###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2023/11/27 ~ 2023/12/01

1.重大弱點漏洞/後門/Exploit/Zero Day
大量Kubernetes機密暴露，波及多家軟體開發商上游
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10825

微軟: Lazarus攻擊知名多媒體軟體商訊連科技，發動供應鏈攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10818

檔案共用系統onwCloud重大漏洞已被用於攻擊行動
https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-owncloud-flaw-patch-now/
https://www.greynoise.io/blog/cve-2023-49103-owncloud-critical-vulnerability-quickly-exploited-in-the-wild
http://infosec.exchange/@shadowserver/111483954554586644

Warning: 3 Critical Vulnerabilities Expose ownCloud Users to Data Breaches
https://thehackernews.com/2023/11/warning-3-critical-vulnerabilities.html

殭屍網路GoTitan鎖定訊息導向中介軟體ActiveMQ重大漏洞而來
https://www.fortinet.com/blog/threat-research/gotitan-botnet-exploitation-on-apache-activemq

GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ
https://www.fortinet.com/blog/threat-research/gotitan-botnet-exploitation-on-apache-activemq

GoTitan Botnet Spotted Exploiting Recent Apache ActiveMQ Vulnerability
https://thehackernews.com/2023/11/gotitan-botnet-spotted-exploiting.html

Zero-Day Alert: Google Chrome Under Active Attack, Exploiting New Vulnerability
https://thehackernews.com/2023/11/zero-day-alert-google-chrome-under.html

Google修補今年第6個Chrome零時差漏洞CVE-2023-6345，其他採用圖像引擎程式庫Skia的軟體也可能曝險
https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html

AI框架Ray存在重大漏洞，攻擊者恐藉此對叢集運算節點進行未經授權存取
https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0

2.銀行/金融/保險/證券/金融監理 新聞及資安
200+ Malicious Android Apps Targeting Iranian Banks: Experts Warn
https://thehackernews.com/2023/11/200-malicious-apps-on-iranian-android.html

上海銀行涉資安問題！1.4萬客戶個資遭外洩　金管會出手開罰1000萬元
https://www.storm.mg/lifestyle/4927615

金管會開罰上海銀千萬元 創銀行個資外洩最重罰鍰
https://www.cna.com.tw/news/afe/202311280303.aspx

銀行因內控制度缺失致客戶資料外洩 金管會：核處 1 千萬元罰鍰
https://www.lawbank.com.tw/news/NewsContent.aspx?NID=197833.00

凱基證、統一證爆資安異常！證交所曝後續處理：與本日行情無關
https://today.line.me/tw/v2/article/LXLRowj

統一證券及凱基證券申報資安異常事件，證交所立即洽該2家證券商，經了解純屬個案內部電腦系統異常，與本日行情並無關係
https://www.tssdnews.com.tw/?FID=64&CID=710143#google_vignette

安碁資訊明年樂觀 金融業上雲需求下半年顯現
https://ec.ltn.com.tw/article/breakingnews/4507483

3.信用卡/電子支付/行動支付/pay/支付系統/資安
綁定 3 大 Pay 檢核手機門號機制，年底前全面上路
https://infosecu.technews.tw/2023/12/01/prevent-fraud-verification-mechanism/

防範手機綁定信用卡盜刷 金管會強化2大措施
https://ec.ltn.com.tw/article/breakingnews/4507859

迎街口全支付入TWQR 搶先布局日韓跨境掃
https://reurl.cc/Doz1xR

第三方支付和電子支付的合縱連橫
https://www.ctee.com.tw/news/20231109700108-439901

金融消保法修正三讀通過 納管電子支付業
https://reurl.cc/NyvaOp

一文看清支援泰國PromptPay互通的香港銀行和電子支付錢包　有哪些支付工具優惠
https://reurl.cc/8NElYX

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
被盜 5400 萬美元後上演「駭客奪權大戰」，KyberSwap 面臨生存危機
https://blockcast.it/2023/12/01/kyberswap-hacker-demands-complete-control-over-kyber/

中國公安部：有駭客犯罪分子利用區塊鏈智能合約漏洞大量增發「虛擬貨幣」套取他人財產
https://news.cnyes.com/news/id/5396339

北韓駭客洗錢工具 混幣器Sinbad遭美國制裁
https://reurl.cc/kax5ld

Web3 安全事件总损失约 3.49 亿美元
https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247498976&idx=1&sn=eff637f42227effd4a4683fc314d78ea

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
北韓駭客組織用惡意軟體，攻擊蘋果電腦操作系統
https://reurl.cc/NyvaRe

北韓駭客利用惡意程式載入工具RustBucket散布Kandykorn
https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/

英國愛德華七世國王醫院傳出遭到勒索軟體Rhysida攻擊
https://securityaffairs.com/154999/cyber-crime/rhysida-ransomware-king-edward-viis-hospital.html

資料分析系統Qlik Sense重大漏洞被用於攻擊行動，駭客發動勒索軟體Cactus攻擊
http://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

中國汽車內裝零件業者延鋒傳出遭到勒索軟體Qilin攻擊
https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-attack-on-automotive-giant-yanfeng/

勒索軟體Djvu出現變種Xaro，駭客將其偽裝成破解軟體散布
https://www.cybereason.com/blog/threat-alert-djvu-variant-delivered-by-loader-masquerading-as-freeware

勒索軟體駭客Black Basta敲詐逾1億美元贖金
https://www.bleepingcomputer.com/news/security/black-basta-ransomware-made-over-100-million-from-extortion/

勒索軟體駭客組織BlackCat聲稱是中石化網路攻擊事故的幕後黑手
https://twitter.com/AlvieriD/status/1729567746487124406

斯洛維尼亞大型能源供應商HSE遭遇勒索軟體攻擊，部分IT系統及檔案遭加密
https://www.bleepingcomputer.com/news/security/slovenias-largest-power-provider-hse-hit-by-ransomware-attack/

美國醫療保健業者Henry Schein傳出遭遇勒索軟體BlackCat攻擊
https://www.bleepingcomputer.com/news/security/healthcare-giant-henry-schein-hit-twice-by-blackcat-ransomware/

中國能源建設公司傳出遭到勒索軟體Rhysida攻擊
https://securityaffairs.com/154785/cyber-crime/rhysida-ransomware-china-energy.html

歐美7個國家聯手，搗毀對71個國家發動攻擊的勒索軟體集團，逮捕主嫌與4名共犯
https://www.bleepingcomputer.com/news/security/police-dismantle-ransomware-group-behind-attacks-in-71-countries/

美國醫療保健服務供應商Ardent Health Services遭遇勒索軟體攻擊，6個州、30家醫院受到波及
https://www.bleepingcomputer.com/news/security/ardent-hospital-ers-disrupted-in-6-states-after-ransomware-attack/

駭客針對遊戲公司發動勒索軟體攻擊，影響1.7萬名玩家，該公司拒付贖金並手動復原資料
https://www.bleepingcomputer.com/news/security/ransomware-attack-on-indie-game-maker-wiped-all-player-accounts/

哈瑪斯駭客運用後門程式SysJoker攻擊以色列組織
https://research.checkpoint.com/2023/israel-hamas-war-spotlight-shaking-the-rust-off-sysjoker/

Israel-Hamas War Spotlight: Shaking the Rust Off SysJoker
https://research.checkpoint.com/2023/israel-hamas-war-spotlight-shaking-the-rust-off-sysjoker/
https://intezer.com/blog/research/wildcard-evolution-of-sysjoker-cyber-threat/

Unveiling Parallax RAT: A Journey from Infection to Lateral Movement
https://www.esentire.com/blog/unveiling-parallax-rat-a-journey-from-infection-to-lateral-movement

DPRK state-linked cyber actors conduct software supply chain attacks
https://www.documentcloud.org/documents/24174869-rok-uk-joint-cyber-security-advisoryeng

DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads
https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/

The Mahagrass Organization (APT-Q-36) uses the Spyder downloader to deliver the Remcos Trojan
https://reurl.cc/DoznDN

New SugarGh0st RAT targets Uzbekistan government and South Korea
https://blog.talosintelligence.com/new-sugargh0st-rat/

Associated Press, ESPN, CBS among top sites serving fake virus alerts
https://www.malwarebytes.com/blog/threat-intelligence/2023/11/associated-press-espn-cbs-among-top-sites-serving-fake-virus-alerts

Hamas-Linked Cyberattacks Using Rust-Powered SysJoker Backdoor Against Israel
https://thehackernews.com/2023/11/hamas-linked-cyberattacks-using-rust.html

Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine
https://thehackernews.com/2023/11/key-cybercriminals-behind-notorious.html

N. Korean Hackers 'Mixing' macOS Malware Tactics to Evade Detection
https://thehackernews.com/2023/11/n-korean-hackers-mixing-and-matching.html

DJVU Ransomware's Latest Variant 'Xaro' Disguised as Cracked Software
https://thehackernews.com/2023/11/djvu-ransomwares-latest-variant-xaro.html

CACTUS Ransomware Exploits Qlik Sense Vulnerabilities in Targeted Attacks
https://thehackernews.com/2023/11/cactus-ransomware-exploits-qlik-sense.html

Qakbot Takedown Aftermath: Mitigations and Protecting Against Future Threats
https://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html

Chinese Hackers Using SugarGh0st RAT to Target South Korea and Uzbekistan
https://thehackernews.com/2023/12/chinese-hackers-using-sugargh0st-rat-to.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
視訊會議系統Zoom存在漏洞，有可能讓攻擊者挾持會議
https://appomni.com/blog_post/claiming-zoom-rooms-service-accounts-to-gain-access-to-tenants/

WhatsApp's New Secret Code Feature Lets Users Protect Private Chats with Password
https://thehackernews.com/2023/12/whatsapps-new-secret-code-feature-lets.html

Zero-Day Alert: Apple Rolls Out iOS, macOS, and Safari Patches for 2 Actively Exploited Flaws
https://thehackernews.com/2023/12/zero-day-alert-apple-rolls-out-ios.html

蘋果發布行動裝置及Mac電腦更新，修補2個已被用於攻擊行動的WebKit零時差漏洞
https://www.bleepingcomputer.com/news/apple/apple-fixes-two-new-ios-zero-days-in-emergency-updates/

中國吃鍋PO文露「點餐碼」　遭惡搞加點NT200萬元餐點
https://news.cts.com.tw/cts/general/202311/202311252256110.html

LINE記事本功能資安破洞！官方急曝止血方法
https://reurl.cc/x65D0E

憂資料遭駭 德勤與KPMG要求員工赴港需使用一次性手機
https://www.rti.org.tw/news/view/id/2188158

中國大陸犯罪集團駭入1440多萬部老年手機 獲利逾4.4億元
https://www.chinatimes.com/realtimenews/20231130002543-260409?chdtv

SIM卡调换黑客被判入狱 8 年，罚金 120 万美元
https://mp.weixin.qq.com/s?__biz=MjM5NjA0NjgyMA==&mid=2651249725&idx=3&sn=0cf8ae46ba606def778957ad6265fcb1&poc_token=HHLjaWWjLFM3i4nFHsgU9qbP1KW_mgodamX86wzr

美國 FCC 推新規定防制 SIM-swap 與門號攜碼攻擊
https://www.twcert.org.tw/tw/cp-104-7551-6f2b8-1.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
「上雲」部署注意數據安全　專家授3招提升安全
https://reurl.cc/V4Aapn

辦公用品零售商Staples傳出營運出現異常，起因是遭遇網路攻擊後關閉部分系統所致
https://www.bleepingcomputer.com/news/security/staples-confirms-cyberattack-behind-service-outages-delivery-issues/

醫療照護系統Capital Health遭遇網路攻擊，造成旗下醫院IT系統中斷
https://www.bleepingcomputer.com/news/security/capital-health-hospitals-hit-by-cyberattack-causing-it-outages/

北約網路聯盟23 強化資安應變
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1633204

日本JAXA遭網路攻擊 火箭、衛星資訊未受影響
https://www.rti.org.tw/news/view/id/2188127

日本航太研究機構JAXA遭遇網路攻擊，AD伺服器被非法存取
https://www.bleepingcomputer.com/news/security/japanese-space-agency-jaxa-hacked-in-summer-cyberattack/
https://japannews.yomiuri.co.jp/society/general-news/20231129-152511/
https://japan.kantei.go.jp/tyoukanpress/202311/29_a.html

美英等國簽協議、AI系統開始設計時須內建資安機制
https://www.ctee.com.tw/news/20231128700955-430702

中國駭客案件數三年連漲 年均增幅近28%
https://reurl.cc/6Qogbb

韓國國家警察廳：來自北韓的駭客，冒充韓國政府機構和記者竊取加密貨幣
https://news.knowing.asia/news/a81b7e61-6292-401e-a022-62b54d030410

潛伏兩年！中國駭客組織Chimera竊歐洲半導體巨擘恩智浦晶片設計
https://reurl.cc/dmNrWz

Google資安專家示警：中共對台灣網攻大增
https://reurl.cc/Ry5dvZ

俄羅斯聯邦航空運輸主管機關傳出遭駭，烏克蘭情報機構聲稱是他們所為
https://gur.gov.ua/en/content/voienna-rozvidka-ukrainy-zdiisnyla-kiberspetsoperatsiiu-shchodo-rosaviatsii-sanktsii-pryskoriuiut-aviakolaps-rf.html

阿富汗政府遭到名為HrServ的Web Shell鎖定
https://securelist.com/hrserv-apt-web-shell/111119/

奇異傳出遭到網路攻擊，駭客聲稱取得大量美國軍事研究單位的機密
https://www.bleepingcomputer.com/news/security/general-electric-investigates-claims-of-cyber-attack-data-theft/

英國、韓國針對北韓駭客組織的攻擊行動提出警告，駭客鎖定身分驗證系統漏洞下手
https://www.bleepingcomputer.com/news/security/uk-and-south-korea-hackers-use-zero-day-in-supply-chain-attack/
https://www.ncsc.gov.uk/news/uk-republic-of-korea-issue-warning-dprk-state-linked-cyber-actors-attacking-software-supply-chains
https://asec.ahnlab.com/wp-content/uploads/2023/10/20231013_Lazarus_OP.Dream_Magic.pdf

欧盟《网络弹性法案》达成临时协议
https://mp.weixin.qq.com/s?__biz=MzUzODYyMDIzNw==&mid=2247507029&idx=2&sn=dc4c564da89a72b5245744e433092d96

澳大利亚政府发布《2023-2030 年网络安全战略》
https://mp.weixin.qq.com/s?__biz=MzIyMjQwMTQ3Ng==&mid=2247489229&idx=1&sn=a6429d847f09a542b7b2b6ae64dc7ebb

Discover How Gcore Thwarted Powerful 1.1Tbps and 1.6Tbps DDoS Attacks
https://thehackernews.com/2023/12/discover-how-gcore-thwarted-powerful.html

New 'HrServ.dll' Web Shell Detected in APT Attack Targeting Afghan Government
https://thehackernews.com/2023/11/new-hrservdll-web-shell-detected-in-apt.html

Konni Group Using Russian-Language Malicious Word Docs in Latest Attacks
https://thehackernews.com/2023/11/konni-group-using-russian-language.html

North Korea's Lazarus Group Rakes in $3 Billion from Cryptocurrency Hacks
https://thehackernews.com/2023/11/north-koreas-lazarus-group-rakes-in-3.html

U.S. Treasury Sanctions Sinbad Cryptocurrency Mixer Used by North Korean Hackers
https://thehackernews.com/2023/11/us-treasury-sanctions-sinbad.html

U.S. Treasury Sanctions North Korean Kimsuky Hackers and 8 Foreign-Based Agents
https://thehackernews.com/2023/12/us-treasury-sanctions-north-korean.html

資安人才需求大 門檻沒想像中高、平均年薪破10萬
https://reurl.cc/Xm1XDj

數位資安技術專業人員
https://www.yourator.co/companies/Cathay-Financial-Holding/jobs/32742

實習《2023資安高手實習培育計劃》
https://ifm.ntut.edu.tw/p/404-1083-132648.php?Lang=zh-tw

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
大江網路資安事件
https://reurl.cc/A0VnGE

竊資軟體Lumma開發者聲稱能復原Google帳號的連線階段，挾持受害者帳號
https://www.ithome.com.tw/news/160011

Check Point《2023年第三季品牌網路釣魚報告》：AI加劇釣魚郵件辨別難度
https://www.techbang.com/posts/111216-check-points-q3-2023-brand-phishing-report-ai-makes-phishing

LINE母公司遭駭，超過40萬筆個資外洩、台灣也遭殃！背後原因跟Naver有關
https://www.bnext.com.tw/article/77571/line-japan-hack-naver?

LINE母公司遭網攻台灣用戶百筆資料外洩 數位部要求提補償方案
https://anntw.com/articles/20231128-veg0

Line證實遭駭遭、40萬筆個資外洩　台灣公司：已通知當事人
https://www.upmedia.mg/news_info.php?Type=24&SerialNo=188444

詐騙 臉書粉專「央廣徵遠端兼職的總統民調電訪人員」
https://tfc-taiwan.org.tw/articles/9939

提高數位韌性！面對郵件詐騙，資安長「知雲善用」已成企業現在進行式
https://www.ithome.com.tw/pr/160056

八種個資是駭客盜竊目標 虛擬貨幣和登入憑證風險最高
https://udn.com/news/story/7240/7606693

暗網最夯八類資料，虛擬加密貨幣資產、網站登入憑證風險最高
https://infosecu.technews.tw/2023/11/29/black-market-data/

個資漏洩！暗網買資料庫 佇網路賣錢趁欲5萬
https://news.pts.org.tw/article/669101

兩名嫌犯暗網購買近2千萬筆臺灣民眾個資，並以每筆500元兜售牟利
https://www.cib.npa.gov.tw/ch/app/news/view?module=news&id=1885&serno=26541a82-49f3-423b-a142-b22348fe43f8#

節慶網路詐騙！六大陷阱　消費者成駭客目標
https://www.technice.com.tw/techmanage/infosecurity/82393/

慢霧：有駭客組織利用Calendly的功能，插入惡意連結發起釣魚攻擊
https://reurl.cc/NyvaGe

連鎖折扣商店Dollar Tree資料外洩，近2百萬人受害，起因是外部供應商遭駭
https://www.bleepingcomputer.com/news/security/dollar-tree-hit-by-third-party-data-breach-impacting-2-million-people/

資安業者Gogolook揭露亞洲詐騙現況，臺灣4成民眾每週會遇到數起騙局
https://www.ithome.com.tw/news/160062

國際物流業者杜拜環球港務證實資料外洩，但攻擊者並未使用勒索軟體加密檔案
https://www.bleepingcomputer.com/news/security/dp-world-confirms-data-stolen-in-cyberattack-no-ransomware-used/

鸡西警方打掉本地电诈”跑分“团伙 | 常德警方破获网络开设赌场案——涉网犯罪每日情报
https://mp.weixin.qq.com/s?__biz=MzAxMzkzNDA1Mg==&mid=2247507553&idx=2&sn=2a301008fb096c5ca57104afbaffd624

加拿大政府外包業者遭駭，導致政府雇員資料被竊
https://www.twcert.org.tw/tw/cp-104-7553-a69e9-1.html

Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale
https://thehackernews.com/2023/11/cybercriminals-using-telekopye-telegram.html

Telekopye: Hunting Mammoths using Telegram bot
https://www.welivesecurity.com/en/eset-research/telekopye-hunting-mammoths-using-telegram-bot/
https://www.welivesecurity.com/en/eset-research/telekopye-chamber-neanderthals-secrets/

How Hackers Phish for Your Users' Credentials and Sell Them
https://thehackernews.com/2023/11/how-hackers-phish-for-your-users.html

Hackers Can Exploit 'Forced Authentication' to Steal Windows NTLM Tokens
https://thehackernews.com/2023/11/hackers-can-exploit-forced.html

10月身分驗證管理業者Okta資料外洩事故範圍擴大，存取該公司客戶支援系統的用戶皆受影響
https://www.bleepingcomputer.com/news/security/okta-october-data-breach-affects-all-customer-support-system-users/

Okta Discloses Broader Impact Linked to October 2023 Support System Breach
https://thehackernews.com/2023/11/okta-discloses-additional-data-breach.html

Transform Your Data Security Posture – Learn from SoFi's DSPM Success
https://thehackernews.com/2023/11/transform-your-data-security-posture.html

公共儲存庫曝露財星500大企業的K8s配置
https://blog.aquasec.com/the-ticking-supply-chain-attack-bomb-of-exposed-kubernetes-secrets

求职APP遭遇撞库攻击，是谁泄露了300余万条用户数据
https://mp.weixin.qq.com/s?__biz=MzI0NzE4ODk1Mw==&mid=2652092499&idx=1&sn=38781f3f384cfe3d78a06f16f560b8cb

E.研究報告/工具
矽谷最潮用語「e/acc」到底是什麼？OpenAI 事件如何推波助瀾
https://www.inside.com.tw/article/33444-what-is-effective-accelerationism

數位關鍵字110.平常不好意思問？一次破除四大家常資安迷思 ft.前HITCON戰隊領隊李倫銓
https://podcast.kkbox.com/tw/episode/SnDFu6_2ITE-l0A642

[iThome鐵人賽 2023] Day 36 - User Remapping 安全機制介紹 (含作業11-1、11-2)
https://www.youtube.com/watch?v=SpqBi33lHpI

Debops是什麼?推薦企業一次看懂Devops定義、流程及優缺點
https://www.digicentre.com.tw/industry_detail?id=137

人工智慧協作守護未來資安創造堅實防線
https://www.eettaiwan.com/20231128np21/

從駭客的角度學攻擊：惡意程式碼逆向全破解
https://www.books.com.tw/products/0010975459

Acess手工注入教学，带你掌握最新注入技巧
https://mp.weixin.qq.com/s?__biz=Mzk0OTQ0MTI2MQ==&mid=2247484283&idx=1&sn=b1b4f87d6b63b793b49b0c677cbedabf

ChatGPT爆資安漏洞！只用一個字，就讓語言模型吐出大量訓練材料，怎麼回事
https://www.bnext.com.tw/article/77635/openai-chatgpt-divergence-attack

研究人員要求ChatGPT重複輸入特定文字，逼得該大型語言模型洩露訓練資料
https://www.ithome.com.tw/news/160081

微軟資料庫管理軟體Access的外部連結功能可被濫用，外洩NTLM雜湊資訊
https://www.ithome.com.tw/news/160077

新型態藍牙攻擊手法Bluffs可讓攻擊者進行中間人攻擊，挾持藍牙通訊
https://www.bleepingcomputer.com/news/security/new-bluffs-attack-lets-attackers-hijack-bluetooth-connections/

APT-C-28（ScarCruft）组织针对韩国部署Chinotto组件的活动分析
https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247494166&idx=1&sn=c88fd9344d0a8b9597260d5d80dc7fce

逆向经历回顾总结
https://mp.weixin.qq.com/s?__biz=MzI3Mzk2OTkxNg==&mid=2247486033&idx=1&sn=34abbcdc23867f91234677ad3728399a

Attack Signals Possible Return of Genesis Market, Abuses Node.js, and EV Code Signing
https://reurl.cc/Nyv125
https://www.trendmicro.com/en_us/research/23/k/attack-signals-possible-return-of-genesis-market.html

Incident Response in Cybersecurity
https://www.threatlocker.com/why-threatlocker/incident-response

Tell Me Your Secrets Without Telling Me Your Secrets
https://thehackernews.com/2023/11/tell-me-your-secrets-without-telling-me.html

Kubernetes Secrets of Fortune 500 Companies Exposed in Public Repositories
https://thehackernews.com/2023/11/kubernetes-secrets-of-fortune-500.html

U.S., U.K., and Global Partners Release Secure AI System Development Guidelines
https://thehackernews.com/2023/11/us-uk-and-global-partners-release.html

Stop Identity Attacks: Discover the Key to Early Threat Detection
https://thehackernews.com/2023/11/stop-identity-attacks-discover-key-to.html

How to Handle Retail SaaS Security on Cyber Monday
https://thehackernews.com/2023/11/how-to-handle-retail-saas-security-on.html

Experts Uncover Passive Method to Extract Private RSA Keys from SSH Connections
https://thehackernews.com/2023/11/experts-uncover-passive-method-to.html

Discover Why Proactive Web Security Outsmarts Traditional Antivirus Solutions
https://thehackernews.com/2023/11/discover-why-proactive-web-security.html

This Free Solution Provides Essential Third-Party Risk Management for SaaS
https://thehackernews.com/2023/11/this-free-solution-provides-essential.html

7 Uses for Generative AI to Enhance Security Operations
https://thehackernews.com/2023/11/7-uses-for-generative-ai-to-enhance.html

F.商業
CyberArk 預測2024年供應鏈連鎖攻擊、雲端Tier-0資產、連線劫持和Cookie竊取將日益猖獗
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10822

呼應「安全未來倡議」! 微軟推出整合Security Copilot的單一安全運營平台
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10816

Palo Alto Networks 推出Strata Cloud Manager及新型新世代防火牆
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10819

微軟資安主管：生成式AI能在資安領域發揮奇效
https://news.cnyes.com/news/id/5393282

VMware增強自動化功能和安全整合　推進IT現代化
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000679104_QDI0SX3I1CYC4R308F8UF&cat=50

Google Cloud 在台落地十年成果豐碩，引領產業突圍 AI 時代邁向智慧轉型
https://www.cw.com.tw/article/5128187

就算病毒突破外圍封鎖線 機台仍有能力阻擋！睿控網安防駭 靠「零信任」打國際杯
https://www.wealth.com.tw/articles/4664f81d-558a-4193-b6c7-6afbe06f95d3

注意兩大社交工程新攻擊模式！安碁資訊開拓微型企業檢測服務
https://finance.technews.tw/2023/12/01/testing-services/

中飛科技宣布代理Recorded Future全球領先威脅情報平台
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000679578_R0W6CXT369WZE29MO0G3O&cat=50

情資驅動資安防禦 量身訂製企業策略
https://teamt5.org/tw/posts/intelligence-driven-cyber-defense/

G.政府
「NICS 台灣資安計畫」助力中小型企業、非營利組織強化資安
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10814

低軌衛星 下一個「太空軍國家隊」
https://udn.com/news/story/11596/7596987

基進黨批唐鳳將美國列為資安危害國家！ 數位部澄清：此為不實訊息
https://reurl.cc/OjZb19

資安即國安 數位部知漏洞嗎
https://udn.com/news/story/7339/7605158

資安法修法將美國列為危害國家而非中國為不實訊息
https://moda.gov.tw/press/clarification/9071

中科院：警監系統誤植標籤　追究廠商違約責任
https://mna.gpwb.gov.tw/news/detail/?UserKey=88d832a6-0510-4488-9caf-a994fe34cde4

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
兆勤公告旗下NAS設備重大漏洞，有可能被用於執行作業系統命令
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products

InfectedSlurs Botnet Spreads Mirai via Zero-Days
https://otx.alienvault.com/pulse/6560a2629741c6dccf310fd3

Akamai示警兩個最新零日漏洞讓大量路由器和安防攝影機飽受Mirai攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10826

Iranian Hackers Exploit PLCs in Attack on Water Authority in U.S.
https://thehackernews.com/2023/11/iranian-hackers-exploit-plcs-in-attack.html

Zyxel Releases Patches to Fix 15 Flaws in NAS, Firewall, and AP Devices
https://thehackernews.com/2023/12/zyxel-releases-patches-to-fix-15-flaws.html

CyberDay 資安產業日　臺灣引入SEMI E187與FIDO資安驗證
https://n.yam.com/Article/20231129445951

美國賓州水利單位的工業控制系統傳出遭到駭客劫持
https://www.securityweek.com/cisa-warns-of-unitronics-plc-exploitation-following-water-utility-hack/
https://www.cbsnews.com/pittsburgh/news/municipal-water-authority-of-aliquippa-hacked-iranian-backed-cyber-group/
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

EC-Council CEH Practical / Master 準備心得 — 讓理論與實作相輔相成的學習
https://medium.com/blacksecurity/ceh-practical-master-3e80cac180a2

EC-Council CEHP考試準備心得
https://hackmd.io/@9dCJrgb6QHGd8dRfgHO0zg/r14xNn1po

ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials
https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4

EC-Council ECSA資安分析專家 v10 考試心得分享
https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html

20180817 EC-Council ECSA v10 PASS
https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html

關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享
https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

CPENT 從暴力到破解
https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295

Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master
https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f

CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證
https://ucom.uuu.com.tw/web/Testimony/Article/4404

kaizensecurity/CPENT
https://github.com/kaizensecurity/CPENT/tree/master

CPENT : Pentesting like NO OTHERS !
https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/

Journey of My CPENT Exam
https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享
https://hackmd.io/@henry-ko/HyQ56e8eF

OSCP（Offensive Security Certified Professional）
https://github.com/0x584A/oscp-notes/tree/master

ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年
https://reurl.cc/aVLoX9

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」
https://www.ithome.com.tw/news/156754

用證照證明自己實力之餘，更應將證照視為督促學習的最大動力
https://www.ithome.com.tw/news/156756

打破證照誤解與迷思，資安專家帶你釐清資安證照的意義
https://www.ithome.com.tw/news/156755

Accelerate Your Career with the Global Leader in Cyber Security Training
https://www.sans.org/mlp/promo-partnership-hacker-news/

6.近期資安活動及研討會
線上資安專題講座-以攻擊策略演練角度協助企業評估、強化與呈現資安投資成效 2023/12/2
https://isipevent.kktix.cc/events/098efec3-copy-2

Just a chat - with no Expectations 2023/12/2
https://www.meetup.com/taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-cryptocurrency-meetup/events/297593750/

ESG and IT 2023/12/2
https://www.meetup.com/women-who-code-taipei/events/297278609/

Bitcoin Tech Summit Taipei 2023/12/3
https://www.meetup.com/taiwan-bitdevs/events/297473145/

企業組織的數位轉型之路：高效生產力x資安防護 2023/12/5
https://www.accupass.com/event/2311130347451526320677

全球資安威脅趨勢 製造業如何預防及因應 2023/12/6
https://techops.digiwin.com/cyber-security-threat/

Machine Learning Tech Talks 2023/12/6
https://www.meetup.com/machine-learning-tech-talks/events/297208975/

HackingThursday 固定聚會@2023 -- 台北 Taipei 2023/12/7
https://www.meetup.com/hackingthursday/events/297418385/

Robotics Monthly Meetup 2023/12/7
https://www.meetup.com/taipei-robotics-meetup-group/events/297636792/

第八屆臺灣區塊鏈愛好者年會 2023/12/7~ 2023/12/8
https://www.accupass.com/event/2310040647454349575700

Taipei DevOps User Group 3rd Event, supported by Wankuma Alliance 2023/12/8
https://www.meetup.com/taipei-devops-user-group/events/297271837/

數據驅動D2E．創新之際：潛入探索Gen.AI工作坊 2023/12/8
https://www.accupass.com/event/2311010427451806924516

WordPress 親子小聚 - 彰化小聚#36 2023/12/10
https://www.meetup.com/changhua-wordpress-meetup-group/events/297436537/

【安碁學苑】資安職能養成-滲透測試實務課程(含Lab實作) 2023/12/4 ~ 2023/12/18
https://www.accupass.com/event/2311270636182570082000

【 2023/12 】WordPress 台北小聚 - 尾牙又來囉 @ 資策會Living Lab+ 2023/12/11
https://www.meetup.com/taipei-wordpress/events/297535721/

2023物流與供應鏈資安研討會 2023/12/12
https://www.accupass.com/event/2311290320541942390236

Elixir Taiwan monthly meetup 2023/12/12
https://www.meetup.com/elixirtw-taipei/events/297356423/

【安碁學苑】金融業資料保護與隱私課程 2023/12/13
https://www.accupass.com/event/2311271112392102674730

《歐立威科技 2023 研討會》12/13 | Elastic APM x AIOps- 強化應用程式效能監控與維運 2023/12/13
https://www.accupass.com/event/2311200958105751274460

拒當受「駭」者！有資安韌性，讓你不怕打 PADDA 2023/12/13
https://metashield.kktix.cc/events/5867ed48

從沙崙資安基地眺望 2024 資安未來研討會 2023/12/15
https://nds.kktix.cc/events/hackermeetup2023

智慧製造產業跨域資安人力高峰論壇 2023/12/15
https://isipevent.kktix.cc/events/f2ce8bcc-copy-4

【資安線上研討會】化被動為主動：資安自動化協作 2023/12/15
https://www.accupass.com/event/2311240306125372701580

滲透測試簡介與實務 2023/12/15
https://web.tabf.org.tw/page/407020/course12.htm

Python爬蟲實戰工作坊 2023/12/16
https://www.meetup.com/pyladiestw/events/297519292/

線上資安專題講座-管窺資訊安全產品研發與人力需求 2023/12/16
https://isipevent.kktix.cc/events/098efec3-copy-1

跟著 AI 叮叮噹！ 2023/12/18
https://www.meetup.com/rladies-taipei/events/297305466/

User Research Taipei: AI and UR 2023/12/19
https://www.meetup.com/taipei-user-research-meetup-group/events/297555022/

Jamf Nation Live Taipei 2023 2023/12/19
https://jamf.kktix.cc/events/jamfnation2023

Taipei dbt Meetup #18 (in-person 👫 & online 👨‍💻)2023/12/20
https://www.meetup.com/taipei-dbt-meetup/events/297459596/

國家高速網路與計算中心教育訓練 結合AI機器學習及CAE模擬之不確定性分析– SmartUQ實作案例分享 2023/12/22
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4079&from_course_list_url=course_index

駭客奪旗攻防演練-金融資安人才養成專班 2023/12/22、27、28、29
https://web.tabf.org.tw/page/ctf/

2023 ISA Taiwan Section 國際自動化協會台灣分會成立大會2023/12/23
https://isatw.kktix.cc/events/d469c85a

【Monosparta ②⓪②④ 第一梯次 軟體開發實戰訓練營➠線上說明會 2024/1/17
https://trunk-studio.kktix.cc/events/monosparta-202401

第七屆《Hit AI & Blockchain》人工智慧暨區塊鏈產業高峰會 2024/2/6
https://www.accupass.com/event/2311160625102022535520