2023年5月20日

柏拉图数据情报。观点:1 CommonMagic APT(先进的持久威胁)运动最近扩大了目标范围包括中部和西部乌克兰。这个运动,至少自2018年以来一直活跃,被认为是由中国政府资助的组织被称为APT27或使者熊猫。恰当的活动是长期的,有针对性的攻击,是为了获得敏感信息和系统。这些攻击通常是由高技术和资金充足的团体,比如民族国家或有组织的犯罪集团。CommonMagic恰当的运动主要有针对性的组织在东南亚,包括政府机构、国防承包商和技术公司。然而,最近的报告显示,该集团已经将重心转移到乌克兰。根据网络安全公司FireEye CommonMagic恰当的运动一直在使用一个名为“RedXOR”目标的新恶意软件变种乌克兰组织。这个恶意软件旨在窃取敏感信息,如登录凭证和财务数据,从受感染的系统。FireEye还指出,CommonMagic恰当的运动一直在使用各种各样的策略来获得乌克兰的网络。 These tactics include spear-phishing emails, which are designed to trick users into clicking on malicious links or downloading infected attachments. In addition to spear-phishing, the CommonMagic APT campaign has also been using “watering hole” attacks. This tactic involves compromising a legitimate website that is frequently visited by the target organization’s employees. Once the website is compromised, the attackers can use it to deliver malware to unsuspecting visitors. The expansion of the CommonMagic APT campaign into Ukraine is concerning for several reasons. First, Ukraine is a strategically important country that has been the target of numerous cyberattacks in recent years. These attacks have included the infamous NotPetya ransomware attack, which caused billions of dollars in damage to Ukrainian businesses and government agencies. Second, the CommonMagic APT campaign is believed to be operated by a state-sponsored group. This means that the Chinese government may be using cyberattacks to gain a strategic advantage in Ukraine and other countries. Finally, the CommonMagic APT campaign is just one of many APT groups that are actively targeting organizations around the world. As these attacks become more sophisticated and widespread, it is essential that organizations take steps to protect themselves from cyber threats. Some of the best practices for protecting against APT attacks include: – Implementing strong access controls and authentication mechanisms – Regularly updating software and security patches – Conducting regular security audits and risk assessments – Providing ongoing cybersecurity training for employees – Using advanced threat detection and response tools By taking these steps, organizations can reduce their risk of falling victim to APT attacks like the CommonMagic campaign. As cyber threats continue to evolve, it is essential that organizations remain vigilant and proactive in their cybersecurity efforts.