Sunny-side spyware. [Research Saturday]

您正在收听由HawxHunt赞助的CyberWire网络。

You're listening to the CyberWire Network powered by n two k.

人工智能让攻击更具迷惑性，人们更难识破，而传统的安全意识和钓鱼培训根本没针对这种级别的攻击设计。

AI is making attacks more convincing, and harder for people to spot, and traditional security awareness and phishing training weren't designed for this level of attack.

HawxHunt通过个性化的钓鱼模拟培训，帮助安全团队让员工应对日常面临的威胁，培训会根据每个人的情况动态调整，长期降低高风险行为。

HawxHunt helps security teams prepare employees for the attacks they face every day with personalized phishing training that adapts to each employee and reduces risky behavior over time.

对于希望加强人员防御层、又不想增加额外人工负担的IT和安全负责人，请访问hawkshunt.com/cyberwire了解更多信息。

For IT and security leaders looking to strengthen their human layer of defense without adding more manual work, visit hawkshunt.com/cyberwire to learn more.

网址是hawkshunt.com/cyberwire。

That's hoxhunt.com/cyberwire.

大家好，欢迎来到CyberWire的科研星期六。

Hello, everyone, and welcome to the CyberWire's Research Saturday.

我是Dave Bitdefender，这是我们每周与研究人员和分析师的对话，他们追踪威胁与漏洞，解决棘手问题，在快速变化的网络环境中保护我们自己。

I'm Dave Bitdefender, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in a rapidly evolving cyberspace.

感谢您的收听。

Thanks for joining us.

这是新出现的活动吗？

Is it new activity?

还是早就存在的活动？

Is it existing activity?

是一群受害者集中受害吗？

Is it a cluster of victims?

还是单独一例？

Or is it isolated case?

就拿‘Kugly Comrades’这个组织来说，我们是从2024年年中开始追踪他们的。

So in the case of Kugly Comrades, we started tracking this group in mid-twenty twenty four.

这是Bitdefender的技术解决方案总监马丁·祖热茨。

That's Martin Zugec, Technical Solutions Director at Bitdefender.

今天我们讨论的研究报告标题是《一个针对地缘政治热点的新威胁行为体》。

The research we're discussing today is titled A New Threat Actor Targeting Geopolitical Hot beds.

这种事一般人可能根本不知道。

It's one of those things that people probably don't know.

这类研究通常要花上好几个月。

Research like this very often takes months.

所以当你看到它一年后才发布，这很正常。

So it's normal when you see it released, let's say, a year later.

因为我们正在详细记录他们使用的所有工具、所有SEGBags，以及完整的InfraGast反应体系。

That's perfectly fine because we are documenting all the tools they are using, all the SEGBags, the complete InfraGast Reaction.

我们在发布数据之前，尽量把情况摸得越全面越好。

We try to get as complete picture as possible before we publish this data.

所以这总是个权衡：是尽快发布，让潜在受害者及时得到警告？

So it's always decision, do we want to release this as soon as possible, so all the potential victims are informed?

还是再等一段时间，以便发现更多细节，提供更完整的分析？

Or do we wait a little bit longer because then we can discover and publish more information and provide more complete picture?

对。

Yeah.

那名字本身呢？

Well, how about the name itself?

我是说，‘Curly Comrades’这名字起得真巧妙。

I mean, curly comrades, that's a clever naming here.

我个人特别喜欢这个名字。

I love the name personally.

我们通常会准备好几个备选名字，这是原因之一。

And are two reasons because we always have like couple of different names that we can choose from.

我觉得‘Cuddly Comrades’这个名字聪明在两点上。

With Cuddly Comrades, I think it is smart name for two reasons.

第一点，它确实准确反映了这个威胁组织的技术特点。

The first reason is, it is actually really reflecting the technical details about this threat actor group.

他们特别喜欢用 curl。

They like to use curl.

还有，经常用 exe 文件。

Exe a lot.

同时，我们注意到他们用来维持持久访问的一个很有趣的手法，就是劫持引擎的 COM 对象。

And at the same time, one of the most interesting techniques that we noticed for the persistent access was hijacking the com objects for the engine.

所以‘Curly Comrades’这个名字里‘COM’大写，就是从这儿来的。

So that's where the curly comrades, the COM is capitalized, is technically coming from.

第二点是，我觉得我们安全行业很多时候在美化网络犯罪，给它们起些听起来特别酷炫的名字，这其实不太妥当。

The second part of the story is, I feel we as a security industry are doing kind of disservice by glamorizing the cybercrime in many cases, picking up the names that sounds like really fancy and cool.

所以我们想强调的是，这些人根本一点都不酷。

So what we also wanted to do is we just wanted to point out that these guys are not cool.

他们就是网络罪犯。

They are cyber criminals.

因此我们也想选一个能反映我们真实看法的名字，你觉得合理吗？

So we really wanted to find also the name that would reflect what we think about them, if it makes sense.

是的，有道理。

Yeah, it does.

那他们主要针对哪些地区和行业？背后的动机又是什么？

Well, tell us what particular regions and sectors that they seem to be targeting and what their motivations seem to be.

根据我们观察到的所有手法和行为，他们的动机很明确：长期窃取数据。

So the motivation, as we've seen to do all the tactics, techniques, everything they were going after is long term data exploitation.

对我们来说，这是其中一个高级持续性威胁组织。

So for us, this is one of the APT groups.

我们已经看到他们多次发动攻击。

We've seen them actually attacking multiple victims.

我们发布的研究报告，并不是基于单一受害者的案例。

So the research that we published, it is not based on a single victim.

正如我所说，我们花了数月时间监控并记录QDUB的所作所为。

As I said, we spent months monitoring and documenting what this QDUB is doing.

但我们发现，他们的目标集中在那些目前在地缘政治上位于俄罗斯和欧洲之间的国家。

But what observed their focus is, they targeting counties where they are geopolitically halfway between Russia and Europe at this moment.

我们看到他们在格鲁吉亚的司法和政府机构下手，不是美国的那个，而是位于俄欧交界处的格鲁吉亚。

So we've seen them targeting judicial and government bodies in Georgia, not the one in The US, the one in the borders between Russia and Europe.

他们还攻击了摩尔多瓦的能源分销公司。

We've seen them targeting energy distribution company in Moldova.

对我们来说，其中一个重点是，他们利用大量合法但已被入侵的网站作为流量中转站。

But one of the highlights for us was also that they used large network of legitimate but compromised websites as traffic delays.

我们记录了一些，但相信还有更多没被发现。

We documented some of them, but we believe there must be a lot more.

这也说明，我们所看到的这个APT组织，即使已经记录了不少，也只是他们庞大恶意网络中的一小部分。

So that also tells us this APT, that what we've seen, even though we documented quite a lot of it, is probably just a small part of a much larger network of compromised web infrastructure they use.

我想说的是，实际受害者的总数，肯定远比我们目前看到的要多得多。

So what I'm trying to say, the total number of victims is definitely significantly higher than what we've seen.

你能给我们讲讲他们通常是怎么操作的吗？

Well, can you walk us through what a typical engagement looks like?

我的意思是，当Curly Comrades盯上一个人时，一般会怎么下手？

I mean, when curly comrades sets their sights on someone, how does it usually go down?

是的。

Yes.

我觉得，而且这种情况很常见，我们完全不清楚他们最初是怎么入侵的。

So I would say, and again, this is something that is very common, we don't have any insights into initial access method they used.

这其实非常普遍。

And that is very common.

这属于取证调查。

Again, it's forensic investigation.

不像电影里那样，每一步都清清楚楚，中间一点空缺都没有。

It's not like in the movie where you know exactly like every single step would happen and there are no gaps.

很多时候，中间都缺了很大一截。

In many cases, there are big gaps.

我们得通过研究其他受害者、收集更多数据来拼凑这些缺失的部分。

We try to figure them out by looking at other victims, collecting more data.

这也是为什么这类研究需要投入大量时间和精力的原因之一。

So that is part of the reason why research like this really take a lot of effort and time.

至于最初的入侵方式，很多时候我们根本不知道，也永远不可能知道。

So initial access, in many cases, we don't know and we will never know.

是的。

Yeah.

我们追踪到的活动实际上能追溯到2023年。

We track the activity actually to, I want to say, 2023.

这里有一件重要的事。

So, here is an important thing.

我们是从2024年年中开始监控他们的。

We started monitoring them from mid-twenty twenty four.

但在进行取证调查时，你需要查看那个日期之前发生的所有事情。

But during forensic investigation, you are looking at everything that happened before that date.

所以我们分析了所有发现的痕迹，确保我们了解他们用来混淆我们的时间戳手法。

So looking at all these artifacts that we were discovering, making sure that we are aware of the timestamping technique, where they are trying to confuse us.

我们发现最早的活动时间是2023年11月。

The earliest date that we found was November 2023, when they were active.

所以，虽然我们不知道他们最初是怎么入侵的，但可以确定他们已经活动很久了。

So again, we don't know initial access when it happened, but we can't get that they've been active for a long time.

现在，

Now,

3Georg在这里做的是，我们发现了一次部署资源客户端的尝试，这并不罕见，是个开源项目。

what 3Georg does here is that we detected an attempt to deploy a resource client, which is not unusual, it's open source project.

Bitdefender团队刚开始调查，很快就发现这远不止是一次孤立的攻击。

So Bitdefender team just started investigating it and quickly found out this is much bigger than just some isolated action.

我们发现了更多被入侵的机器和凭证，开始把所有线索串联起来。

We found more compromised machines, credentials, started putting everything together.

这个威胁组织非常注重隐藏自己的访问路径，确保即使被发现并清除，也能通过多种方式重新潜入。

We've seen this threat actor have been really focused on proxying their access and making sure they have multiple ways how to get back to the victim if they would be discovered and kicked out.

我们之前提到的Esox隧道找到了，还在一台面向公网的主机上发现了他们自建的SOX5服务器。

So we found the Esox tunnel that I mentioned before, but we also found the custom SOX5 server on one of the internet facing hosts.

这算是另一个备用的入口。

That was one of the alternative entry points.

后来我们还发现Dagberg试图在受害网络和攻击者基础设施之间建立多条隧道，用的工具包括SSH和STunnel。

And later on, we discovered Dagberg attempts to build multiple tunnels between the victim network and infrastructure of the threat actors using tools like SSH or STunnel.

这种持续努力恢复访问的手段，是APT组织的典型做法，这个团伙也不例外。

So that was something that we've seen as kind of the persistent effort to regain access was a very common tactic of APT groups, including this one.

我们能深入看看他们是如何维持持久化的吗？

Can we dig into their persistence here?

研究报告中提到一个叫MUCOR代理的工具，帮助他们隐藏行踪。

The research talks about, I believe it's called MUCOR agent, to help them stay hidden.

这个东西具体是怎么运作的？

What's going on there?

对。

Yeah.

对我个人来说，MucorAgent绝对是最大的发现。

So the MucorAgent was definitely the highlight for me personally.

我们在多个系统上都发现了它。

What what we found we found it on multiple systems.

这是他们核心工具包里常用的一个工具。

So this was one of the tools that they've, that was like part of the core toolkits they've been using.

它是用.NET写的，能执行PowerShell脚本，这种手法在APT组织里很常见。

It's written in dot net, and it executes PowerShell, something that we are seeing happening with APT groups quite a lot.

最让我们感兴趣的是，这个MucorAgent是如何被激活的。

What was the most interesting for us was the way how this mucoq agent is activated.

我们其实一直在找有没有人提到过类似的东西，但没发现任何相关研究。

It's really we try to find anyone referencing anything similar, but we couldn't find any research.

据我所知，我们是第一个记录下这个的。

So as far as I know, we are the first one documented this.

他们具体的做法是这样的。

So what they are doing is the following.

这次攻击的第一步，涉及了MucorAgent的多个组件。

The first step in the attack, there are multiple components of this mucoid agent.

第一步是利用一个.NET程序集，去劫持COM处理器。

The first step is they are using the dot net assembly that is going to hijack the COM handler.

如果你从来没接触过COM对象，那恭喜你，我早年可是花了好几年跟DLL打交道。

Now, if you've never been dealing with a COM object, congratulations, I spent many years fighting with the DLL back in my early days.

这玩意儿真是让人头疼。

So this is the stuff of nightmares.

这是Windows执行代码的一种特别复杂的方式——它不直接运行可执行文件，而是调用一个类ID，这个类ID又可能触发另一个类ID，从而执行某些操作。

This is the really complicated way how Windows sometimes execute the code instead of executing the binary, they just called the class ID that might call another class ID, execute something.

说实话，我不喜欢这一点，一个典型的Windows系统里有成百上千个COM类ID。

To be honest, I don't like, there are hundreds or maybe thousands of class IDs that are part of the COM on a typical Windows system.

别藏着掖着，马丁。

So Don't hold back, Martin.

别藏着掖着。

Don't hold back.

是的。

Yeah.

这事儿又让我想起了当年二月的那些夜晚，我整晚做噩梦。

This this was, again, like, had night back in the days in February, I had nightmares about this.

所以。

So

我明白了。

I see.

我们马上回来。

We'll be right back.

在移动应用安全方面，差不多就行其实很危险。

When it comes to mobile application security, good enough is a risk.

最近一项调查显示，72%的组织去年至少遭遇过一次移动应用安全事件，92%的受访者表示过去两年威胁水平持续上升。

A recent survey shows that 72% of organizations reported at least one mobile application security incident last year, and 92% of responders reported threat levels have increased in the past two years.

GuardSquare 为您的移动应用提供最高级别的安全防护，同时不影响性能、上线速度或用户体验。

GuardSquare delivers the highest level of security for your mobile apps without compromising performance, time to market, or user experience.

了解更多 GuardSquare 如何为您的 Android 和 iOS 应用提供行业领先的保护，访问 www.guardsquare.com。

Discover how GuardSquare provides industry leading security for your Android and iOS apps at www.guardsquare.com.

大多数系统信任的范围都远远超出了必要程度，而攻击者正是利用了这一点。

Most environments trust far more than they should, and attackers know it.

ThreatLocker 通过在执行时默认拒绝所有操作来解决这个问题。

ThreatLocker solves that by enforcing default deny at the point of execution.

启用 ThreatLocker 的白名单机制，能彻底阻止未知程序运行。

With ThreatLocker allow listing, you stop unknown executables cold.

通过网络隔离，您可以精准控制受信任应用的行为。

With ring fencing, you control how trusted applications behave.

通过 ThreatLocker 的 D a C 配置防护机制，你能真正确信你的环境没有配置错误，并且清楚了解是否符合合规要求。

And with ThreatLocker D a C defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards.

ThreatLocker 是实现零信任原则最简单的方式，还不用承受复杂的运维负担。

ThreatLocker is the simplest way to enforce zero trust principles without the operational pain.

它提供强大的保护，让 CISO 能够真正看清情况、掌控全局，真正安心。

It's powerful protection that gives CISOs real visibility, real control, and real peace of mind.

即使安全团队规模很小，ThreatLocker 也能让零信任变得切实可行。

ThreatLocker makes zero trust attainable, even for small security teams.

看看为什么成千上万的企业选择 ThreatLocker 来减少告警疲劳、从源头阻止勒索软件，并重新掌控自己的环境。

See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments.

立即前往 threatlocker.com/n2k 预约演示。

Schedule your demo at threatlocker.com/n2k today.

他们所做的，是从众多 COM 对象中选一个 CLS ID——那个 16 位的类 ID 我就不念了——然后把它的目标指向改掉，原本应该触发的是正常的 .NET 框架，结果却运行了 mucoid 代理。

So, what they are doing is that they choose one of these many, many com objects with CLS ID, the class ID that I'm not going to say, it's 16 characters and so And they just changed the target of that com object, instead of pointing to the normally executed dot net framework that will be triggered, it was actually running the mucoid agent.

这就是第一步。

So that is step number one.

他们其实就是把路径重定向了。

Essentially, they just redirect it.

如果有人想运行 .NET 框架的某个部分，结果不会执行原本的目标，而是运行恶意代码。

If something will try to run part of the dot net framework, instead of running the target, it's going to run malicious code.

这是第一种手法。

That's one.

更大的问题是，这个 COM 处理器到底是怎么被触发的？

Now, the bigger question is, how is this com handler actually triggered?

到底是谁在启动它？

What is going to do it?

这里最巧妙的地方在于，他们用了计划任务，这个功能默认是关闭的。

And here comes the really smart part, where they are using scheduled task for this, that is disabled by default.

如果你在排查开机时启动的所有程序，根本不会注意到这个，因为它默认是禁用的，根本不会运行。

So if you are looking at everything that is starting, for example, at a startup of machine, you are not going to look at this one, because again, it's disabled, it's not executed.

这个计划任务负责触发一个叫 Engine 的组件。

The scheduled task is responsible for something called engine.

在 .NET 框架里，.NET 本身不是编译好的代码。

In dot net framework, dot net framework comes, it's not compiled code.

所以每次你在一台新机器上第一次运行 .NET 代码时，它都会被转换成一种叫 IL 的中间语言，这种语言会针对当前机器做优化执行。

So what happens on every single machine when you execute dot net code for the first time, it's turning into something called IL, which is language that's optimized on execution on that specific machine.

其实你也可以提前把所有这些 .NET 代码编译好，这样运行起来就更快了。

Now, you can kind of also precompile all this dot net code, so it just executes faster.

说到这个，我以前经常处理这类问题，尤其是在优化大规模服务器集群的执行效率时。

Again, coming back from my background, I used to deal with this a lot when we were optimizing execution on like large farms of servers.

说白了，你就是提前把 .NET 代码编译好。

So, really, you are doing is that you are just pre compiling the dot net code.

这种预编译通常发生在特定时刻，比如你安装了新的 .NET 版本，就会触发代码的预编译。

Now, when this is happening is at very specific times, you install a new dot net that can trigger this pre compilation of the code.

安装新应用的时候，也可能触发代码的预编译。

You install a new application, this can trigger pre compilation of the code.

有时候这是为了优化，但触发的时间非常随机。

Sometimes it is optimization, but it happens at really very random intervals.

在这种情况下，操作系统只是启用这个计划任务。

What the operating system is doing in that case is that it will just enable the scheduled task.

而这个计划任务的触发条件不是开机、登录或固定时间，跟平常不一样。

And the trigger for the scheduled task is not on startup, logon, or specific time, as is usual.

这里的触发条件是系统空闲时。

The trigger here is on idle.

本质上，你是在告诉机器：帮我把这里所有的 .NET 代码都预编译一遍，什么时候你有空就什么时候做。

Essentially, are telling the machine, hey, I need you to pre compile all the dot net code that you have here, and just do it anytime it's good time for you.

只要你没在忙别的事，就可以开始。

If you are not busy doing something, that's when you can start.

.NET 预编译会把所有代码都处理完，完成后它会自动把计划任务再关掉。

This dot net precompilation is going to precompile all the code, and when it's done, it will go back and disable the scale task again.

至于什么时候触发，完全没有固定规律。

And then at the random time interval, it's not specified in any way.

操作系统自己会决定什么时候启动这个原生映像生成器，也就是背后的引擎。

Again, operating system can decide I want to trigger this native image generator, that's the engine.

所以它会再次启用。

So it will enable it again.

对你来说，不仅什么时候启用完全无法预测，连什么时候执行也完全没规律。

And it's completely unpredictable for you, first of all, when it's going to be enabled, but also when it's going to be executed.

执行完之后，它又会被禁用。

And after it's done, it is disabled again.

所以对你而言，就好像它从来都没运行过一样。

So it looks to you as if it was never executed before.

这就是 muCore 组件的工作方式。

And that is how the muCore agent is working.

所以，它不仅窃取了一个藏在成千上万条日志键后面的、由十六位字符串隐藏起来的类。

So again, not only it is hijacking one of the con classes that are completely hidden in like thousands of different logistic keys behind the 16 digit long string.

这只是第一部分，第二部分是：这个机制是如何被触发、如何被加载的？

That is the first part of it, but it's also the second, how is this triggered, how is this loaded?

这招也很聪明，它利用了一个被禁用的计划任务——表面上是禁用的，但实际上照样能运行。

That's also smart because it's relying on the schedule task that is disabled, but just a pigs to be disabled, but it actually executes.

这么说，这个操作相当复杂，对吧？

So is it fair to say that this operation is fairly sophisticated?

是的，毫无疑问。

Yeah, absolutely.

正如我之前提到的，这只是第一部分。

So as I was mentioning, this was the first part.

我们当时记录了大量内容。

There was a lot that we documented.

正是这一点引起了我们的注意。

This was what caught our attention.

但后面还有更多值得观察的地方。

But that was a lot more seeing.

而且，他们使用的基础设施，比如下载恶意代码并用作命令与控制服务器的那些网站，大多数其实并不是恶意网站。

And again, the infrael structure that was used, downloading some malicious code used as the command and as the C2 server, for example, for communication, most of it were not malicious sites.

几乎全是被入侵的正规网站，只是被改造成了这个网络的一部分。

Almost all of it were legitimate sites that were just compromised and redesigned to be part of this network.

所以，这也是一个非常明显的迹象，说明这个行动远比我们想象的更高级。

So again, that is one of the best signs that we have telling us like this is much more advanced operation.

他们一直悄无声息地潜伏了很长时间。

They stayed stealthy under the radar for a very, very long time.

所以，这比我们现在看到的任何情况都要大规模得多。

So, yeah, it's much bigger than what we are seeing today.

那韧性方面呢？

What about resilience?

我的意思是，一旦防御体系启动，他们是怎么应对的？

I mean, when defenses spring up, how do they respond to that?

这种情况很常见。

That is very common.

一旦被赶出去，他们会用多种方式重新潜入。

So they used multiple methods how to get back inside if they are kicked out.

对于这类高级持续性威胁来说，这再正常不过了。

That is very common for these APTs.

我们最近调查的这次活动里，他们做了一件事，这在所有网络犯罪分子中都很常见——不管是为钱还是受国家支持的，他们越来越不再依赖恶意软件，转而更多地使用系统自带的普通工具。

The last activity that we investigated, they they did something that we are seeing doing all the cyber criminals, whether they are financially motivated or state affiliated, they are switching less and less to use malware, and they are switching more to use normal common binaries.

比如在Kugly Kongregs的案例中，过去他们用过各种工具，但最近这次——我记不清具体日期或时间了，不过这是我们调查的最后一次事件——他们用了不同的手法。

So, for example, in the case of Kugly Kongregs, we've seen them using different tools in the past, but the last incident, and I don't see the date here or time, but this was the last one we investigated.

他们用了SSH，还用了S隧道套件里的TS隧道来加密TCP流量。

They used SSH, and they used the TS tunnel that is part of the S tunnel suite for encryption of the TCP traffic.

这样一来，就很好地隐藏了SSH通信，绕过了基于网络的检测机制。

So it's really obfuscating the SSH communication and evading the network based mechanisms in this case.

但和很多这类组织一样，他们用了多个工具、多个终端、多个内部网关。

But again, as with many of these groups, they used multiple tools, multiple endpoints, multiple gateways inside the system.

所以说，这类行动通常都非常复杂。

So again, like all these operations are usually very sophisticated.

这次也不例外。

This is not an exception.

对。

Yeah.

根据你收集的关于这个组织的所有信息，你有什么建议？

So given everything that you've collected here about this group, what are your recommendations?

组织应该如何更好地保护自己？

How how should organizations best defend themselves?

如果我看看我们记录的所有TTPs，我也会给出一些更通用的建议。

So if I look at everything we documented for the TTPs, and I will also give like more general recommendation.

在我们做的大多数调查中，都发现了两个主要问题。

The first one is most of these investigations we are doing, we are seeing two big problems.

第一个问题是，受害者没有部署EDR或XDR系统。

The first one is that the victim doesn't have EDR or XDR.

如今我们面对的大多是现代威胁行为者，遇到的更多是可疑行为，而不是明显的恶意活动。

We are dealing a lot more today with all the modern threat actors, we are dealing a lot more with suspicious behavior, not clearly malicious.

所以你必须有工具能过滤掉这些干扰信息，帮你 pinpoint 出真正需要调查的线索。

So you really need to have the tools that will go through this noise and highlight for you, these are the things you should investigate.

这一点确实值得认真考虑。

And it's really good to think about it.

现在不再是非黑即白，非坏即好那么简单了。

It's no longer binary just this is bad or this is good.

更多是概率问题，比如我们有60%的把握认为这行为可疑。

It's all about percentages like this is we are 60% sure this is suspicious.

所以需要一套真正高效的EDR或XDR系统，既能减少误报，又能提供可操作的线索。

So having really good EDR, XDR that doesn't provide doesn't generate like too much noise, it's still actionable.

要有效发现并缩短威胁在你网络中潜伏的时间，这是最有效的方法之一。

One of the best things how to detect, how to minimize the time when the threat tactics are on your network.

这算是第一点。

So that would be one.

而且在很多调查中，我们发现这些工具根本就没部署。

And again, in many investigations, are just seeing these tools are not deployed.

我们经常遇到的第二个问题是运营上的漏洞。

The second one that we see very often are operational gaps.

我的意思是，有些公司虽然买了EDR或XDR解决方案，

And what I mean by this is some companies will buy EDIXDR solutions.

到最后，他们只会觉得，只要有了这个工具，问题就自然解决了。

And then at the end, all they are going to do is they will just think that that is the tool that will solve the problem.

但你想想，如果没有自己的安全运营团队，EDR和XDR其实没多大用处。

But if you think about it, EDRXDR is not really that useful if you don't have your own security operations.

真正关键的是，你得有一个配备齐全、训练有素的SOC，这才是流程、人员和工具的结合。

So, having your own SOC that is staffed properly, trained properly, is the combination of process people and tools.

如果你没有专人去查看和处理这些告警，最后就会陷入我们见过无数次的情况——调查之后发现，到处都是危险信号，却没人去回应。

Then if you don't have these people looking at those alerts and triaging, then you will end up in a situation that we've seen many, many times where after investigation like this, we can conclude there are red flags all over the place, and no one was just responding to them.

我不是说这一个具体案例，而是我们研究中普遍看到的现象。

I'm not saying this particular investigation, but more broadly what we are seeing in our research.

所以，确保你用的工具能帮你发现网络、终端和云端服务器上的异常行为。

So, again, make sure you have the tools that will highlight to you suspicious activity on the network, on endpoints, on servers in the cloud.

同时，也要有能响应这些告警的人，不管是内部的SOC团队，还是外包的托管检测与响应服务。

And also, you have the people that can respond to it, whether it's the SOC or is the managed detection and response services that you can use.

最后一个建议是，一定要跟上最新的安全研究进展。

The last recommendation I would do is make sure that you are keeping up with the latest research.

我们现在看到更多‘无文件攻击’的案例了。

Conversation, we are seeing a lot more of the living of the land attacks.

各种网络罪犯正在从使用专用工具，转向直接利用系统上已有的东西。

We are seeing all kinds of cyber criminals transitioning from using specialized tool to just using whatever is available on those systems.

高级持续性威胁组织是最后一批还依赖定制恶意软件的群体，这些软件很难被发现。

APTs are one of the last groups where at the end, they usually rely on the custom malware that's really hard to detect.

但即便如此，他们也在用这些现成的工具。

But again, even them, they are using these tools.

他们用的都是合法的远程监控和管理工具，也就是RMM工具。

They are using legitimate remote monitoring and management, the RMM tools.

我们看到所有这些网络罪犯都采用了同样的套路：只用系统里本来就有的东西，根本不带任何新工具进来，这样就很难在网络中被发现。

So we see all these cyber criminals adopting the playbook where they just use what is available on the system and they don't really bring anything new that can be easily detected on the network.

要警惕Living-off-the-Land技术，也要提防这些攻击者滥用合法工具。

So be aware of law beams, be aware of argument abuse by these threat actors.

感谢Bitdefender的马丁·祖热茨参与我们的讨论。

Our thanks to Martin Zugec from Bitdefender for joining us.

这项研究的标题是《一个新威胁行为者瞄准地缘政治热点地区》。

The research is titled A New Threat Actor Targeting Geopolitical Hotbeds.

我们在节目笔记里会提供相关链接。

We'll have a link in the show notes.

以上就是由 N2K Cyberwire 带来的‘研究星期六’。

And that's Research Saturday brought to you by N2K Cyberwire.

我们非常想知道你们对这个播客的看法。

We'd love to know what you think of this podcast.

你们的反馈能帮助我们提供真正有用的信息，助你在瞬息万变的网络安全领域始终保持领先。

Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity.

如果喜欢我们的节目，欢迎在你常用的平台给个评分和评论。

If you like our show, please share a rating and review in your favorite app.

也请填写节目笔记里的问卷，或者发邮件到 cyberwiren2k dot com。

Please also fill out the survey in the show notes or send an email to cyberwiren2k dot com.

本期节目由莉兹·斯托克斯制作。

This episode was produced by Liz Stokes.

本节目由埃利奥特·佩尔茨曼和特雷·赫斯特混音。

We're mixed by Elliot Peltzman and Trey Hester.

我们的制作人是珍妮弗·艾本。

Our producer is Jennifer Eiben.

彼得·基尔佩是我们的出版人，我是戴夫·维特纳。

Peter Kilpey is our publisher, and I'm Dave Wittner.

感谢收听。

Thanks for listening.

我们下次再见。

We'll see you back here next time.