中国の「APT10」が最新のTTP（戦術、技術、および手順）を用い、日本企業を標的に
ファイア・アイは今年7月、「APT10」（別名：MenuPass）と思われるグループによる、日本のメディア業界を標的にしたアクティビティを検知・阻止しました。APT10は、ファイア・アイが2009年より追跡している中国のサイバー・スパイ・グループで、これまでも日本の企業・組織を標的としてきました。今回の攻撃キャンペーンでは、UPPERCUTバックドアをインストールする、悪意ある文書を添付したスピアフィッシング・メールが、日本のメディア業界におけるさまざまな企業・団体に送付されました。このバックドアは、コミュニティではANEL の名で知られており、最新バージョンが発表されるまでは、ベータ版またはRC（リリース候補版）の形で提供されていました。本ブログでは、バージョン間の更新内容や差異について分析しています。 攻撃の概要 最初の攻撃ベクトルでは、悪意あるVBAマクロを格納したMicrosoft
Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science | FireEye Inc
Many attackers continue to leverage PowerShell as a part of their malware ecosystem, mostly delivered and executed by malicious binaries and documents. Of malware that uses PowerShell, the most prevalent use is the garden-variety stager: an executable or document macro that launches PowerShell to download another executable and run it. There has been significant development and innovation in the f
Red Team Tool Roundup | FireEye Inc
In many cases Red Team tools are not written because someone feels like writing a tool, or wakes up one morning thinking, “I want to write a tool today”. Red Teamers generally identify tedious tasks in their methodology and then create tools that automate these tasks for current and future assessments. As my boss likes to say, jokingly: laziness breeds ingenuity! At Mandiant, we’ve developed (or s
Targeted Attacks against Banks in the Middle East | FireEye Inc
UPDATE (Dec. 8, 2017): We now attribute this campaign to APT34, a suspected Iranian cyber espionage threat group that we believe has been active since at least 2014. Learn more about APT34 and their late 2017 targeting of a government organization in the Middle East. Introduction In the first week of May 2016, FireEye’s DTI identified a wave of emails containing malicious attachments being sent to
Evasive Tactics: Terminator RAT | FireEye Blog
FireEye Labs has been tracking a variety of advanced persistent threat (APT) actors that have been slightly changing their tools, techniques, and procedures (TTPs) in order to evade network defenses. Earlier, we documented changes to Aumlib, the malware used in the attack against the New York Times, and Taidoor, a malware family that is being used in ongoing cyber-espionage campaigns particularly
IE Zero Day is Used in DoL Watering Hole Attack
Similar to what we found before in a series of watering hole attacks, targeting CFR and Chinese Dissidents, zero-day and just patched vulnerabilities were used. In the latest watering hole attack against Department of Labor (DoL), our research indicates a new IE zero-day is used in this watering hole attack, although some other vendors claim they are using known vulnerabilities. This particular e
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
http://www.fireeye.com/blog/technical/malware-research/2013/08/njw0rm-brother-from-the-same-mother.html
