SOC Prime 최신 위협 | 21 중 15 번째 페이지

Kimsuky APT 공격 탐지: 북한 해커가 TRANSLATEXT 크롬 확장 기능을 악용하여 민감한 데이터 탈취

7월 03, 2024

북한과 연계된 악명 높은 위협 행위자로 알려진 Kimsuky APT 그룹 은(는) TRANSLATEXT라는 새로운 악성 구글 크롬 확장을 사이버 스파이 활동에 활용하여 민감한 사용자 데이터를 불법적으로 수집합니다. 2024년 초봄에 시작된 ongoing 캠페인은 주로 한국의 학술 기관을 타깃으로 하고 있습니다. TRANSLATEXT를 활용하는 Kimsuky 캠페인 탐지 APT 위협이 증가하면서 지정학적 긴장이 심화되고 있으므로, 보안 전문가들은 차세대 도구를 활용하여 […]

CVE-2024-5806 탐지: 시중에 적극적으로 악용되고 있는 Progress MOVEit Transfer의 새로운 인증 우회 취약점

6월 26, 2024

6월의 사이버 위협 환경은 새로운 취약성의 공개 덕분에 뜨거워지고 있습니다. 예를 들어 CVE-2024-4577 및 CVE-2024-29849이 있습니다. 연구원들은 CVE-2024-5806으로 추적되는 Progress MOVEit Transfer의 새로운 치명적인 인증 부적절 취약성을 발견했으며, 발견 몇 시간 만에 실제로 적극적인 악용이 이루어지고 있습니다. CVE-2024-5806 악용 시도 탐지 작년의 사건 이후로 MOVEit은 사이버 범죄자들에게 여전히 매력적인 대상이며, 대규모 기업의 내부 파일에 접근할 […]

GrimResource 공격 탐지: 새로운 감염 기법이 Microsoft 관리 콘솔을 악용하여 전체 코드 실행을 획득하다

6월 25, 2024

사이버 보안 연구원들은 특별히 제작된 MSC 파일과 Windows XSS 결함을 활용한 새로운 코드 실행 기법을 발견했습니다. 새로 발견된 감염 기법인 GrimResource는 공격자들이 Microsoft 관리 콘솔(MMC)에서 코드 실행을 수행할 수 있게 합니다. 방어자들은 2024년 6월 초에 VirusTotal에 업로드된 GrimResource를 사용하는 샘플을 발견했으며, 이는 새로운 감염 기법이 야생에서 적극적으로 악용되고 있음을 나타냅니다. GrimResource 공격 탐지 날로 증가하는 […]

UNC3886: 중국과 연계된 새로운 사이버 스파이 위협 행위자, 포티넷 및 VMware 제로데이와 맞춤형 악성코드 악용하여 장기적인 스파이 행위

6월 20, 2024

2024년 1분기, 중국, 북한, 이란, 러시아의 고급 지속 위협(APT) 그룹은 정교한 사이버 스파이 캠페인을 진행하기 위해 크게 향상되고 혁신적인 공격 능력을 보여주었습니다. 이 활동의 급증은 글로벌 사이버 보안 환경에 상당한 도전을 제기했습니다. 최근 보안 전문가들은 중국과 관련된 Velvet Ant 그룹의 활동을 밝혀내어 F5 BIG-IP 장치를 약 3년 동안 침투하여 악성코드를 배포하고 민감한 데이터를 탈취했습니다. 그러나, […]

벨벳 앤트 활동 감지: 중국 지원 사이버 스파이 그룹, F5 BIG-IP 디바이스에 배포된 악성코드를 사용하여 장기 공격 개시

6월 18, 2024

중국과 연관된 사이버 첩보 그룹 벨벳 앤트는 약 3년 동안 F5 BIG-IP 장치를 내부 C2 서버로 침투하여 악성 코드를 배포하고, 탐지를 교묘히 피하며 민감한 데이터를 탈취하고 있습니다. 벨벳 앤트 공격 탐지 2024년 1분기, 중국, 북한, 이란, 러시아를 포함한 다양한 지역의 APT 그룹들이 동적이고 혁신적인 공격 능력을 크게 증가시켰으며, 이는 전 세계 사이버 보안 환경에 상당한 […]

TellYouThePass Ransomware Attack Detection

TellYouThePass 랜섬웨어 공격 탐지: 해커들이 CVE-2024-4577을 악용하여 웹 셸 설치 및 멀웨어 투하

6월 13, 2024

TellYouThePass 랜섬웨어 운영자들이 PHP-CGI 취약점으로 추적된 새로운 적대 캠페인인 CVE-2024-4577을 활용하여 발견되었습니다. 적들은 이 결함을 무기화하여 웹 셸을 업로드하고 감염된 인스턴스에 TellYouThePass 랜섬웨어를 배포합니다. TellYouThePass 랜섬웨어 캠페인 탐지 새로 밝혀진 PHP-CGI 버그가 야외 공격을 위해 빠르게 무기화되어 TellYouThePass 랜섬웨어 배포를 촉진함에 따라 보안 전문가들은 이 신종 위협에 적극적으로 대응해야 합니다. 잠재적인 TellYouThePass 침입을 가장 초기에 […]

CVE-2024-4577 탐지: 새로운 쉽게 악용 가능한 PHP 취약점이 RCE로 이어질 수 있음

6월 12, 2024

공개 직후 CVE-2024-29849 및 PoC 릴리스에 이어, 또 다른 보안 결함이 사이버 위협 환경에서 화제가 되고 있습니다. CVE-2024-4577의 성공적인 악용은 Windows 기반 PHP 서버에서 RCE를 유발할 수 있습니다. 이 보안 버그는 CGI 인자 주입 취약점으로, Windows OS의 모든 PHP 버전과 기본 설정된 모든 XAMPP 설치에 영향을 미칩니다. CVE-2024-4577 악용 시도 탐지 사이버 범죄가 이제 비즈니스 […]

CVE-2024-29849 탐지: Veeam 백업 엔터프라이즈 매니저의 치명적인 인증 우회

6월 11, 2024

또 다른 하루, 또 다른 위협이 사이버 방어자를 도전하게 하고 있습니다. 이번에 사이버 보안 경고는 Veem Backup Enterprise Manager (VBEM) 전반에 걸쳐 식별된 악질적인 결함이 인증을 우회하고 플랫폼의 웹 인터페이스에 완전한 액세스를 허용하는 것과 관련되어 있습니다. CVE-2024-29849로 추적되는 이 버그는 9.8 CVSS 점수를 받았으며, PoC가 공개적으로 발표되면서 위협이 증가하고 있습니다. CVE-2024-29849 익스플로잇 탐지 최신 통계 […]

UAC-0020, 버민(Vermin) 공격 탐지: SPECTR 멀웨어와 SyncThing 유틸리티를 사용한 SickSync 캠페인, 우크라이나 군대 표적

6월 07, 2024

The Vermin 해킹 그룹, UAC-0020로도 알려져 있으며, 우크라이나 군대를 목표로 다시 나타났습니다. 우크라이나 군사 사이버 보안 센터와 협력하여 CERT-UA가 발견한 최신 “SickSync” 캠페인에서는 적들이 2019년부터 그들의 적 도구 모음에 속해 있던 SPECTR 맬웨어를 다시 사용하고 있습니다. 우크라이나 군대를 목표로 하는 SickSync 캠페인: 공격 분석 2024년 6월 6일, CERT-UA는 우크라이나 군사 사이버 보안 센터와 협력하여 UAC-0020 […]

UAC-0200 공격 탐지: 적대 세력이 Signal을 통해 유포된 DarkCrystal RAT를 활용하여 우크라이나 공공 부문을 겨냥한 타겟 피싱 공격을 시작하다

6월 06, 2024

러시아-우크라이나 전쟁이 시작된 2022년 이후, 공격적인 작전이 상당히 증가하여 지정학적 긴장이 글로벌 기업에 미치는 심각한 영향을 강조했습니다. 다수의 해킹 그룹이 우크라이나를 실험장으로 사용하여 유럽과 미국의 정치적 영역으로 공격 표면을 확장하고 있습니다. CERT-UA는 최근 정부 기관, 군대 및 방위 기관을 대상으로 한 사이버 공격의 새로운 급증에 대해 보고하였으며, 이는 Signal 메신저를 통해 퍼지는 DarkCrystal RAT 악성코드를 […]

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.

최신 위협

Follow us on:

Archive

Tags