{"id":556,"date":"2020-09-17T12:36:04","date_gmt":"2020-09-17T04:36:04","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=556"},"modified":"2020-09-17T14:44:08","modified_gmt":"2020-09-17T06:44:08","slug":"%e7%be%8e%e5%9c%8b%e5%8f%b8%e6%b3%95%e9%83%a8%e6%ad%a3%e5%bc%8f%e8%b5%b7%e8%a8%b4%e4%b8%ad%e5%9c%8b%e5%9c%8b%e5%ae%b6%e7%b4%9a%e9%a7%ad%e5%ae%a2%e7%b5%84%e7%b9%94apt-41%e4%b8%ad%e7%9a%84%e4%ba%94","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=556","title":{"rendered":"\u7f8e\u570b\u53f8\u6cd5\u90e8\u6b63\u5f0f\u8d77\u8a34\u4e2d\u570b\u570b\u5bb6\u7d1a\u99ed\u5ba2\u7d44\u7e54APT 41\u4e2d\u7684\u4e94\u540d\u6210\u54e1! \u6307\u63a7APT41\u5165\u4fb5\u4e86\u5168\u7403\u9ad8\u9054100\u591a\u5bb6\u4f01\u696d!"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"940\" height=\"788\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/FBIWanted.png\" alt=\"\" class=\"wp-image-557\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/FBIWanted.png 940w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/FBIWanted-300x251.png 300w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/FBIWanted-768x644.png 768w\" sizes=\"auto, (max-width: 940px) 100vw, 940px\" \/><\/figure>\n\n\n\n<p>\u7f8e\u570b\u53f8\u6cd5\u90e89\u670816\u65e5\u5ba3\u5e03\u8d77\u8a34\u96b8\u5c6c\u65bcAPT 41(\u6216\u7a31Winnti)\u99ed\u5ba2\u7d44\u7e54\u7684\u4e94\u540d\u4e2d\u570b\u99ed\u5ba2\uff0c\u7f8e\u570b\u6307\u63a7APT 41\u7cbe\u5fc3\u7b56\u5283\u4e86\u5c0d\u5168\u7403100\u591a\u5bb6\u516c\u53f8\u7684\u5165\u4fb5\uff0c\u5176\u4e2d\u5305\u62ec\u5c0d\u8edf\u9ad4\u4f9b\u61c9\u5546\uff0c\u96fb\u904a\u516c\u53f8\uff0c\u96fb\u8a0a\u516c\u53f8\u7b49\u7b49\u3002<\/p>\n\n\n\n<p>\u7f8e\u570b\u8cc7\u5b89\u516c\u53f8FireEye\u66fe\u5728\u4e00\u4efd\u5831\u544a\u4e2d\u5c07APT41\u8996\u70ba\u300c\u8fd1\u5e74\u4f86\u4e2d\u570b\u7db2\u8def\u9593\u8adc\u6700\u5ee3\u6cdb\u6d3b\u52d5\u4e4b\u4e00\u300d\uff0c\u4e5f\u8868\u793aAPT 41\u4e3b\u8981\u662f\u66ff\u4e2d\u570b\u653f\u5e9c\u6ef2\u900f\u5168\u7403\u79d1\u6280\u3001\u901a\u8a0a\u548c\u91ab\u7642\u4fdd\u5065\u6a5f\u69cb\u7b49\uff0c\u4e5f\u6703\u70ba\u500b\u4eba\u5229\u76ca\u800c\u5229\u7528\u52d2\u7d22\u8edf\u9ad4\u9396\u5b9a\u96fb\u904a\u516c\u53f8\u53ca\u653b\u64ca\u52a0\u5bc6\u8ca8\u5e63\u5546\u3002APT 41\u5c0f\u7d44\u662f\u7576\u4eca\u6700\u81ed\u540d\u662d\u8457\uff0c\u6700\u6d3b\u8e8d\u7684\u570b\u5bb6\u8cc7\u52a9\u7684\u99ed\u5ba2\u7d44\u7e54\u4e4b\u4e00\uff0cFireEye\u7684\u5831\u544a\u767c\u5e03\u5f8c\uff0c2019\u5e748\u6708\u6709\u5169\u540dAPT 41\u6210\u54e1\uff08\u5f35\u6d69\u7136\u548c\u8b5a\u6234\u6797\uff09\u88ab\u7f8e\u570b\u53f8\u6cd5\u90e8\u8d77\u8a34\uff0c\u9019\u662f\u4ed6\u5011\u7684\u8d77\u8a34\u66f8\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-documentcloud\"><div class=\"wp-block-embed__wrapper\">\n<iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" title=\"ZHR Indictment Redacted (Hosted by DocumentCloud)\" src=\"\/\/www.documentcloud.org\/documents\/7209588-ZHR-Indictment-Redacted.html?embed=true&#038;responsive=false&#038;sidebar=false#?secret=V6FM0GTTvX\" data-secret=\"V6FM0GTTvX\" frameborder=\"0\"><\/iframe>\n<\/div><\/figure>\n\n\n\n<p>\u4e0a\u67082020\u5e748\u6708\uff0c\u5176\u4ed6\u4e09\u540dAPT 41\u6210\u54e1\uff08\u8523\u7acb\u5fd7\uff0c\u9322\u5ddd\uff0c\u4ed8\u5f37\uff09\u4e5f\u88ab\u8d77\u8a34\uff0c\u7f8e\u570b\u6307\u63a7\u9019\u4e09\u540d\u99ed\u5ba2\u5c0d\u591a\u5bb6\u516c\u53f8\u7684\u5165\u4fb5\uff0c\u64da\u7a31\u4ed6\u5011\u5728\u4e00\u9593\u7531\u4e2d\u570b\u5b98\u54e1\u5bc6\u5207\u76e3\u7763\u4e0b\u904b\u4f5c\u7684\u524d\u53f0\u516c\u53f8\u201c\u6210\u90fd404\u7db2\u8def\u6280\u8853\uff02\u5de5\u4f5c\uff0c\u9019\u662f\u4ed6\u5011\u7684\u8d77\u8a34\u66f8\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-documentcloud\"><div class=\"wp-block-embed__wrapper\">\n<iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" title=\"C404 Indictment Reduced Size (Hosted by DocumentCloud)\" src=\"\/\/www.documentcloud.org\/documents\/7209586-C404-Indictment-Reduced-Size.html?embed=true&#038;responsive=false&#038;sidebar=false#?secret=bupTuNDbwN\" data-secret=\"bupTuNDbwN\" frameborder=\"0\"><\/iframe>\n<\/div><\/figure>\n\n\n\n<p>\u6839\u64daCrowdStrike\u7684\u9996\u5e2d\u6280\u8853\u5b98\u517c\u806f\u5408\u5275\u8fa6\u4ebaDmitri Alperovitch\u900f\u9732\uff0c\u7f8e\u570b\u5b98\u54e1\u6514\u622a\u4e86\u4e00\u4e9b\u7dda\u4e0a\u804a\u5929\uff0c APT 41\u6210\u54e1\u8523\u7acb\u5fd7\u5439\u5653\u8207\u4e2d\u570b\u570b\u5bb6\u5b89\u5168\u90e8\u7684\u5bc6\u5207\u806f\u7e6b\u4ee5\u53ca\u53ea\u8981\u4ed6\u5011\u4e0d\u653b\u64ca\u4e2d\u570b\uff0c\u6240\u4eab\u6709\u7684\u4fdd\u8b77\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"578\" height=\"295\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/hacker.png\" alt=\"\" class=\"wp-image-558\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/hacker.png 578w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/hacker-300x153.png 300w\" sizes=\"auto, (max-width: 578px) 100vw, 578px\" \/><\/figure>\n\n\n\n<p>\u9664\u90195\u540d\u4e2d\u570b\u99ed\u5ba2\u5916\uff0c\u7f8e\u570b\u53f8\u6cd5\u90e8\u4eca\u5929\u4e5f\u540c\u6a23\u8d77\u8a34\u53e6\u59162\u540d\u99ac\u4f86\u897f\u4e9e\u5546\u4eba\uff0c\u4ed6\u5011\u6d89\u53ca\u8207\u5176\u4e2d2\u540d\u4e2d\u570b\u99ed\u5ba2\u5171\u8b00\u5165\u4fb5\u904a\u6232\u516c\u53f8\u7db2\u8def\u7aca\u53d6\u8cc7\u6599\u4e26\u8a66\u5716\u5728\u6697\u7db2\u51fa\u552e\uff0c\u9019\u662f\u4ed6\u5011\u7684\u8d77\u8a34\u66f8\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-documentcloud\"><div class=\"wp-block-embed__wrapper\">\n<iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" title=\"Wong Indictment Redacted (Hosted by DocumentCloud)\" src=\"\/\/www.documentcloud.org\/documents\/7209587-Wong-Indictment-Redacted.html?embed=true&#038;responsive=false&#038;sidebar=false#?secret=7aZnDG0Dox\" data-secret=\"7aZnDG0Dox\" frameborder=\"0\"><\/iframe>\n<\/div><\/figure>\n\n\n\n<p>\u64da\u76f8\u4fe1<a href=\"https:\/\/www.seagm.com\/zh-tw\/\">Seagm<\/a>\u662f\u4ed6\u5011\u7d93\u71df\u7684\u7db2\u7ad9\uff0c\u662f\u4e00\u500b\u51fa\u552e\u904a\u6232\u8ca8\u5e63\u7684\u7db2\u7ad9\u3002\u4ed6\u5011\u540c\u6642\u8b93APT 41\u975e\u6cd5\u5229\u7528, \u9054\u53d6\u7aca\u53d6\u8cc7\u6599\u7684\u76ee\u7684\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"680\" height=\"408\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/coin.jpg\" alt=\"\" class=\"wp-image-559\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/coin.jpg 680w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/coin-300x180.jpg 300w\" sizes=\"auto, (max-width: 680px) 100vw, 680px\" \/><\/figure>\n\n\n\n<p>\u672c\u6708\u521d\uff0c\u806f\u90a6\u8abf\u67e5\u5c40(FBI) \u7372\u5f97\u4e86\u6cd5\u9662\u4ee4\uff0c\u6263\u62bc\u4e86APT 41\u5728\u904e\u53bb\u7684\u884c\u52d5\u4e2d\u4f7f\u7528\u904e\u7684\u57fa\u790e\u8a2d\u65bd\uff0c\u6578\u767e\u500b\u5e33\u6236\uff0c\u4f3a\u670d\u5668\uff0c\u57df\u540d\uff0cC2\u548c\u5931\u6548\u7db2\u9801\u7b49\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"666\" height=\"474\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/Dropdead.png\" alt=\"\" class=\"wp-image-560\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/Dropdead.png 666w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2020\/09\/Dropdead-300x214.png 300w\" sizes=\"auto, (max-width: 666px) 100vw, 666px\" \/><\/figure>\n\n\n\n<p>\u6700\u65b0APT 41\u5165\u4fb5\u5168\u7403\u7684\u76f8\u95dc\u60c5\u8cc7, \u5c31\u5728<a href=\"http:\/\/www.billows.com.tw\/\">\u7ae3\u76df\u79d1\u6280<\/a>\u4ee3\u7406\u7684 AlienVault OTX \u60c5\u8cc7\u5e73\u53f0\u4e0a:<\/p>\n\n\n\n<p><a href=\"https:\/\/otx.alienvault.com\/pulse\/5f62318a419e133716eca72d\">https:\/\/otx.alienvault.com\/pulse\/5f62318a419e133716eca72d<\/a><\/p>\n\n\n\n<p>*****<a href=\"http:\/\/www.billows.com.tw\" data-type=\"URL\" data-id=\"www.billows.com.tw\">\u7ae3\u76df\u79d1\u6280<\/a>\u5feb\u5831\u6b61\u8fce\u8f49\u8f09\uff0c\u4f46\u8acb\u8a3b\u660e\u51fa\u8655<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7f8e\u570b\u53f8\u6cd5\u90e89\u670816\u65e5\u5ba3\u5e03\u8d77\u8a34\u96b8\u5c6c\u65bcAPT 41(\u6216\u7a31Winnti)\u99ed\u5ba2\u7d44\u7e54\u7684\u4e94\u540d\u4e2d\u570b\u99ed\u5ba2\uff0c\u7f8e\u570b\u6307\u63a7APT 41 <a class=\"read-more\" href=\"https:\/\/blog.billows.com.tw\/?p=556\">READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[32,78,112],"class_list":{"0":"post-556","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"hentry","6":"category-6","7":"tag-otx","9":"tag-112"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=556"}],"version-history":[{"count":3,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/556\/revisions"}],"predecessor-version":[{"id":564,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/556\/revisions\/564"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}