Silobreaker Update 2021年04月30日

インターネット上でトレンドとなっている脅威アクター、マルウェアのランキングです。
Silobreaker の API を使用して作成しています。このページに関する説明はこちらをご覧ください。

Name	Move	Volume 1d	Volume 7d	Volume 30d
CostaRicto		3	3	3
APT-C-39		1	1	1
XDSpy		1	1	1
APT30		35	42	42
Water Pamola		7	8	8

Name	Move	Volume 1d	Volume 7d	Volume 30d
SombRAT		5	5	5
RotaJakiro		27	30	30
RainyDay Backdoor		10	13	13
AgeLocker Ransomware		8	8	9
Nebulae Backdoor		14	31	31

• ThreatActor:CostaRicto
• Ransomware group targeted SonicWall vulnerability pre-patch
• Published by SC Magazine US (2021-04-30 07:44:00)
• Entities:
  • Company:SonicWall Inc,  Company:Mandiant Corp,  Keyphrase:Ransomware,  Keyphrase:Vulnerability,  Malware:HelloKitty Ransomware
• ThreatActor:APT-C-39
• Purple Lambert, a new malware of CIA-linked Lambert APT group
• Published by Security Affairs (2021-04-29 20:15:03)
• Entities:
  • Keyphrase:Malware,  ThreatActor:The Lamberts,  Keyphrase:APT Advanced Persistent Threat,  Company:Symantec Corporation,  Organization:CIA Central Intelligence Agency
• ThreatActor:XDSpy
• Government sector faces growing danger from cyber threats
• Published by BetaNews – RSS (2021-04-29 23:20:50)
• Entities:
  • Keyphrase:Cyber Threat,  ThreatActor:XDSpy,  Keyphrase:Cybercrime,  Keyphrase:APT Advanced Persistent Threat,  Keyphrase:Nation-state
• ThreatActor:APT30
• Chinese APT “NAIKON” Is Using a Backup Backdoor Called “Nebulae”
• Published by TechNadu (2021-04-29 18:03:00)
• Entities:
  • ThreatActor:APT30,  AttackType:Backdoor,  Keyphrase:Chinese APT,  Keyphrase:Back-Up,  Malware:RainyDay Backdoor
• ThreatActor:Water Pamola
• Water Pamola Attacked Online Shops Via Malicious Orders
• Published by Reddit – BlueTeamSec – RSS (2021-04-29 23:02:10)
• Entities:
  • ThreatActor:Water Pamola,  Keyphrase:Attacked
• Malware:SombRAT
• Mandiant – We observed UNC2447, an aggressive financially motivated group, exploit SonicWall SMA 100 series VPN zero-day vulne… https://t.co/UuzbgpxJJA
• Published by Mandiant – Twitter (2021-04-30 07:32:01)
• Entities:
  • Malware:SombRAT,  Product:SonicWall SMA 100 Series,  Username:@mandiant,  Domain:feye.io,  Keyphrase:Zero-Day
• Malware:RotaJakiro
• RotaJakiro Linux backdoor has flown under the radar since 2018
• Published by Security Affairs (2021-04-29 15:22:02)
• Entities:
  • Malware:RotaJakiro,  AttackType:Backdoor,  Keyphrase:Linux OS,  Keyphrase:Radar,  Keyphrase:Encryption
• Malware:RainyDay Backdoor
• unix_root – Researchers have uncovered a new cyber espionage campaign by Naikon APT Chinese hackers targeting military organiza… https://t.co/DQXcsr1EAF
• Published by unix_root – Twitter (2021-04-29 19:27:07)
• Entities:
  • Malware:RainyDay Backdoor,  Malware:Nebulae Backdoor,  ThreatActor:APT30,  Username:@unix_root,  Domain:thehackernews.com
• Malware:AgeLocker Ransomware
• QNAP finds evidence of AgeLocker ransomware activity in the wild
• Published by BleepingComputer.com (2021-04-30 03:26:08)
• Entities:
  • Malware:AgeLocker Ransomware,  Malware:Qlocker Ransomware,  Keyphrase:NAS Network-Attached Storage,  Keyphrase:Campaign
• Malware:Nebulae Backdoor
• Securityblog – Naikon APT uses new Nebulae backdoor in attacks aimed at military orgs https://t.co/7qvpFVFAzj
• Published by Securityblog – Twitter (2021-04-30 05:59:15)
• Entities:
  • Malware:Nebulae Backdoor,  ThreatActor:APT30,  Username:@securityblog,  UrlFull:https://securityaffairs.co/wordpress/117321/apt/naikon-apt-nebulae-backdoor.html,  Keyphrase:Military/Armed Forces