新年快樂
高級威脅分析
1、俄羅斯APT28攻擊法國CENTREON公司，這是一家做IT監控設備的公司，不知道有沒有後續的供應鏈攻擊事件。
https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-005/
https://github.com/Neo23x0/Fenrir/releases/tag/0.8.0-centreon
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
2、Lookout Discovers Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict.印度APT組織孔夫子使用兩個Android間諜軟體Hornbill和SunBird 這兩種惡意軟體被用來監視與巴基斯坦軍事，核當局和克什米爾印度選舉官員有關的人員。
https://blog.lookout.com/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict
3、탈륨 조직, 코로나19 관련 소상공인 지원 종합안내로 위장한 HWP 공격
https://blog.alyac.co.kr/3586
4、拉丁美洲Javali銀行木馬，為Avira防病毒合法注入器提供武器以植入惡意軟體
https://seguranca-informatica.pt/latin-american-javali-trojan-weaponizing-avira-antivirus-legitimate-injector-to-implant-malware/
5、接上，拉丁美洲Lampion木馬，使用與COVID-19相關的模板攻擊活動，利用Google雲存儲下載執行dll
https://seguranca-informatica.pt/lampion-trojan-disseminated-in-portugal-using-covid-19-template/
6、微軟表示，它在SolarWinds攻擊中發現了1,000多個開發人員的指紋
https://www.theregister.com/2021/02/15/solarwinds_microsoft_fireeye_analysis/
https://www.cbsnews.com/news/solarwinds-hack-russia-cyberattack-60-minutes-2021-02-14/
7、伊朗Static Kitten針對阿聯和科威特政府機構的網絡間諜活動
https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
技術分享
1、分享一個開源C2工具：BlackMamba
https://github.com/loseys/BlackMamba
2、黑灰產ScamClub使用postMessage（）Shenanigans繞過了iframe沙箱[CVE-2021–1801]
https://blog.confiant.com/malvertiser-scamclub-bypasses-iframe-sandboxing-with-postmessage-shenanigans-cve-2021-1801-1c998378bfba
C2：
xmou.s3.us-east-2.amazonaws.com/mou.jsimpve.s3.amazonaws.com/create.jsdgoi.s3.us-east-2.amazonaws.com/goi.jsyflx.s3.us-east-2.amazonaws.com/flx.jsmiil.s3.us-east-2.amazonaws.com/iia.jsdjian.s3.amazonaws.com/jia.jsaimppv.s3.amazonaws.com/jiy.jsaylei.s3.amazonaws.com/lei.jsajluo.s3.amazonaws.com/luo.jsapzaf.s3.amazonaws.com/zaf.jsappang.s3.us-east-2.amazonaws.com/pan.jsdkjieg.s3.amazonaws.com/jieg.jsadlya.s3.amazonaws.com/lya.jsyddof.s3.amazonaws.com/dof.jsmeixop.s3.us-east-2.amazonaws.com/xop.jsaqkol.s3.amazonaws.com/kol.jsimpvv.s3.us-east-2.amazonaws.com/dsd.jsmqyuj.s3.amazonaws.com/yuj.jswpbgm.s3.amazonaws.com/bgm.jspzhufm.s3.amazonaws.com/zhuf.jscxpm.s3.amazonaws.com/cx.jskhpm.s3.amazonaws.com/kh.jsvcjm.s3.amazonaws.com/vc.jslxpm.s3.amazonaws.com/lx.jsowpd.s3.amazonaws.com/ow.jskdjm.s3.amazonaws.com/kd.jsrmbp.s3.amazonaws.com/bp.jszhpmm.s3.amazonaws.com/zh.jslrydy.s3-ap-southeast-1.amazonaws.com/lr.jskiyy.s3-ap-southeast-1.amazonaws.com/ki.jsoummm.s3.amazonaws.com/ou.jsgsyyd.s3.amazonaws.com/gs.jsqqpm.s3.amazonaws.com/qq.jsnxya.s3-ap-southeast-1.amazonaws.com/nx.jszpdk.s3.amazonaws.com/zp.jsmrptm.s3.amazonaws.com/mr.jsktzmy.s3-ap-southeast-1.amazonaws.com/kt.jsnzdpy.s3-ap-southeast-1.amazonaws.com/nz.jsvpydy.s3-ap-southeast-1.amazonaws.com/vp.j
3、關於防彈主機的一些必須知道的事兒
https://intel471.com/blog/bulletproof-hosting-fast-flux-dns-double-flux-vps/
4、Telegram的 animated stickers遠程攻擊，擁有10億用戶的Android應用無法修復漏洞
https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/
5、BazaLoader惡意軟體，使用.bazar後綴C2。
https://www.proofpoint.com/us/blog/threat-insight/baza-valentines-day
6、開源情報工具大會以及工具集合，必收藏！
https://www.sans.org/blog/list-of-resource-links-from-open-source-intelligence-summit-2021/
7、微軟稱，自2020以來，每月的Web Shell攻擊數量已經翻了一番。
https://www.microsoft.com/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/
8、MAC 版本的telegram 可以通過用戶數據存儲位置找到那些「隱私、撤回、銷毀」的音頻信息。取證可用。
https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html
漏洞相關
https://www.trendmicro.com/en_us/research/21/b/shareit-flaw-could-lead-to-remote-code-execution.html
2、FileZen漏洞（CVE-2021-20655）Soliton Systems KK發布了有關文件數據傳輸設備FileZen中的漏洞（CVE-2021-20655）的信息。具有系統管理員帳戶訪問權限的遠程攻擊者可以利用此漏洞執行任意OS命令。
https://www.jpcert.or.jp/english/at/2021/at210009.html
3、CVE-2020-11635 Zscaler Windows客戶端連接器本地特權升級漏洞
https://trust.zscaler.com/posts/7316
4、SAP幾個漏洞，CVE-2021-21477 代碼執行，老牛逼了
https://onapsis.com/blog/sap-security-patch-day-february-2021-critical-patch-released-sap-commerce
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543
5、IBM InfoSphere Information Server 0DAY，反序列化（CWE-502），標識為CVE-2020-27583，CVSS3評分為9.8。該漏洞允許具有root特權的不受限制的遠程代碼執行，而無需任何身份驗證。
https://nvd.nist.gov/vuln/detail/CVE-2020-27583
6、TCP / IP堆棧中的漏洞允許TCP連接劫持，研究人員發現其中9個堆棧無法正確爾託防火牆軟體漏生成ISN，從而使連接容易受到攻擊。這些漏洞統稱為NUMBER：JACK，影響到CycloneTCP，FNET，MPLAB Net，Nucleus NET，Nut / Net，picoTCP，uIP，uC / TCP-IP和TI-NDKTCPIP（Nanostack和lwIP不受影響）
https://www.forescout.com/company/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
7、平底鍋幾個高階漏洞
https://portswigger.net/daily-swig/palo-alto-firewall-software-vulnerability-quartet-revealed
8、西門子修補了2種工具中的21個漏洞
https://www.govinfosecurity.com/siemens-patches-21-vulnerabilities-in-2-tools-a-15983
數據洩露
https://blog.emsisoft.com/en/37707/incident-report/
2、yandex內部人員洩露用戶郵箱數據。
https://yandex.com/company/press_center/press_releases/2021/2021-12-02
3、國際律師事務所Jones Day受Clop勒索軟體攻擊而被盜的文件超過100G，追蹤器原因，疑似是攻擊通過平底鍋的軟體漏洞進來的。
https://siliconangle.com/2021/02/16/law-firm-jones-day-hit-clop-ransomware-attack-files-stolen/
4、Adorcam應用程式通過ElasticSearch資料庫洩漏了數百萬條用戶記錄，該資料庫收入超過1.24億行數據，公開的數據包括用戶電子郵件地址，哈希密碼，Wi-Fi網絡名稱，客戶端IP，用戶ID，網絡攝像頭序列號，網絡攝像頭設置（包括麥克風狀態），國家/地區地理位置，SSID/無線網絡，名稱和網絡攝像頭捕獲的圖像。
https://cisomag.eccouncil.org/adorcam-app-leaks-millions-of-user-records-via-elasticsearch-database/
5、黑客論壇上出售烏克蘭的PrivatBank資料庫，大概4000W數據
https://cybernews.com/security/largest-commercial-bank-ukraine-40-million-user-records-sold-online/
網絡戰與網絡情報
1、美國海軍發布標準化作戰指導書4.0
海軍於2月16日發布了COVID-19標準化操作指南（SOG）4.0版，以與冠狀病毒大流行作鬥爭，以對抗NAVADMIN 037/21。
https://www.navy.mil/Press-Office/News-Stories/Article/2503737/us-navy-issues-standardized-operational-guidance-40/utm_source/twitter/utm_medium/social/utm_content/100001854090010/utm_campaign/Man/linkId/100000032802624/
2、法院文件顯示FBI可以使用工具訪問iPhone上的私人Signal消息。其實，斯諾登早就告訴大家了
https://beta.documentcloud.org/documents/20474939-usa-v-jarrett-crisler-signal-extraction-2
3、xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
https://ciso.economictimes.indiatimes.com/news/clubhouse-may-be-leaking-data-to-chinese-govt-stanford-report/80959425