{"id":1539,"date":"2021-12-03T14:54:52","date_gmt":"2021-12-03T06:54:52","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=1539"},"modified":"2021-12-03T14:54:52","modified_gmt":"2021-12-03T06:54:52","slug":"%e7%be%8e%e5%9c%8b%e5%92%8c%e5%8a%a0%e6%8b%bf%e5%a4%a7%e7%9a%84%e9%97%9c%e9%8d%b5%e5%9f%ba%e7%a4%8e%e8%a8%ad%e6%96%bd%e6%88%90%e7%82%ba%e6%96%b0%e5%9e%8b%e5%8b%92%e7%b4%a2%e8%bb%9f%e9%ab%94-sabbath","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=1539","title":{"rendered":"\u7f8e\u570b\u548c\u52a0\u62ff\u5927\u7684\u95dc\u9375\u57fa\u790e\u8a2d\u65bd\u6210\u70ba\u65b0\u578b\u52d2\u7d22\u8edf\u9ad4 Sabbath \u7684\u76ee\u6a19"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"865\" height=\"572\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image.png\" alt=\"\" class=\"wp-image-1540\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image.png 865w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-300x198.png 300w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-768x508.png 768w\" sizes=\"auto, (max-width: 865px) 100vw, 865px\" \/><figcaption><strong>Sabbath\u7684\u52d2\u7d22\u4fe1<\/strong><\/figcaption><\/figure>\n\n\n\n<p>\u81ea 2021 \u5e74 6 \u6708\u4ee5\u4f86\uff0c\u4e00\u500b\u540d\u70ba Sabbath \u76f8\u5c0d\u8f03\u65b0\u7684\u52d2\u7d22\u8edf\u9ad4\u7d44\u7e54\u4e00\u76f4\u91dd\u5c0d\u7f8e\u570b\u548c\u52a0\u62ff\u5927\u7684\u95dc\u9375\u57fa\u790e\u8a2d\u65bd(\u5305\u62ec\u6559\u80b2\u3001\u885b\u751f\u548c\u81ea\u7136\u8cc7\u6e90)\u70ba\u76ee\u6a19\uff0c\u6839\u64daMandiant \u7814\u7a76\u54e1\u7684\u8abf\u67e5\u7d50\u679c\uff0c\u767c\u73feSabbath\u4e4b\u524d\u4ee5 Arcane \u548c Eruption \u7684\u540d\u7fa9\u904b\u4f5c\uff0c\u5f8c\u8005\u65bc\u53bb\u5e74\u88ab\u89c0\u5bdf\u5230\u90e8\u7f72 ROLLCOAST\u52d2\u7d22\u8edf\u9ad4\u3002ROLLCOAST\u80fd\u52a0\u8f09\u5230memory\u5167\u4e26\u6703\u5728\u786c\u789f\u4e0a\u64e6\u6389\u5176\u8e2a\u8de1\u3002<\/p>\n\n\n\n<p>\u64da<a href=\"https:\/\/www.mandiant.com\/resources\/sabbath-ransomware-affiliate\"><strong>Mandiant\u7684\u5831\u544a<\/strong><\/a>\uff0c2021\u5e7410 \u6708\uff0cSabbath\u5efa\u7acb\u4e86\u63ed\u79d8\u7db2\u7ad954BB47h\uff0c\u63a8\u51fa\u79df\u7528\u52d2\u7d22\u8edf\u9ad4\u5373\u670d\u52d9\uff08Ransomware as a Service\uff1bRaaS\uff09\u7684\u5e73\u53f0\u4e26\u7a4d\u6975\u5730\u5c0b\u627e\u5408\u4f5c\u5925\u4f34\u548c\u6703\u54e1\u3002\u503c\u5f97\u4e00\u63d0\u7684\u662f\uff0cSabbath\u6703\u5411\u5176\u6703\u54e1\u63d0\u4f9b\u9810\u914d\u7f6e(Pre-configure)\u7684Cobalt Strike\u6709\u6548\u8377\u8f09(payloads)\u3002<\/p>\n\n\n\n<p>\u572810 \u6708\u9996\u6b21\u66dd\u5149\u6642\uff0c\u8a72\u7d44\u7e54\u901a\u904e <a href=\"https:\/\/www.reddit.com\/r\/SecOpsDaily\/comments\/qfkpgc\/the_new_ransomware_group_54bb47h_seem_to_have\/\">Reddit<\/a> \u516c\u958b\u52d2\u7d22\u7f8e\u570b\u5fb7\u5dde\u7684\u4e00\u500b\u5b78\u5340\uff0c\u8981\u6c42\u652f\u4ed8\u6578\u767e\u842c\u7f8e\u5143\u8d16\u91d1\u3002\u64da\u4e86\u89e3\uff0cSabbath\u63a1\u53d6\u4e86\u7570\u5e38\u6fc0\u9032\u7684\u65b9\u6cd5\uff0c\u76f4\u63a5\u5411\u6559\u8077\u54e1\u3001\u5bb6\u9577\u751a\u81f3\u5b78\u751f\u767c\u9001\u96fb\u5b50\u90f5\u4ef6\uff0c\u4ee5\u9032\u4e00\u6b65\u5411\u5b78\u5340\u65bd\u58d3\u3002<\/p>\n\n\n\n<p>\u64da\u89c0\u5bdf\uff0c\u4f5c\u70ba\u54c1\u724c\u91cd\u5851(Rebrand)\u7684\u4e00\u90e8\u5206\uff0cArcane\u4e0d\u50c5\u66f4\u6539\u5176\u540d\u7a31\u70baSabbath\u3001\u5176logo\u548c\u914d\u8272\u4e5f\u66f4\u6539\u4e86\uff0c\u7136\u800c\u653b\u64ca\u8005\u5728\u5176\u63ed\u79d8\u7db2\u7ad9\u4e0a\u7e7c\u7e8c\u72af\u540c\u6a23\u7684\u8a9e\u6cd5\u932f\u8aa4\uff0c\u4e26\u4fdd\u6301Cobalt Strike\u7684Beacon\u6a23\u672c\u548c\u57fa\u790e\u8a2d\u65bd\u4e0d\u8b8a\uff0c\u8db3\u4ee5\u8b49\u660eSabbath\u8207Arcane\u7684\u95dc\u9023\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"865\" height=\"545\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-1.png\" alt=\"\" class=\"wp-image-1541\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-1.png 865w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-1-300x189.png 300w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-1-768x484.png 768w\" sizes=\"auto, (max-width: 865px) 100vw, 865px\" \/><figcaption><strong>Sabbath\u7684\u63ed\u79d8\u7db2\u7ad9<\/strong><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"865\" height=\"584\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-2.png\" alt=\"\" class=\"wp-image-1542\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-2.png 865w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-2-300x203.png 300w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/12\/image-2-768x519.png 768w\" sizes=\"auto, (max-width: 865px) 100vw, 865px\" \/><figcaption><strong>Arcane\u7684\u63ed\u79d8\u7db2\u7ad9<\/strong><\/figcaption><\/figure>\n\n\n\n<p>Mandiant \u8868\u793a\uff0c\u81ea 2021 \u5e74 7 \u6708\u4ee5\u4f86\uff0cSabbath\u4e00\u76f4\u5728\u4f7f\u7528 Themida \u4f86\u6253\u5305\u5176\u60e1\u610f\u8edf\u9ad4\u6a23\u672c\u6709\u52a9\u65bc\u5b83\u907f\u514d\u88ab IPS\u3001WAF \u7b49\u7db2\u8def\u5b89\u5168\u5de5\u5177\u6aa2\u6e2c\u5230\u3002\u7814\u7a76\u4eba\u54e1\u9084\u6307\u51fa\uff0c\u8a72\u7d44\u7e54\u81ea 6 \u6708\u4ee5\u4f86\u4e00\u76f4\u4f7f\u7528\u5177\u6709\u7368\u7279\u6027\u7684 Cobalt Strike\u7684Beacon\u6a23\u672c\u3002Sabbath\u3001Arcane\u548cEruption\u80cc\u5f8c\u7d44\u7e54\u88ab\u8ffd\u6eaf\u70ba\u99ed\u5ba2\u7d44\u7e54UNC2190\uff0c\u8a72\u7d44\u7e54\u64c5\u9577\u53cd\u5fa9\u91cd\u65b0\u547d\u540d\u53ca\u5305\u88dd\u52d2\u7d22\u8edf\u9ad4\u4ee5\u907f\u514d\u88ab\u767c\u73fe\uff0c\u53e6\u5916\u96d6\u7136\u90e8\u7f72\u52d2\u7d22\u8edf\u9ad4\u7684\u7bc4\u570d\u6709\u9650\uff0c\u4f46\u6703\u4ee5\u7aca\u53d6\u5927\u91cf\u6578\u64da\u9032\u884c\u52d2\u7d22\uff0c\u4e26\u4e14\u5a01\u8105\u7834\u58de\u5099\u4efd\u3002<\/p>\n\n\n\n<p>Sabbath\u7684\u5165\u4fb5\u6307\u6a19(Indicator of compromise -IOCs):<\/p>\n\n\n\n<p>SHA 256<\/p>\n\n\n\n<p>da92878c314307a5e5c9df687ec19a402d93126b3818e5fb6b7241ab375d1e12<\/p>\n\n\n\n<p>0fb410b9a4d32a473b2ee28d4dc5e19a64524e107b980fc1ce8de2ad0dcc3302<\/p>\n\n\n\n<p>298662f3fed24d757634a022c16f4124919b653f8bf7717e4f7a5b7d741729c0<\/p>\n\n\n\n<p>a053408747e9b32721d25c00351c4ce9286208e8714780416f18cbe2536672a9<\/p>\n\n\n\n<p>afd61168c1fae6841faa3860dca0e5839f1b7a3169184a1c04de5a9b88adfe5d<\/p>\n\n\n\n<p>b2ffd7d83e004308a97355a18529fe3528dcbbd7901fb28aaad9d46194469947<\/p>\n\n\n\n<p>e302a958856208adeab4ab3cd6d2991e644798fabd57bb187a0aede314a4baa0<\/p>\n\n\n\n<p>8ddb23c90cb4133b4624127a1db75335a51e90d557c01e996ce33fe23f638e71<\/p>\n\n\n\n<p>1bbb11e526141af7bafb5d4db3671b1a01bb277fda047920995c1f2a4cb6654c<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u81ea 2021 \u5e74 6 \u6708\u4ee5\u4f86\uff0c\u4e00\u500b\u540d\u70ba Sabbath \u76f8\u5c0d\u8f03\u65b0\u7684\u52d2\u7d22\u8edf\u9ad4\u7d44\u7e54\u4e00\u76f4\u91dd\u5c0d\u7f8e\u570b\u548c\u52a0\u62ff\u5927\u7684\u95dc\u9375\u57fa\u790e\u8a2d <a class=\"read-more\" href=\"https:\/\/blog.billows.com.tw\/?p=1539\">READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-1539","post","type-post","status-publish","format-standard","hentry","category-6"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1539","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1539"}],"version-history":[{"count":1,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1539\/revisions"}],"predecessor-version":[{"id":1543,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1539\/revisions\/1543"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}