###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2023/2/20 ~ 2023/2/24

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 發布多個產品的安全公告
https://www.cisa.gov/uscert/ncas/current-activity/2023/02/16/cisco-releases-security-advisories-multiple-products

思科修補應用程式中心基礎架構系統的高風險漏洞
https://www.securityweek.com/cisco-patches-high-severity-vulnerabilities-in-aci-components/

VMware Patches Critical Vulnerability in Carbon Black App Control Product
https://thehackernews.com/2023/02/vmware-patches-critical-vulnerability.html

美國國家安全局提供居家辦公的網路安全建議，指出路由器是重要環節
https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3304674/nsa-releases-best-practices-for-securing-your-home-network/

U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog
https://thehackernews.com/2023/02/us-cybersecurity-agency-cisa-adds-three.html

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy
https://thehackernews.com/2023/02/fortinet-issues-patches-for-40-flaws.html

Fortinet的NAC設備重大漏洞已出現攻擊行動
https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-fortinet-bug-to-backdoor-servers/

研究人員公布Fortinet的NAC設備重大漏洞的概念性驗證程式
https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/

近半數專案的程式碼基礎含有高風險弱點
https://www.synopsys.com/content/dam/synopsys/sig-assets/reports/rep-ossra-2023.pdf

多款WAF可能存在CRLF漏洞，Akamai是目前發現的首例
https://www.praetorian.com/blog/using-crlf-injection-to-bypass-akamai-web-app-firewall/

Windows備份服務的權限提升漏洞恐出現攻擊行動
https://cloudsek.com/threatintelligence/cve-2023-21752-privilege-escalation-vulnerability-on-windows-backup-service

美國警告IBM檔案共用系統漏洞、Mitel網路電話系統漏洞已被用於攻擊行動
https://www.cisa.gov/uscert/ncas/current-activity/2023/02/21/cisa-adds-three-known-exploited-vulnerabilities-catalog

Carbon Black App Control出現重大漏洞，恐被用於存取作業系統底層
https://www.vmware.com/security/advisories/VMSA-2023-0004.html

SolarWinds預告將修補高風險漏洞
https://www.securityweek.com/solarwinds-announces-upcoming-patches-for-high-severity-vulnerabilities

2.銀行/金融/保險/證券/金融監理 新聞及資安
金管會首次邀集金融機構資安長召開聯繫會議
https://reurl.cc/OVkg9R

金管會首開金融資安長會議 供應鏈資安韌性成焦點
https://udn.com/news/story/123309/6991761

金管會緊盯資安 金融機構連假出包30分內要通報
https://wantrich.chinatimes.com/news/20230223901082-420501

The Secret Vulnerability Finance Execs are Missing
https://thehackernews.com/2023/02/the-secret-vulnerability-finance-execs.html

Magecart攻擊行動再度出現，駭客濫用Cloudflare的API攔截線上交易資料
https://www.malwarebytes.com/blog/threat-intelligence/2023/02/multilingual-skimmer-fingerprints-users-via-cloudflare-endpoint-api

3.信用卡/電子支付/行動支付/pay/支付系統/資安
三星強強聯手 對戰Apple Pay
https://ctee.com.tw/news/global/812761.html

挪威行動支付Vipps向蘋果發起挑戰 盼歐盟採取反壟斷行動
https://news.cnyes.com/news/id/5087703

擴大應用場景，全盈+PAY 宣佈將導入企業員工支付、銀行 app 支付等新服務
https://www.techbang.com/posts/104179-pluspay

6大類悠遊卡總整理 細說從頭不再霧煞煞
https://reurl.cc/OVkoYA

歐付寶 獲APP無障礙檢測指引驗證
https://wantrich.chinatimes.com/news/20230207900092-420501

印星連結電子支付平台 莫迪預期將成主流交易模式
https://reurl.cc/ZXjo4g

升格電支納管 金管會限大型第三方支付3∕15回覆
https://ec.ltn.com.tw/article/paper/1567454

柬埔寨申請加入人民幣跨境支付系統
https://www.chinatimes.com/newspapers/20230223000724-260301?chdtv

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Platypus在駭客攻擊後將至少償還63%的用戶資金
https://news.cnyes.com/news/id/5096058

Coinbase員工密碼被竊，駭客存取內部系統
https://www.ithome.com.tw/news/155630

挪威警方從NFT電玩Axie Infinity事故追回580萬美元的加密貨幣
https://www.bleepingcomputer.com/news/security/norwegian-police-recover-58m-crypto-from-massive-axie-infinity-hack/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
大型農產品經銷商Dole遭勒索軟體攻擊，部分業務受到影響
https://www.bleepingcomputer.com/news/security/fruit-giant-dole-suffers-ransomware-attack-impacting-operations/

不要擅自安裝破解版Final Cut Pro影音編輯軟體！有人藉此散布挖礦程式
https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs/

葡萄牙自來水公司傳出遭到勒索軟體LockBit攻擊
https://securityaffairs.com/142477/cyber-crime/lockbit-water-utility-aguas-do-porto.html

資安防護恐面臨應接不暇危機！逾三分之一惡意軟體採用20種戰術與攻擊手法
https://www.picussecurity.com/resource/blog/the-red-report-2023-top-ten-attack-techniques

GoDaddy被駭客竊走公司程式碼，並在代管服務植入惡意程式多年
https://www.ithome.com.tw/news/155604

亞美尼亞組織遭到後門程式OxtaRAT監控
https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/

針對半導體業者MKS Instruments遭勒索軟體攻擊的事故，有消息指出損失達2.5億美元
https://therecord.media/applied-materials-supply-chain-mks-ransomware-attack/

駭客假借提供改良版PyPI套件的名義散布惡意程式
https://www.reversinglabs.com/blog/beware-impostor-http-libraries-lurk-on-pypi

Python Developers Warned of Trojanized PyPI Packages Mimicking Popular Libraries
https://thehackernews.com/2023/02/python-developers-warned-of-trojanized.html

後門程式是2022年企業首要威脅
https://securityintelligence.com/posts/2023-x-force-threat-intelligence-index-report/

竊密軟體Stealc鎖定22款網頁瀏覽器、75個外掛程式、25個加密貨幣錢包而來
https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

駭客假借提供ChatGPT應用程式的名義，針對Windows、安卓用戶散布惡意軟體
https://blog.cyble.com/2023/02/22/the-growing-threat-of-chatgpt-based-phishing-attacks/

印度、美國、印尼、伊朗遭到殭屍網路MyloBot鎖定，一天逾5萬裝置遭感染
https://www.bitsight.com/blog/mylobot-investigating-proxy-botnet

南韓記者遭到安卓惡意軟體RambleOn鎖定
https://interlab.or.kr/archives/2567

挖礦程式利用ProxyShell漏洞散布
https://www.ithome.com.tw/news/155559

勒索軟體CatB挾持MSDTC服務來執行加密工作
https://www.fortinet.com/blog/threat-research/ransomware-roundup-catb-ransomware

日本、中國遭到惡意軟體WhiskerSpy鎖定，假借影音轉碼軟體散布
https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-backdoor.html

勒索軟體HardBit 2.0企圖得知目標組織資安險保單資料，藉此決定索討金額
https://www.varonis.com/blog/hardbit-2.0-ransomware

醫療組織LVHN傳出遭到勒索軟體BlackCat攻擊
https://www.wfmz.com/news/area/lehighvalley/lvhn-reports-cyberattack-by-russian-ransomware-gang/article_6ceb11e0-b133-11ed-9bdc-7b7c0a2adf99.html

北韓駭客Lazarus利用後門程式WinorDLL64發動攻擊
https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/

Lazarus Group Likely Using New WinorDLL64 Backdoor to Exfiltrate Sensitive Data
https://thehackernews.com/2023/02/lazarus-group-using-new-winordll64.html

Clasiopa: New Group Targets Materials Research
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clasiopa-materials-research

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering

HWP Malware Using the Steganography Technique: RedEyes (ScarCruft)
https://asec.ahnlab.com/en/48063/

The Growing Threat of ChatGPT-Based Phishing Attacks
https://blog.cyble.com/2023/02/22/the-growing-threat-of-chatgpt-based-phishing-attacks/

Cyber attack of the group UAC-0050 using the Remcos program
https://cert.gov.ua/article/3931296

Andoryu Botnet. A New Botnet Based on Socks Protocol
https://ti.qianxin.com/blog/articles/Andoryu-Botnet-A-New-Botnet-Based-on-Socks-Protocol/

Nevada Ransomware - Waiting For The Next Dark Web Jackpot
https://resecurity.com/blog/article/nevada-ransomware-waiting-for-the-next-dark-web-jackpotnevcorps5cvivjf6i2gm4uia7cxng5ploqny2rgrinctazjlnqr2yiyd.onion/

Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers
https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html

HardBit 2.0 Ransomware
https://www.varonis.com/blog/hardbit-2.0-ransomware

Technical Analysis of Rhadamanthys Obfuscation Techniques
https://www.zscaler.com/blogs/security-research/technical-analysis-rhadamanthys-obfuscation-techniques

Hung Cyber Evil Ratels: From the targeted attacks to the widespread usage of Brute Ratel
https://yoroi.company/research/hunting-cyber-evil-ratels-from-the-targeted-attacks-to-the-widespread-usage-of-brute-ratel/

Mylobot: Investigating a proxy botnet
https://www.bitsight.com/blog/mylobot-investigating-proxy-botnet

Operation Silent Watch: Desktop Surveillance in Azerbaijan and Armenia
https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/

Gamaredon Exploits Hoaxshell to Target Ukrainian Organizations
https://mrtiepolo.medium.com/russian-apt-gamaredon-exploits-hoaxshell-to-target-ukrainian-organizations-173427d4339b

Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack
https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-backdoor.html

SoulSearcher Worm
https://research.openanalysis.net/yara/soulsearcher/intel/malpedia/worm/2023/02/16/soulsearcher-worm.html

Esxi Args Ransomware
https://otx.alienvault.com/pulse/63efb9e916f33f537b8fe7a4

Stealc, a copycat of Vidar and Raccoon infostealers gaining in popularity
https://github.com/SEKOIA-IO/Community/blob/main/IOCs/stealc/stealc_iocs_20230220.csv
https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Magecart Attack Disguised as Google Tag Manager
https://www.akamai.com/blog/security/magecart-attack-disguised-as-google-tag-manager

GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft
https://thehackernews.com/2023/02/godaddy-discloses-multi-year-security.html

Experts Warn of RambleOn Android Malware Targeting South Korean Journalists
https://thehackernews.com/2023/02/experts-warn-of-rambleon-android.html

Armenian Entities Hit by New Version of OxtaRAT Spying Tool
https://thehackernews.com/2023/02/armenian-entities-hit-by-new-version-of.html

Mirai 殭屍網路新變種V3G4鎖定Linux 和物聯網設備
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10335

New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices
https://thehackernews.com/2023/02/new-mirai-botnet-variant-v3g4.html

Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software
https://thehackernews.com/2023/02/critical-rce-vulnerability-discovered.html

Cyber Espionage Group Earth Kitsune Deploys WhiskerSpy Backdoor in Latest Attacks
https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html

Samsung Introduces New Feature to Protect Users from Zero-Click Malware Attacks
https://thehackernews.com/2023/02/samsung-introduces-new-feature-to.html

Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies
https://thehackernews.com/2023/02/researchers-warn-of-reverserat-backdoor.html

New S1deload Malware Hijacking Users' Social Media Accounts and Mining Cryptocurrency
https://thehackernews.com/2023/02/new-s1deload-malware-hijacking-users.html

Hackers Using Trojanized macOS Apps to Deploy Evasive Cryptocurrency Mining Malware
https://thehackernews.com/2023/02/hackers-using-trojanized-macos-apps-to.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Twitter Limits SMS-Based 2-Factor Authentication to Blue Subscribers Only
https://thehackernews.com/2023/02/twitter-limits-sms-based-2-factor.html

Apple Warns of 3 New Vulnerabilities Affecting iPhone, iPad, and Mac Devices
https://thehackernews.com/2023/02/apple-warns-of-3-new-vulnerabilities.html

蘋果行動裝置與電腦存在權限提升漏洞，攻擊者可使用root權限存取任意檔案
https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-advanced-research-center-discovers-a-new-privilege-escalation-bug-class-on-macos-and-ios.html

Google 計畫透過強化韌體安全機制，加強 Android 資安防護能力
https://www.twcert.org.tw/tw/cp-104-6951-eb200-1.html

YouTube與臉書用戶遭到竊密軟體S1deload Stealer鎖定
https://www.bitdefender.com/blog/labs/s1deload-stealer-exploring-theeconomics-of-social-networkaccount-hijacking/

三星針對旗下手機加入零點擊漏洞防護措施
https://news.samsung.com/global/samsung-message-guard-protects-you-from-new-and-invisible-threats

Even Top-Ranked Android Apps in Google Play Store Provide Misleading Data Safety Labels
https://thehackernews.com/2023/02/majority-of-android-apps-on-google-play.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
雲端基礎設施遭到濫用，駭客攻擊電信業者
https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/

勒索軟體駭客組織Nevada Group鎖定5千個美國與歐洲的組織
https://www.ft.com/content/ad987139-e8ac-427d-9a07-25e1dd91d76b

材料研究機構遭駭客組織Clasiopa鎖定
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clasiopa-materials-research

研究人員揭露2022年DDoS攻擊態勢，駭客偏好採取僅一小時以內的短時間攻擊策略
https://www.microsoft.com/en-us/security/blog/2023/02/21/2022-in-review-ddos-attack-trends-and-insights/

逾4成企業2022下半發現Log4Shell相關攻擊
https://www.fortinet.com/blog/threat-research/fortiguard-labs-threat-report-key-findings-2h-2022

想當駭客勒索集團也需要「面試」，暗網的人力資源論壇每季開出一萬名職缺、帶獎金還有年休
https://www.techbang.com/posts/103656-cybercrime-syndicates-offer-six-figure-salaries-bonuses-and

歐盟委員會：禁止官方設備上使用TikTok
https://reurl.cc/yke05E

俄羅斯駭客利用2021年埋入的後門對烏克蘭政府機關發動攻擊
https://www.bleepingcomputer.com/news/security/ukraine-says-russian-hackers-backdoored-govt-websites-in-2021/

美國防部將敏感電子郵件曝險於外部網路達2周
https://www.ithome.com.tw/news/155623

印度政府機關遭到駭客組織SideCopy鎖定
https://threatmon.io/apt-sidecopy-targeting-indian-government-entities/

Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products
https://thehackernews.com/2023/02/experts-sound-alarm-over-growing.html

New Hacking Cluster 'Clasiopa' Targeting Materials Research Organizations in Asia
https://thehackernews.com/2023/02/new-hacking-cluster-clasiopa-targeting.html

Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client
https://thehackernews.com/2023/02/gcore-thwarts-massive-650-gbps-ddos.html

Norway Seizes $5.84 Million in Cryptocurrency Stolen by Lazarus Hackers
https://thehackernews.com/2023/02/norway-seizes-584-million-in.html

Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine
https://thehackernews.com/2023/02/google-reveals-alarming-surge-in.html

Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia
https://thehackernews.com/2023/02/hydrochasma-new-threat-actor-targets.html

Threat Actors Adopt Havoc Framework for Post-Exploitation in Targeted Attacks
https://thehackernews.com/2023/02/threat-actors-adopt-havoc-framework-for.html

【大醫生技】資安工程師
https://www.104.com.tw/job/7wvbx?jobsource=googlejobs

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Cymetrics調查9成航空旅遊業者有帳密外洩風險
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10338

微風集團遭駭，90 萬客戶個資網上兜售
https://www.inside.com.tw/article/30832-hacker-breeze-information

百貨業者微風內部資料傳出流入駭客論壇
https://breached.vc/Thread-Selling-TW-TaiWan-s-revenue-of-30-billion-enterprise-Breeze-Group-data-leakage--67738

微風拒付3顆比特幣贖90萬筆個資　駭入時間點有貓膩！疑內神通外鬼
https://tw.nextapple.com/local/20230223/837AD6F1FD000891244F825694D89A8F

臺灣電話號碼外洩比例逾6成，但密碼外洩更嚴重
https://gogolook.com/zh-hant/news/gogolook-fraud-report-2022-info-leak

WordPress網站被植入廣告詐欺外掛程式
https://www.malwarebytes.com/blog/threat-intelligence/2023/02/wordpress-sites-backdoored-with-ad-fraud-plugin

兩個駭客組織假冒高階主管，使用13種語言發動商業郵件詐騙攻擊
https://intelligence.abnormalsecurity.com/blog/midnight-hedgehog-mandarin-capybara-multilingual-executive-impersonation

洩資再+1？民眾至統一時代購物　竟接「誤刷詐騙」
https://news.tvbs.com.tw/local/2050877

【錯誤】臉書粉專「勞工紓困補助金 勞工紓困貸款 112年已經開始申辦 申辦時間2/1開始」
https://tfc-taiwan.org.tw/articles/8840

共享車個資也「共享」 和泰等3家公司遭證交所開罰
https://news.cnyes.com/news/id/5095710

台灣個資外洩猖狂！盤點整理哪些政府機構、航空、百貨企業傳出會員資料流出
https://dailyview.tw/popular/detail/20413

從強式MFA到抗網釣MFA
https://www.ithome.com.tw/news/155547

因現行MFA仍有可乘之機，信用卡交易驗證安全需要持續強化
https://www.ithome.com.tw/news/155539

網站應用程式MFA被突破，還有Cookie theft的不同威脅層面
https://www.ithome.com.tw/news/155575

強化登入安全，導入無密碼已成IT界共識
https://www.ithome.com.tw/news/155544

Passkey無密碼登入正夯，NTT DOCOMO首度在臺公開導入經驗
https://www.ithome.com.tw/news/155589

臺灣航空、旅遊業者網站缺乏相關的防護設定
https://cymetrics.io/zh-tw/latest/report/cymetrics-2023-taiwan-top15-airline-and-travel-agency-exposure-assessment-report

二維碼產生網站MyQRcode曝露用戶資料，起因是資料庫不設防
https://www.hackread.com/qr-code-generator-my-qr-code-data-leak/

印度火車訂票系統RailYatri遭駭，波及3,100萬旅客
https://www.hackread.com/indian-ticketing-platform-railyatri-hacked/

兒童福利機構Tulsa表示有2萬人個資在2021年網路攻擊事故外洩
https://www.thejournal.ie/tusla-contact-20000-people-data-compromised-during-hse-cyber-attack-5999841-Feb2023/

有個每週下載逾350萬次的NPM套件帳號安全性堪慮！爆出具有易遭挾持的風險
https://blog.illustria.io/illustria-discovers-account-takeover-vulnerability-in-a-popular-package-affecting-1000-8aaaf61ebfc4

1.5萬個NPM套件含有網釣URL連結
https://checkmarx.com/blog/how-npm-packages-were-used-to-spread-phishing-links/

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links
https://thehackernews.com/2023/02/attackers-flood-npm-repository-with.html

Researchers Hijack Popular NPM Package with Millions of Downloads
https://thehackernews.com/2023/02/researchers-hijack-popular-npm-package.html

Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed
https://thehackernews.com/2023/02/coinbase-employee-falls-for-sms-scam-in.html

電玩業者Activision傳出資料外洩事故，曝露員工與遊戲資料
https://www.bleepingcomputer.com/news/security/activision-confirms-data-breach-exposing-employee-and-game-info/

新加坡、中國的大型資料中心用戶帳密遭竊
https://www.resecurity.com/blog/article/cyber-attacks-on-data-center-organizations

為迴避偵測，歹徒在詐騙簡訊使用注音文
https://gogolook.com/zh-hant/news/gogolook-fraud-report-2022-calls-sms

線上AI圖像編輯工具Cutout傳出資料外洩，曝露用戶敏感資料
https://cybernews.com/security/ai-editing-service-leaks-images-customer-data/

E.研究報告/工具
企業資安防禦關鍵　身分安全為首要之務
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=60&id=0000657002_PFMLYHW81GGU4W1W8WW50

黑色產業鏈 商業模式大成長
https://ctee.com.tw/news/tech/814427.html

研究人員將機器學習語言模型ChatGPT用於檢查入侵指標
https://securelist.com/ioc-detection-experiments-with-chatgpt/108756/

How to Detect New Threats via Suspicious Activities
https://thehackernews.com/2023/02/how-to-detect-new-threats-via.html

The Future of Network Security: Predictive Analytics and ML-Driven Solutions
https://thehackernews.com/2023/02/the-future-of-network-security.html

Researchers Discover Numerous Samples of Information Stealer 'Stealc' in the Wild
https://thehackernews.com/2023/02/researchers-discover-dozens-samples-of.html

3 Steps to Automate Your Third-Party Risk Management Program
https://thehackernews.com/2023/02/3-steps-to-automate-your-third-party.html

F.商業
別人怎麼做？Gartner公布2022-2024十大資安技術部署趨勢
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10339

Veeam發布 VBR v12備份和復原方案、Veeam 勒索軟體攻擊安心保障計畫
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10332

趨勢科技收購SOC技術領導廠Anlyz 強化資安平台
https://www.sinotrade.com.tw/richclub/news/63f76354f1ac6ae3b3a2a531

趨勢科技宣布併購Anlyz　強化XDR 資安平台
https://www.technice.com.tw/cloudtech/infosecurity/39122/

DEVCORE 執行長翁浩正：資安已走入「VUCA 時代」，企業必須隨著外在環境，變得更強大！
https://buzzorange.com/techorange/2023/02/23/devcore-allen-own/

Akamai 煥新 2023 新春媒體記者會：打造「下一個十年，企業所需要的雲端」
https://technews.tw/2023/02/23/akamai-2023/

Fortinet：毀滅性資料破壞軟體增五成
https://www.ctimes.com.tw/DispNews-tw.asp?O=HK72NAMPW2ESAA00NH

G.政府
數位部：個資聯防通報機制新上路 資安院已配合經濟部行政調查微風百貨
https://moda.gov.tw/press/press-releases/3845

資安外洩常態化已成國安問題　賴士葆：政府應更積極處理
https://ctinews.com/news/items/4OaZrBoGa6

個資外洩頻傳 唐鳳：檢視資安法納管範圍
https://ctee.com.tw/news/policy/814226.html

微風遭駭個資外洩 唐鳳擬修資安法因應
https://ec.ltn.com.tw/article/breakingnews/4220595

工研院參與國際組織FIDO聯盟　展示零信任架構五大安全戰略
https://www.itri.org.tw/ListStyle.aspx?DisplayStyle=01_content&SiteID=1&MmmID=1036276263153520257&MGID=112022309573352081

公投電子連署系統年底上路？ 中選會：資安無虞才上線
https://www.chinatimes.com/realtimenews/20230224001752-260407?chdtv

法務部調查局資安工作站偵辦戶役政資料遭竊案新聞稿
https://www.mjib.gov.tw/news/Details/1/839

國外駭客兜售我2357萬筆個資 調查局掌握中籍人士犯案
https://news.ltn.com.tw/news/society/breakingnews/4221461

200億數發部擋不住個資外洩 賴士葆酸：天才IT大臣唐鳳略遜駭客
https://reurl.cc/klLW5r

北市消防局勤指中心電腦遭駭！駭客植挖礦程式　時間逾半年
https://reurl.cc/eXmo5j

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
Dragos：2022年工控系統勒索軟體攻擊暴增87%
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10337

報告：2022年西門子工控漏洞數量最多，但不代表最不安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10329

Panasonic Automotive Systems、趨勢科技以及 VicOne 共同展示次世代汽車座艙系統虛擬化資安解決方案
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10330

無線工業物聯網裝置存在38個漏洞
https://go.otorio.com/hubfs/Whitepapers%20and%20Reports/whitepaper%20-%20Industrial%20wireless%20IoT%20research.pdf

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

6.近期資安活動及研討會
淺談總經數據與金融市場應用 2023/2/27
https://www.meetup.com/rladies-taipei/events/290280800/

資安保險與資安鑑識創新服務論壇暨ACFD第二屆第四次會員大會 2023/3/3
https://acfd.kktix.cc/events/ci2023

DEVCORE Conference 2023 - 3/10 企業場 2023/3/10
https://devcore.kktix.cc/events/devcoreconf2023-0310

DEVCORE Conference 2023 - 3/11 駭客場 2023/3/11
https://devcore.kktix.cc/events/devcoreconf2023

掌握資安趨勢 讓大數據決策市場研討會 2023/3/16
https://www.accupass.com/event/2212200343421615169635

2022 OT 工控資安年會-活動報名 2023/3/24
https://reurl.cc/5Mq327

iPAS-「初級」資訊安全工程師-能力研習衝刺班 2023/4/15、4/22
https://www.cisanet.org.tw/Course/Detail/3948

iPAS中級資訊安全人員訓練班 2023/5/4 ~ 2023/6/1
https://edu.tcfst.org.tw/web/tw/class/show.asp?courseidori=12C013