###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2023/3/6 ~ 2023/3/10

1.重大弱點漏洞/後門/Exploit/Zero Day
中華資安國際發現CVE弱點，國內某企業雲端硬碟系統具有一項漏洞
https://www.twcert.org.tw/tw/cp-132-6973-45872-1.html

SonicWall的SSL VPN設備遭到中國駭客鎖定
https://www.mandiant.com/resources/blog/suspected-chinese-persist-sonicwall

Fortinet防火牆、網頁安全閘道存在重大漏洞
https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-critical-unauthenticated-rce-vulnerability/

New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access
https://thehackernews.com/2023/03/new-critical-flaw-in-fortios-and.html

Jenkins伺服器漏洞CorePlague有可能被攻擊者遠端執行任意程式碼
https://blog.aquasec.com/jenkins-server-vulnerabilities

Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks
https://thehackernews.com/2023/03/jenkins-security-alert-new-security.html

Veeam高風險漏洞恐讓駭客破壞組織的備份基礎架構
https://www.veeam.com/kb4424

Toyota墨西哥分公司的CRM系統出現嚴重漏洞，可被用於存取客戶資料
https://eaton-works.com/2023/03/06/toyota-c360-hack/

Google發布Chrome 111，修補40個漏洞
https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html

美國在2022年彙整557個已被用於攻擊的漏洞
https://vulncheck.com/blog/2022-cisa-kev-review

UAC再度出現被繞過的情況！Windows信任的資料夾存在可被繞過的弱點
https://www.sentinelone.com/blog/dbatloader-and-remcos-rat-sweep-eastern-europe/

VMware終止支援產品的重大漏洞出現攻擊行動
https://lab.wallarm.com/vmware-nsx-manager-vulnerabilities-being-actively-exploited-in-the-wild/

逾半數漏洞公開後一週內就出現攻擊行動
https://www.rapid7.com/blog/post/2023/02/28/a-shifting-attack-landscape-rapid7s-2022-vulnerability-intelligence-report/

2022年的漏洞濫用攻擊，有極大比例使用是2017年至2021年列管的漏洞
https://www.tenable.com/blog/tenable-2022-threat-landscape-report-reduce-your-exposure-by-tackling-known-vulnerabilities

DJI大疆無人機出現漏洞，恐曝露控制者的位置
https://www.helpnetsecurity.com/2023/03/07/vulnerability-dji-drones-reveal-pilot-location/

微軟封鎖來自網路的Excel附加元件
https://www.bleepingcomputer.com/news/microsoft/microsoft-excel-now-blocking-untrusted-xll-add-ins-by-default/

微軟針對Intel處理器弱點發布更新程式
https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-security-updates-for-intel-cpu-flaws/

Booking.com修補可能導致用戶帳號遭接管的OAuth漏洞
https://salt.security/blog/traveling-with-oauth-account-takeover-on-booking-com

2.銀行/金融/保險/證券/金融監理 新聞及資安
79家金融業被召喚開資安會議，會中聚焦供應鏈資安韌性、聯防效能
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10347

九大行庫公股董總開會 資安兵棋推演
https://www.chinatimes.com/newspapers/20230310000187-260202?chdtv

金管會提醒企業重視資安風險管理，並適時評估投保資安保險
https://www.fsc.gov.tw/ch/home.jsp?id=96&parentpath=0,2&mcustomize=news_view.jsp&dataserno=202303090002&dtable=News

三大類資安險可助企業防駭 資料保護責任保險賣最好
https://news.cnyes.com/news/id/5110032?exp=a

企業網路風險意識抬頭 資安險保費收入4年暴增逾3倍
https://reurl.cc/o07q9l

在臺灣超商領錢其實很安全？──德國路邊提款機頻遭歹徒炸，政府銀行都頭痛
https://crossing.cw.com.tw/article/17390

墨西哥銀行遭到ATM惡意軟體FiXS鎖定
https://www.metabaseq.com/fixs-atms-malware/

New FiXS ATM Malware Targeting Mexican Banks
https://thehackernews.com/2023/03/new-fixs-atm-malware-targeting-mexican.html

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity
https://thehackernews.com/2023/03/lazarus-group-exploits-zero-day.html

非洲金融科技新創Flutterwave遭到駭客攻擊，損失逾420萬美元
https://techpoint.africa/2023/03/05/hackers-have-stolen-2-9-billion-from-flutterwave/

3.信用卡/電子支付/行動支付/pay/支付系統/資安
「駭客來了 市府個資被盜」金山華人1妙招防信用卡盜刷
https://www.worldjournal.com/wj/story/121472/7019585

又駭！Agoda帳號遭「異地登入」　綁信用卡即盜刷
https://news.tvbs.com.tw/life/2062436

信用卡資料黑市BidenCash洩露逾2百萬張金融卡資料
https://www.bleepingcomputer.com/news/security/bidencash-market-leaks-over-2-million-stolen-credit-cards-for-free/

家樂福「結帳當機」搶修中
https://reurl.cc/jlDOOy

電支購物互通Q3上線　免換App即可掃瞄支付
https://www.cardu.com.tw/news/detail.php?48367

挪威行動支付Vipps向蘋果發起挑戰 盼歐盟採取反壟斷行動
https://news.cnyes.com/news/id/5087703

公股銀強化銀行帳戶連結電支
https://ctee.com.tw/news/finance/822472.html

還在追求行動載具、電子支付嗎？現金正在全世界展開反攻
https://www.commonhealth.com.tw/article/87794

Mercedes-Benz推出Mercedes Pay+，首度將汽車變成電子支付設備
https://www.carstuff.com.tw/car-news/item/37719-mercedes-benz-mercedes-pay.html

數位支付正火！數位支付APP網路聲量排名揭曉
https://reurl.cc/lvDM4v

印星連結電子支付平台 莫迪預期將成主流交易模式
https://reurl.cc/1e1p7p

電子支付之戰 韓國推元宇宙聯盟闢新商機
https://ctee.com.tw/news/finance/815803.html

藍新科技 拚兩年內IPO
https://ctee.com.tw/news/stocks/819244.html

滿 18 歲的快看過來！郵局帳戶＋iCash Pay 就能投資「國民 ETF」
https://technews.tw/2023/03/09/icash-pay-etf/

遠通電收電子支付停車費新服務 非eTag用戶也適用
https://money.udn.com/money/story/5613/7002543

廣宇：牆與中國互聯網——手機支付
https://www.epochtimes.com/b5/23/3/10/n13946935.htm

香港八達通連接中國大陸一卡通　320個城市可用
https://www.setn.com/News.aspx?NewsID=1262025

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Blockbooster Web3.0社交元宇宙駭客松將於4月7日至9日在香港舉行
https://news.cnyes.com/news/id/5107526

美國司法部內部轉帳？價值10億美元的暗網相關比特幣被轉移
https://news.knowing.asia/news/44572daa-e0c0-4247-a11f-afa5c0af3cbf

14萬枚比特幣賣壓》Mt.Gox最大債權人將「先倒貨三成」，剩七成續抱觀望
https://www.blocktempo.com/bankrupt-mt-gox-s-biggest-creditor-won-t-sell-returned-bitcoin-btc/

14萬比特幣拋壓再延》Mt.Gox(門頭溝)債權人還款截止日延至 10/31
https://www.blocktempo.com/mt-gox-creditor-registration-system-extension/

美聯儲主席：國會需要制定法律框架以監管穩定幣
https://news.cnyes.com/news/id/5107909

報告：以太坊、Solana、Avalanche、Cosmos、Tezos是白帽駭客最為關注的區塊鏈
https://news.cnyes.com/news/id/5110854?exp=a

發新代幣H1、搶進Web3社群新戰場！Yield App推出與EVM兼容的Layer 1 Haven 1
https://news.knowing.asia/news/8426ef0c-1a0e-4f83-b048-51d9ab7844a8

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
ESET發現第一個能繞過Windows 11安全啟動的惡意軟體
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10350

IBM：「先部署後門程式再勒索」製造業連續兩年受攻擊最多
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10348

生成式 AI 降低惡意程式打造門檻，資安廠：善加利用以 AI 打 AI
https://technews.tw/2023/03/08/generative-ai-security/

AI降低惡意程式門檻？專家：善加利用可打擊複雜攻擊
https://reurl.cc/n7DRZ1

每支付一筆贖金等於資助勒索病毒集團未來的 9 次攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10356

竊密軟體LokiBot攻擊行動在2022年底大幅增加
https://unit42.paloaltonetworks.com/lokibot-spike-analysis/

日本音響器材業者鐵三角傳出遭勒索軟體攻擊
https://www.audio-technica.co.jp/news/detail/196

惡意軟體QBot大肆透過微軟筆記軟體OneNote檔案散布
https://www.trellix.com/en-us/about/newsroom/stories/research/qakbot-evolves-to-onenote-malware-distribution.html

明尼阿波利斯校區傳出遭到勒索軟體Medusa攻擊，駭客索討百萬美元換取刪除資料
https://www.bleepingcomputer.com/news/security/ransomware-gang-posts-video-of-data-stolen-from-minneapolis-schools/

巴基斯坦駭客鎖定安卓手機散布後門程式CapraRAT
https://www.welivesecurity.com/2023/03/07/love-scam-espionage-transparent-tribe-lures-indian-pakistani-officials/

有人利用區塊鏈電玩Sandbox的名義發動網釣攻擊，散布惡意程式
https://sandboxgame.medium.com/notice-of-security-incident-february-2023-ea692ee8094b

惡意PyPI套件挾帶惡意軟體Colour-Blind
https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools

德國大學傳出遭到勒索軟體Vice Society攻擊
https://therecord.media/germany-ransomware-haw-hamburg-vice-society

惡意軟體Emotet再度捲土重來，假借發票的名義散布
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/

西班牙醫院傳出遭到勒索軟體Ransom House而癱瘓
https://securityaffairs.com/143121/cyber-crime/hospital-clinic-de-barcelona-ransomware.html

波蘭市長傳出遭到間諜軟體Pegasus跟縱
https://www.reuters.com/article/poland-pegasus/polish-mayor-targeted-by-pegasus-spyware-media-idINL8N35B21J

勒索軟體Play洩露聲稱從美國奧克蘭市竊得的資料
https://www.securityweek.com/ransomware-operators-leak-data-allegedly-stolen-from-city-of-oakland/

FBI和CISA警告Royal勒索軟體瞄準關鍵基礎設施
https://www.ithome.com.tw/news/155787

勒索軟體Royal鎖定美國關鍵基礎設施而來
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

2月中旬美國加州奧克蘭市遭到網路攻擊傳出是勒索軟體Play所為
https://www.bleepingcomputer.com/news/security/play-ransomware-claims-disruptive-attack-on-city-of-oakland/

Can You See It Now? An Emerging LockBit Campaign
https://www.fortinet.com/blog/threat-research/emerging-lockbit-campaign

Just Because It’s Old Doesn’t Mean You Throw It Away (Including Malware!)
https://www.fortinet.com/blog/threat-research/just-because-its-old-doesnt-mean-you-throw-it-away-including-malware

Cryptocurrency Entities at Risk: Threat Actor Uses Parallax RAT for Infiltration
https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration

Redis Miner Leverages Command Line File Hosting Service
https://www.cadosecurity.com/redis-miner-leverages-command-line-file-hosting-service/

New malicious email campaign by the threat actor TA499
https://www.hivepro.com/tracking-the-malicious-email-campaigns-of-russia-aligned-ta499/

Redirection Roulette: Thousands of hijacked websites in East Asia redirecting visitors to other sites
https://www.wiz.io/blog/redirection-roulette

New HiatusRAT router malware covertly spies on victims
https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
https://github.com/blacklotuslabs/IOCs/blob/main/Hiatus_IoCs.txt

New APT37 campaign targeting individuals for intelligence collection
https://asec-ahnlab-com.translate.goog/ko/48764/?_x_tr_sl=auto&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp

ImBetter: New Information Stealer Spotted Targeting Cryptocurrency Users
https://blog.cyble.com/2023/03/06/imbetter-new-information-stealer-spotted-targeting-cryptocurrency-users/

How SYS01 Stealer Will Get Your Sensitive Facebook Info
https://blog.morphisec.com/sys01stealer-facebook-info-stealer

SYS01stealer: New Threat Using Facebook Ads to Target Critical Infrastructure Firms
https://thehackernews.com/2023/03/sys01stealer-new-threat-using-facebook.html

竊密程式SYS01 stealer鎖定企業用戶的臉書帳密
https://blog.morphisec.com/sys01stealer-facebook-info-stealer

A Noteworthy Threat: How Cybercriminals are Abusing OneNote
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/a-noteworthy-threat-how-cybercriminals-are-abusing-onenote-part-1/
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/a-noteworthy-threat-how-cybercriminals-are-abusing-onenote-part-2/

Malvertising In Google Search Results Delivering Stealers
https://securelist.com/malvertising-through-search-engines/108996/

BlackSnake Ransomware Emerges from Chaos Ransomware’s Shadow
https://blog.cyble.com/2023/03/09/blacksnake-ransomware-emerges-from-chaos-ransomwares-shadow/

DeepStreamer: Illegal Movie Streaming Platforms Hide Lucrative Ad Fraud Operation
https://www.malwarebytes.com/blog/threat-intelligence/2023/03/deepstreamer-illegal-movie-streaming-platforms-hide-lucrative-ad-fraud-operation

Prometei botnet improves modules and exhibits new capabilities in recent updates
https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2023/03/prometei-botnet-improves.txt?ref=cisco-talos-blog

Chinese Hackers Targeting European Entities with New MQsTTang Backdoor
https://thehackernews.com/2023/03/chinese-hackers-targeting-european.html

Core Members of DoppelPaymer Ransomware Gang Targeted in Germany and Ukraine
https://thehackernews.com/2023/03/core-members-of-doppelpaymer-ransomware.html

Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps
https://thehackernews.com/2023/03/transparent-tribe-hackers-distribute.html

一百多家組織的居易路由器遭駭客組織鎖定，植入木馬程式HiatusRAT
https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/

New HiatusRAT Malware Targets Business-Grade Routers to Covertly Spy on Victims
https://thehackernews.com/2023/03/new-hiatusrat-malware-targets-business.html

Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant
https://thehackernews.com/2023/03/xenomorph-android-banking-trojan.html

North Korean UNC2970 Hackers Expands Operations with New Malware Families
https://thehackernews.com/2023/03/north-korean-unc2970-hackers-expands.html

遠端桌面軟體漏洞被用於部署惡意軟體PlugX
https://asec.ahnlab.com/en/49097/

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware
https://thehackernews.com/2023/03/hackers-exploiting-remote-desktop.html

勒索軟體IceFire鎖定IBM檔案共享系統下手，加密Linux主機
http://s1.ai/IceFire

IceFire Ransomware Exploits IBM Aspera Faspex to Attack Linux-Powered Enterprise Networks
https://thehackernews.com/2023/03/icefire-linux-ransomware.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Google 計畫透過強化韌體安全機制，加強 Android 資安防護能力
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10343

Shein's Android App Caught Transmitting Clipboard Data to Remote Servers
https://thehackernews.com/2023/03/sheins-android-app-caught-transmitting.html

到處被禁！TikTok推新資安計畫　致力消除歐美各國疑慮
https://tw.nextapple.com/international/20230309/07F27F17D52F421148687657463FFD73

捷克當局：TikTok受中共管轄 構成安全威脅
https://reurl.cc/RvzQdn

美情報首長坦言 中共可控制TikTok影響對台論述
https://www.ntdtv.com.tw/b5/20230309/video/360357.html

完備亞灣5G資安互通驗證場域　耀睿O-RAN實驗室啟用
https://www.bo6s.com.tw/news_detail.php?NewsID=62018

Android三月更新發布，修補2個重大程式碼執行漏洞
https://www.bleepingcomputer.com/news/security/android-march-2023-update-fixes-two-critical-code-execution-flaws/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
GitHub將在3月13日後，開始強制要求開發者啟用雙因素驗證
https://www.ithome.com.tw/news/155870

部分Oracle Weblogic Server遭到挖礦軟體ScrubCrypt鎖定
https://www.fortinet.com/blog/threat-research/old-cyber-gang-uses-new-crypter-scrubcrypt

New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic
https://thehackernews.com/2023/03/new-scrubcrypt-crypter-used-in.html

電商網站客戶遭到R3NIN Sniffer工具包鎖定
https://blog.cyble.com/2023/02/28/r3nin-sniffer-toolkit-an-evolving-threat-to-e-commerce-consumers/

上季資安事件頻傳 非法入侵為大宗
https://ctee.com.tw/news/tech/821600.html

Oakland駭客攻擊事件似乎難了
https://posts.careerengine.us/p/640a13ba730ecb545d62585b?from=latest-posts-panel&type=previewimage

歐盟DNS網路基礎設施初期規模預計為上億用戶提供服務
https://blog.twnic.tw/2023/03/10/25939/

上萬個網站遭到挾持，將中國使用者重新導向到成人或賭博網站
https://www.wiz.io/blog/redirection-roulette

台灣華語文學習中心遭網路攻擊 徐佳青：法警方證實中共駭攻
https://udn.com/news/story/6656/7019530

僑委會：中國海外警察服務站不只監控海外移民，還發動統戰試圖影響傳統僑社友台立場
https://www.thenewslens.com/article/182173

中國海外警察網攻巴黎台灣華文中心 僑委會強化僑校資安
https://news.ltn.com.tw/news/politics/breakingnews/4233855

立陶宛情報首長：俄軍資源能再戰2年！ 關鍵在「伊朗、北韓」等國軍事支援
https://times.hinet.net/news/24444429

歐洲多數企業與組織擁抱零信任策略，有高達三分之二的比例開始採用
https://www.infosecurity-magazine.com/news/twothirds-of-european-started-zero/

美國白宮發布最新國家資安策略，要求企業負起更大責任
https://www.ithome.com.tw/news/155784

美國要求自來水供應業者在稽核過程必須報告資安威脅態勢
https://www.securityweek.com/epa-mandates-states-report-on-cyber-threats-to-water-systems/

美國公布國家網路安全戰略，希望透過軟體廠商來改善相關安全
https://www.bankinfosecurity.com/us-cybersecurity-strategy-shifts-liability-issues-to-vendors-a-21356

美國CISA提供開源工具Decider，目的是讓資安人員能將攻擊行為對應到MITRE ATT&CK框架
https://www.cisa.gov/news-events/news/helping-cyber-defenders-decide-use-mitre-attck

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems
https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.html

U.S. Cybersecurity Agency Raises Alarm Over Royal Ransomware's Deadly Capabilities
https://thehackernews.com/2023/03/us-cybersecurity-agency-raises-alarm.html

Hackers Exploit Containerized Environments to Steal Proprietary Data and Software
https://thehackernews.com/2023/03/hackers-exploit-containerized.html

New Cryptojacking Campaign Leverages Misconfigured Redis Database Servers
https://thehackernews.com/2023/03/new-cryptojacking-campaign-leverages.html

Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks
https://thehackernews.com/2023/03/experts-reveal-google-cloud-platforms.html

Experts Discover Flaw in U.S. Govt's Chosen Quantum-Resistant Encryption Algorithm
https://thehackernews.com/2023/03/experts-discover-flaw-in-us-govts.html

中國駭客Sharp Panda鎖定亞洲政府機關而來
https://research.checkpoint.com/2023/pandas-with-a-soul-chinese-espionage-attacks-against-southeast-asian-government-entities/

Sharp Panda Using New Soul Framework Version to Target Southeast Asian Governments
https://thehackernews.com/2023/03/sharp-panda-using-new-soul-framework.html

Iranian Hackers Target Women Involved in Human Rights and Middle East Politics
https://thehackernews.com/2023/03/iranian-hackers-target-women-involved.html

公股銀行MA徵才開跑！數金與資安領域最搶手
https://reurl.cc/XLE3vj

資深資安工程師/資安技術主管(台南)
https://www.104.com.tw/job/7xc1f?jobsource=googlejobs

資安工程師(亞東證券)
https://www.104.com.tw/job/7xcq5?jobsource=googlejobs

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach
https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html

15萬買下全台2300萬人個資！你最隱私的資料被賤賣，政府卻坐視不管
https://www.youtube.com/watch?v=mG0ev48u4QQ

民團調查 7成立委認為台灣數位人權保障落後他國
https://www.rti.org.tw/news/view/id/2161556

戶籍外洩案朝野抓錯重點？ 資安界：應增加電磁紀錄保管權責
https://www.peoplenews.tw/articles/0e4f819c21

資策會科法所TPIPAS講座：個資外洩不容忽視 企業應強化資安意識
https://n.yam.com/Article/20230309324104

資安研究指出：多數單位無法於 1 小時內解決雲端資安威脅
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10363

宏碁證實產品技術文件伺服器遭駭
https://www.cna.com.tw/news/afe/202303080428.aspx

傳再遭駭客侵取160GB資料 宏碁：未被攻擊，已採取適當因應
https://reurl.cc/GeAlop

伺服器資料驚傳遭駭客「高價出售」！宏碁回應了
https://www.chinatimes.com/realtimenews/20230308006249-260410?chdtv

駭客掛牌出售被盜的160GB資料，宏碁確認出現安全事件
https://www.techbang.com/posts/104507-hackers-list-for-sale-stolen-160gb-of-data-acer-confirms-a

韓國整容診所閉路電視畫面流出　多達30名藝人中招
https://www.hk01.com/article/875157?utm_source=01articlecopy&utm_medium=referral

詐騙新招！沒按連結商人戶口仍被盗走存款剩7元 銀行卻這樣回
https://udn.com/news/story/6812/7019126

9百萬AT&T用戶資料外洩，起因是合作廠商遭駭
https://www.bleepingcomputer.com/news/security/atandt-alerts-9-million-customers-of-data-breach-after-vendor-hack/

商業郵件詐騙攻擊過程可能僅有數個小時
https://twitter.com/MsftSecIntel/status/1633515412142034944

駭客假借賺錢遊戲盜取加密貨幣
https://www.ic3.gov/Media/Y2023/PSA230309

美國眾議院傳出資料外洩，FBI著手調查
https://twitter.com/henryrodgersdc/status/1633575335869521921

駭客架設冒牌ChatGPT平臺向用戶發動網釣攻擊，目標是進行投資詐騙
https://www.bitdefender.com/blog/hotforsecurity/bitdefender-labs-warns-of-fresh-phishing-campaign-that-uses-copycat-chatgpt-platform-to-swindle-eager-investors/

請人為名盜應徵者信用卡購物　詐騙集團4成員認盜竊候判
https://hk.on.cc/hk/bkn/cnt/news/20230310/bkn-20230310145439101-0310_00822_001.html

E.研究報告/工具
JetBrains程式碼品質檢查工具Qodana可對PHP程式碼進行污點分析
https://www.ithome.com.tw/news/155829

微軟與MITRE聯手，發布能模擬攻擊機器學習系統的工具Arsenal
https://www.securityweek.com/new-tool-made-by-microsoft-and-mitre-emulates-attacks-on-machine-learning-systems/

研究人員找出濫用微軟搜尋引擎AI機器人騙取使用者個資的方法
https://greshake.github.io/

指令共享服務遭到濫用！組態配置不佳的Redis伺服器遭鎖定，駭客發動挖礦攻擊
https://www.cadosecurity.com/redis-miner-leverages-command-line-file-hosting-service/

2023 Browser Security Report Uncovers Major Browsing Risks and Blind Spots
https://thehackernews.com/2023/03/2023-browser-security-report-uncovers.html

From Disinformation to Deep Fakes: How Threat Actors Manipulate Reality
https://thehackernews.com/2023/03/from-disinformation-to-deep-fakes-how.html

Does Your Help Desk Know Who's Calling
https://thehackernews.com/2023/03/does-your-help-desk-know-whos-calling.html

ChatGPT in an iOS Shortcut — Worlds Smartest HomeKit Voice Assistant
https://matemarschalko.medium.com/chatgpt-in-an-ios-shortcut-worlds-smartest-homekit-voice-assistant-9a33b780007a

When Partial Protection is Zero Protection: The MFA Blind Spots No One Talks About
https://thehackernews.com/2023/03/when-partial-protection-is-zero.html

Creating my first home server
https://medium.com/@tararhoseyn/creating-my-first-home-server-2104cc610514

F.商業
資通電腦攜手 Comodo 提供端點安全管理、阻擋勒索攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10353

Security and IT Teams No Longer Need To Pay For SaaS-Shadow IT Discovery
https://thehackernews.com/2023/03/security-and-it-teams-no-longer-need-to.html

Syxsense Platform: Unified Security and Endpoint Management
https://thehackernews.com/2023/03/syxsense-platform-unified-security-and.html

面對市場與產業快速變化 Aruba 預測將有資安、NaaS、AIOps 等六大趨勢
https://reurl.cc/MR8G1m

Check Point Software: 高達48%的EMAIL夾帶惡意檔案以微軟office檔案佯裝
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10358

新一代整合式解決方案翻轉被動防禦 攜手在地企業抵禦新型網路攻擊 Check Point CPX 360 2023 台灣站揭露全新資安趨勢與挑戰
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/2D52F645594149B39883AD88244BE74A

資安新創Anozr way助企業主管限縮數位足跡，避免遭駭客攻擊
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=f377c399-16d8-43d0-a127-1f0324a0f0e8

G.政府
調查局掌握中籍駭客盜賣我國2357萬筆個資，要價美金5千
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10345

跨界攜手・婕出共好　國科會「2023 Tech GiCS女婕思」即日啟動
https://www.nstc.gov.tw/folksonomy/detail/b62a118f-e022-4efb-9f73-7d13fc1724b6?l=ch

無人機資安檢測採型式審驗 民航局：兼顧產業發展 搭配日落條款
https://www.technice.com.tw/technology/drone/41159/

數發部擬門號內建防詐機制 最快今年上路
https://news.pts.org.tw/article/626302

金管會近期積極推動強化上市（櫃）公司資通安全管理之措施
https://www.sfb.gov.tw/ch/home.jsp?id=95&parentpath=0,2&mcustomize=multimessage_view.jsp&dataserno=202303090003&dtable=News

華航、iRent遭駭名人受害 未來資安危機未揭露可罰500萬元
https://reurl.cc/RvzQ0z

上市櫃資安事件頻傳 金管會：未即時發重訊最重罰500萬
https://udn.com/news/story/7239/7020987

戶役政資料遭盜賣 林右昌：非駭客入侵
https://today.line.me/tw/v2/article/j7qBM62

2300萬餘戶役政資料遭兜售 林右昌：檢調正調查外洩原因
https://taronews.tw/2023/03/08/897315/

護照預約系統一度當機 外交部：研判與駭客無關
https://news.ltn.com.tw/news/politics/breakingnews/4234492

為防範非公務機關個資外洩，行政院長陳建仁提出三大精進策略，首度提出要設置獨立個資監管機關
https://www.ey.gov.tw/Page/9277F759E41CCD91/20466a66-3b95-40b8-80b3-e9833a4c3e30

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
信賴平臺模組TPM 2.0 爆漏洞，數十億物聯網設備受威脅
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10352

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices
https://thehackernews.com/2023/03/new-flaws-in-tpm-20-library-pose-threat.html

Why Healthcare Can't Afford to Ignore Digital Identity
https://thehackernews.com/2023/03/why-healthcare-cant-afford-to-ignore.html

為晶片加上「防盜鎖」，陽明交大出身的Jmem Tek的硬體資安技術有何特別
https://meet.bnext.com.tw/articles/view/50065

物聯網產品進入歐盟市場的資安通行證
https://www.eettaiwan.com/20230310np21/

德國針對Wago的PLC工控設備漏洞提出警告
https://www.securityweek.com/critical-vulnerabilities-allow-hackers-to-take-full-control-of-wago-plcs/

美國針對5個工控系統漏洞提出警告
https://www.cisa.gov/news-events/alerts/2023/03/02/cisa-releases-five-industrial-control-systems-advisories

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

6.近期資安活動及研討會
DEVCORE Conference 2023 - 3/11 駭客場 2023/3/11
https://devcore.kktix.cc/events/devcoreconf2023

Web3 用戶資安沙龍（高雄）2023/3/12
https://www.accupass.com/event/2303071752257561949460

Hugging Face :Zero-Shot Image Classification/OpenAI 2023/3/14
https://www.meetup.com/tensorflow-user-group-taipei/events/290714432/

佈局雲端資安 打造零信任架構 2023/3/15 此活動為線上活動
https://www.accupass.com/event/2302220900331672222575

三月定期聚會-我們對於在花蓮工作的想像與實踐 2023/3/15
https://www.meetup.com/hualien-py/events/291790073/

掌握資安趨勢 讓大數據決策市場研討會 2023/3/16
https://www.accupass.com/event/2212200343421615169635

[Python 入門] 線上 2023/03 月份 2023/3/18
https://www.meetup.com/pyladiestw/events/291843185/

一鍵完成設備部署、資安、合規的實作秘笈-三月場 | In Taipei Apple Office（商務場）2023/3/23
https://jamf.kktix.cc/events/onetouch2303

落實企業資安防護，強化企業營運韌性＿資安研討會 2023/3/23
https://www.accupass.com/event/2302060303531883855085

用Immersive Open Web 創造您自己的3D世界. 2023/3/23
https://www.meetup.com/hubs-creators-meetup/events/291532452/

2022 OT 工控資安年會-活動報名 2023/3/24
https://reurl.cc/5Mq327

珈特科技_APPLE資安研討會 2023/3/29
https://gettechnology.kktix.cc/events/1c9146ab

次世代 IT 管理 啓動雲端旅程 2023/3/30 此活動為線上活動
https://www.accupass.com/event/2302030247499784123840

iPAS-「初級」資訊安全工程師-能力研習衝刺班 2023/4/15、4/22
https://www.cisanet.org.tw/Course/Detail/3948

iPAS中級資訊安全人員訓練班 2023/5/4 ~ 2023/6/1
https://edu.tcfst.org.tw/web/tw/class/show.asp?courseidori=12C013