{"id":131761,"date":"2023-12-29T06:00:53","date_gmt":"2023-12-29T14:00:53","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=131761"},"modified":"2024-06-17T01:11:16","modified_gmt":"2024-06-17T08:11:16","slug":"unit42-threat-intelligence-roundup","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/unit42-threat-intelligence-roundup\/","title":{"rendered":"Unit 42 \u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u307e\u3068\u3081: DarkGate \u304b\u3089 AsyncRAT \u307e\u3067 2023 \u5e74 10 \u6708\u301c 12 \u6708\u306b SNS \u306b\u6295\u7a3f\u3057\u305f\u901f\u5831\u306e\u632f\u308a\u8fd4\u308a"},"content":{"rendered":"

<\/a>\u6982\u8981<\/h2>\n

\u672c\u7a3f\u3067\u306f\u3001Unit 42 \u304c\u78ba\u8a8d\u3057\u3001SNS \u3092\u901a\u3058\u3066\u5e83\u7bc4\u306a\u8105\u5a01\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0 \u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u3068\u5171\u6709\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u30fc (\u306a\u3089\u3073\u306b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u30d7\u30c3\u30b7\u30e5\u3059\u308b\u8105\u5a01\u30b0\u30eb\u30fc\u30d7) \u3092\u307e\u3068\u3081\u307e\u3059\u3002IcedID \u3084 DarkGate \u306a\u3069\u306e\u4e00\u90e8\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u7e70\u308a\u8fd4\u3057\u767b\u5834\u3057\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 TA577 \u306b\u95a2\u3059\u308b\u6295\u7a3f\u3082\u591a\u6570\u542b\u3081\u307e\u3057\u305f\u3002TA577 \u306f\u8907\u6570\u306e\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u30fc\u3092\u914d\u5e03\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u672c\u7a3f\u3067\u306f\u305d\u306e\u306a\u304b\u304b\u3089 Pikabot \u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002\u307b\u304b\u306b\u306f\u3001JinxLoader \u306a\u3069\u65b0\u3057\u3081\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u3064\u3044\u3066\u3082\u6295\u7a3f\u3057\u307e\u3057\u305f\u3002<\/p>\n

\u79c1\u305f\u3061\u306f SNS \u3092\u901a\u3058\u3066\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u3092\u5171\u6709\u3059\u308b\u3053\u3068\u3067\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u6ce8\u76ee\u3059\u3079\u304d\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3092\u8fc5\u901f\u306b\u30ec\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u6295\u7a3f\u3067\u306f\u3001\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u3092\u307e\u3068\u3081\u3001\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u6709\u76ca\u306a\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u63d0\u4f9b\u3057\u3001\u4fb5\u5bb3\u6307\u6a19 (IoC) \u3092\u63d0\u793a\u3057\u3066\u3044\u307e\u3059\u30022023 \u5e74\u3001\u79c1\u305f\u3061\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831 93 \u4ef6\u306f\u5408\u8a08\u3067 160\u4e07\u4ee5\u4e0a\u306e\u30a4\u30f3\u30d7\u30ec\u30c3\u30b7\u30e7\u30f3\u3092\u751f\u307f\u51fa\u3057\u3001\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u3078\u306e\u8fc5\u901f\u306a IoC \u63d0\u4f9b\u306e\u4fa1\u5024\u306e\u9ad8\u3055\u3092\u793a\u3057\u307e\u3057\u305f\u3002<\/p>\n

\u672c\u7a3f\u3067\u306f\u30012023 \u5e74 10 \u6708\u304b\u3089 12 \u6708\u306b\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u5168\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u3092\u632f\u308a\u8fd4\u308a\u307e\u3059\u3002\u3053\u3046\u3057\u3066\u632f\u308a\u8fd4\u308b\u3053\u3068\u3067\u3001\u5358\u4e00\u306e\u6295\u7a3f\u304b\u3089\u306f\u898b\u3048\u3065\u3089\u3044\u30c8\u30ec\u30f3\u30c9\u3092\u7279\u5b9a\u3059\u308b\u6a5f\u4f1a\u3092\u5f97\u3089\u308c\u307e\u3059\u3002\u4fb5\u5bb3\u306e\u5146\u5019<\/a>\u30bb\u30af\u30b7\u30e7\u30f3\u306b\u4e00\u89a7\u8868\u3092\u307e\u3068\u3081\u307e\u3057\u305f\u3002\u3053\u306e\u8868\u306b\u3059\u3079\u3066\u306e\u6295\u7a3f\u306e\u6295\u7a3f\u65e5\u3001\u540d\u524d\u3001SNS \u3078\u306e\u30ea\u30f3\u30af\u3001GitHub \u4e0a\u306e IoC \u3092\u7db2\u7f85\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u3053\u308c\u3089\u306e\u6295\u7a3f\u306e\u591a\u304f\u306f\u3001Wireshark \u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u611f\u67d3\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3084\u3001\u95a2\u9023\u3059\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u30d1\u30b1\u30c3\u30c8 \u30ad\u30e3\u30d7\u30c1\u30e3\u30fc (pcap) \u306b\u7d10\u3065\u304f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af IoC \u3084\u30b3\u30e1\u30f3\u30c8\u3078\u306e\u30ea\u30f3\u30af\u3092\u542b\u3081\u3066\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u305f\u3081\u3001\u672c\u7a3f\u3092\u8aad\u3080\u3053\u3068\u3067 Wireshark \u30b9\u30ad\u30eb\u7fd2\u5f97\u30fb\u5411\u4e0a\u306e\u6a5f\u4f1a\u3082\u5f97\u3089\u308c\u307e\u3059\u3002<\/p>\n

SNS \u6295\u7a3f\u3067\u5171\u6709\u3055\u308c\u305f IoC \u306f\u3059\u3079\u3066\u3001\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u88fd\u54c1\u306b\u3088\u3063\u3066\u60aa\u610f\u304c\u3042\u308b\u3068\u898b\u306a\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u5224\u5b9a\u306f\u305f\u3068\u3048\u3070<\/span>\u30af\u30e9\u30a6\u30c9\u914d\u4fe1\u578b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30b5\u30fc\u30d3\u30b9<\/span><\/a> (<\/span>Advanced WildFire<\/span><\/a>\u3001<\/span>Advanced URL Filtering<\/span><\/a> \u306a\u3069) <\/span>\u3092\u6709\u52b9\u306b\u3057\u305f\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/span><\/a>\u3067\u6d3b\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/span>\u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001<\/span>\u3053\u3061\u3089<\/span><\/a>\u306e\u554f\u3044\u5408\u308f\u305b\u30d5\u30a9\u30fc\u30e0\u304b\u3089\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001infojapan@paloaltonetworks.com \u307e\u3067\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3066\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044 (\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/span><\/p>\n

SNS \u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u3092\u30ea\u30a2\u30eb\u30bf\u30a4\u30e0\u306b\u78ba\u8a8d\u3059\u308b\u306b\u306f\u3001X (\u65e7 Twitter)<\/a>\u3001LinkedIn<\/a> \u3067\u300cUnit 42\u300d\u3092\u30d5\u30a9\u30ed\u30fc\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n\n
\u95a2\u9023\u3059\u308b Unit 42 \u306e\u30c8\u30d4\u30c3\u30af<\/b><\/td>\nWireshark<\/a>, Malware<\/a>, RATs<\/a>, Trojan<\/a><\/td>\n<\/tr>\n
\u8a00\u53ca\u3055\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u30fc<\/b><\/td>\nDarkGate, Pikabot, IcedID, AsyncRAT, JinxLoader<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/a>\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831<\/h2>\n

\u672c\u30b5\u30a4\u30c8\u3067 Unit 42 \u306f\u975e\u5e38\u306b\u8a73\u7d30\u306a\u8a18\u4e8b\u3092\u516c\u958b\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u307b\u304b\u306b SNS \u3092\u901a\u3058\u3066 IoC \u3084 TTP (\u6226\u8853\u30fb\u6280\u8853\u30fb\u624b\u9806)\u3001\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u95a2\u3059\u308b\u3082\u308d\u3082\u308d\u306e\u89b3\u6e2c\u7d50\u679c\u306a\u3069\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3082\u901f\u5831\u3068\u3057\u3066\u5171\u6709\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

JinxLoader \u306b\u95a2\u3057\u3001\u521d\u3081\u3066\u516c\u958b\u3055\u308c\u305f\u6295\u7a3f\u3092\u884c\u3063\u305f<\/a>\u306e\u306f\u79c1\u305f\u3061 Unit 42 \u3067\u3057\u305f\u3002\u3053\u306e\u60c5\u5831\u3092\u3082\u3068\u306b\u3001\u5c11\u306a\u304f\u3068\u3082\u5225\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696d 1 \u793e (ProofPoint \u306eEmerging Threats (ET) Labs<\/a> \u30c1\u30fc\u30e0) \u304c\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u751f\u6210\u3059\u308b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af \u30d1\u30bf\u30fc\u30f3\u3092\u30c8\u30ea\u30ac\u30fc\u3059\u308b\u65b0\u305f\u306a\u30b7\u30b0\u30cd\u30c1\u30e3\u3092\u4f5c\u6210\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002<\/p>\n

\u3053\u3053\u3067\u306f 10 \u6708\u304b\u3089 12 \u6708\u306b\u516c\u958b\u3057\u305f\u5168 SNS \u6295\u7a3f\u3092\u307e\u3068\u3081\u308b\u307b\u304b\u3001\u632f\u308a\u8fd4\u308a\u306e\u6700\u5f8c\u306b\u8868<\/a>\u3092\u8ffd\u52a0\u3057\u3001\u3053\u3053\u306b\u5143\u306e\u6295\u7a3f\u3068 GitHub \u4e0a\u306e\u3059\u3079\u3066\u306e IoC \u3078\u306e\u30ea\u30f3\u30af\u3092\u542b\u3081\u3066\u304a\u304d\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u5143\u6295\u7a3f\u306b\u306f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u3084\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8 (\u75d5\u8de1) \u306e\u30b9\u30af\u30ea\u30fc\u30f3 \u30ad\u30e3\u30d7\u30c1\u30e3\u30fc\u304b\u3089 Wireshark \u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u95a2\u9023\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u3044\u305f\u308b\u307e\u3067\u3001\u5171\u6709\u3055\u308c\u305f\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u306e\u753b\u50cf\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u306b\u306f\u611f\u67d3\u30c1\u30a7\u30fc\u30f3 (\u3042\u308c\u3070) \u306e\u307f\u3092\u542b\u3081\u307e\u3059\u304c\u3001\u6b8b\u308a\u306e\u90e8\u5206\u3092\u78ba\u8a8d\u3059\u308b\u306b\u306f X (\u65e7 Twitter) \u304b LinkedIn \u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n

\u6ce8: \u300c\u611f\u67d3\u65e5\u300d\u306f\u300cSNS \u3078\u306e\u6295\u7a3f\u65e5\u300d\u3068\u540c\u3058\u3068\u306f\u9650\u308a\u307e\u305b\u3093\u3002IoC \u30bb\u30af\u30b7\u30e7\u30f3\u306e\u8868\u306b\u306f\u300cSNS \u3078\u306e\u6295\u7a3f\u65e5\u300d\u3092\u542b\u3081\u3066\u3044\u307e\u3059\u3002\u4e00\u65b9\u3001\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u3092\u793a\u3059\u753b\u50cf\u306b\u8868\u793a\u3055\u308c\u3066\u3044\u308b\u306e\u306f\u300c\u611f\u67d3\u65e5\u300d\u3067\u3059\u3002\u300c\u611f\u67d3\u65e5\u300d\u3068\u300cSNS \u3078\u306e\u6295\u7a3f\u65e5\u300d\u3092\u6bd4\u8f03\u3057\u305f\u7d50\u679c\u3001\u305d\u308c\u3089\u304c\u4e00\u81f4\u3057\u3066\u3044\u306a\u304f\u3066\u3082\u3001\u6df7\u4e71\u3057\u306a\u304f\u3066\u3060\u3044\u3058\u3087\u3046\u3076\u3067\u3059\u3002<\/p>\n

<\/a>\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831: 10 \u6708<\/h2>\n

<\/a>DarkGate<\/h3>\n

10 \u6708\u306f DarkGate<\/a> \u306e\u4e8b\u4f8b\u3092 2 \u4ef6\u6295\u7a3f\u3057\u307e\u3057\u305f\u3002\u6700\u521d\u306e\u4e8b\u4f8b<\/a>\u306f Microsoft Teams \u3092\u901a\u3058\u3066\u914d\u5e03\u3055\u308c\u305f DarkGate \u30de\u30eb\u30a6\u30a7\u30a2\u3067\u3057\u305f\u3002\u653b\u6483\u8005\u306f\u6a19\u7684\u7d44\u7e54\u306e CEO \u3092\u88c5\u3063\u3066\u88ab\u5bb3\u8005\u306b Teams \u306e\u62db\u5f85\u72b6\u3092\u9001\u4fe1\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u9001\u4fe1\u3055\u308c\u305f\u30e1\u30c3\u30bb\u30fc\u30b8\u306b\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u4fdd\u8b77\u3055\u308c\u305f .zip \u30a2\u30fc\u30ab\u30a4\u30d6\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u4ee5\u4e0b\u306e\u56f3 1 \u306b\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u5168\u4f53\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n

\"2023-10-12
\u56f3 1. Microsoft Teams \u30e1\u30c3\u30bb\u30fc\u30b8\u304b\u3089\u59cb\u307e\u308b DarkGate \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

2 \u3064\u3081\u306e\u4e8b\u4f8b<\/a>\u3067\u306f\u3001DocuSign \u3092\u88c5\u3046 PDF \u30d5\u30a1\u30a4\u30eb\u3092\u6dfb\u4ed8\u3057\u305f\u507d\u306e\u8acb\u6c42\u66f8\u30e1\u30fc\u30eb\u306b\u3088\u3063\u3066 DarkGate \u30de\u30eb\u30a6\u30a7\u30a2\u304c\u914d\u5e03\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u56f3 2 \u306f\u3001\u3053\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u304c\u3069\u306e\u3088\u3046\u306b\u6a5f\u80fd\u3059\u308b\u304b\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002\u6ce8\u610f\u3057\u3066\u8aad\u3081\u3070\u3001\u3053\u308c\u3089 2 \u3064\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u306e\u9055\u3044\u3092\u898b\u308f\u3051\u3089\u308c\u308b\u3067\u3057\u3087\u3046\u3002<\/p>\n

\"2023-10-25
\u56f3 2. \u96fb\u5b50\u30e1\u30fc\u30eb\u304b\u3089\u59cb\u307e\u308b DarkGate \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>Pikabot<\/h3>\n

10\u6708\u306f Pikabot<\/a> \u306e\u4e8b\u4f8b\u3082 2 \u4ef6\u6295\u7a3f\u3057\u307e\u3057\u305f\u3002\u6700\u521d\u306e\u4e8b\u4f8b\u3067\u306f\u3001Pikabot \u3078\u306e\u611f\u67d3<\/a>\u5f8c\u3001179.60.149[.]244:443<\/span> \u4e0a\u3067\u7a3c\u50cd\u3059\u308b zzerxc[.]com<\/span> \u3092\u4f7f\u3063\u305f Cobalt Strike \u306e HTTPS C2 \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3078\u3068\u3064\u306a\u304c\u3063\u3066\u3044\u307e\u3057\u305f\u3002\u56f3 3 \u306b\u3053\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u5168\u4f53\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n

\"Cobalt
\u56f3 3. Pikabot \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

2 \u3064\u3081\u306e\u4e8b\u4f8b<\/a>\u3067\u306f\u3001\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306e TA577<\/a> \u306b\u3088\u308b Pikabot \u306e\u30d7\u30c3\u30b7\u30e5\u30fb\u611f\u67d3\u5f8c\u306b 45.155.249[.]171:443<\/span> \u4e0a\u3067\u7a3c\u50cd\u3059\u308b ponturded[.]com<\/span> \u3092\u4f7f\u3063\u305f Cobalt Strike \u306e HTTPS \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3078\u3068\u3064\u306a\u304c\u3063\u3066\u3044\u307e\u3057\u305f\u3002\u4eca\u56de\u306e\u307e\u3068\u3081\u3067\u306f\u3055\u3089\u306b\u591a\u6570 TA577 \u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u76ee\u306b\u3059\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002\u4e0b\u56f3 4 \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u306f\u307b\u304b\u306e TA577 \u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3068\u306f\u9055\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n

\"2023.10.17(\u6728)\u3002\u96fb\u5b50\u30e1\u30fc\u30eb
\u56f3 4. Pikabot \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>IcedID (Bokbot)<\/h3>\n

\u30d0\u30f3\u30ad\u30f3\u30b0\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac IcedID<\/a> \u306b\u95a2\u3059\u308b 10 \u6708\u306e\u552f\u4e00\u306e\u5831\u544a\u306f\u30d5\u30a9\u30fc\u30af\u3055\u308c\u305f\u4e9c\u7a2e\u306b\u3088\u308b\u611f\u67d3\u3067\u3001BackConnect<\/a>\u3001Anubis VNC<\/a>\u3001CobaltStrike\u3001ConnectWise ScreenConnect<\/a> \u304c\u4f7f\u308f\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u521d\u671f\u611f\u67d3\u304b\u3089\u304a\u3088\u305d 95 \u5206\u3068\u3044\u3046\u901f\u3055\u3067\u300c\u653b\u6483\u8005\u304c\u30ad\u30fc\u30dc\u30fc\u30c9\u306b\u624b\u3092\u7f6e\u3044\u3066\u64cd\u4f5c\u3057\u3066\u3044\u308b\u300d\u3053\u3068\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u56f3 5 \u306f\u3001\u3053\u306e\u4e9c\u7a2e\u304c\u3069\u306e\u3088\u3046\u306b\u6a5f\u80fd\u3059\u308b\u304b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\"2023-10-18
\u56f3 5. \u30d5\u30a9\u30fc\u30af\u3055\u308c\u305f IcedID \u4e9c\u7a2e\u306b\u3088\u308b\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>WS_FTP \u30b5\u30fc\u30d0\u30fc\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027<\/h3>\n

\u79c1\u305f\u3061\u306f WS_FTP Server Critical Vulnerability <\/a>\u306b\u5bfe\u3059\u308b\u8907\u6570\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u8a66\u884c\u3092\u89b3\u6e2c\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u8a66\u884c\u3067\u306f\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u3089\u304c URL 103[.]163.187.12:8080\/cz3eKnhcaD0Fik7Eexo66A<\/span> \u3092\u7d4c\u7531\u3057\u3066 Meterpreter \u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u914d\u5e03<\/a>\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u56f3 6 \u306b\u306f\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u306e\u307b\u304b\u3001\u4f7f\u7528\u3055\u308c\u308b\u30b3\u30de\u30f3\u30c9\u3082\u542b\u3081\u3066\u3042\u308a\u307e\u3059\u3002<\/p>\n

\"\"
\u56f3 6. WS_FTP \u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3059\u308b\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>AsyncRAT<\/h3>\n

\u3053\u3061\u3089\u306f Traffic Director \u30b7\u30b9\u30c6\u30e0 (TDS) \u306b\u3088\u3063\u3066 HTTP 404 (Not Found) \u306e\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3092\u884c\u3046 URL \u30c1\u30a7\u30fc\u30f3<\/a>\u304c AsyncRAT <\/a> \u4e9c\u7a2e\u3078\u306e\u611f\u67d3\u306b\u3064\u306a\u304c\u3063\u305f\u4e8b\u4f8b\u3067\u3059\u3002\u56f3 7 \u306f\u3001\u30b7\u30f3\u30d7\u30eb\u306a\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n

\"2023-10-23
\u56f3 7. AsyncRAT \u4e9c\u7a2e\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>Citrix NetScaler<\/h3>\n

2023 \u5e74 10 \u6708\u306f\u3001\u72af\u7f6a\u8005\u3089\u304c Citrix NetScaler \u306b\u5b58\u5728\u3059\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027 (CVE-2023-3519) <\/a>\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3057\u3066\u3044\u308b\u5146\u5019\u304c\u8907\u6570\u89b3\u6e2c\u3055\u308c\u307e\u3057\u305f\u3002\u91ce\u751f (in the wild) \u3067\u3053\u306e\u8106\u5f31\u6027\u3092\u76e3\u8996\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u3042\u308b\u7279\u5b9a\u6642\u70b9\u3067\u306e\u540c\u8106\u5f31\u6027\u306b\u95a2\u9023\u3059\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3 \u30c7\u30fc\u30bf<\/a>\u3092\u30bf\u30a4\u30e0\u30ea\u30fc\u306b\u53d6\u5f97\u3067\u304d\u307e\u3057\u305f\u3002\u56f3 8 \u306f\u3053\u306e\u60c5\u5831\u3092\u30b7\u30f3\u30d7\u30eb\u306a\u68d2\u30b0\u30e9\u30d5\u3067\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002\u3053\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u304c\u6700\u3082\u591a\u6570\u691c\u51fa (300 \u4ef6\u3092\u8d85\u3048\u308b) \u3055\u308c\u305f\u30c9\u30e1\u30a4\u30f3\u306f jscloud[.]biz<\/span> \u3067\u3057\u305f\u3002<\/p>\n

\"\u91ce\u751f\u3067\u89b3\u6e2c\u3055\u308c\u305f\u3001\u30a4\u30f3\u30b8\u30a7\u30af\u30c8\u88ab\u5bb3\u3092\u53d7\u3051\u305f\u30c9\u30e1\u30a4\u30f3\u306e\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u6570\u3092\u68d2\u30b0\u30e9\u30d5\u3067\u8868\u3057\u305f\u3082\u306e\u3002
\u56f3 8. \u91ce\u751f\u3067\u89b3\u6e2c\u3055\u308c\u305f Citrix RCE \u8106\u5f31\u6027 (CVE-2023-3519) \u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u88ab\u5bb3\u30c9\u30e1\u30a4\u30f3 \u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u6570 (2023 \u5e74 10 \u6708 17 \u65e5\u6642\u70b9\u306e\u30c7\u30fc\u30bf)<\/figcaption><\/figure>\n

<\/a>\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831: 11 \u6708<\/h2>\n

<\/a>IcedID<\/h3>\n

11 \u6708\u6700\u521d\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u6295\u7a3f<\/a>\u306f\u3001.msi<\/span> \u30d5\u30a1\u30a4\u30eb\u7531\u6765\u306e IcedID (Bokbot) \u611f\u67d3\u3067\u3057\u305f\u3002159.89.124[.]188:443<\/span> \u4e0a\u306e IcedID BackConnect \u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u901a\u5e38\u306e HTTPS C2 \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u52a0\u3048\u3066\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002\u56f3 9 \u306b\u8d64\u67a0\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u305f\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u6ce8\u76ee\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n

\"IcedID
\u56f3 9. IcedID \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3 (\u611f\u67d3\u5143\u4e0d\u660e)<\/figcaption><\/figure>\n

\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 TA577 \u306f\u3001\u96fb\u5b50\u30e1\u30fc\u30eb \u30ea\u30f3\u30af\u304b\u3089\u88ab\u5bb3\u8005\u306b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u305b\u305f\u30c7\u30a3\u30b9\u30af\u30a4\u30e1\u30fc\u30b8\u3092\u7d4c\u7531\u3057\u3066\u3001\u518d\u3073 IcedID (Bokbot) \u306e\u4e9c\u7a2e\u3092\u914d\u5e03<\/a>\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u56f3 10 \u306f\u3001\u3053\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002TA577 \u306b\u3088\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u8abf\u67fb\u3092\u7d9a\u3051\u308b\u3053\u3068\u3067\u30a2\u30ca\u30ea\u30b9\u30c8\u304c\u6ce8\u610f\u3059\u3079\u304d\u30c8\u30ec\u30f3\u30c9\u304c\u898b\u3048\u3066\u304f\u308b\u3067\u3057\u3087\u3046\u3002<\/p>\n

\"\u611f\u67d3\u30c1\u30a7\u30fc\u30f3:<\/a>
\u56f3 10. \u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 TA577 \u304c IcedID \u306e\u4e9c\u7a2e\u3092\u914d\u5e03\u3057\u3066\u3044\u305f\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>DarkGate<\/h3>\n

11 \u6708\u306f\u3001\u5c11\u306a\u304f\u3068\u3082 2 \u4ef6\u3001DarkGate \u306e\u4e8b\u4f8b\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u79c1\u305f\u3061\u304c\u6700\u521d\u306b\u78ba\u8a8d\u3057\u305f\u4e8b\u4f8b<\/a>\u3067\u306f\u3001\u3044\u304b\u306b\u3082\u305d\u308c\u3089\u3057\u3044\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3088\u308a\u3001\u88ab\u5bb3\u8005\u304c\u30d1\u30b9\u30ef\u30fc\u30c9\u4fdd\u8b77\u3055\u308c\u305f .zip<\/span> \u30d5\u30a1\u30a4\u30eb\u306b\u8a98\u5c0e\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u56f3 11 \u304b\u3089\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u5168\u4f53\u3092\u628a\u63e1\u3067\u304d\u307e\u3059\u3002<\/p>\n

\"2023-11-20
\u56f3 11. \u3082\u3063\u3068\u3082\u3089\u3057\u3044\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u7531\u6765\u3059\u308b DarkGate \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

11 \u6708 2 \u3064\u3081\u306e DarkGate \u4e8b\u4f8b<\/a>\u3067\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u4fdd\u8b77\u3055\u308c\u305f .zip<\/span> \u304c\u914d\u5e03\u3055\u308c\u3066\u3044\u307e\u3057\u305f (\u914d\u5e03\u5143\u306f\u4e0d\u660e)\u3002\u3088\u305d\u3067\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b DarkGate \u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3068\u672c\u6295\u7a3f\u306e\u305d\u308c\u3068\u3092\u6bd4\u8f03\u5bfe\u7167\u3059\u308c\u3070\u3001\u3053\u306e\u653b\u6483\u8005\u306e\u884c\u3046\u653b\u6483\u306e\u30d1\u30bf\u30fc\u30f3\u3092\u77e5\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n

\"\u914d\u5e03\u5143\u4e0d\u660e
\u56f3 12. DarkGate \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3 (\u611f\u67d3\u5143\u4e0d\u660e)<\/figcaption><\/figure>\n

<\/a>Pikabot<\/h3>\n

\u518d\u3073 TA577 \u7387\u3044\u308b\u653b\u6483\u304c\u89b3\u6e2c\u3055\u308c\u307e\u3057\u305f\u300211 \u6708\u306b\u89b3\u6e2c\u3057\u305f Pikabot \u306e\u4e8b\u4f8b\u3067\u3001\u79c1\u305f\u3061\u306f 10 \u6642\u9593\u306b\u304a\u3088\u3076\u611f\u67d3\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304b\u3089\u751f\u3058\u305f IoC \u306e\u30ea\u30b9\u30c8<\/a>\u3092\u4f5c\u6210\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u611f\u67d3\u306f\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u7531\u6765\u3057\u3001\u305d\u3053\u304b\u3089\u6c38\u7d9a\u7684\u306a Pikabot DLL \u306b\u81f3\u308b\u3082\u306e\u3067\u3057\u305f\u3002\u8a73\u7d30\u306f\u56f3 13 \u3092\u3054\u89a7\u304f\u3060\u3055\u3044\u3002<\/p>\n

\"2023-11-02
\u56f3 13. TA577 \u304c\u914d\u5e03\u3057\u305f Pikabot \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>JinxLoader<\/h3>\n

\u30ea\u30fc\u30b0\u30fb\u30aa\u30d6\u30fb\u30ec\u30b8\u30a7\u30f3\u30c9 (League of Legends) \u306e\u30ad\u30e3\u30e9\u30af\u30bf\u30fc\u306b\u3061\u306a\u3093\u3067\u540d\u4ed8\u3051\u3089\u308c\u305f\u3068\u3044\u308f\u308c\u308b JinxLoader \u306f\u3001Go \u8a00\u8a9e\u3067\u66f8\u304b\u308c\u3066\u3044\u307e\u3059\u3002Symantec \u304c JinxLoader \u306e\u4fdd\u8b77\u306b\u95a2\u3059\u308b\u901f\u5831<\/a>\u3092\u5c11\u3057\u524d\u306b\u516c\u958b\u3057\u3066\u3044\u307e\u3057\u305f\u3002JinxLoader \u306b\u95a2\u3059\u308b\u521d\u306e\u516c\u958b\u60c5\u5831\u3068\u306a\u3063\u305f\u6295\u7a3f<\/a>\u3067\u3001\u79c1\u305f\u3061\u306f\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2 \u30b5\u30fc\u30d3\u30b9\u304c 2023 \u5e74 4 \u6708 30 \u65e5\u306b hackforums[.]net<\/span> \u306b\u521d\u3081\u3066\u6295\u7a3f\u3055\u308c\u305f\u6bd4\u8f03\u7684\u65b0\u3057\u3044\u3082\u306e\u3067\u3042\u308b\u3053\u3068\u3092\u6307\u6458\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u306e 8 \u3064\u306e\u30b9\u30c6\u30c3\u30d7\u306e\u8a73\u7d30\u3092\u56f3 14 \u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n

\"\u653b\u6483\u30c1\u30a7\u30fc\u30f3:
\u56f3 14. Formbook\/XLoader \u3092\u914d\u5e03\u3059\u308b JinxLoader \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

<\/a>\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831: 12 \u6708<\/h2>\n

<\/a>Loader EXE<\/h3>\n

12 \u6708\u306f\u3001\u30a8\u30f3\u30b3\u30fc\u30c9\/\u6697\u53f7\u5316\u3055\u308c\u305f TCP \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u4f7f\u3063\u3066 91.92.120[.]119:62520 <\/span> \u4e0a\u3067\u7a3c\u50cd\u3059\u308b C2 \u3068\u3084\u308a\u3068\u308a\u3057\u3001\u4e0d\u660e\u306a\u30de\u30eb\u30a6\u30a7\u30a2\u3078\u306e\u611f\u67d3\u306b\u81f3\u308b\u3001\u3042\u308b EXE Loader<\/a> \u306e\u767a\u898b\u304b\u3089\u59cb\u307e\u308a\u307e\u3057\u305f\u3002\u8a73\u3057\u304f\u306f\u56f3 15 \u3092\u3054\u89a7\u304f\u3060\u3055\u3044\u3002<\/p>\n

\"2023.12.5(\u706b)
\u56f3 15. \u30ed\u30fc\u30c0\u30fc\u304b\u3089\u672a\u78ba\u8a8d\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u611f\u67d3\u306b\u81f3\u308b\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

\u3042\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d9\u30f3\u30c0\u30fc<\/a>\u306f\u3001\u5f53\u8a72\u30ed\u30fc\u30c0\u30fc\u3092\u300cPureLoader\u300d\u3001\u672a\u78ba\u8a8d\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u300cPureLogs\u300d\u30b9\u30c6\u30a3\u30fc\u30e9\u30fc\u3068\u8b58\u5225\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u3053\u306e\u672a\u78ba\u8a8d\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u3064\u3044\u3066\u306f\u307b\u304b\u306b\u516c\u306b\u5171\u6709\u3055\u308c\u305f\u60c5\u5831\u304c\u307b\u3068\u3093\u3069\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n

<\/a>DarkGate<\/h3>\n

2023 \u5e74 12 \u6708\u3001\u79c1\u305f\u3061\u306f DarkGate \u30de\u30eb\u30a6\u30a7\u30a2\u306e\u4e8b\u4f8b\u3092 1 \u4f8b\u5831\u544a\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u3042\u308b PDF \u30d5\u30a1\u30a4\u30eb\u3092\u901a\u3058\u3066\u914d\u5e03\u3055\u308c\u3066\u3044\u307e\u3057\u305f(\u3053\u306e PDF \u306f VirusTotal \u4e0a\u3067\u78ba\u8a8d\u3067\u304d\u307e\u3059)\u3002\u3053\u306e PDF \u30d5\u30a1\u30a4\u30eb\u306b\u306f\u3001DarkGate \u306e\u60aa\u610f\u306e\u3042\u308b ZIP \u30a2\u30fc\u30ab\u30a4\u30d6\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u30ea\u30f3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u56f3 16 \u306f\u3001PDF \u30d5\u30a1\u30a4\u30eb\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n

\"Adobe
\u56f3 16. \u60aa\u610f\u306e\u3042\u308b .zip <\/span>\u30a2\u30fc\u30ab\u30a4\u30d6\u3078\u306e\u30ea\u30f3\u30af\u3092\u542b\u3080 PDF \u306b\u7531\u6765\u3059\u308b DarkGate \u3078\u306e\u611f\u67d3<\/figcaption><\/figure>\n

<\/a>Astaroth\/Guildma<\/h3>\n

\u300cAstaroth \u3068 Guildma\u300d\u3068\u805e\u3044\u3066\u9023\u60f3\u3059\u308b\u306e\u306f\u30013 \u3064\u306e\u6708\u3068\u9752\u3044\u808c\u306e\u30a8\u30a4\u30ea\u30a2\u30f3\u3092\u8868\u7d19\u306b\u63cf\u3044\u305f 1970 \u5e74\u4ee3\u306e\u4e09\u6587 SF \u5c0f\u8aac\u306e\u767b\u5834\u4eba\u7269\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002\u305f\u3060\u3057\u3053\u308c\u3089\u306f\u5b9f\u969b\u306b\u306f\u79c1\u305f\u3061\u304c\u89b3\u6e2c\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u540d\u524d<\/a>\u3067\u3001\u30d6\u30e9\u30b8\u30eb\u306e\u5dde\u4ea4\u901a\u5c40 (Detran) \u3092\u88c5\u3063\u305f\u30dd\u30eb\u30c8\u30ac\u30eb\u8a9e\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u304b\u3089\u78ba\u8a8d\u3055\u308c\u305f\u3082\u306e\u3067\u3059 (\u56f3 17)\u3002\u5dde\u4ea4\u901a\u5c40\u3092\u30e2\u30c1\u30fc\u30d5\u3068\u3057\u305f\u5f53\u8a72\u30de\u30eb\u30b9\u30d1\u30e0\u306f\u3001\u30a8\u30f3\u30c9 \u30e6\u30fc\u30b6\u30fc\u3092\u8a98\u5c0e\u3057\u3066 zip \u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3078\u306e\u30ea\u30f3\u30af\u3092\u8e0f\u307e\u305b\u307e\u3059\u3002\u3053\u308c\u304c Guildma (\u5225\u540d Astaroth) \u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3\u306e\u59cb\u307e\u308a\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n

\"Mozilla
\u56f3 17. \u60aa\u610f\u306e\u3042\u308b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u306b\u30ea\u30f3\u30af\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3002\u30dd\u30eb\u30c8\u30ac\u30eb\u8a9e\u3067\u66f8\u304b\u308c\u3066\u3044\u308b<\/figcaption><\/figure>\n

<\/a>Pikabot<\/h3>\n

2023 \u5e74\u306e TA577 \u306b\u95a2\u3059\u308b\u6700\u5f8c\u304b\u3089 2 \u3064\u3081\u306e\u6295\u7a3f\u306f\u3001\u540c\u30b0\u30eb\u30fc\u30d7\u304c\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u30ea\u30f3\u30af\u304b\u3089\u59cb\u307e\u308b Pikabot \u306e\u914d\u5e03\u3092\u884c\u3063\u3066\u3044\u308b<\/a>\u3068\u3044\u3046\u3082\u306e\u3067\u3057\u305f\u3002\u56f3 18 \u306b\u305d\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u3092\u793a\u3057\u307e\u3059\u3002\u3053\u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3\u306f TA577 \u306b\u95a2\u3059\u308b\u4ee5\u524d\u306e\u30a8\u30f3\u30c8\u30ea\u30fc\u3068\u3069\u3046\u9055\u3046\u306e\u3067\u3057\u3087\u3046\u304b\u3002<\/p>\n

\"TA557
\u56f3 18. \u8105\u5a01\u30b0\u30eb\u30fc\u30d7 TA577 \u304c\u30d7\u30c3\u30b7\u30e5\u3059\u308b Pikabot \u306e\u611f\u67d3\u30c1\u30a7\u30fc\u30f3<\/figcaption><\/figure>\n

(\u8ffd\u52a0\u3067\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u304c\u306a\u3051\u308c\u3070) \u4eca\u5e74\u6700\u5f8c\u3068\u306a\u308b\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u306e\u6295\u7a3f\u3067\u306f\u3001\u518d\u3073 TA577<\/a> \u306b\u3088\u308b Pikabot \u611f\u67d3\u306e\u62e1\u5927\u306b\u3064\u3044\u3066\u5171\u6709\u3057\u307e\u3057\u305f\u3002<\/p>\n

\u3053\u306e\u4e8b\u4f8b\u3067\u306f\u3053\u306e\u611f\u67d3\u306f\u3001\u30c9\u30e1\u30a4\u30f3\u540d\u3068\u3057\u3066 masterunis[.]net<\/span> \u3092\u4f7f\u3046\u3001207.246.99[.]159:443<\/span> \u4e0a\u3067\u7a3c\u50cd\u3059\u308b Cobalt Strike \u3078\u3068\u3064\u306a\u304c\u3063\u3066\u3044\u307e\u3057\u305f\u3002\u56f3 19 \u306f\u3053\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u5206\u6790\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n

\"Wireshark
\u56f3 19. Wireshark \u3067 Pikabot \u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u8868\u793a\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n

<\/a>\u7d50\u8ad6<\/h2>\n

\u79c1\u305f\u3061\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u901f\u5831\u306f\u3001Windows \u30de\u30eb\u30a6\u30a7\u30a2\u3092\u4e2d\u5fc3\u306b\u53d6\u308a\u4e0a\u3052\u3001\u305d\u306e\u6642\u70b9\u3067\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u304b\u3089\u306e\u95a2\u5fc3\u304c\u9ad8\u3044\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u30fc\u306b\u3064\u3044\u3066\u6295\u7a3f\u3059\u308b\u3088\u3046\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/span><\/p>\n

\u6700\u65b0\u60c5\u5831\u3092\u30ea\u30a2\u30eb\u30bf\u30a4\u30e0\u306b\u8ffd\u8de1\u3059\u308b\u306b\u306f\u3001\u79c1\u305f\u3061\u306e LinkedIn<\/a> \u3084 X (\u65e7 Twitter) <\/a>\u3092\u30d5\u30a9\u30ed\u30fc\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u30cf\u30c3\u30b7\u30e5\u30bf\u30b0\u3092\u8ffd\u8de1\u3059\u308b\u5834\u5408\u306f #Unit42ThreatIntel \u3092\u30d5\u30a9\u30ed\u30fc\u3057\u3001\u5e38\u306b\u6700\u65b0\u306e\u6295\u7a3f\u3092\u30ad\u30e3\u30c3\u30c1\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u306e\u307b\u304b\u3001\u79c1\u305f\u3061\u306e GitHub \u30ea\u30dd\u30b8\u30c8\u30ea\u30fc<\/a>\u304b\u3089\u306e\u901a\u77e5\u3092\u30aa\u30f3\u306b\u3057\u3066\u6700\u65b0\u60c5\u5831\u3092\u53d7\u3051\u53d6\u308b\u65b9\u6cd5\u3082\u3042\u308a\u307e\u3059\u3002<\/p>\n

\u4e8b\u60c5\u901a\u306e\u7686\u3055\u3093\u306e\u30b3\u30e1\u30f3\u30c8\u3084\u5171\u6709\u3001\u8cea\u554f\u306b\u3088\u308b\u53c2\u52a0\u3082\u304a\u5f85\u3061\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

<\/a>\u4fdd\u8b77\u3068\u7de9\u548c\u7b56<\/h3>\n

SNS \u6295\u7a3f\u3067\u5171\u6709\u3055\u308c\u305f IoC \u306f\u3059\u3079\u3066\u3001\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u88fd\u54c1\u306b\u3088\u3063\u3066\u60aa\u610f\u304c\u3042\u308b\u3068\u898b\u306a\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u5224\u5b9a\u306f\u305f\u3068\u3048\u3070<\/span>\u30af\u30e9\u30a6\u30c9\u914d\u4fe1\u578b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30b5\u30fc\u30d3\u30b9<\/span><\/a> (<\/span>Advanced WildFire<\/span><\/a>\u3001<\/span>Advanced URL Filtering<\/span><\/a> \u306a\u3069) <\/span>\u3092\u6709\u52b9\u306b\u3057\u305f\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/span><\/a>\u3067\u6d3b\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/span>\u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001<\/span>\u3053\u3061\u3089<\/span><\/a>\u306e\u554f\u3044\u5408\u308f\u305b\u30d5\u30a9\u30fc\u30e0\u304b\u3089\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001infojapan@paloaltonetworks.com \u307e\u3067\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3066\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044 (\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/span><\/p>\n

<\/a>IoC (\u4fb5\u5bb3\u6307\u6a19)<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\u6295\u7a3f\u65e5<\/b><\/td>\n\u611f\u67d3<\/b><\/td>\n\u30ea\u30f3\u30af<\/b><\/td>\nIoC<\/b><\/td>\n<\/tr>\n
10\/03\/2023<\/span><\/td>\nWS_FTP \u306e\u8106\u5f31\u6027<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\n\u672c\u7a3f\u306b IoC \u8a18\u8f09\u00a0<\/span><\/td>\n<\/tr>\n
10\/03\/2023<\/span><\/td>\nPikabot<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
10\/12\/2023<\/span><\/td>\nDarkGate<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
10\/17\/2023<\/span><\/td>\nPikabot<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
10\/18\/2023<\/span><\/td>\n\u91ce\u751f\u3067\u89b3\u6e2c\u3055\u308c\u305f Citrix NetScaler \u306b\u5f71\u97ff\u3059\u308b\u30ea\u30e2\u30fc\u30c8\u5b9f\u884c\u306e\u8106\u5f31\u6027 (RCE)<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
10\/20\/2023<\/span><\/td>\nIcedID\u00a0<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
10\/23\/2023<\/span><\/td>\nAsyncRAT<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
10\/25\/2023<\/span><\/td>\nDarkGate<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
11\/01\/2023<\/span><\/td>\nIcedID<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
11\/03\/2023<\/span><\/td>\nPikabot<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
11\/21\/2023<\/span><\/td>\nDarkGate<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
11\/28\/2023<\/span><\/td>\nIcedID \u4e9c\u7a2e<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
11\/30\/2023<\/span><\/td>\nJinxLoader<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
11\/30\/2023<\/span><\/td>\nDarkGate<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
12\/06\/2023<\/span><\/td>\n\u672a\u78ba\u8a8d\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u3064\u306a\u304c\u308b Loader EXE<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
12\/07\/2023<\/span><\/td>\nDarkGate<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
12\/12\/2023<\/span><\/td>\nAstaroth\/Guildma<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
12\/15\/2023<\/span><\/td>\nPikabot<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n
12\/18\/2023<\/span><\/td>\nPikabot<\/span><\/td>\nTwitter (X)<\/span><\/a>, <\/span>LinkedIn<\/span><\/a><\/td>\nIoC<\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/a>
\n\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/h2>\n