はてなブックマーク

• あとで読む

  Chinese APT Targeting Cambodian Government

  3 users

  unit42.paloaltonetworks.com

  By Unit 42 November 7, 2023 at 9:01 PM Category: Government Tags: advanced persistent threat, Advanced URL Filtering, Advanced WildFire, APAC, APT, China, Cloud-Delivered Security Services, Cortex XSIAM, Cortex XSOAR, DNS security, next-generation firewall, Prisma Cloud, WildFire This post is also available in: 日本語 (Japanese) Executive Summary Unit 42 has identified malicious Chinese APT infrastru

  • テクノロジー
  • 2023/11/09 07:22

  • 中国
  • security
  • あとで読む
• あとで読む

  AWS's Log4Shell Hot Patch Vulnerable to Container Escape and Privilege Escalation

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Executive Summary Following Log4Shell, AWS released several hot patch solutions that monitor for vulnerable Java applications and Java containers and patch them on the fly. Each solution suits a different environment, covering standalone servers, Kubernetes clusters, Elastic Container Service (ECS) clusters and Fargate. The hot patches aren't exclusiv

  • テクノロジー
  • 2022/04/21 10:45
• あとで読む

  CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Executive Summary Recently, two vulnerabilities were announced within the Spring Framework, an open-source framework for building enterprise Java applications. On March 29, 2022, the Spring Cloud Expression Resource Access Vulnerability tracked in CVE-2022-22963 was patched with the release of Spring Cloud Function 3.1.7 and 3.2.3. Two days later on M

  • テクノロジー
  • 2022/04/02 05:11

  • Java
  • tool
  • software
  • development
  • IT
  • security
  • programming
  • news
• あとで読む

  Wireshark Tutorial: Examining Emotet Infection Traffic

  283 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Executive Summary This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps). Familiarity with Wireshark is necessary to understand this tutorial, which focuses on Wireshark version 3.x. Emotet is an information-stealer first reported in 2014 as banking malware. It has since evol

  • テクノロジー
  • 2021/01/20 13:22

  • wireshark
  • あとで読む
  • セキュリティ
  • security
  • emotet
  • ネットワーク
  • http
  • network
  • TCP
  • 統計
• あとで読む

  IAMFinder: Open Source Tool to Identify Information Leaked from AWS IAM Reconnaissance

  6 users

  unit42.paloaltonetworks.com

  IAMFinder: Open Source Tool to Identify Information Leaked from AWS IAM Reconnaissance This post is also available in: 日本語 (Japanese) Executive Summary In a recent blog, “Information Leakage in AWS Resource-Based Policy APIs,” Unit 42 researchers disclosed a class of Amazon Web Services (AWS) APIs that can be abused to find existing users and Identity and Access Management (IAM) roles in arbitrary

  • テクノロジー
  • 2021/01/10 16:03

  • AWS
  • セキュリティ
  • あとで読む
• あとで読む

  Wireshark Tutorial: Examining Qakbot Infections

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Overview Qakbot is an information stealer also known as Qbot. This family of malware has been active for years, and Qakbot generates distinct traffic patterns. This Wireshark tutorial reviews a recent packet capture (pcap) from a Qakbot infection. Understanding these traffic patterns can be critical for security professionals when detecting and invest

  • テクノロジー
  • 2020/03/24 10:08

  • security
• あとで読む

  Making Containers More Isolated: An Overview of Sandboxed Container Technologies

  3 users

  unit42.paloaltonetworks.com

  Making Containers More Isolated: An Overview of Sandboxed Container Technologies This post is also available in: 日本語 (Japanese) Executive Summary While the majority of the IT industry is in the midst of adopting container-based infrastructure (cloud-native solution), it is imperative to understand the technology’s limitations. Traditional containers such as Docker, Linux Containers (LXC), and Rock

  • テクノロジー
  • 2019/06/25 08:49
• あとで読む

  New Mirai Variant Targets Enterprise Wireless Presentation & Display Systems

  4 users

  unit42.paloaltonetworks.com

  New Mirai Variant Targets Enterprise Wireless Presentation & Display Systems This post is also available in: 日本語 (Japanese) Executive Summary In early January 2019, Unit 42 discovered a new variant of the infamous IoT/Linux botnet Mirai. Mirai is best known for being used in massive, unprecedented DDoS attacks in 2016. Some of the most notable targets included: web hosting provider OVH, DNS provid

  • テクノロジー
  • 2019/03/19 00:10

  • security
  • あとで読む
• あとで読む

  Breaking out of Docker via runC – Explaining CVE-2019-5736

  4 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Last week (2019-02-11) a new vulnerability in runC was reported by its maintainers, originally found by Adam Iwaniuk and Borys Poplawski. Dubbed CVE-2019-5736, it affects Docker containers running in default settings and can be used by an attacker to gain root-level access on the host. Aleksa Sarai, one of runC’s maintainers, found that the same funda

  • テクノロジー
  • 2019/02/23 14:22

  • Docker
• あとで読む

  Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products

  4 users

  unit42.paloaltonetworks.com

  Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products This post is also available in: 日本語 (Japanese) Palo Alto Networks Unit 42 recently captured and investigated new samples of the Linux coin mining malware used by the Rocke group. The family was suspected to be developed by the Iron cybercrime group and it’s also associated with the Xbash malware we reported on in Sep

  • テクノロジー
  • 2019/01/24 09:04

  • セキュリティ
  • security
• あとで読む

  Bisonal Malware Used in Attacks Against Russia and South Korea

  4 users

  unit42.paloaltonetworks.com

  Table 1. File hashes and paths targeting Russia The dropper then creates following registry entry to execute the Bisonal sample when the computer reboots: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez” Bisonal main module The DLL (pvcu.dll) is Bisonal malware but using a different cipher for C2 communication that other pub

  • テクノロジー
  • 2018/08/01 01:45

  • security
• あとで読む

  Sofacy Attacks Multiple Government Entities | Palo Alto Networks

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) The Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Sednit, Tsar Team, Pawn Storm) is a well-known adversary that remains highly active in the new calendar year of 2018. Unit 42 actively monitors this group due to their persistent nature globally across all industry verticals. Recently, we discovered a campaign launched at various Ministries of Foreig

  • テクノロジー
  • 2018/03/01 09:44
• あとで読む

  IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability | paloaltonetworks

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Summary In early December 2017, 360 Netlab discovered a new malware family which they named Satori. Satori is a derivative of Mirai and exploits two vulnerabilities: CVE-2014-8361 a code execution vulnerability in the miniigd SOAP service in Realtek SDK, and CVE 2017-17215 a newly discovered vulnerability in Huawei’s HG532e home gateway patched in ear

  • テクノロジー
  • 2018/01/12 09:01
• あとで読む

  UBoatRAT Navigates East Asia | paloaltonetworks

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Executive Summary Palo Alto Networks Unit 42 has identified attacks with a new custom Remote Access Trojan (RAT) called UBoatRAT. The initial version of the RAT, found in May of 2017, was simple HTTP backdoor that uses a public blog service in Hong Kong and a compromised web server in Japan for command and control. The developer soon added various new

  • テクノロジー
  • 2017/11/29 12:00
• あとで読む

  Operation Blockbuster Goes Mobile | paloaltonetworks

  3 users

  unit42.paloaltonetworks.com

  Unit 42 has discovered a new cluster of malware samples, which targets Samsung devices and Korean language speakers, with relationships to the malware used in Operation Blockbuster. The specific points of connection between these new samples and Operation Blockbuster include: payloads delivered by the macros discussed in Operation Blockbuster Sequel malware used by the HiddenCobra threat group mal

  • 暮らし
  • 2017/11/21 09:46
• あとで読む

  Threat Brief: Patch Today and Don’t Get Burned by an Android Toast Overlay

  3 users

  unit42.paloaltonetworks.com

  Threat Brief: Patch Today and Don’t Get Burned by an Android Toast Overlay This post is also available in: 日本語 (Japanese) Today, Palo Alto Networks Unit 42 researchers are announcing details on a new high- severity vulnerability affecting the Google Android platform. Patches for this vulnerability are available as part of the September 2017 Android Security Bulletin. This new vulnerability does NO

  • テクノロジー
  • 2017/09/11 09:27
• あとで読む

  “Tick” Group Continues Attacks

  6 users

  unit42.paloaltonetworks.com

  By Kaoru Hayashi July 24, 2017 at 6:00 PM Category: Unit 42 Tags: 9002, Daserf, Datper, Gh0st, HomamDownloader, JAPAN KOREA, Minzen, NamelessHdoor, Tick This post is also available in: 日本語 (Japanese) The “Tick” group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years. The group focuses on companies that have intellectual property or sen

  • テクノロジー
  • 2017/07/25 12:16

  • あとで読む
• あとで読む

  Threat Brief: WanaCrypt0r– What We Know

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Situation Summary This Unit 42 blog provides an update on the threat situation surrounding the WanaCrypt0r ransomware attacks and how the attack propagates. Initial reports said that the WanaCrypt0r attack began as part of a spam/phishing campaign. Unit 42 and other researchers have concluded that these reports are not substantiated. While the initial

  • 暮らし
  • 2017/05/17 09:26
• あとで読む

  New IoT/Linux Malware Targets DVRs, Forms Botnet

  3 users

  unit42.paloaltonetworks.com

  Table 1 Top 20 Countries for potentially vulnerable TVT DVR Digital Devices Propagation and Vulnerability Exploitation Amnesia communicates with its C2 server using the IRC protocol. Figure 2 shows some commands it was designed to receive, including to launch DDoS attacks by different types of HTTP flooding and UDP flooding. Figure 2  C2 Commands of Amnesia In addition to these commands, two more

  • テクノロジー
  • 2017/04/07 09:55
• あとで読む

  menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations

  6 users

  unit42.paloaltonetworks.com

  This malware is provided with an icon that appears to be that of a Microsoft Word document, as we can see in the image below. Figure 4. Icon used for ChChes Additionally, we discovered that the samples identified in attacks against Japanese organizations were digitally signed using the certificate originally used by the Italian-based company, HackingTeam. Readers may recall that HackingTeam was co

  • テクノロジー
  • 2017/02/17 08:41

  • Windows
• あとで読む

  Campaign Evolution: EITest from October through December 2016

  3 users

  unit42.paloaltonetworks.com

  Campaign Evolution: EITest from October through December 2016 This post is also available in: 日本語 (Japanese) EITest is a name originally coined by Malwarebytes Labs in 2014 to describe a campaign that uses exploit kits (EKs) to deliver malware. Until early January 2016, "EITest" was used as a variable name in the attacker’s malicious injected script in pages on legitimate websites compromised by t

  • 暮らし
  • 2017/01/13 01:01
• あとで読む

  DragonOK Updates Toolset and Targets Multiple Geographic Regions

  4 users

  unit42.paloaltonetworks.com

  DragonOK Updates Toolset and Targets Multiple Geographic Regions This post is also available in: 日本語 (Japanese) The DragonOK group has been actively launching attacks for years. We first discussed them in April 2015 when we witnessed them targeting a number of organizations in Japan. In recent months, Unit 42 has observed a number of attacks that we attribute to this group. Multiple new variants o

  • 学び
  • 2017/01/06 13:01
• あとで読む

  MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies

  3 users

  unit42.paloaltonetworks.com

  MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies This post is also available in: 日本語 (Japanese) In June 2016, Unit 42 published the blog post “Tracking Elirks Variants in Japan: Similarities to Previous Attacks”, in which we described the resemblance of attacks using the Elirks malware family in Japan and Taiwan. Since then, we continued tracking this thre

  • 暮らし
  • 2016/09/15 10:18
• あとで読む

  Aveo Malware Family Targets Japanese Speaking Users

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) Palo Alto Networks has identified a malware family known as ‘Aveo’ that is being used to target Japanese speaking users. The ‘Aveo’ malware name comes from an embedded debug string within the binary file. The Aveo malware family has close ties to the previously discussed FormerFirstRAT malware family, which was also witnessed being used against Japane

  • 世の中
  • 2016/08/17 17:03
• あとで読む

  Tracking Elirks Variants in Japan: Similarities to Previous Attacks

  3 users

  unit42.paloaltonetworks.com

  Tracking Elirks Variants in Japan: Similarities to Previous Attacks This post is also available in: 日本語 (Japanese) A recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, that were found during the investigation. PlugX has been used in a number of attacks since first being discovered in 2012, and we have published several articles related to its use

  • 世の中
  • 2016/06/24 09:09
• あとで読む

  New Wekby Attacks Use DNS Requests As Command and Control Mechanism

  3 users

  unit42.paloaltonetworks.com

  New Wekby Attacks Use DNS Requests As Command and Control Mechanism This post is also available in: 日本語 (Japanese) We have observed an attack led by the APT group Wekby targeting a US-based organization in recent weeks. Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is kn

  • テクノロジー
  • 2016/05/25 11:41
• あとで読む

  New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists

  3 users

  unit42.paloaltonetworks.com

  New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists This post is also available in: 日本語 (Japanese) Malware writers have always sought to develop feature-rich, easy to use tools that are also somewhat hard to detect via both host- and network-based detection systems.  For many years, one of the go-to families of malware used by both less-skilled and advanced actors has been the Poi

  • テクノロジー
  • 2016/04/22 15:47
• あとで読む

  Locky Ransomware Installed Through Nuclear EK

  3 users

  unit42.paloaltonetworks.com

  This post is also available in: 日本語 (Japanese) In February 2016, Unit 42 published detailed analysis of Locky ransomware. We certainly weren’t the only ones who saw this malware, and many others have also reported on it. Since that time, Locky has been frequently noted in various campaigns using malicious spam (malspam) to spread this relatively new strain of ransomware. When we initially reported

  • 世の中
  • 2016/03/22 09:44

次のページ