###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2021/4/5 ~ 2021/4/9

1.重大弱點漏洞/後門/Exploit/Zero Day
美國政府警告Fortinet軟體漏洞恐遭國家駭客開採
https://www.ithome.com.tw/news/143629

Critical Auth Bypass Bug Found in VMware Data Center Security Product
https://thehackernews.com/2021/04/critical-auth-bypass-bug-found-in.html

還不快更新FortiOS？極惡勒索軟體Cring開始攻擊歐洲公司
https://reurl.cc/9Zqpv8

FBI及CISA發現有國家支持的駭客組織，正在針對尚未修補Fortinet軟體已知漏洞的使用單位發動滲透攻擊
https://reurl.cc/V3g13Y

思科修補SD-WAN vManage的遠端程式攻擊漏洞
https://www.ithome.com.tw/news/143708

Oracle PeopleSoft Enterprise PeopleTools存在未明漏洞
https://vul.wangan.com/a/CNVD-2018-08455

VMware 發布多種產品的安全更新
https://www.vmware.com/security/advisories/VMSA-2021-0004.html

VMware Security Advisory VMSA-2021-0005
https://www.vmware.com/security/advisories/VMSA-2021-0005.html

Cisco Security Advisories April 7 2021
https://reurl.cc/Kx5QpM

AMD承認Zen 3 CPU易受新型類Spectre攻擊影響但暫時問題不大
https://www.cnbeta.com/articles/tech/1110567.htm

SAP NetWeaver Application Server Java跨站脚本漏洞
https://vul.wangan.com/a/CNVD-2020-65561

Castel NextGen DVR 跨站請求偽造漏洞
https://vul.wangan.com/a/CNVD-2021-24901

Watch Out! Mission Critical SAP Applications Are Under Active Attack
https://thehackernews.com/2021/04/watch-out-mission-critical-sap.html

Microsoft Security Update for Edge
https://msrc.microsoft.com/update-guide/
https://msrc.microsoft.com/update-guide/releaseNote/2021-Apr
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21199
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21198
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21197
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21196
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21195
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21194

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
安聯中國人事大調整，涉及壽險、財險、資管公司等
https://news.sina.com.tw/article/20210402/38096230.html

數位金融監理科技 宜在地化
https://www.chinatimes.com/newspapers/20210404000114-260202?chdtv

個資外洩疑慮！　金管會開放金融科技業也能看「個人信用評分」
https://tw.appledaily.com/property/20210405/RKXQAY6KDZCDPMGCLVEDEGC4QI/

金管會：將嚴審將來銀行資安內控
https://reurl.cc/jq2Gvq

揭露金融生態圈戰略！ 金融大咖的野心與布局
https://reurl.cc/7yLEgl

3大純網銀對決　憑什麼爭出頭
http://n.yam.com/Article/20210405544690

企金數位需求大 花旗台灣追趕亞太級
https://www.chinatimes.com/realtimenews/20210408005254-260410?chdtv

虛擬券商藍圖未來將顛覆台灣證券市場
https://finance.ettoday.net/news/1956232

5-star customer service: fraudsters launch massive campaign against Indonesia’s major banks on Twitter
https://reurl.cc/zbLNbQ

Financial Cyberthreats in 2020
https://securelist.com/financial-cyberthreats-in-2020/101638/

3.電子支付/行動支付/pay/資安
台灣電子支付突破 1200 萬人使用！但支付 app 可能造成什麼不平等
https://buzzorange.com/2021/04/09/payment-app/

街口條款！金管會擬出手，明定電子支付平台不能賣共同基金
https://www.inside.com.tw/article/23091-jkos-clause-fsc

電子支付平台不得進行共同基金銷售活動
https://reurl.cc/yn0MAl

悠遊卡業績未達標 柯P怪林向愷抗命不做電子支付
https://www.chinatimes.com/realtimenews/20210409004874-260407?chdtv

LINE Pay Money即起開放繳納中信卡帳單
https://ec.ltn.com.tw/article/breakingnews/3494777

嗶悠遊卡方便但沒旅平險保障　跨縣旅行記得亮卡刷
https://www.mirrormedia.mg/story/20210409money002/

悠遊付進駐連鎖藥局　丁丁藥局滿額回饋10%
https://www.cardu.com.tw/news/detail.php?43001

政府剝不掉的「蝦皮」，下一步該怎麼走
https://www.inside.com.tw/article/23100-shopee-next-step

手機支付掛點！英男停車沒帶錢貼紙條「求別開單」　回來意外撿到一張黃牌
https://www.ettoday.net/dalemon/post/53971

中國央行四部委發文：支持符合條件的外資機構在海南依法獲取支付牌照
https://news.sina.com.tw/article/20210409/38165730.html

基隆稅局增「行動支付」 掃描QR-CODE條碼線上繳稅
https://reurl.cc/3NWYkL

汽機車牌照稅4月開徵 信用卡、行動支付繳稅回饋大車拚
https://news.cnyes.com/news/id/4623543

陸大媽買鞋行動支付 「惡劣小動作」輸入數字店員氣炸
https://reurl.cc/qm2Np0

四大超商今開始代收捐款　LINE Pay首度加入免手續費
https://tw.appledaily.com/life/20210405/I5JLFLTLMZE7RMLRXMAA5ZUMNQ/

4.加密貨幣/挖礦/區塊鍊/智能合約 資安
美國最大加密貨幣交易所Coinbase獲美SEC核准 4月14日直接上市
https://reurl.cc/NXLXVe

Archegos爆倉敲響金融警鐘 華爾街沒說的操盤秘密
https://www.chinatimes.com/realtimenews/20210403000026-260410?chdtv

ETH創歷史新高2,151｜1.61億以太坊選擇權下週到期；Filecoin單月爆漲5倍上230美元
https://www.blocktempo.com/161m-ethereum-options-expiry-china-is-crazy-for-folecoin/

Trezor｜冒牌冷錢包上架蘋果App Store！用戶不查遭詐「3,000萬台幣BTC」
https://www.blocktempo.com/app-store-scam-by-faking-trezor-app/

去中心化域名服務項目 Handshake 已修復通貨膨脹漏洞
https://www.chainnews.com/zh-hant/news/866906720286.htm

深度專欄｜中國公安部研究員 : 基於區塊鏈的「數位貨幣犯罪資產」追蹤及取證
https://www.blocktempo.com/research-on-tracking-criminal-digital-currency-assets/

疫情加速電子支付普及化 香港宜打造環球數字貨幣中心
https://www.hkcd.com/content/2021-04/07/content_1260332.html

疫情加速美國成第 2 大行動支付市場，2025 年過半手機將採非接觸式支付
https://technews.tw/2021/04/07/contactless-mobile-payments-surpass-half-smartphone-users/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
The "Fair" Upgrade Variant of Phobos Ransomware
https://blog.morphisec.com/the-fair-upgrade-variant-of-phobos-ransomware

勒索軟體 WannaCry 重出江湖！近半年受害者暴增 40 倍
https://3c.ltn.com.tw/news/43822

Muhstik殭屍網絡變種攻擊容器管理系統Kubernetes，漏洞危及2萬台服務器安全
https://s.tencent.com/research/report/1289.html

美國第6大學區遭勒索軟體入侵 傳支付逾1400萬元贖金
https://news.ltn.com.tw/news/world/breakingnews/3488288

美FCC籲堵華為禁令漏洞 荷媒爆華為藏後門
https://reurl.cc/KxL0dn

驚！日月光集團遭勒索病毒攻擊　一度關閉系統
https://tw.appledaily.com/property/20210405/JIX4LGXOQBFHZHK6NFTKPRYCOU/

要求4,000萬元贖金，傳支付逾50萬元脫困
https://reurl.cc/E2LmOv

駭客濫用GitHub Actions功能以於GitHub伺服器上挖礦
https://www.ithome.com.tw/news/143634

無線 IoT 設備製造商 Sierra Wireless 遭勒贖攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9138

Evolution and rise of the Avaddon Ransomware-as-a-Service
https://securityaffairs.co/wordpress/116282/cyber-crime/avaddon-ransomware-evolution.html

Cybercrime, great wave of IcedID attacks via mail zip attachments
https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-great-wave-of-icedid-attacks-via-mail-zip-attachments/

Povlsomware Ransomware Features Cobalt Strike Compatibility
https://www.trendmicro.com/en_us/research/21/c/povlsomware-ransomware-features-cobalt-strike-compatibility.html?utm_medium=smk

Ransomware gang wanted $40 million in Florida schools cyberattack
https://www.bleepingcomputer.com/news/security/ransomware-gang-wanted-40-million-in-florida-schools-cyberattack/

Pre-Installed Malware Dropper Found On German Gigaset Android Phones
https://thehackernews.com/2021/04/pre-installed-malware-dropper-found-on.html

Experts uncover a new Banking Trojan targeting Latin American users
https://thehackernews.com/2021/04/experts-uncover-new-banking-trojan.html

Researchers uncover a new Iranian malware used in recent cyberattacks
https://thehackernews.com/2021/04/researchers-uncover-new-iranian-malware.html

Hackers Exploit Unpatched VPNs to Install Ransomware on Industrial Targets
https://thehackernews.com/2021/04/hackers-exploit-unpatched-vpns-to.html

PHP Site's User Database Was Hacked In Recent Source Code Backdoor Attack
https://thehackernews.com/2021/04/php-sites-user-database-was-hacked-in.html

Hackers Targeting professionals With 'more_eggs' Malware via LinkedIn Job Offers
https://thehackernews.com/2021/04/hackers-targeting-professionals-with.html

Yanbian Gang Malware Continues with Wide-Scale Distribution and C2
https://www.riskiq.com/blog/external-threat-management/yanbian-gang-malware-distribution/

Zeppelin Ransomware Threat Assessment
https://unit42.paloaltonetworks.com/ransomware-threat-assessments/3/
https://github.com/pan-unit42/iocs/blob/master/Zeppelin_IOCs.text

Aurora Campaign: Attacking Azerbaijan Using Multiple RATs
https://blog.malwarebytes.com/threat-analysis/2021/04/aurora-campaign-attacking-azerbaijan-using-multiple-rats/

A Technical Analysis of the Ares Banking Trojan
https://www.zscaler.com/blogs/security-research/ares-malware-grandson-kronos-banking-trojan

New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp
https://research.checkpoint.com/2021/new-wormable-android-malware-spreads-by-creating-auto-replies-to-messages-in-whatsapp/

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
蘋果關閉iOS 14.4.1認證，無法從iOS 14.4.2 降級了
https://mrmad.com.tw/apple-stop-ios14-4-1-signing

中國駭客組織為竊取5G機密，鎖定全球電信業者
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9155

Can We Stop Pretending SMS Is Secure Now
https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/

Google limits which apps can access the list of installed apps on your device
https://thehackernews.com/2021/04/google-limits-which-apps-can-access.html

WhatsApp-based wormable Android malware spotted on the Google Play Store
https://thehackernews.com/2021/04/whatsapp-based-wormable-android-malware.html

Android to Support Rust Programming Language to Prevent Memory Flaws
https://thehackernews.com/2021/04/android-to-support-rust-programming.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
從太陽風網路戰談資安
https://talk.ltn.com.tw/article/paper/1440893

黑客威脅4大資訊安全＋防範建議　防毒軟件、密碼必備仲要做樣嘢
https://reurl.cc/E2Lm9A

臺灣資安研究之光！戴夫寇爾勇奪Pwn2Own冠軍，首度有臺灣隊伍獲獎
https://www.ithome.com.tw/news/143753

涉嫌駭入移民局系統 反貪會逮捕4名技術員
https://reurl.cc/L0gMWa

北韓駭客Lazarus利用新的後門程式對南非貨運公司下手
https://www.ithome.com.tw/news/143751

陸監管機構批准騰訊私有化搜狗
https://www.chinatimes.com/realtimenews/20210409004103-260410?chdtv

狂勝歐陽妮妮！ 中國記者採訪工安意外被阻擋 口袋莫名「多出8千塊」
https://reurl.cc/WEg1Gx

美國擬立法保護關鍵基礎設施抵禦駭客攻搫
https://blog.twnic.tw/2021/04/05/17808/

中國駭客入侵印度電力系統及疫苗生產商
https://www.ptt.cc/bbs/nCoV2019/M.1614830997.A.C5F.html

他們已鎖定能說好中國故事的「台灣素楷模」
https://reurl.cc/3Npxbj

中共如何全面統戰臺灣
https://reurl.cc/NXLrqx

中製硬碟 險成空軍雲端系統
https://news.ltn.com.tw/news/politics/paper/1441243

中共黑客如何侵入微軟？疑似通過事前竊取的個資
https://www.ntdtv.com/b5/2021/04/08/a103092011.html

從9歲童到歌手…中國政府被爆握700美國人黑名單
https://reurl.cc/WEg1N5

上海公安文件外洩　爆監控5千外國人
https://tw.appledaily.com/headline/20210402/MFNR4S3AWZHHZFNDFY7YIEK56M/

上海公安文件流出　驚見5000外國人被入庫、維吾爾人成「疑似恐怖分子」
https://tw.appledaily.com/international/20210401/U7DBAN4BAZHYXLH36KZNZM2EBA/

中共爆監控外國人信息 美國民眾：不會去旅遊
https://reurl.cc/mq4nxA

上海公安數據庫洩露揭示中國對維族人的監視
https://www.abc.net.au/chinese/2021-04-01/shanghai-files-shed-light-on-china-surveillance-state/100044228

中國宜堅持發展自主操作系統
https://www.eet-china.com/mp/a44937.html

胡劍江：基本法附件修訂案為「愛國者治港」奠定堅實保障
https://www.wenweipo.com/a/202104/03/AP6067f7cae4b04e1918cedde8.html

各界港青堅定支持完善選舉制度　落實「愛國者治港」原則
https://www.wenweipo.com/a/202104/02/AP6066d06ee4b04e1918ceb6db.html

人大為港完善選舉制度 助「一國兩制」行穩致遠
http://www.hkcd.com/content/2021-04/03/content_1259844.html

中聯辦指中央改善選舉制度獲香港各界支持
https://www.881903.com/news/local/2381707

中國外交部駐港公署：美方沒有資格打著價值觀的幌子插手香港事
http://www.hkcna.hk/content/2021/0402/889050.shtml

抓到宿敵把柄？　伊朗宣布逮捕「以色列間諜」
https://tw.appledaily.com/international/20210405/O7T7LHZMBJF3NOKAOLIFRJUYYE/

Biden's cyber executive order to include new rules for federal agencies, contractors
https://www.cyberscoop.com/cyber-executive-order-supply-chain-solarwinds/

Australians flagged in Shanghai security files which shed light on China's surveillance state and monitoring of Uyghurs
https://www.abc.net.au/news/2021-04-01/shanghai-files-shed-light-on-china-surveillance-state/100040896

Security threats increasing with 70% using personal devices for work
https://www.helpnetsecurity.com/2021/03/16/using-personal-devices-for-work/

FBI and CISA warn of state hackers attacking Fortinet FortiOS servers
https://www.bleepingcomputer.com/news/security/fbi-and-cisa-warn-of-state-hackers-attacking-fortinet-fortios-servers/

Myanmar orders wireless internet shutdown until further notice: telecoms sources
https://www.reuters.com/article/us-myanmar-politics-internet-idUSKBN2BO5H2

DeepDotWeb Admin Pleads Guilty to Money Laundering Charges
https://thehackernews.com/2021/04/deepdotweb-admin-pleads-guilty-to-money.html

NIST and HIPAA: Is There a Password Connection
https://thehackernews.com/2021/04/nist-and-hipaa-is-there-password.html

APT Actors Gaining Initial Access for Attacks
https://www.ic3.gov/Media/News/2021/210402.pdf

MITRE Madness: A Guide to Weathering the Upcoming Vendor Positioning Storm
https://thehackernews.com/2021/04/mitre-madness-guide-to-weathering.html

Hackers From China Target Vietnamese Military and Government
https://thehackernews.com/2021/04/hackers-from-china-target-vietnamese.html

資訊安全專員
https://www.104.com.tw/job/78mog

【資安所】業務經理
https://www.104.com.tw/job/78q4i

【IT】資安駐點工程師 - 2100178
https://www.104.com.tw/job/78hfu

業務專員 - 資安網路(無經驗可)
https://www.104.com.tw/job/78ftr

資安分析主任
https://nabi.104.com.tw/job/78qnf?moveto=skillList&content=10002948

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
網傳「台灣空軍四架F16戰機叛逃...是駐紮在桃園機場第16航空聯隊的飛機...飛機編號為TY160531」
https://tfc-taiwan.org.tw/articles/5241

趨勢科技聯手165防詐騙專線，公布2021第一季三大熱門詐騙手法
https://www.ithome.com.tw/news/143700

駭客賤賣價值近4千萬美元的禮物卡資料，疑自禮物卡交易網站竊得
https://www.ithome.com.tw/news/143710

詐騙犯給反詐刑警發「通緝令」，全程哈哈哈哈
https://news.sina.com.tw/article/20210403/38099868.html

網路時代個資透明 免費Wi-Fi恐造成資安風險
https://www.peopo.org/news/524955

假冒Netflix「免費看2個月」 500用戶信用卡個資遭竊
https://reurl.cc/4yOpdY

Google Play驚見假Netflix！誘拐用戶下載竊個資
https://newtalk.tw/news/view/2021-04-09/561102

「追劇兩個月免錢」！　惡意軟體騙多人上當　500人個資遭竊取
https://gotv.ctitv.com.tw/2021/04/1746466.htm

駭客把臉書總裁小紮的電話掛到了互聯網上
https://gnews.org/zh-hant/1067713/

臉書5億個資外洩！台灣73萬用戶上榜 傳創辦人祖克柏也受害
https://www.chinatimes.com/realtimenews/20210404002871-260410?chdtv

驚！ 臉書5億餘筆個資外洩 台灣逾73萬名用戶資訊恐遭駭客利用
https://news.ltn.com.tw/news/world/breakingnews/3489389

Facebook 又爆個資外洩，5.33 億用戶個資被發布在駭客論壇上
https://technews.tw/2021/04/04/facebook-hudson/

5.33億Facebook用戶數據被洩露，發言人：2年前的舊消息
https://finance.sina.com.cn/tech/2021-04-04/doc-ikmxzfmk3253016.shtml

【臉書遭駭】台灣73萬用戶受害　連薩克柏手機號碼也曝光
https://tw.appledaily.com/international/20210404/DJWGPNGWBNH7BLIABFODORV35M/

快查！Facebook爆台灣73萬用戶個資遭竊 超神網站讓你秒查自己是否「中招」
https://reurl.cc/E2yRja

【臉書遭駭】香港300萬中國67萬個資外洩　專家：改密碼、防詐騙簡訊
https://tw.appledaily.com/international/20210404/EBAYXMRF7FC2HDRGQNWBAWLGLY/

5 億 3,300 萬 Facebook 用戶個人資料被放上駭客討論區任人下載
https://www.pcmarket.com.hk/533-million-facebook-user-personal-information-leaked/

逾5億用戶個資遭貼至駭客論壇 臉書：2019年事件早已修復
https://www.cna.com.tw/news/firstnews/202104040010.aspx

逾5億臉書用戶個資 張貼線上駭客論壇免費使用
https://udn.com/news/story/7088/5364685?from=udn-ch1_breaknews-1-0-news

逾5億用戶個資外洩 臉書：有心人抓取非遭駭
https://www.truemii.com.tw/content/20210408400429-990105

香港300萬中國67萬個資外洩　專家：改密碼、防詐騙簡訊
https://tw.appledaily.com/international/20210404/EBAYXMRF7FC2HDRGQNWBAWLGLY/

FB資料外洩涉300萬香港用戶　林鄭行會立會成員中招
https://reurl.cc/DvLxoN

私隱專員公署就FB用戶資料疑遭外洩展開循規審查
https://reurl.cc/yn4O5E

自己資料自己救！極嚴重保安漏洞：Facebook 資料外洩事件
https://reurl.cc/WEMzaZ

Facebook 個資5.33 億外洩，但官方不打算告訴你「因為知道了也沒用」
https://www.techbang.com/posts/85781-facebook-responds-533-million-data-leak-notify-users

政府收緊公司查冊　財庫局許正宇：有人將資料武器化　應堵漏洞
https://reurl.cc/yn47Ra

只有黨能查！限公司查冊遭批 港府反控：有人將資料武器化
https://ec.ltn.com.tw/article/breakingnews/3489613

LinkedIn 三分之二用戶資料遭轉售 駭客4位數拍賣用戶資料
https://reurl.cc/2bemjm

LinkedIn驚爆資安疑慮！5億用戶個資被放上駭客論壇拍賣
https://newtalk.tw/news/view/2021-04-09/560997

假資安公司「SecuriElite」針對資安人員發起社交工程攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9158

隱私全被看光！特斯拉 Model 3 車內鏡頭遭破解，駭客釋出多段車廂內影片
https://technews.tw/2021/04/09/greentheonly-tesla-model-3/

網傳車內監控畫面曝光 特斯拉：北美以外錄影功能未開通
https://reurl.cc/dVgWn2

好友皆可看！美女師15min啪啪片PO網　學生群組廣傳：要告訴老師嗎
https://gotv.ctitv.com.tw/2021/04/1746337.htm

533 Million Facebook Users' Phone Numbers and Personal Data Leaked Online
https://thehackernews.com/2021/04/533-million-facebook-users-phone.html

Phishing Trends with PDF Files in 2020
https://unit42.paloaltonetworks.com/phishing-trends-with-pdf-files/

E.研究報告
EP42 - 資安攻擊的七個步驟｜網路攻擊鏈
https://open.firstory.me/story/ckn3lteeyz99e0823evu40upd

新世代主動式防禦興起，牽制駭客也成攻防手段之一（上）
https://www.ithome.com.tw/tech/143477

新世代主動式防禦興起，牽制駭客也成攻防手段之一（下）
https://www.ithome.com.tw/tech/143478

Hancitor's Use of Cobalt Strike and a Noisy Network Ping Tool
https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/

360發布“安全漏洞”雙報告政產學研發聲力挺“白帽黑客”
http://www.chinanews.com/business/2021/04-03/9447033.shtml

「安全漏洞」頻發敲響警鐘360 攜手政產學研為「白帽群體」保駕護航
http://www.geekpark.net/news/276152

復現影響79款Netgear路由器高危漏洞
https://zhuanlan.zhihu.com/p/361885899

用Rust重寫Linux內核，這可能嗎
https://www.sohu.com/a/458893575_355140

CTF-WEB中上傳漏洞的經典考法
https://zhuanlan.zhihu.com/p/362148183

Zero click vulnerability in Apple’s macOS Mail
https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c

THIS MAN THOUGHT OPENING A TXT FILE IS FINE, HE THOUGHT WRONG. MACOS CVE-2019-8761
https://www.paulosyibelo.com/2021/04/this-man-thought-opening-txt-file-is.html

Koadic
https://github.com/zerosum0x0/koadic

Attackers are abusing GitHub infrastructure to mine cryptocurrency
https://securityaffairs.co/wordpress/116294/malware/github-infrastructure-attacks-miner.html

RedTeamCCode
https://github.com/Mr-Un1k0d3r/RedTeamCCode/blob/main/unhook_crowdstrike_64.c

Code Scanning a GitHub Repository using GitHub Advanced Security within an Azure DevOps Pipeline by Kevin Alwell
https://hakin9.org/code-scanning-a-github-repository-using-github-advanced-security/

Cybercrime, grande ondata di attacchi IcedID via allegati zip
https://www.difesaesicurezza.com/areariservatacat/cybercrime-grande-ondata-di-attacchi-icedid-via-allegati-zip/

ToothPicker - An In-Process, Coverage-Guided Fuzzer For iOS
https://hakin9.org/toothpicker-an-in-process-coverage-guided-fuzzer-for-ios/

Navigating Transformation with Managed Cybersecurity Services
https://www.tripwire.com/state-of-security/security-data-protection/navigating-transformation-with-managed-cybersecurity-services/

FBI: APTs Actively Exploiting Fortinet VPN Security Holes
https://threatpost.com/fbi-apts-actively-exploiting-fortinet-vpn-security-holes/165213/

Feds say hackers are likely exploiting critical Fortinet VPN vulnerabilities
https://arstechnica.com/gadgets/2021/04/feds-say-hackers-are-likely-exploiting-critical-fortinet-vpn-vulnerabilities/

APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign
https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/

Play Wi-Fi Hacking Games Using Microcontrollers to Practice Wi-Fi Attacks Legally
https://null-byte.wonderhowto.com/how-to/play-wi-fi-hacking-games-using-microcontrollers-practice-wi-fi-attacks-legally-0238563/

ElegyRAT-C-Sharp
https://github.com/zhaoweiho/ElegyRAT-C-Sharp

Fuzzing sockets: Apache HTTP, Part 1: Mutations
https://securitylab.github.com/research/fuzzing-apache-1/

Pentesting a banking FTP service
https://blog.lexfo.fr/pentesting-pesit-ftp.html

Why Banks Are Still A Top Target For DDoS Attacks
https://www.imperva.com/blog/why-banks-are-still-a-top-target-for-ddos-attacks/

Navigating Cyber 2021
https://www.fsisac.com/hubfs/GIOReport2021/NavigatingCyber2021.pdf

11 Useful Security Tips for Securing Your AWS Environment
https://thehackernews.com/2021/04/11-useful-security-tips-for-securing.html

Rocke Group Actively Targeting the Cloud: Wants Your SSH Keys
https://www.intezer.com/blog/cloud-security/rocke-group-actively-targeting-the-cloud-wants-your-ssh-keys/

EtterSilent: The Underground’s New Favorite Maldoc Builder
https://intel471.com/blog/ettersilent-maldoc-builder-macro-trickbot-qbot/

Iran’s APT34 Returns with an Updated Arsenal
https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/

What is Astro Locker Team
https://news.sophos.com/en-us/2021/03/31/sophos-mtr-in-real-time-what-is-astro-locker-team/
https://github.com/sophoslabs/IoCs/blob/master/Ransomware-MountLocker.csv
https://github.com/sophoslabs/IoCs/blob/master/Ransomware-AstroLocker.csv

APT-C-23 Threat Group Uses Voice Changing Software in Espionage Attempt
https://www.cadosecurity.com/post/threat-group-uses-voice-changing-software-in-espionage-attempt

The Leap of a Cycldek-related Threat Actor
https://securelist.com/the-leap-of-a-cycldek-related-threat-actor/101243/

F.商業
電信三雄強攻新創 加碼孵金蛋
https://money.udn.com/money/story/5612/5364434

AWS網頁應用程式防火牆現可辨識並阻擋機器人流量
https://www.ithome.com.tw/news/143619

Cisco推出全新SASE架構全面保護端點至雲端，並優化雲端原生平台SecureX
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9141

Armv9 是 Arm 針對未來人工智慧、安全性與特定運算需求的解決方案
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9143

帆宣攜手逢甲 打造亞太區第1座5G專網智慧城市實驗場域
https://money.udn.com/money/story/5612/5377340

Fujitsu與趨勢科技合作企業 5G 專網資安
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9153

主動防禦遠端存取的資安威脅
http://n.yam.com/Article/20210409221631

G.政府
打造資安國家隊逾900人才缺口 政府多管道補強
https://news.ltn.com.tw/news/politics/breakingnews/3488173

國安局忠誠儀測室有四部冷氣直吹 「儀測員」送美受訓
https://udn.com/news/story/10930/5355698

國安局引用法核潛艦南海活動公開情報 指區域情勢不安
https://udn.com/news/story/10930/5361231

紅鏈滲透 國安局：情況非常嚴峻
https://ec.ltn.com.tw/article/paper/1440517

國安局新狙擊槍模組完成測試 採購五千發狙擊彈護層峰
https://udn.com/news/story/10930/5355817

國安局：中共111年召開20大 恐增台灣國安壓力
https://www.cna.com.tw/news/aipl/202103310313.aspx

台灣軍情萎縮　影響情報外交
https://reurl.cc/4yvyqL

資安疑慮》立委促建立供應商制度 過濾資格
https://news.ltn.com.tw/news/politics/paper/1441244

政府網防機制 國安局揪五大問題
https://news.ltn.com.tw/news/politics/paper/1441245

第六期國家資通安全法：佈建「主動防禦」聯網，躍升亞太資安樞紐
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9142

防範公務機密被駭　南市工務局辦講習強化資安維護
https://m.news.sina.com.tw/article/20210409/38162406.html

台積電、世芯晶片助中國製飛彈？王美花：未涉軍用
https://buzzorange.com/techorange/2021/04/09/china-missiles-use-tsmc-chip/

立院審太空發展法草案 吳政忠備詢
https://reurl.cc/R6gXLn

科技部定於4月28日舉辦「沙崙智慧綠能科學城C區資安暨智慧科技產業研發大樓招商說明會」
https://reurl.cc/g83Mep

110年「智慧製造資安強化推動計畫」
https://tiip.itnet.org.tw/newsPage.php?pk=391

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車 相關資安
Another Mirai variant used in attempted hacks on routers, switches
https://www.cyberscoop.com/mirai-unit-42-research-botnet/

智慧家庭裝置帶來了方便 卻讓家暴受害者比例漸增
https://reurl.cc/AgLA9K

嬰兒房監視器傳詭異「救救我」求助聲 網友驚：超恐怖
https://reurl.cc/zb4Qm0

SCADAfence: OT高端網路安全解決方案解決製造業的安全挑戰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9140

IT/OT稽核關鍵指標: ISO 27001及 IEC 62443
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9154

ICS Advisory ICSA-21-091-01
https://us-cert.cisa.gov/ics/advisories/icsa-21-091-01

I.教育訓練
Reverse Engineering 101
https://infosecwriteups.com/reverse-engineering-101-7acd1e6abfd8

Reverse-Engineering
https://github.com/mytechnotalent/Reverse-Engineering

How Cyrebro Can Unify Multiple Cybersecurity Defenses to Optimize Protection
https://thehackernews.com/2021/04/how-cyrebro-can-unify-multiple.html

Get Started in Cybersecurity
https://www.sans.org/cybersecurity-careers/?utm_source=Twitter&utm_campaign=New%20to%20Cyber

How the Work-From-Home Shift Impacts SaaS Security
https://thehackernews.com/2021/04/how-work-from-home-shift-impacts-saas.html

How Cyrebro Can Unify Multiple Cybersecurity Defenses to Optimize Protection
https://thehackernews.com/2021/04/how-cyrebro-can-unify-multiple.html

J.人工智慧/AI/ML/人臉辨識
人工智慧加速產業轉型 AI數據替製造業接上明日新電力
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=13&id=0000607579_MWF47DB88SVDWJ8JVZP5X

有賴通訊科技軟實力打造專網智慧工廠
https://udn.com/news/story/11726/5376280

YouTube「違規影片收視率」大幅降低 透過 AI 人工智慧有效過濾違規影片
https://www.cool3c.com/article/160861

6.近期資安活動及研討會
定期小聚暨GDG Taoyuan - GCP 4/11
https://www.meetup.com/GDGTaoyuan/events/277144104

MLDM Monday @ 三創育成 | 不平衡數據之機器學習分析流程：Python 程式手把手實作 4/12
https://www.meetup.com/Taiwan-R/events/277082073/

Android Code Club(Taipei) 4/14
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/bkzcmryccgbsb/

高雄 Rails Meetup 4/14
https://www.meetup.com/rails-taiwan/events/qxfvjkyccgbsb/

Scala Taiwan #38 - Mini One-afternoon Conference 4/17
https://www.meetup.com/Scala-Taiwan-Meetup/events/277230320/

技術管理者論壇 - 商業與技術的平衡 4/17
https://techxleadership.kktix.cc/events/techxleadership-2021-apr

CHECK POINT EXPERIENCE APAC 2021 4/20 ~ 4/21
https://virtual-cpx-apac.checkpoint.com/

高雄 Rails Meetup 4/21
https://www.meetup.com/rails-taiwan/events/qxfvjkyccgbcc/

Android Code Club(Taipei) 4/21
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/bkzcmryccgbcc/

Ubuntu Core 20 台北研討會 4/21
https://docs.google.com/forms/d/e/1FAIpQLScUZVv4yiSOBG87vOsRbhKRG50KXWIMw5ESIWzKDLBUV6VIqQ/viewform

Figma: a wireframe/mockup/graphic design tool for beginners 4/23
https://www.meetup.com/taiwan-code-camp/events/277230481/

6h UI UX Weekend Crash Course 4/24
https://www.meetup.com/taiwan-code-camp/events/276965238/

工業控制系統資通安全論壇 4/26
https://acfd2019.kktix.cc/events/831e3194

MLDM Monday @ 三創育成 | TBD (可能與機器人相關主題) 4/26
https://www.meetup.com/Taiwan-R/events/277082078/

國家高速網路與計算中心 教育訓練 【資安中階課程】你被已毒了嗎? - 初探行動應用APP安全風險檢驗 4/27
https://reurl.cc/6y74ly

How to Improve, Continuously? 如何能夠「持續地」改進 4/28
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003453/

Why Self-Organization Matters For Scrum Teams 5/20
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003653/

國家高速網路與計算中心 教育訓練 「大數據程式開發平台(VM版本)」建置與開發實務課程 5/21
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3945&from_course_list_url=course_index

學生計算機年會 SITCON 2021
https://sitcon.org/2021/

2021製造業資安論壇 6/10
https://docs.google.com/forms/d/e/1FAIpQLSeJEpc_ePmJGx2RO6hlSJQnmsFTzBT-2zkzjcnPHbdYS2UAhQ/viewform

行動應用APP安全檢測與實務(可抵內稽) 6/11
https://www.caa.org.tw/coursedetail-3515.html

Maximize the Output, or Optimize the Outcome 6/24
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003947/