5f0a\u793e\u306e\u30a2\u30c9\u30d0\u30f3\u30b9\u30c8 \u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8 \u30d7\u30ed\u30c6\u30af\u30b7\u30e7\u30f3\u3001Traps\u306f\u3001\u672c\u30ec\u30dd\u30fc\u30c8\u306b\u6319\u3052\u305f\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u8106\u5f31\u6027\u304cWindows\u30db\u30b9\u30c8\u3067\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u9632\u5fa1\u3057\u307e\u3059\u3002<\/li>\n<li>WildFire\u306f\u3001\u672c\u30ec\u30dd\u30fc\u30c8\u306b\u8a18\u8f09\u3055\u308c\u3066\u3044\u308b\u3001\u3059\u3079\u3066\u306eAndroid\u304a\u3088\u3073Windows\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u60aa\u610f\u304c\u3042\u308b\u3082\u306e\u3068\u3057\u3066\u5206\u985e\u3057\u307e\u3059\u3002<\/li>\n<li>\u672c\u30ec\u30dd\u30fc\u30c8\u3067\u6319\u3052\u305f\u30d5\u30a1\u30a4\u30eb\u306b\u95a2\u3059\u308b\u3001\u30a2\u30f3\u30c1\u30de\u30eb\u30a6\u30a7\u30a2 \u30b7\u30b0\u30cd\u30c1\u30e3\u306f\u65e2\u306b\u30ea\u30ea\u30fc\u30b9\u6e08\u307f\u3067\u3059\u3002<\/li>\n<li>\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9 \u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u3067\u4f7f\u7528\u3055\u308c\u308b\u30c9\u30e1\u30a4\u30f3\u540d\u306f\u3001PANDB\u3067\u60aa\u610f\u304c\u3042\u308b\u3082\u306e\u3068\u3057\u3066\u65e2\u306b\u5206\u985e\u6e08\u307f\u3067\u3059\u3002<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><b>Scarlet Mimic\u306e\u6307\u6a19\u30c7\u30fc\u30bf<\/b><\/h3>\n<h4><b>FakeM\u30ab\u30b9\u30bf\u30e0SSL\u306e\u30b5\u30f3\u30d7\u30eb<\/b><\/h4>\n<p style=\"padding-left: 40px;\">12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d<br \/>\n33e50c44804d4838dba6627b08210029ff9106fa7fd16cd7255271e153f58b05<br \/>\n3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520<br \/>\n5182dc8667432d76a276dc4f864cdfcef3e481783ebaf46d3b1397080b798f4a<br \/>\n523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b<br \/>\n5dade00db195087aa336ce190b5fd1c22992c49556c623b42a9f742d73241a7f<br \/>\n7156f6416e7116e52f9c67f4e716b1dbea17387e61009c7f2825debbbb4dcb73<br \/>\n79aca57905cca1e56b0cedf48a4d81812639c333ee6532d90a074d64b3852d6f<br \/>\n879edf0417c4a9759040b51bf83b2fc918a6644a7c29a52252003a63036aea5c<br \/>\n9b77bbb620f50632fae17c40c7469fc93ffdbc4136a6d893a9a10a44bc435da5<br \/>\na1b7fe2acdb7a5b0c52b7c1960cfad531a7ca85b602fc90044c57a2b2531699f<br \/>\na268cc4931781d1d8094a4f8f596c2de3d662f2581c735b0810ff0ecefe3f859<br \/>\na4abbcfdbf4a6c52349a843eac0396e6d8abb05f1324223980d824629a42ef7a<br \/>\na569f3b02a4be99e0b4a9f1cff43115da803f0660dd4df114b624316f3f63dc6<br \/>\nb4c1e9c99f861a4dd7654dcc3548ab5ddc15ee5feb9690b9f716c4849714b20d<br \/>\nbbdedcfe789641e7f244700e8c028ef51094b66508f503876eb0d6aa16df6aa8<br \/>\nc7b9e6b5ab07e6da404af9894c8422d9a0c9586334ddc0a3c1ea6bf23ef97fb2<br \/>\ncaeace73a17e220634525d2a4117525fd60cb86a06873c86571e89d156f8d72d<br \/>\ncaf76e19a2681dd000c96d8389afc749e774c083aef09f023d4f42fbc49d4d3d<br \/>\ne96097826179a66cc3061be0f99f7b55cc9692a6378b5c4364699327823098ab<br \/>\nf511b13341c9fb4ec9ecfcfe5a5813b964c362d7c709c402ead4e010d857bf6c<br \/>\nfa08a498da0b31e77669d51a28dff166d84983fa6af693063c08f312fdce93e3<br \/>\ndf9872d1dc1dbb101bf83c7e7d689d2d6df09966481a365f92cd451ef55f047d<\/p>\n<h4><b>FakeM SSL\u306e\u30b5\u30f3\u30d7\u30eb<\/b><\/h4>\n<p style=\"padding-left: 40px;\">0aab09bf0db30a4be28d19475082fd5e7f75879bf9029fdd8dfc3a1e1f072b0c<br \/>\n2e1472a65a8df43c8bc9b0aff954fbc1a093c4214f6a718a08e1321db83ca683<br \/>\n3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90<br \/>\n41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33<br \/>\n4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3<br \/>\n5154511a439bb367b7dd56232eb15281cb6dc4d64ea3a06e7fbbe6b176e385d4<br \/>\n5fae5750797ebe7e7a6a6919a7d66deffb141ec28737bd72a1f7da8edd330b60<br \/>\naa8a302a53bd39b2d2a6e3d8497575e2a5f9757b248e34c8e0821ce9eee5cc32<br \/>\nb3c9bb22fa1bc358dc23a1a4bdaf85ad1add4d812b107b7ab887affbf689933a<br \/>\ncd506679fd32dab16dee6fbf1cfdfe0836e092a4f5669418a199d99c9cd33abd<br \/>\nd1dd4469c7b5c462e5ff2dcef5d22775250e9ebf395f65da624f18ea7144e173<br \/>\nd698008e417da867d02e2f5cdcc80ff92af753dd585fada42fc611c2d7332c3a<\/p>\n<h4><b>FakeM\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u30b5\u30f3\u30d7\u30eb<\/b><\/h4>\n<p style=\"padding-left: 40px;\">53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60<br \/>\n9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5<br \/>\n53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e<br \/>\n631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3<br \/>\n7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8<br \/>\n7c9421a4605decfa1b3e22addbca98d86ea757dcd8ff8e075d13228c99618637<br \/>\n202975d10ba417cf441e8f9986d2496807fe39e057d3226ec3b2713f0c218cd8<br \/>\n22e7517d8996e92998eb996416f9d8ef06b3b1c220c1a5d29ccd5aaef7b10c72<br \/>\n435df30d139ccbe5ce4e5ca6fe072e42e96d5ea1efd5317deebce462ecccc7ab<br \/>\n47d9ba5f7bf70c5d2b7a832e070957cc7ebdcfd0a6ee75851df16dc45971ce8a<br \/>\n4a3d0df9fa198a7ebe45db5239d22067e74924b1aace52029b3acc9b51af691e<br \/>\n4d539f638ed476ca08da838cdfbf710dae82b582256d60a009e9d304f6822e65<br \/>\nbe0e8da7e261ec7d08eaa78e79ceb1be47c324b8e142097bf6569f9471c98a4e<br \/>\nc30d03750458bb5f2b03d6bd399ffca6d378a3adb5a74bee3b6ba4b982dbf273<br \/>\ncc7db456825e266849090b6fa95a94ad8c4c717712b610b0d39077af5222f4be<br \/>\nd6d2a77f8ed2fe9fed9ee6dcb4cc0b339ba47a575c717c35815243c752d8f60c<br \/>\ndb8338e6b883fdceaa02c10ad683547a26ae32e0d4641cc24c7bd3b45154abb0<br \/>\ne8e5ecf525c5259651bfbdf1923215729ec67658225eca1b02519f5f6279eacb<br \/>\nec4deb761b09ddc706804ef669836cf4b199f1d74b14ad623a6f6cc2f38190b8<br \/>\n669ce0975c133d54e414dbf1de546aed742e76fe3e60568e2bd4747b7e0f8b70<br \/>\n0d77f5f1d4c0f02fb88ac33fa365b17d28d1521cea59329ca4b3dd0b7031a60e<br \/>\n363d9557861fab2d83d04847b967996361e670e571b335c7a535bc6278cba149<br \/>\n7fb2c37431fd7b05414b134732ba0b29cd7dad17fc176627ee0815aac60c1ab9<br \/>\n77e4ef9e08f1095487b4fa27492b4c9b8e833f29598f99a0d10f7c85b4254761<br \/>\na4ffca5f1c3d9c21629fa98a1e91121d954ab9347e86ac3c9613dae61bf30393<br \/>\n428121c421bf81a0d689014cf21ec7951b0c32add86198e06f7d636981f68755<br \/>\na195f564aa2fb66db119e2fbec93e319a973e5cf50fbf9fc08bd81f9b7ee8af8<br \/>\nc1e8ff8ebe3754bc7d14509ef3678edf7551d876d3fa847d07d469c09bceae91<br \/>\n53238f67ac7e4cc27264efbacc8712bd97a5775feaf633c63adaa0785d038e8a<br \/>\n508a7cab0f2a69ba66e92e86817a49ecd1b9c8ae11a995147944995fc868dfad<br \/>\nfb60d14de4dba022f11437845d465a661d0c78d3d097a38770816f06992bf0af<br \/>\n8da2f9afd914a4318a97f4d74809c0c383f8ebf0d3d6e3d3715efbd71a66a52f<br \/>\n6fe33c672fd30bba9bbc89dc7d88993d8783382c9f9c510677b1bb068a5f1e51<br \/>\n6a1c7999b4ba92899d3364fc729d0f052680be5a71dd0f13cbabdb19b82bf858<br \/>\n5db51f2f7c31de7d165ec4892ae7dcedaa036caedeef718b57953d7935582f04<br \/>\n27167a9d63f5ddc68a12decb1a1e0a2a29c72fe0681dca2c4f3d169f048a9d38<br \/>\n6f10c892133b5dac6c40cfe77ca32b42572bc56909481b236080dfc143ef9afd<br \/>\nde12cd8d11478d17342c60239837c1afcc9fee72df6ffdf9943802640d43f77a<br \/>\n0f2db64b8283b76d49c9bb272beafab8323f941b6dc3888b42ff02f08634d016<\/p>\n<h4><b>Psylo\u306e\u30b5\u30f3\u30d7\u30eb<\/b><\/h4>\n<p style=\"padding-left: 40px;\">19bbee954ac1a21595e63cb86d1a596236aed353804aec5cb8adfa62e70280d3<br \/>\na9f0bddc3d3516af8355e8ac17309528cd018347e5f56a347c14da0a83b0028a<br \/>\n00bb399c429e0f1f7de751103fe92b5f820d1686d01662a08583b7a94aaed94e<\/p>\n<h4><b>MobileOrder\u306e\u30b5\u30f3\u30d7\u30eb<\/b><\/h4>\n<p style=\"padding-left: 40px;\">03004ccc23033a09532bea7dfa08c8dfa85814a15f5e3aedb924a028bcd6f908<\/p>\n<h4><b>CallMe\u306e\u30b5\u30f3\u30d7\u30eb<\/b><\/h4>\n<p style=\"padding-left: 40px;\">071c34b9701dd84f9590ba899a8af3eeec228a928f2d98a80dbc780e396ee01a<br \/>\nd1f0658bbb15ab2bccc210d7e1f21b96e14ae22de8494ca95b12e182f3d0f693<br \/>\n9ff687a813a5cb5ff10374c86f852534c1aa3e5a221123214bf52b2ff455a5da<br \/>\n8c423506c0c7ebe1e61071374ecf0806463a02a2100b5daa1bd942129ff8a235<br \/>\n91e36e720477146f1a0c050d3bc74bc6683a03e7631317ded3c598a10465dcc8<br \/>\nc981db20d588ba2d0f437b4e5459e7c6763f52a97841450c94591ca28a9a2d69<br \/>\n95dba004f949e44cb447246f3d2420b01db4541d0e4fa7b00d798f38a3d251e4<\/p>\n<h4><b>FakeM\u30ab\u30b9\u30bf\u30e0SSL C2\u30b5\u30fc\u30d0<\/b><\/h4>\n<p style=\"padding-left: 40px;\">aaa123.spdns[.]de<br \/>\nadmin.spdns[.]org<br \/>\ndetail43.myfirewall[.]org<br \/>\neconomy.spdns[.]de<br \/>\nfirefox.spdns[.]de<br \/>\nfirewallupdate.firewall-gateway[.]net<br \/>\nintersecurity.firewall-gateway[.]com<br \/>\nkaspersky.firewall-gateway[.]net<br \/>\nkasperskysecurity.firewall-gateway[.]com<br \/>\nkissecurity.firewall-gateway[.]net<br \/>\nmail.firewall-gateway[.]com<br \/>\nnews.firewall-gateway[.]com<br \/>\nopero.spdns[.]org<br \/>\nsys.firewall-gateway[.]net<\/p>\n<h4><b>FakeM\u30ab\u30b9\u30bf\u30e0C2\u30b5\u30fc\u30d0<\/b><\/h4>\n<p style=\"padding-left: 40px;\">account.websurprisemail[.]com<br \/>\naddi.apple.cloudns[.]org<br \/>\nbailee.alanna.cloudns[.]biz<br \/>\nbee.aoto.cloudns[.]org<br \/>\nbook.websurprisemail[.]com<br \/>\ndesk.websurprisemail[.]com<br \/>\ndolat.diyarpakzimin[.]com<br \/>\ndolat.websurprisemail[.]com<br \/>\ndolet.websurprisemail[.]com<br \/>\ngithub.ignorelist[.]com<br \/>\nislam.youtubesitegroup[.]com<br \/>\nmareva.catherine.cloudns[.]us<br \/>\nmuslim.islamhood[.]net<br \/>\np.klark.cloudns[.]in<br \/>\nppcc.vasilevich.cloudns[.]info<br \/>\npress.ufoneconference[.]com<br \/>\nvip.yahoo.cloudns[.]info<\/p>\n<h4><b>FakeM\u30aa\u30ea\u30b8\u30ca\u30ebC2\u30b5\u30fc\u30d0<\/b><\/h4>\n<p style=\"padding-left: 40px;\">207.204.225[.]117<br \/>\naccounts.yourturbe[.]org<br \/>\naddnow.zapto[.]org<br \/>\nbits.githubs[.]net<br \/>\nclean.popqueen.cloudns[.]org<br \/>\neconomy.spdns[.]eu<br \/>\neemete.freetcp[.]com<br \/>\nemail.googmail[.]org<br \/>\nfish.seafood.cloudns[.]org<br \/>\nfreeavg.sytes[.]net<br \/>\nfreeonline.3d-game[.]com<br \/>\nibmcorp.slyip[.]com<br \/>\nlemondtree.freetcp[.]com<br \/>\nliumingzhen.myftp[.]org<br \/>\nliumingzhen.zapto[.]org<br \/>\nn.popqueen.cloudns[.]org<br \/>\nnews.googmail[.]org<br \/>\noic-oci.3-a[.]net<br \/>\npolat.googmail[.]org<br \/>\nqq.ufoneconference[.]com<br \/>\nqq.yourturbe[.]org<br \/>\nsisiow.slyip[.]com<br \/>\nupdate.googmail[.]org<br \/>\nuprnd.flnet[.]org<br \/>\nvideo.googmail[.]org<br \/>\nwebmail.yourturbe[.]org<br \/>\nworldwildlife.effers[.]com<br \/>\nwww.angleegg.ddns[.]us<br \/>\nwww.angleegg.xxxy[.]info<br \/>\nwww.googmail[.]org<br \/>\nyouturbe.co[.]cc<br \/>\nyycc.mrbonus[.]com<br \/>\nzjhao.dtdns[.]net<\/p>\n<h4><b>Psylo C2\u30b5\u30fc\u30d0<\/b><\/h4>\n<p style=\"padding-left: 40px;\">apple.lenovositegroup[.]com<br \/>\nmm.lenovositegroup[.]com<br \/>\nftp112.lenta.cloudns[.]pw<br \/>\nwww.gorlan.cloudns[.]pro<br \/>\notcgk.border.cloudns[.]pw<\/p>\n<h4><b>MobileOrder C2\u30b5\u30fc\u30d0<\/b><\/h4>\n<p style=\"padding-left: 40px;\">ziba.lenovositegroup[.]com<\/p>\n<h4><b>CallMe C2\u30b5\u30fc\u30d0<\/b><\/h4>\n<p style=\"padding-left: 40px;\">apple12.crabdance[.]com<br \/>\nupdate.googmail[.]org<br \/>\napple12.crabdance[.]com<br \/>\nalma.apple.cloudns[.]org<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 \u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9 \u30cd\u30fc\u30e0\u304c\u4ed8\u3051\u3089\u308c\u305f\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u308b\u4e00\u9023\u306e\u653b\u6483\u306b\u3064\u3044\u3066\u8abf\u67fb\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u306f4\u5e74\u4ee5\u4e0a\u524d\u304b\u3089\u59cb\u307e\u308a\u3001\u305d\u306e\u6a19\u7684\u306e\u9078\u3073\u65b9\u306e\u30d1\u30bf\u30fc<\/p>\n","protected":false},"author":51,"featured_media":106755,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4321,1974,4428],"tags":[4909,6063,7775,7777,6475,7779,7759,4569,7781,7783,5547,7785,7787,7649,7789,7790,7367],"product_categories":[4340,4444],"coauthors":[105,935],"class_list":["post-106818","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-research","category-malware-ja","category-threat-research-ja","tag-android-ja","tag-apple-ja","tag-brutishcommand-ja","tag-callme-ja","tag-cyber-espionage-ja","tag-cyber-threat-alliance-ja","tag-cybersecurity-ja","tag-espionage-ja","tag-fakem-ja","tag-mac-os-x-ja","tag-microsoft-ja","tag-mobileorder-ja","tag-psylo-ja","tag-scarlet-mimic-ja","tag-skiboot-loader-ja","tag-subtractthis","tag-trojans-ja","product_categories-advanced-wildfire","product_categories-advanced-wildfire-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5<\/title>\n<meta name=\"description\" content=\"\u6982\u8981 \u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5\" \/>\n<meta property=\"og:description\" content=\"\u6982\u8981 \u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2016-01-25T01:00:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-04-27T07:41:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/04\/unit42-web-banner-650x300-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"650\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jen Miller-Osborn, Robert Falcone\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5","description":"\u6982\u8981 \u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/","og_locale":"ja_JP","og_type":"article","og_title":"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5","og_description":"\u6982\u8981 \u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/","og_site_name":"Unit 42","article_published_time":"2016-01-25T01:00:11+00:00","article_modified_time":"2020-04-27T07:41:39+00:00","og_image":[{"width":650,"height":300,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/04\/unit42-web-banner-650x300-1.jpg","type":"image\/jpeg"}],"author":"Jen Miller-Osborn, Robert Falcone","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/"},"author":{"name":"Jen Miller-Osborn","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/c5032b4c146b46d71669b248ad6e8142"},"headline":"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5","datePublished":"2016-01-25T01:00:11+00:00","dateModified":"2020-04-27T07:41:39+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/"},"wordCount":2783,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/04\/unit42-web-banner-650x300-1.jpg","keywords":["Android","Apple","BrutishCommand","CallMe","cyber espionage","Cyber Threat Alliance","cybersecurity","Espionage","FakeM","Mac OS X","Microsoft","MobileOrder","Psylo","Scarlet Mimic","SkiBoot Loader","SubtractThis","Trojans"],"articleSection":["Threat Research","\u30de\u30eb\u30a6\u30a7\u30a2","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/","name":"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/04\/unit42-web-banner-650x300-1.jpg","datePublished":"2016-01-25T01:00:11+00:00","dateModified":"2020-04-27T07:41:39+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/c5032b4c146b46d71669b248ad6e8142"},"description":"\u6982\u8981 \u904e\u53bb7\u304b\u6708\u9593\u3001Unit 42\u306f\u300cScarlet Mimic\u300d\u3068\u3044\u3046\u30b3\u30fc\u30c9","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#primaryimage","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/04\/unit42-web-banner-650x300-1.jpg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/04\/unit42-web-banner-650x300-1.jpg","width":650,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/scarlet-mimic-years-long-espionage-targets-minority-activists\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"Scarlet Mimic: \u9577\u5e74\u306b\u308f\u305f\u308a\u5c11\u6570\u6c11\u65cf\u306e\u4eba\u6a29\u6d3b\u52d5\u5bb6\u3092\u6a19\u7684\u306b\u3059\u308b\u30b9\u30d1\u30a4\u653b\u6483\u6d3b\u52d5"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/c5032b4c146b46d71669b248ad6e8142","name":"Jen Miller-Osborn","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/9213e49ea48b7676660bac40d05c9e3e","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Jen Miller-Osborn"},"url":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/author\/jen-miller-osborn\/"}]}},"_links":{"self":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/106818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=106818"}],"version-history":[{"count":3,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/106818\/revisions"}],"predecessor-version":[{"id":106821,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/106818\/revisions\/106821"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/106755"}],"wp:attachment":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=106818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=106818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=106818"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=106818"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=106818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}