###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2023/3/20 ~ 2023/3/24

1.重大弱點漏洞/後門/Exploit/Zero Day
Adobe 已發布安全更新，以解決多個 Adobe 產品中的弱點
https://www.cisa.gov/news-events/alerts/2023/03/14/adobe-releases-security-updates-multiple-products

微軟發佈3月份安全性公告
https://www.cisa.gov/news-events/alerts/2023/03/14/microsoft-releases-march-2023-security-updates

Windows 11剪取工具也存在Acropalypse漏洞
https://www.bleepingcomputer.com/news/microsoft/windows-11-snipping-tool-privacy-bug-exposes-cropped-image-content/

中國工業自動化軟體WellinTech KingHistorian存在高風險漏洞
https://blog.talosintelligence.com/vulnerability-spotlight-wellintech-ics-platform-vulnerable-to-information-disclosure-buffer-overflow-vulnerabilities/

Chinese Hackers Exploit Fortinet Zero-Day Flaw for Cyber Espionage Attack
https://thehackernews.com/2023/03/chinese-hackers-exploit-fortinet-zero.html

2022 年有 55 個 0-day 漏洞遭駭侵者濫用於攻擊，以 Microsoft、Google、Apple 為主
https://www.twcert.org.tw/tw/cp-104-7009-dab0d-1.html

From Ransomware to Cyber Espionage: 55 Zero-Day Vulnerabilities Weaponized in 2022
https://thehackernews.com/2023/03/from-ransomware-to-cyber-espionage-55.html

Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites
https://thehackernews.com/2023/03/critical-woocommerce-payments-plugin.html

SAP 修復五個高危險漏洞，呼籲用戶儘快更新
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10374

思科網路設備作業系統IOS出現高風險漏洞
https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74842

GoAnywhwere漏洞受害組織持續增加，多倫多市、維珍集團、P&G入列
https://www.ithome.com.tw/news/156101

Hitachi Energy也傳出成為GoAnywhere零時差漏洞的受害組織
http://www.hitachienergy.com/news/features/2023/03/third-party-cybersecurity-incident

研究人員發布Veeam備份系統重大漏洞的概念性驗證程式碼
https://www.horizon3.ai/veeam-backup-and-replication-cve-2023-27532-deep-dive/

美國CISA啟動勒索軟體漏洞預警計畫
https://www.csoonline.com/article/3691229/cisa-kicks-off-ransomware-vulnerability-pilot-to-help-spot-ransomware-exploitable-flaws.html

針對可繞過BitLocker的WinRE元件漏洞，微軟發布新的緩解工具
https://support.microsoft.com/en-us/topic/kb5025175-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2022-41099-ba6621fa-5a9f-48f1-9ca3-e13eb56fb589

2.銀行/金融/保險/證券/金融監理 新聞及資安
New Kritec Magecart skimmer found on Magento stores
https://www.malwarebytes.com/blog/threat-intelligence/2023/03/new-kritec-skimmer

Banking 101: What You Need to Know, and What Causes Bank Runs
https://sfoerster-5338.medium.com/banking-101-what-you-need-to-know-and-what-causes-bank-runs-1a84386f67d4

Google Cloud參與FS-ISAC重大供應商計畫，成為第一個投入的主要雲端服務業者
https://cloud.google.com/blog/products/identity-security/google-cloud-fs-isac-advance-security-in-financial-services

臺灣金融機構遭到中國駭客鎖定，假借以保單借款為誘餌的釣魚郵件，意圖散布Cobalt Strike
https://teamt5.org/tw/posts/press-release-chinese-adversaries-targeting-taiwan-financial-institutions/

美國證交所研擬擴大客戶隱私保護法規的適用範圍
https://www.scmagazine.com/analysis/breach/sec-proposes-slew-of-new-cyber-rules-for-secure-financial-entities

有人假冒銀行的名義，在推特回覆使用者標註的貼文
https://www.bleepingcomputer.com/news/security/convincing-twitter-quote-tweet-phone-scam-targets-bank-customers/

安卓木馬FakeCalls對南韓銀行用戶發動攻擊，影響的金融機構超過20家
https://research.checkpoint.com/2023/south-korean-android-banking-menace-fakecalls/

3.信用卡/電子支付/行動支付/pay/支付系統/資安
拉丁美洲行動支付平臺遭到安卓木馬GoatRAT濫用，攻擊巴西銀行用戶
https://blog.cyble.com/2023/03/14/goatrat-android-banking-trojan-variant-targeting-brazilian-banks/

Apple Pay在南韓啟用 搶食行動支付大餅
https://reurl.cc/rLYlpO

興登堡做空支付公司 Block，股價暴跌近 15%
https://technews.tw/2023/03/24/hindenburg-takes-aim-at-dorsey-payments-firm-block/

美國行動支付龍頭股Block遭沽空機構突襲，股價週四大跌近15%
https://reurl.cc/KM96Zy

電子支付防詐帶頭衝 一卡通聯手Gogolook加強保障客戶權益
https://ec.ltn.com.tw/article/breakingnews/4247294

Gogolook攜一卡通 打擊支付詐騙
https://www.chinatimes.com/newspapers/20230323000205-260204?chdtv

多元支付方式興起 消費者有多樣選擇
https://www.peopo.org/news/626999

行動支付普及化 台灣「數位行善」成趨勢
https://money.udn.com/money/story/5635/6994176

行動支付取代實體錢包 99%民眾疫後繼續用
https://reurl.cc/mlYde7

防堵電子支付遭盜用 4/1起核驗原始手機碼
https://reurl.cc/V8WaGY

電子支付 微信：內地支付市場發展領先 未來為香港引入行業解決方案
https://reurl.cc/qkYD9q

金融機構危機處理要點 擬納入電子支付、信用卡
https://reurl.cc/rLYxdx

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Hackers Steal Over $1.6 Million in Crypto from General Bytes Bitcoin ATMs Using Zero-Day Flaw
https://thehackernews.com/2023/03/hackers-steal-over-16-million-in-crypto.html

Coinbase加密貨幣錢包存在漏洞Red Pill，恐被用於迴避偵測
https://zengo.com/zengo-uncovers-security-vulnerabilities-in-popular-web3-transaction-simulation-solutions-the-red-pill-attack/

General Bytes比特幣ATM遭到零時差漏洞攻擊，駭客竊走逾150萬美元
https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Google：安全繞過正成為網路攻擊的新趨勢，台灣需注意Magniber勒索軟體
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10375

逾5萬個網站被植入惡意JavaScript程式碼，將使用者重新導向惡意網站
https://unit42.paloaltonetworks.com/malicious-javascript-injection/

惡意NuGet套件鎖定.NET開發人員而來
https://jfrog.com/blog/attackers-are-starting-to-target-net-developers-with-malicious-code-nuget-packages/

惡意軟體Emotet透過OneNote筆記檔案散布
https://www.malwarebytes.com/blog/threat-intelligence/2023/03/emotet-onenote

駭客以服務型式提供惡意程式Cinoshi多種攻擊模組
https://blog.cyble.com/2023/03/23/cinoshi-project-and-the-dark-side-of-free-maas/

北韓駭客組織APT37透過微軟說明文件檔案散布惡意程式
https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37

拉丁美洲遭金融木馬Mispadu鎖定，逾9萬個帳號密碼遭濫用
https://www.metabaseq.com/mispadu-banking-trojan/

電信業者Docomo遭到網路攻擊，相關服務正在恢復
https://www.postguam.com/news/local/docomo-restoring-its-services-after-cybersecurity-incident/article_2211d1e6-c497-11ed-b87c-a7ce522f93de.html

農產品批發商Dole證實勒索軟體攻擊事故導致員工資料外洩
https://www.sec.gov/Archives/edgar/data/1857475/000185747523000013/dole-20221231.htm

勒索軟體成2022年歐洲交通運輸業者的重大威脅
https://www.enisa.europa.eu/publications/enisa-transport-threat-landscape

美國醫療機構成駭客組織Killnet、LockBit攻擊目標
https://www.scmagazine.com/news/ransomware/black-basta-killnet-lockbit-groups-targeting-healthcare

缺乏管理的Linux伺服器遭到DDoS惡意軟體ShellBot攻擊
https://asec.ahnlab.com/en/49769/

惡意軟體DotRunpeX透過搜尋引擎廣告散布
https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/

勒索軟體Trigona鎖定美國、歐洲、澳洲而來
https://unit42.paloaltonetworks.com/trigona-ransomware-update/

歐洲政府機關遭到駭客組織Winter Vivern鎖定，利用冒牌防毒植入惡意程式
https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/

美國奢侈品百貨薩克斯第五大道傳出遭勒索軟體Clop攻擊
https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-saks-fifth-avenue-retailer-says-mock-data-stolen/

不只加密檔案，勒索軟體CatB也能竊取瀏覽器與收信軟體的機密
https://www.sentinelone.com/blog/decrypting-catb-ransomware-analyzing-their-latest-attack-methods/

Go語言殭屍網路HinataBot鎖定路由器、伺服器漏洞而來
https://www.akamai.com/blog/security-research/hinatabot-uncovering-new-golang-ddos-botnet

中國、俄羅斯駭客利用惡意軟體Silkloader迴避偵測
https://labs.withsecure.com/publications/silkloader

荷蘭海運業者Royal Dirkzwager傳出遭勒索軟體Play攻擊
https://therecord.media/royal-dirkzwager-ransomware-attack-dutch-shipping

惡意NuGet套件鎖定.NET開發人員而來
https://jfrog.com/blog/attackers-are-starting-to-target-net-developers-with-malicious-code-nuget-packages/

半導體設備商MKS Instruments遭遇勒索軟體攻擊，面臨集體訴訟
https://www.cybersecuritydive.com/news/mks-instruments-class-action-litigation-ransomware/645061/

Adobe線上文件簽署服務遭濫用，拿來散布竊資軟體RedLine
https://blog.avast.com/adobe-acrobat-sign-malware

Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation
https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem

Previously Undiscovered TeamTNT Payload Recently Surfaced
https://www.cadosecurity.com/previously-undiscovered-teamtnt-payload-recently-surfaced/

CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes
https://www.crowdstrike.com/blog/crowdstrike-discovers-first-ever-dero-cryptojacking-campaign-targeting-kubernetes/

LemonDuck Mining Botnet
https://www.antiy.cn/research/notice&report/research_report/20230310.html

Magniber ransomware actors used a variant of Microsoft SmartScreen bypass
https://otx.alienvault.com/pulse/6415544752318a16a59401eb

BianLian Ransomware Gang Continues to Evolve
https://redacted.com/blog/bianlian-ransomware-gang-continues-to-evolve/

HookSpoofer: The Modified Open Source Stealer Bundlers Making the Rounds
https://www.uptycs.com/blog/threat-research-hookspoofer

DotRunpeX - demystifying new virtualized .NET injector used in the wild
https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/

Peeking at Reaper’s surveillance operations
https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine
https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

Bad magic: new APT found in the area of Russo-Ukrainian conflict
https://securelist.com/bad-magic-apt/109087/

The Unintentional Leak: A glimpse into the attack vectors of APT37
https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37

A look at a Magecart skimmer using the Hunter obfuscator
https://www.malwarebytes.com/blog/threat-intelligence/2023/03/hunter-skimmer

Session Cookies, Keychains, SSH Keys and More | 7 Kinds of Data Malware Steals from macOS Users
https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/

Cinoshi Project and the Dark Side of Free MaaS
https://blog.cyble.com/2023/03/23/cinoshi-project-and-the-dark-side-of-free-maas/

Operation Tainted Love | Chinese APTs Target Telcos in New Attacks
https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/

Emotet resumes spam operations, switches to OneNote
https://blog.talosintelligence.com/emotet-switches-to-onenote/
https://github.com/Cisco-Talos/IOCs/blob/main/2023/03/prometei-botnet-improves.txt

UNC961: Three Encounters with a Financially Motivated Threat Actor
https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated

LockBit 3.0 Ransomware: Inside the Cyberthreat That's Costing Millions
https://thehackernews.com/2023/03/lockbit-30-ransomware-inside.html

FakeCalls Vishing Malware Targets South Korean Users via Popular Financial Apps
https://thehackernews.com/2023/03/fakecalls-vishing-malware-targets-south.html

New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks
https://thehackernews.com/2023/03/new-golang-based-hinatabot-exploiting.html

Lookalike Telegram and WhatsApp Websites Distributing Cryptocurrency Stealing Malware
https://thehackernews.com/2023/03/lookalike-telegram-and-whatsapp.html

Researchers Shed Light on CatB Ransomware's Evasion Techniques
https://thehackernews.com/2023/03/researchers-shed-light-on-catb.html

Emotet Rises Again: Evades Macro Security via OneNote Attachments
https://thehackernews.com/2023/03/emotet-rises-again-evades-macro.html

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers
https://thehackernews.com/2023/03/new-shellbot-ddos-malware-targeting.html

New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads
https://thehackernews.com/2023/03/new-dotrunpex-malware-delivers-multiple.html

Mispadu Banking Trojan Targets Latin America: 90,000+ Credentials Stolen
https://thehackernews.com/2023/03/mispadu-banking-trojan-targets-latin.html

Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware
https://thehackernews.com/2023/03/rogue-nuget-packages-infect-net.html

NAPLISTENER: New Malware in REF2924 Group's Arsenal for Bypassing Detection
https://thehackernews.com/2023/03/new-naplistener-malware-used-by-ref2924.html

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers
https://thehackernews.com/2023/03/new-shellbot-ddos-malware-targeting.html

Nexus: A New Rising Android Banking Trojan Targeting 450 Financial Apps
https://thehackernews.com/2023/03/nexus-new-rising-android-banking-trojan.html

ScarCruft's Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques
https://thehackernews.com/2023/03/scarcrufts-evolving-arsenal-researchers.html

Nexus: A New Rising Android Banking Trojan Targeting 450 Financial Apps
https://thehackernews.com/2023/03/nexus-new-rising-android-banking-trojan.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
手機編輯過的照片有可能被復原！研究人員揭露Google手機圖片編輯工具漏洞Acropalypse
https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html

安卓版中國購物App拼多多遭下架，Google表示原因是網路上出現惡意版程式
https://www.ithome.com.tw/news/156029

Google Pixel手機存在漏洞Acropalypse，可復原編輯過的圖片
https://www.bleepingcomputer.com/news/security/google-pixel-flaw-allowed-recovery-of-redacted-cropped-images/

冒牌Telegram與WhatsApp網站散布能挾持剪貼簿的惡意程式
https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/

iPhone不見慘被盜刷28萬！苦主曝「預設1功能」沒關，手機免解鎖就能做到…3步驟要先做
https://www.businesstoday.com.tw/article/category/183011/post/202303230025/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
WooCommcerce電商網站的付款流程模組遭到攻擊，駭客注入竊資程式碼
http://blog.sucuri.net/2023/03/woocommerce-skimmer-reveals-tampered-gateway-plugin.html

台灣有四項資安威脅數量高居全球前五
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10371

臺灣面臨網攻次數是全球平均的兩倍！2022年臺灣每週每個組織面臨3千次攻擊
https://www.ithome.com.tw/news/156040

2022網路威脅攻擊達到1,460億次，較前年多出55%
https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports/roundup/rethinking-tactics-annual-cybersecurity-roundup-2022

防駭客攻擊盜取醫療網資 新樓醫院找「世界級」專家協防
https://health.ltn.com.tw/article/breakingnews/4248061

駭客將更加專注於攻擊、竊取雲端系統的資料
https://www.crowdstrike.com/blog/global-threat-report-preview-2023/

挖礦攻擊只是幌子！駭客組織TeamTNT發動攻擊疑為竊取機密資料
https://www.cadosecurity.com/previously-undiscovered-teamtnt-payload-recently-surfaced/

印度國防研發機構DRDO遭駭客組織SideCopy攻擊
https://blog.cyble.com/2023/03/21/notorious-sidecopy-apt-group-sets-sights-on-indias-drdo/

南亞、東南亞遭到竊資軟體Naplistener攻擊
https://www.elastic.co/security-labs/naplistener-more-bad-dreams-from-the-developers-of-siestagraph

北韓駭客利用瀏覽器外掛竊取Gmail的信件
https://www.verfassungsschutz.de/SharedDocs/publikationen/EN/prevention/2023-03-20-joint-cyber-security-advisory-korean.pdf?__blob=publicationFile

2023年已有17個歐洲國家遭俄羅斯駭客鎖定，從事網路間諜攻擊
https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf

美國國安局發布零信任身分管理ICAM指南
https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3328152/nsa-releases-recommendations-for-maturing-identity-credential-and-access-manage/

烏克蘭地方政府遭到駭客組織Bad Magic攻擊
https://securelist.com/bad-magic-apt/109087/

New 'Bad Magic' Cyber Threat Disrupts Ukraine's Key Sectors Amid War
https://thehackernews.com/2023/03/new-bad-magic-cyber-threat-disrupt.html

GitHub Swiftly Replaces Exposed RSA SSH Key to Protect Git Operations
https://thehackernews.com/2023/03/github-swiftly-replaces-exposed-rsa-ssh.html

German and South Korean Agencies Warn of Kimsuky's Expanding Cyber Attack Tactics
https://thehackernews.com/2023/03/german-and-south-korean-agencies-warn.html

Researchers Uncover Chinese Nation State Hackers' Deceptive Attack Strategies
https://thehackernews.com/2023/03/researchers-uncover-chinese-nation.html

資安合規處-資安顧問
https://www.104.com.tw/job/7vycj?jobsource=m_job_same_b

亞太地區2022年面臨210萬資安人才短缺
https://www.isc2.org//-/media/ISC2/Research/2022-WorkForce-Study/ISC2-Cybersecurity-Workforce-Study.ashx

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
ChatGPT傳資安漏洞「聊天紀錄被看光」　提醒用戶1招保護個資
https://www.mirrormedia.mg/story/20230322edi047/

ChatGPT修補曝露用戶對話紀錄標題的漏洞
https://www.ithome.com.tw/news/156068

台灣成網路詐騙天堂屢遭砲轟！企業如何化解因資安而起的永續經營危機
https://csr.cw.com.tw/article/43060

資安即國安？2357萬台人資料遭兜售 他探索外洩網：無所不有
https://udn.com/news/story/120911/7046246

駭客假借貸款名義發動BEC攻擊，企圖詐騙3,600萬美元
https://abnormalsecurity.com/blog/36-million-vendor-fraud

中東、非洲求職者遭到2,400個詐騙網頁盯上
https://www.group-ib.com/blog/venomous-vacancies/

超級跑車製造商法拉利證實發生資料外洩事故，並強調不願妥協付錢
https://www.ferrari.com/en-EN/corporate/articles/cyber-incident-in-ferrari

美國連鎖超商Lowe's Market配置錯誤，恐曝露客戶個資
https://cybernews.com/security/lowes-market-data-leak/

政府普發現金尚未開放，已傳出詐騙集團註冊網域行騙
https://facebook.com/story.php?story_fbid=pfbid0339qMsRXbGLzffdUw3B5vDGWQWgL3HacQjQHtcb8hgVKmChCWWL8AxxhYtFEaqL1rl&id=100069163841054

2022年BEC詐騙事故翻倍，威脅首度超越勒索軟體
https://www.secureworks.com/resources/rp-irs-learning-from-incident-response-team-2022-year-in-review

美國NBA資料外洩，粉絲個資流出
https://www.ithome.com.tw/news/156003

Pompompurin Unmasked: Infamous BreachForums Mastermind Arrested in New York
https://thehackernews.com/2023/03/pompompurin-unmasked-infamous.html

New Cyber Platform Lab 1 Decodes Dark Web Data to Uncover Hidden Supply Chain Breaches
https://thehackernews.com/2023/03/new-cyber-platform-lab-1-decodes-dark.html

BreachForums Administrator Baphomet Shuts Down Infamous Hacking Forum
https://thehackernews.com/2023/03/breachforums-administrator-baphomet.html

Operation Soft Cell: Chinese Hackers Breach Middle East Telecom Providers
https://thehackernews.com/2023/03/operation-soft-cell-chinese-hackers.html

Fake ChatGPT Chrome Browser Extension Caught Hijacking Facebook Accounts
https://thehackernews.com/2023/03/fake-chatgpt-chrome-browser-extension.html

Investigating a Recent Facebook Phishing Campaign
https://www.silentpush.com/blog/fake-links-and-compromised-messenger-accounts-investigating-a-recent-facebook-phishing-campaign

E.研究報告/工具
THN Webinar: 3 Research-Backed Ways to Secure Your Identity Perimeter
https://thehackernews.com/2023/03/thn-webinar-3-research-backed-ways-to.html

A New Security Category Addresses Web-borne Threats
https://thehackernews.com/2023/03/a-new-security-category-addresses-web.html

Preventing Insider Threats in Your Active Directory
https://thehackernews.com/2023/03/preventing-insider-threats-in-your.html

2023 Cybersecurity Maturity Report Reveals Organizational Unpreparedness for Cyberattacks
https://thehackernews.com/2023/03/2023-cybersecurity-maturity-report.html

Bad Bad UX: 20 Common Mistakes in User Experience
https://medium.com/@FlowMapp/bad-bad-ux-20-common-mistakes-in-user-experience-d30301ba686b

AI And The Copyright Problem
https://medium.com/geekculture/ai-and-the-copyright-problem-97da479a9ccd

F.商業
Vectra AI：以子之矛 攻子之盾 – 資安諸葛亮
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10369

Fortinet：逾六成企業曾因採行遠距工作模式而發生資料外洩
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10372

Palo Alto Networks推出最新零信任營運安全解決方案
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10378

中華資安國際 連續四年獲資安廠商評鑑五Ａ最高評價
https://www.businessweekly.com.tw/focus/indep/1003209

思科啟動台灣數位加速計畫 2.0，資安、韌性是重點
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10380

創泓與網安智慧合作『網路資訊安全國際頂尖證照培訓課程』
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000659415_46A5F92T0HGL6S6KDKMAS

OPSWAT 期待與您在資安人2023 OT 資安年會相見
https://www.docutek.com.tw/newsDetail.php?id=527

AWS推出資料無塵室服務Clean Rooms，供企業與外部進行安全資料協作
https://www.ithome.com.tw/news/156072

G.政府
組織、法規帶來的窘境 讓資安即國安難落實 資安風暴救火隊數發部 為何失靈了
https://www.businesstoday.com.tw/article/category/183027/post/202303220033/

立院教文會考察故宮資安防護 蕭宗煌認「圖檔外流」為同仁疏失
https://www.chinatimes.com/realtimenews/20230322003207-260405?chdtv

巷仔內／「數位故宮」資安反應超慢　鴕鳥心態面對失
https://www.nownews.com/news/6089472

112年資訊安全服務機構能量登錄暨資通安全自主產品認定公告～開始申請
https://www.acw.org.tw/News/Detail.aspx?id=3278

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems
https://thehackernews.com/2023/03/cisa-alerts-on-critical-security.html

洛克威爾自動化：網路資安風險是企業期望透過智慧製造計劃優化的首要項目
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10376

資安別再複製貼上 ！OT、 IT 系統重點大不同，智慧工廠如何迎擊新形態資安攻擊
https://buzzorange.com/techorange/2023/03/21/rockwell-automation-ot-it/

美國針對工控系統重大漏洞提出警告
https://www.cisa.gov/news-events/alerts/2023/03/21/cisa-releases-eight-industrial-control-systems-advisories

研究人員公布Netgear Orbi家用Wi-Fi路由器重大漏洞的概念性驗證程式
https://blog.talosintelligence.com/vulnerability-spotlight-netgear-orbi-router-vulnerable-to-arbitrary-command-execution/

Aveva旗下的HMI、SCADA工控系統解決方案存在漏洞
https://www.securityweek.com/organizations-notified-of-remotely-exploitable-vulnerabilities-in-aveva-hmi-scada-products/

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

6.近期資安活動及研討會
OCF x MOPCON 春季開源交流會 2023/3/28
https://ocftw.kktix.cc/events/khspringparty

Rails 前後端分離方案的良好作法與利弊分析 2023/3/28
https://rubytaiwan.kktix.cc/events/rubyjam

網路自由小聚 [3月] X-Road vs T-Road 2023/3/29
https://ocftw.kktix.cc/events/internetfreedom-mar2023

珈特科技_APPLE資安研討會 2023/3/29
https://gettechnology.kktix.cc/events/1c9146ab

次世代 IT 管理 啓動雲端旅程 2023/3/30 此活動為線上活動
https://www.accupass.com/event/2302030247499784123840

OWASP Meetup 2023.Apr . 2023/4/7
https://csa.kktix.cc/events/owasp202304-copy-1

跨境數位威權：全球數位威權趨勢對台灣的機遇和挑戰 2023/4/8
https://ocftw.kktix.cc/events/citizenseminar

iPAS-「初級」資訊安全工程師-能力研習衝刺班 2023/4/15、4/22
https://www.cisanet.org.tw/Course/Detail/3948

「Meta 台灣 AR 黑客松」 2023/4/22 ~ 2023/4/23
https://www.arhackathon.tw/

RSA Conference 2023 2023/4/24 ~ 2023/4/27
https://www.rsaconference.com/usa

iPAS中級資訊安全人員訓練班 2023/5/4 ~ 2023/6/1
https://edu.tcfst.org.tw/web/tw/class/show.asp?courseidori=12C013

(ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27
https://www.isc2.org/Congress-2023