---
# System prepended metadata

title: 資安事件新聞週報 2023/3/27  ~  2023/3/31
tags: [資安事件新聞週報]

---

###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2023/3/27  ~  2023/3/31

1.重大弱點漏洞/後門/Exploit/Zero Day
一網打盡18種雲端服務的不當設定或漏洞風險，攻擊工具AlienFox可大量搜刮這些系統當中的帳密資料
https://www.sentinelone.com/labs/dissecting-alienfox-the-cloud-spammers-swiss-army-knife/

Winter Vivern利用Zimbra漏洞竊取北約組織電子郵件
https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability

為什麼CVE-2023-23397你必須關注？並且應盡速更新
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10386

Cisco 發布多個產品的安全公告
https://www.cisa.gov/news-events/alerts/2023/03/23/cisco-releases-security-advisories-multiple-products

微軟修補可回復原始圖片的臭蟲Acropalypse
https://www.ithome.com.tw/news/156124

微軟Azure Service Fabric Explorer存在XSS漏洞，允許攻擊者遠端執行程式碼
https://www.ithome.com.tw/news/156231

Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers
https://thehackernews.com/2023/03/microsoft-warns-of-stealthy-outlook.html

Microsoft Issues Patch for aCropalypse Privacy Flaw in Windows Screenshot Tools
https://thehackernews.com/2023/03/microsoft-issues-patch-for-acropalypse.html

Researchers Detail Severe "Super FabriXss" Vulnerability in Microsoft Azure SFX
https://thehackernews.com/2023/03/researchers-detail-severe-super.html

OpenAI修補可盜帳號、洩露個資的ChatGPT漏洞
https://www.ithome.com.tw/news/156205

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident
https://thehackernews.com/2023/03/openai-reveals-redis-bug-behind-chatgpt.html

漏洞挖掘競賽Pwn2Own Vancouver 2023落幕，參賽者找出27個零時差漏洞、抱走百萬美元獎金
https://www.zerodayinitiative.com/blog/2023/3/24/pwn2own-vancouver-2023-day

身分驗證及管理系統Okta出現漏洞，恐曝露用戶帳號資料而被濫用
https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data

企業儲存設備平均存在14個漏洞，而成為駭客覬覦的目標
https://www.continuitysoftware.com/pressreleases/state-of-storage-security-report/

IBM檔案共用系統Aspera Faspex漏洞出現攻擊行動
https://www.rapid7.com/blog/post/2023/03/28/etr-active-exploitation-of-ibm-aspera-faspex-cve-2022-47986/

網站管理系統CloudPanel曝露共用證書漏洞
https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/

2.銀行/金融/保險/證券/金融監理 新聞及資安
櫃買業績發表 4月7日秀資安
https://reurl.cc/7RYVdN

金融業用ChatGPT 立委：有資安疑慮
https://reurl.cc/WDzO8y

金融業用ChatGPT涉資安疑慮？金管會：將廣泛性盤點
https://wantrich.chinatimes.com/news/20230329900645-420501

金融業導入ChatGPT涉資安疑慮 台立委籲金管會盤點與修法
https://www.epochtimes.com/b5/23/3/29/n13961045.htm

澳洲金融機構Latitude Financial資料外洩，影響1,400萬客戶
https://www.latitudefinancial.com.au/about-us/media-releases/cybercrime-update-27-03-2023.html

IcedID Malware Shifts Focus from Banking Fraud to Ransomware Delivery
https://thehackernews.com/2023/03/icedid-malware-shifts-focus-from.html

駭客聲稱掌握證交所資料，金管會表示無外洩情事
https://www.cna.com.tw/news/afe/202303290069.aspx

First Citizens Bank宣布全面收購矽谷銀行
https://www.ithome.com.tw/news/156182

Google雲端GCP服務應臺灣金融機構上雲需求，完成獨立第三方單位聯合查核
https://www.ithome.com.tw/news/156170

3.信用卡/電子支付/行動支付/pay/支付系統/資安
Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites
https://thehackernews.com/2023/03/critical-woocommerce-payments-plugin.html

手機護資安！全台金融業半數都靠 HyperG的appGuard
https://www.nownews.com/news/6094353

「先買後付」來了！蘋果Apple Pay Later還能貸款 美國搶先試用
https://reurl.cc/gZNYOb

雷門多元支付串聯花蓮智慧交通整合服務新亮點
https://n.yam.com/Article/20230331579444

電子支付帳戶也遭詐騙集團冒用！一卡通投身金融防詐，Gogolook成為合作首選
https://www.storm.mg/article/4764218

金融機構危機處理要點 擬納入電子支付、信用卡
https://reurl.cc/ykWAzD

防堵電子支付遭盜用　4/1起核驗原始手機碼
https://www.cardu.com.tw/news/detail.php?48456

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Sftimo交易所：預防投資者上當受騙，從自身做起
https://reurl.cc/eXQkVK

Chainlink將於4月28日至6月9日舉辦2023年春季駭客松
https://news.cnyes.com/news/id/5133118

BTC攻佔歐洲央行！投影「巨型比特幣LOGO」金融叛客現場開趴
https://www.blocktempo.com/ecb-building-projected-with-bitcoin-logo/

確定了！「V 神」將亮相「ETHTaipei」暢談以太坊未來藍圖
https://blockcast.it/2023/03/31/get-ready-for-an-amazing-talk-by-vitalik-buterin-at-ethtaipei/

美國CFTC控告幣安與趙長鵬
https://www.ithome.com.tw/news/156167

貨幣對決／電子支付人口已近8成　為什麼還需要CBDC
https://finance.ettoday.net/news/2458881

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
微軟在OneNote封鎖120種可能被用於散布惡意程式的檔案格式
https://www.bleepingcomputer.com/news/security/microsoft-onenote-will-block-120-dangerous-file-extensions/

美國電信網路服務業者Lumen證實遭到2次網路攻擊
https://www.cybersecuritydive.com/news/lumen-ransomware-attack/646135/

中國駭客散布Linux惡意軟體Mélofée
https://blog.exatrack.com/melofee/

Dark Power 新勒索軟體組織不到一個月內勒索10個目標
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10391

從勒索軟體到網路間諜行動：2022 年武器化的 55 個零日漏洞
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10381

LockBit 3.0 勒索軟體
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a

一款新的 Andorid 殭屍木馬為你的銀行金融數據而生
https://www.kocpc.com.tw/archives/486330

中國駭客組織Mustang Panda利用以密碼保護的文件檔案來規避防毒軟體偵測
https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html

勒索軟體Dark Power一個月內攻陷10個組織
https://www.trellix.com/en-us/about/newsroom/stories/research/shining-light-on-dark-power.html

竊資軟體BlackGuard針對剪貼簿、瀏覽器擴充套件下手，盜取加密貨幣
https://cybersecurity.att.com/blogs/labs-research/blackguard-stealer-extends-its-capabilities-in-new-variant

殭屍網路病毒Emotet針對美國報稅季而來
https://www.bleepingcomputer.com/news/security/emotet-malware-distributed-as-fake-w-9-tax-forms-from-the-irs/

中國核能產業遭駭客組織Bitter鎖定，散布惡意程式
https://www.intezer.com/blog/research/phishing-campaign-targets-nuclear-energy-industry/

駭客以服務型式提供惡意程式Cinoshi多種攻擊模組
https://blog.cyble.com/2023/03/23/cinoshi-project-and-the-dark-side-of-free-maas/

出現鎖定Mac用戶的竊資軟體，能從OS內建密碼管理系統盜走各式帳密
https://www.uptycs.com/blog/macstealer-command-and-control-c2-malware

惡意PyPI套件濫用Unicode異體字元進行混淆，目的是規避偵測
https://blog.phylum.io/malicious-actors-use-unicode-support-in-python-to-evade-detection

美國波多黎各水道管理局傳出遭勒索軟體Vice Society攻擊
https://therecord.media/fbi-investigating-cyberattack-on-puerto-rico

勒索軟體為近2年歐洲交通運輸業者的重大威脅
https://www.enisa.europa.eu/publications/enisa-transport-threat-landscape

博奕業者Crown Resorts證實因GoAnywhere遭駭而被勒索
https://www.bleepingcomputer.com/news/security/crown-resorts-confirms-ransom-demand-after-goanywhere-breach/

Google揭露間諜軟體供應商濫用熱門平臺零時差和既有漏洞
https://www.ithome.com.tw/news/156207

惡意軟體IcedID出現精簡版變種，被用於散布第二階段作案工具
https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid

Analysis of SideCopy Group's Recent Attacks Using Indian Ministry of Defense Documents as Lures
https://reurl.cc/DmYqGE

New loader on the bloc - AresLoader
https://intel471.com/blog/new-loader-on-the-bloc-aresloader

Nexus: a new Android botnet?
https://www.cleafy.com/cleafy-labs/nexus-a-new-android-botnet

Warning on KIMSUKY1 Cyber Actor's Recent Cyber Campaigns against Google's Browser and App Store Services
https://reurl.cc/rLkEpr

Shining Light on Dark Power: Yet Another Ransomware Gang
https://www.trellix.com/en-us/about/newsroom/stories/research/shining-light-on-dark-power.html

Earth Preta Updated Stealthy Strategies
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/c/earth-preta-updated-stealthy-strategies/iocs-earth-pretas-updated-stealthy-strategies.txt
https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html

Scarcruft Bolsters Arsenal for targeting individual Android devices
https://medium.com/s2wblog/scarcruft-bolsters-arsenal-for-targeting-individual-android-devices-97d2bcef4ab

Fork in the Ice: The New Era of IcedID
https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid

Finding Gozi
https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/

MacStealer: New macOS-based Stealer Malware Identified
https://www.uptycs.com/blog/macstealer-command-and-control-c2-malware

Heavy Shadows: Summary of Recent Attack Techniques Used by Donot Group
https://ti.qianxin.com/blog/articles/Heavy-Shadows:-Summary-of-Recent-Attack-Techniques-Used-by-Donot-Group-EN/

Updates from the MaaS: new threats delivered through NullMixer
https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1

AsyncRAT Crusade: Detections and Defense
https://www.splunk.com/en_us/blog/security/asyncrat-crusade-detections-and-defense.html

New OpcJacker Malware Distributed via Fake VPN Malvertising
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/c/new-opcjacker-malware-distributed-via-fake-vpn-malvertising/ioc-new-opcJacker-malware-distributed-via-fake-vpn-malvertising.txt
https://www.trendmicro.com/en_us/research/23/c/new-opcjacker-malware-distributed-via-fake-vpn-malvertising.html

Makop: The Toolkit of a Criminal Gang
https://medium.com/@lcam/makop-the-toolkit-of-a-criminal-gang-53cd44563c11

VoIP網路電話系統3CX的用戶端程式遭到滲透，原因是受到駭客的軟體供應鏈攻擊
https://www.bleepingcomputer.com/news/security/hackers-compromise-3cx-desktop-app-in-a-supply-chain-attack/

CrowdStrike Falcon Platform Detects and Prevents Active Intrusion Campaign Targeting 3CXDesktopApp Customers
https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
https://objective-see.org/blog/blog_0x73.html
https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
https://www.3cx.com/blog/news/desktopapp-security-alert/

3CX Desktop App Supply Chain Attack Leaves Millions at Risk - Urgent Update on the Way!
https://thehackernews.com/2023/03/3cx-desktop-app-targeted-in-supply.html

3CX Supply Chain Attack — Here's What We Know So Far
https://thehackernews.com/2023/03/3cx-supply-chain-attack-heres-what-we.html

LimeRAT Malware Analysis: Extracting the Config
https://any.run/cybersecurity-blog/limerat-malware-analysis/

DBatLoader Actively Distributing Malwares Targeting Europea
https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses

Exploitation is a Dish Best Served Cold: Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe
https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability

Ducktail: Dissecting a complex infection chain started from social engineering
https://otx.alienvault.com/pulse/64260878d21ef6bbcde86089

Dissecting AlienFox | The Cloud Spammer’s Swiss Army Knife
https://assets.sentinelone.com/sentinellabs22/s1_-sentinellabs_dis#page=1s1_-sentinellabs_dis.pdf

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data
https://thehackernews.com/2023/03/malicious-python-package-uses-unicode.html

New MacStealer macOS Malware Steals iCloud Keychain Data and Passwords
https://thehackernews.com/2023/03/new-macstealer-macos-malware-steals.html

惡意程式載入器DBatLoader在歐洲散布木馬程式與竊資軟體
https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses

Stealthy DBatLoader Malware Loader Spreading Remcos RAT and Formbook in Europe
https://thehackernews.com/2023/03/stealthy-dbatloader-malware-loader.html

President Biden Signs Executive Order Restricting Use of Commercial Spyware
https://thehackernews.com/2023/03/president-biden-signs-executive-order.html

俄羅斯及東歐遭到惡意Tor瀏覽器鎖定，散布剪貼簿挾持程式
https://securelist.com/copy-paste-heist-clipboard-injector-targeting-cryptowallets/109186/

Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware
https://thehackernews.com/2023/03/trojanized-tor-browser-installers.html

AlienFox Malware Targets API Keys and Secrets from AWS, Google, and Microsoft Cloud Services
https://thehackernews.com/2023/03/alienfox-malware-targets-api-keys-and.html

Mélofée: Researchers Uncover New Linux Malware Linked to Chinese APT Groups
https://thehackernews.com/2023/03/melofee-researchers-uncover-new-linux.html

Chinese RedGolf Group Targeting Windows and Linux Systems with KEYPLUG Backdoor
https://thehackernews.com/2023/03/chinese-redgolf-group-targeting-windows.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Apple Issues Urgent Security Update for Older iOS and iPadOS Models
https://thehackernews.com/2023/03/apple-issues-urgent-security-update-for.html

Smart Mobility has a Blindspot When it Comes to API Security
https://thehackernews.com/2023/03/smart-mobility-has-blindspot-when-it.html

Spyware Vendors Caught Exploiting Zero-Day Vulnerabilities on Android and iOS Devices
https://thehackernews.com/2023/03/spyware-vendors-caught-exploiting-zero.html

研究人員揭露新型態Wi-Fi攻擊手法，可攔截流量、繞過安全機制
https://papers.mathyvanhoef.com/usenix2023-wifi.pdf

New Wi-Fi Protocol Security Flaw Affecting Linux, Android and iOS Devices
https://thehackernews.com/2023/03/new-wi-fi-protocol-security-flaw.html

蘋果強化iOS/iPadOS安全性 更新多套作業系統解決漏洞
https://netmag.tw/2023/03/31/apple-strengthens-ios-ipados-security-update-multiple-suite-of-operating-systems-to-resolve-vulnerabilities

蘋果針對舊版iOS作業系統修補WebKit零時差漏洞
https://www.bleepingcomputer.com/news/apple/apple-fixes-recently-disclosed-webkit-zero-day-on-older-iphones/

安卓、iOS手機出現零時差漏洞，被駭客用於部署惡意程式
https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/

美國證實5個iOS與安卓漏洞被用於攻擊行動，要求聯邦機構限期修補
https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-bugs-exploited-to-drop-spyware/

Nokia今年內讓4G網路上月球
https://www.ithome.com.tw/news/156184

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
全球資安人才缺口達340萬，2022年遭入侵5次以上的企業增加53％
https://www.fortinet.com/content/dam/fortinet/assets/reports/2023-cybersecurity-skills-gap-report.pdf

企業採用的開放原始碼軟體，有近9成使用了超過4年沒更新的元件
https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html

網軍針對政府機關發動地毯式DNS攻擊
https://hisecure.hinet.net/secureinfo/popup.php?cert_id=HiNet-2023-0027

歐洲刑警組織警告網路罪犯濫用ChatGPT
https://www.europol.europa.eu/media-press/newsroom/news/criminal-use-of-chatgpt-cautionary-tale-about-large-language-models

報告：中共政府支持的黑客組織非常活躍
https://www.epochtimes.com/b5/23/3/30/n13961910.htm

中國駭客的攻擊行動Operation Soft Cell鎖定中東電信業者而來
https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/

北韓駭客APT43埋藏攻擊行蹤長達5年
https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime-espionage

北韓駭客團體APT43透過加密貨幣洗錢自給自足維持間諜行動
https://www.ithome.com.tw/news/156194

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations
https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report

澳洲大學網站接連遭到兩個駭客組織DDoS攻擊
https://blog.cloudflare.com/ddos-attacks-on-australian-universities/

以邪治邪！英國設置冒牌DDoS攻擊租賃服務的網站來識別網路罪犯
https://www.nationalcrimeagency.gov.uk/news/nca-infiltrates-cyber-crime-market-with-disguised-ddos-sites

U.K. National Crime Agency Sets Up Fake DDoS-For-Hire Sites to Catch Cybercriminals
https://thehackernews.com/2023/03/uk-national-crime-agency-sets-up-fake.html

Researchers Uncover Chinese Nation State Hackers' Deceptive Attack Strategies
https://thehackernews.com/2023/03/researchers-uncover-chinese-nation.html

20-Year-Old BreachForums Founder Faces Up to 5 Years in Prison
https://thehackernews.com/2023/03/20-year-old-breachforums-founder-faces.html

North Korean APT43 Group Uses Cybercrime to Fund Espionage Operations
https://thehackernews.com/2023/03/north-korean-apt43-group-uses.html

Pakistan-Origin SideCopy Linked to New Cyberattack on India's Ministry of Defence
https://thehackernews.com/2023/03/pakistan-origin-sidecopy-linked-to-new.html

資安服務助理工程師
https://www.104.com.tw/job/6pw58?jobsource=googlejobs

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Phishing Campaign Targets Chinese Nuclear Energy Industry
https://www.intezer.com/blog/research/phishing-campaign-targets-nuclear-energy-industry/

駭客假冒企業SharePoint檔案共用通知郵件，對攻擊目標所屬的員工進行網路釣魚
https://www.kaspersky.com/blog/sharepoint-notification-scam/47593/

大學教授遭到變臉不雅照勒索，疑中國駭客所為
https://udn.com/news/story/7320/7054755
https://news.ltn.com.tw/news/society/paper/1573945
https://www.cna.com.tw/news/ahel/202303240332.aspx

資安業者Black Lantern提供開源工具Badsecrets，可偵測網頁應用程式框架曝露的帳密資料
https://blog.blacklanternsecurity.com/p/introducing-badsecrets

AI測試框架MLflow出現漏洞，恐導致資料外洩
https://protectai.com/blog/hacking-ai-system-takeover-exploit-in-mlflow

推特網站與內部工具的原始碼傳出被公布於GitHub儲存庫
https://www.ithome.com.tw/news/156159

適逢美國報稅季，殭屍網路病毒Emotet假借IRS寄出申報單名義進行網路釣魚攻擊
https://www.bleepingcomputer.com/news/security/emotet-malware-distributed-as-fake-w-9-tax-forms-from-the-irs/

Instagram詐騙傳出以提供時裝購物商城Shein禮物卡為誘餌
https://blog.avast.com/shein-instagram-scam

美國警告駭客假借採購名義進行商業郵件詐騙
https://www.ic3.gov/Media/Y2023/PSA230324

豐田汽車義大利分公司資安出包！市場行銷系統帳密竟在公開網路曝露逾一年半
https://cybernews.com/security/toyota-customer-data-leak/

臺灣民眾網路詐騙抵抗力有待加強，透過錯誤資訊來確認資訊真偽的比例高達8成
https://usa.visa.com/content/dam/VCOM/regional/na/us/run-your-business/documents/visa-fraudulese-report.pdf

ChatGPT資料外洩，起因是近期新加入使用的元件出現弱點
https://openai.com/blog/march-20-chatgpt-outage

兒童程式開發課程系統iD Tech傳出個資遭外洩
https://techcrunch.com/2023/03/23/id-tech-kids-tech-camp-data-breach/

威秀影城傳出50萬筆客戶資料外洩
https://tw.nextapple.com/local/20230330/797513A5ED5E2F1F401C209A13DCC250

E.研究報告/工具
CIA資安鐵三角（CIA triad）
https://blog.twnic.tw/2023/03/29/26302/

如何輕鬆管理ISO27001文件和紀錄
https://www.attnerp.com.tw/post-2303301/

研究人員揭露針對語音助理發動的無聲攻擊手法
https://www.bleepingcomputer.com/news/security/inaudible-ultrasound-attack-can-stealthily-control-your-phone-smart-speaker/

Where SSO Falls Short in Protecting SaaS
https://thehackernews.com/2023/03/where-sso-falls-short-in-protecting-saas.html

Breaking the Mold: Pen Testing Solutions That Challenge the Status Quo
https://thehackernews.com/2023/03/breaking-mold-pen-testing-solutions.html

How to Build a Research Lab for Reverse Engineering — 4 Ways
https://thehackernews.com/2023/03/how-to-build-research-lab-for-reverse.html

Cyberstorage: Leveraging the Multi-Cloud to Combat Data Exfiltration
https://thehackernews.com/2023/03/cyberstorage-leveraging-multi-cloud-to.html

Deep Dive Into 6 Key Steps to Accelerate Your Incident Response
https://thehackernews.com/2023/03/deep-dive-into-6-key-steps-to.html

F.商業
CyberArk強化員工密碼管理功能，支援採用 CAPTCHA驗證
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10383

思科啟動台灣數位加速計畫 2.0，資安、韌性是重點
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10380

果核數位子公司HyperG自研產品取得CC國際資安認證
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10390

GitHub Swiftly Replaces Exposed RSA SSH Key to Protect Git Operations
https://thehackernews.com/2023/03/github-swiftly-replaces-exposed-rsa-ssh.html

產官學聯防校園資安　世新大學攜手瑞擎數位、資策會資安所提升數位時代保護力
https://www.owlting.com/news/articles/317375

WIZON懷生數位宣布成立 聚焦資安即服務模式
https://twnewshub.com/archives/44603

思科最新調查：僅16%台灣企業為資安威脅做好準備
https://www.winnews.com.tw/125305/

微軟發布 Security Copilot，將 AI 的強大功能帶入資安防禦領域
https://news.microsoft.com/zh-tw/security-copilot/

微軟針對企業資安需求打造以人工智慧驅動的Security Copilot服務
https://mashdigi.com/microsoft-creates-ai-driven-security-copilot-service-for-enterprise-information-security-needs/

精誠攜美資安大廠 一站式平台服務
https://wantrich.chinatimes.com/news/20230330900195-420501

德凱集團買下臺灣資安新創安華聯網
https://www.dekra.com.tw/tc/dekra-de-kai-ji-tuan-bing-gou-an-hua-lian-wang-gong-gu-ya-tai-shi-chang-qiang-hua-quan-fang-wei-zi-an-ye-wu/

資安業者Rapid7買下Minerva，強化勒索軟體防護與回應
https://www.rapid7.com/about/press-releases/rapid7-acquires-minerva-labs/

奧義智慧推出XCockpit自動化資安威脅管理平臺
https://ctee.com.tw/industrynews/automation/836474.html

Google正式推出機密協同運算服務Confidential Space
https://www.ithome.com.tw/news/156229

AutoCAD、Maya終於支援Apple Silicon晶片
https://www.ithome.com.tw/news/156226

Google Assistant部門傳改組，將以Bard為重點
https://www.ithome.com.tw/news/156221

Google相容於PostgreSQL的雲端資料庫AlloyDB，提供下載版本支援本地用例
https://www.ithome.com.tw/news/156218

傳微軟又將打造對抗ChromeOS的下一代Windows，且支援AI
https://www.ithome.com.tw/news/156199

思科Webex加入多項人工智慧功能，改善線上會議協作體驗
https://www.ithome.com.tw/news/156196

Amazon Chime SDK通話分析新功能，可即時分析語音情感和搜尋說話者紀錄
https://www.ithome.com.tw/news/156176

橘子集團資安系統獲CC國際資安認證，布局東南亞拓展商機
https://reurl.cc/n7xY91

G.政府
資安院研議AI技術檢測機制 擬年底前出爐
https://admin.rti.org.tw/news/view/id/2163514

AI技術檢測標準與工具 資安院擬年底前推出
https://ec.ltn.com.tw/article/breakingnews/4255480

打造資安一條龍服務！資安院長何全德：「台版AI框架」拚今年下半年啟動
https://tw.stock.yahoo.com/news/cyber-security-105101714.html

資安院：培育人才像養成棒球選手 每年拚150高階戰力
https://reurl.cc/xle3NV

數位部有資安署又有資安院，兩者怎麼分
https://technews.tw/2023/03/29/moda-nics-2/

數位發展部下設資通安全研究院 個資事件查處列重點
https://news.pts.org.tw/article/629803

捷克國安局長同行訪台　加速雙邊軍事、資安聯防合作
https://www.upmedia.mg/news_info.php?Type=1&SerialNo=169250

2023年企業永續發展行動方案出爐！資本額不到20億元上市櫃公司未來也要編製永續報告書
https://www.ithome.com.tw/news/156181

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
美國CISA警告須注意Delta及Rockwell工業控制系統多個高危險漏洞
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10389

Microsoft Introduces GPT-4 AI-Powered Security Copilot Tool to Empower Defenders
https://thehackernews.com/2023/03/microsoft-introduces-gpt-4-ai-powered.html

友通深耕智慧交通
https://money.udn.com/money/story/5710/7068176?from=edn_newestlist_cate_side

車用電子夯 趨勢友通組隊衝
https://wantrich.chinatimes.com/news/20230331900053-420101

威聯通針對旗下NAS修補Linux元件權限提升漏洞
https://www.qnap.com/en/security-advisory/qsa-23-11

殭屍網路病毒ShellBot、MooBot大量散播有新管道，它們鎖定Realtek物聯網平臺與網管系統Cacti重大漏洞
https://www.fortinet.com/blog/threat-research/moobot-strikes-again-targeting-cacti-and-realtek-vulnerabilities

Google BigQuery新機器學習推理引擎支援外部自定義模型
https://www.ithome.com.tw/news/156191

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

6.近期資安活動及研討會
Just a chat - with no Expectations 2023/4/1
https://www.meetup.com/taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-cryptocurrency-meetup/events/292187542/

SyntaxError 2023/4/5
https://www.meetup.com/pythonhug/events/292275935/

HackingThursday 固定聚會@2023 -- 台北 Taipei 2023/4/6
https://www.meetup.com/hackingthursday/events/292299234/

用 Keelung 構造零知識證明 FunTh#83 2023/4/6
https://www.meetup.com/functional-thursday/events/292296123/

OWASP Meetup 2023.Apr . 2023/4/7
https://csa.kktix.cc/events/owasp202304-copy-1

Application of Formal Methods to High-Security Requirements Software 2023/4/7
https://www.meetup.com/automotive-security-research-group-taipei-asrg-%E8%87%BA%E5%8C%97/events/292558745/

Bitcoin Meetup & Socratic Seminar With Jimmy Song, Andrew Chow and Nopara 2023/4/7
https://www.meetup.com/taiwan-bitdevs/events/292571920/

跨境數位威權：全球數位威權趨勢對台灣的機遇和挑戰 2023/4/8
https://ocftw.kktix.cc/events/citizenseminar

《數位創新沙龍座談小聚》混合雲轉型：從 IT 到學術的旅程 2023/4/8
https://www.accupass.com/event/2303230824409325135880

超融合架構暨網路資安防護論壇 2023/4/12
https://www.accupass.com/event/2303200150055844623280

Airflow Taiwan User Meetup #3 2023/4/13
https://www.meetup.com/taipei-py/events/292026654/

Fortify 直擊漏洞，佈建合規資安研討會 2023/4/14
https://www.accupass.com/event/2303160227581447651717

網路資安鐘點戰 防止威脅入侵的五大戰略 2023/4/12 ~ 5/17
https://www.accupass.com/event/2303250723538886915720

TWCC-CLI 基本操作 - 計算資源管理自動化 2023/4/14
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4034&from_course_list_url=course_index

AI & XR Meetup 2023/4/15
https://www.meetup.com/taiwan-ai-xr-discovery-meetups/events/292574374/

WordPress - 桃園午茶小聚 #23 2023/4/15
https://www.meetup.com/taoyuan-wordpress-meetup/events/292467443/

iPAS-「初級」資訊安全工程師-能力研習衝刺班 2023/4/15、4/22 
https://www.cisanet.org.tw/Course/Detail/3948

Taipei dbt Meetup #10 (in-person 👫 & online 👨‍💻)2023/4/16
https://www.meetup.com/taipei-dbt-meetup/events/291861526/

資安五四三 2023/4/18
https://csa.kktix.cc/events/1f504d33

Hugging Face :Object Detection 2023/4/18
https://www.meetup.com/tensorflow-user-group-taipei/events/290714768/

平行計算程式設計基礎課程 2023/4/18
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4032&from_course_list_url=course_index

無所不在的混合雲與ZTA交流研討會 2023/4/20
https://www.nehs.hc.edu.tw/?p=14035

資安韌性與金融科技創新 2023/4/21
https://www.accupass.com/event/2303281153102586247910

資安大師班 - 讓專家來為你解密資安實戰 2023/4/21
https://www.accupass.com/event/2303310934086693440470

「Meta 台灣 AR 黑客松」 2023/4/22 ~ 2023/4/23
https://www.arhackathon.tw/

EDB 15 資安新功能 TDE & SSL 保衛資料庫安全 2023/4/26
https://www.accupass.com/event/2303310808018123738370

RSA Conference 2023 2023/4/24 ~ 2023/4/27
https://www.rsaconference.com/usa

網站應用程式安全（資安專業課程訓練） 2023/4/28
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X21031

TWCC-CLI 進階操作- AI/ML 自動流程 2023/5/12
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4035&from_course_list_url=course_index

【實作體驗營】一日駭客x網路弱點滲透 2023/5/13
https://www.accupass.com/event/2303030820005796452650

iPAS中級資訊安全人員訓練班 2023/5/4 ~ 2023/6/1
https://edu.tcfst.org.tw/web/tw/class/show.asp?courseidori=12C013

(ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27
https://www.isc2.org/Congress-2023


