###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2024/5/20 ~ 2024/5/24

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://www.cisa.gov/news-events/alerts/2024/05/16/cisco-releases-security-updates-multiple-products

GitLab揭露高風險漏洞，未經身分驗證的攻擊者恐發動XSS攻擊接管帳號
https://www.ithome.com.tw/news/163080

針對Ivanti零時差漏洞攻擊事故，資安組織MITRE揭露駭客濫用VMware虛擬化平臺的細節
https://www.ithome.com.tw/news/163089

Ivanti修補端點管理程式EPM重大層級的SQL注入漏洞
https://www.ithome.com.tw/news/163077

Ivanti修補端點管理程式重大層級的漏洞
https://forums.ivanti.com/s/article/Security-Advisory-May-2024

Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager
https://thehackernews.com/2024/05/ivanti-patches-critical-remote-code.html

Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern
https://thehackernews.com/2024/05/ransomware-attacks-exploit-vmware-esxi.html

CISA Warns of Actively Exploited Apache Flink Security Vulnerability
https://thehackernews.com/2024/05/cisa-warns-of-actively-exploited-apache.html

谷歌釋出更新修補Chrome九個安全漏洞，包括新的零日漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11087

Google Detects 4th Chrome Zero-Day in May Actively Under Attack - Update ASAP
https://thehackernews.com/2024/05/google-detects-4th-chrome-zero-day-in.html

非洲與中東遭到鎖定，駭客利用微軟Exchange已知漏洞散布惡意程式Keylogger
https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/positive-technologies-detects-a-series-of-attacks-via-microsoft-exchange-server/

MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks
https://thehackernews.com/2024/05/ms-exchange-server-flaws-exploited-to.html

Veeam修補備份集中管理控制臺4個漏洞，包括繞過驗證登入的重大漏洞
https://www.ithome.com.tw/news/163030

Critical Veeam Backup Enterprise Manager Flaw Allows Authentication Bypass
https://thehackernews.com/2024/05/critical-veeam-backup-enterprise.html

駭客針對Openfind產品發動攻擊
https://www.twcert.org.tw/tw/cp-104-7807-be65a-1.html

研究人員揭露威聯通NAS作業系統漏洞，並指出15個漏洞僅有4個完成修補
https://www.ithome.com.tw/news/163034

研究人員揭露向威聯通通報的NAS作業系統漏洞，並指出15個漏洞僅有4個完成修補
https://labs.watchtowr.com/qnap-qts-qnapping-at-the-wheel-cve-2024-27130-and-friends/

QNAP Patches New Flaws in QTS and QuTS hero Impacting NAS Appliances
https://thehackernews.com/2024/05/qnap-patches-new-flaws-in-qts-and-quts.html

Deserialization of VIEWSTATE: how an “unpatched” vulnerability plays
into the hands of pro-government groups
https://1-rt--solar-ru.translate.goog/solar-4rays/blog/4329/?_x_tr_enc=1&_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp

Attackers exploiting new critical vulnerabilities on Kubernetes clusters
https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/

Git修補5個漏洞，其中包含子模組複製儲存庫產生的RCE漏洞
https://www.ithome.com.tw/news/163000

GitHub針對Enterprise Server用戶提出警告，該系統存在可繞過SAML單一登入的身分驗證弱點
https://www.ithome.com.tw/news/163024

Firefox用於存取PDF檔案的元件存在弱點，有可能被用於執行任意JavaScript程式碼
https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/

Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail
https://thehackernews.com/2024/05/cyber-criminals-exploit-github-and.html

資料收集器Fluent Bit存在重大漏洞，恐導致阻斷服務、RCE攻擊
https://www.tenable.com/blog/linguistic-lumberjack-attacking-cloud-services-via-logging-endpoints-fluent-bit-cve-2024-4323

"Linguistic Lumberjack" Vulnerability Discovered in Popular Logging Utility Fluent Bit
https://thehackernews.com/2024/05/linguistic-lumberjack-vulnerability.html

GHOSTENGINE Exploits Vulnerable Drivers to Disable EDRs in Cryptojacking Attack
https://thehackernews.com/2024/05/ghostengine-exploits-vulnerable-drivers.html

用於人工智慧系統的Python開發套件存在重大漏洞，恐導致系統資料外流
https://www.ithome.com.tw/news/162976

Intel發布5月例新更新，修補人工智慧模型壓縮工具重大漏洞
https://www.ithome.com.tw/news/162983

2.銀行/金融/保險/證券/金融監理 新聞及資安
遭跨國執法單位圍勦的金融木馬Grandoreiro傳出東山再起，駭客鎖定超過60個國家、1,500家銀行客戶發動攻擊
https://www.ithome.com.tw/news/163002

Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide
https://thehackernews.com/2024/05/grandoreiro-banking-trojan-resurfaces.html

Exploring the Metamorfo Banking Trojan
https://www.forcepoint.com/blog/x-labs/exploring-metamorfo-banking-malware

3.信用卡/電子支付/行動支付/pay/支付系統/資安
iPhone 整合行動支付 App 捷徑 2.0：一鍵顯示載具、付款條碼
https://applealmond.com/posts/233028#google_vignette

iPhone 行動支付捷徑：一鍵開啟 LINE Pay、街口、7-11 等不同 App 的付款條碼
https://applealmond.com/posts/232688

上海實體卡 助入境人士移動支付
https://udn.com/news/story/7333/7976753

大眾運輸系統手機進站多元支付方式懶人包
https://www.kocpc.com.tw/archives/548358

澳門通攜手阿里巴巴、螞蟻集團生態企業亮相BEYOND
https://news.cnyes.com/news/id/5574314

LINE Pay 2024全新規則
https://reurl.cc/qVY0zg

LINE Pay綁對信用卡 回饋省很大
https://reurl.cc/dnamz8

金管會出招堵App綁卡盜刷 將比照三大行動支付商模式
https://money.udn.com/money/story/5613/7969437

日本行動支付PayPay大當機 網友哀嚎
https://reurl.cc/4rNW5K

中華郵政首次連結電子支付！玉山 Wallet 新增郵政儲金帳戶功能
https://finance.technews.tw/2024/05/22/wallet/

內地電子支付｜數字人民幣懶人包
https://reurl.cc/z156yN

正妹賣洗澡水狂賺290萬 電子支付平台PayPal竟私吞5年
https://news.ltn.com.tw/news/novelty/breakingnews/4679733

電支3月用戶 突破2,800萬人
https://reurl.cc/yLA6yD

支付平台Adyen：本港近六成消費者依賴電子支付方式
http://www.aastocks.com/tc/stocks/news/aafn-news/NOW.1351116/2

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Unveiling a Crypto Mining Operation
https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine

數字人民幣是什麼？香港人如何註冊、增值、使用
https://reurl.cc/5vROgV

SEC綠燈放行以太幣現貨ETF 加密貨幣卻走跌 外媒點出這原因
https://m.cnyes.com/news/id/5574639

繼ETH之後，下一個獲得ETF批準的加密貨幣會是SOL嗎
https://m.cnyes.com/news/id/5574712

川普團隊接受「加密貨幣捐款」！揚言要吸引「幣圈大軍」把總統一票投給他
https://blockcast.it/2024/05/22/rump-campaign-start-accepting-cryptocurrency-donations-vows-to-build-a-crypto-army/

知名柴犬迷因本尊狗狗離世 狗狗幣聞訊下跌
https://www.ctee.com.tw/news/20240524701232-430702

加密貨幣時代的變遷：美元霸權侵蝕下如何破繭重生
https://news.cnyes.com/news/id/5571316

5月報稅季快結束！交易所提醒「虛擬錢幣」也要誠實申報以免受罰
https://reurl.cc/MOzyv4

印度央行公報深討加密貨幣，監管立場模糊！警告Crypto投機性強、缺乏穩定與責任
https://www.blocktempo.com/rbi-warns-retail-investors-to-be-cautious-when-investing-in-crypto/

解讀美國加密貨幣政策轉向：投票推翻 SAB 121，釋放以太幣 ETF 利好訊號
https://blockcast.it/2024/05/21/why-us-election-decides-the-fate-of-ethereum-etfs/

某地址10小時前售出252枚WBTC
https://news.cnyes.com/news/id/5568402

如何避免老鼠倉？檢查代幣是否為詐騙的8種方法
https://www.blocktempo.com/8-ways-to-check-if-a-coin-is-a-scam-at-a-glance/

$CREAM、$Bobaoppa迷因暴漲！麻吉大哥：我變神了，你們普通人不配跟我說話.
https://www.blocktempo.com/cream-and-bobaoppa-rise/

Gala Games創辦人：GALA以太坊合約安全，正與FBI等機構合作追查攻擊者
https://news.knowing.asia/news/54d3d5b8-07d2-42d4-a11d-af4b85cdeee0

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
國際特赦組織揭發大量間諜軟體出口至印尼 供應網路複雜難追蹤
https://pourquoi.tw/intlnews-indo-pacific-240517-1/

美國人工智慧專家遭到鎖定，攻擊者對其散布惡意程式SugarGh0st RAT
https://www.ithome.com.tw/news/162981

JAVS法庭錄影軟體遭遇供應鏈攻擊，攻擊者在安裝程式植入後門
https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/

資料破壞軟體BiBi Wiper出現新變種，鎖定以色列、阿爾巴尼亞發動攻擊
https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/

Foxit PDF Reader用戶遭到鎖定，駭客利用軟體彈出視窗的內容進行社交工程攻擊，散布多種惡意軟體
https://www.ithome.com.tw/news/163064

竊資軟體SolarMarker採用多層基礎設施，意圖躲避資安人員及執法單位打擊犯罪
https://www.recordedfuture.com/exploring-the-depths-of-solarmarkers-multi-tiered-infrastructure

駭客組織散布惡意軟體GhostEngine，意圖發動自帶驅動程式攻擊、部署挖礦程式
https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine

勒索軟體駭客透過惡意廣告聲稱提供PuTTY、WinSCP，意圖對企業組織的網路管理員下手
https://www.ithome.com.tw/news/163003

Analysis of APT attack cases targeting domestic companies using Dora RAT (Andariel Group)
https://asec-ahnlab-com.translate.goog/ko/65495/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

使用俄文的駭客濫用GitHub發起攻擊行動GitCaught，聲稱提供知名應用程式散布竊資軟體
https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure

GitCaught: Threat Actor Leverages GitHub Repository for Malicious Infrastructure
https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure

From Document to Script: Insides of DarkGate's Campaign
https://community.riskiq.com/article/055cd342/indicators

go[.]skimresources[.]com - malicious redirect chain
https://www.virustotal.com/graph/gf60e0771e44a4bb6bb2d71845532ee50c7b2d6fa6b034510b7b45657cdbaa5f6
https://go.skimresources.com/?id=2728X590260&url=https://the-gadgeteer.com/2024/02/08/mini-pcs-big-risks-malware-found-on-2-machines-we-recently-reviewed/&sref=https://www.neowin.net/news/we-tested-acemagic-beelink-and-geekom-mini-pcs-with-several-anti-malware-programs/&pref=https://www.google.com/&xuuid=12d61fd6f189b674aab1a9820bf2fd1c&xtz=240&xs=1&jv=amp@1.0.3
https://www.virustotal.com/gui/url/54ec77060939baa377cf5dbe0224455e19950dccb7a1e3c13c21691849bf3a1c

hxxp://lgecares[.]com/[U]/nWKxn8 smishing attempt - They really want you to check your suds
https://www.virustotal.com/graph/g71814095c11b4701ade6284126cafcdbb28467642a9249df90fa17a7fa8cc05e
https://tria.ge/240523-axnq7afb39
https://www.hybrid-analysis.com/sample/4703ca8a91fda8e3c0a3f93a607471de970f60eda13b51db2f8e7d54c3732681/664e8f9c52c0735df7011c28

Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking
https://thehackernews.com/2024/05/kinsing-hacker-group-exploits-more.html

韓國Linux主機遭到北韓駭客kimsuky鎖定，被植入後門程式Gomir
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage

Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks
https://thehackernews.com/2024/05/kimsuky-apt-deploying-linux-backdoor.html

China-Linked Hackers Adopt Two-Stage Infection Tactic to Deploy Deuterbear RAT
https://thehackernews.com/2024/05/china-linked-hackers-adopt-two-stage.html

Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns
https://thehackernews.com/2024/05/latrodectus-malware-loader-emerges-as.html

Courtroom Software Backdoored to Deliver RustDoor Malware in Supply Chain Attack
https://thehackernews.com/2024/05/courtroom-software-backdoored-to.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Android裝置App的資料共享方式有資安破口，研究人員揭露能以此發動的攻擊手法Dirty Stream，影響範圍廣大
https://www.ithome.com.tw/news/162969

安卓木馬Antidot偽裝成Google Play更新程式引誘使用者上當，意圖竊取帳密資料、聯絡人資訊、簡訊
https://cyble.com/blog/new-antidot-android-banking-trojan-masquerading-as-google-play-updates/

北韓駭客Kimsuky藉由Facebook Messenger鎖定目標，藉此散布惡意程式
https://www.genians.co.kr/blog/threat_intelligence/facebook

North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign
https://thehackernews.com/2024/05/north-korean-hackers-exploit-facebook.html

Zoom Adopts NIST-Approved Post-Quantum End-to-End Encryption for Meetings
https://thehackernews.com/2024/05/zoom-adopts-nist-approved-post-quantum.html

資安專家稱手機重啟可降低被駭風險，但多久重開一次最好
https://buzzorange.com/techorange/2024/05/20/how-often-should-switch-off-your-phone/

WhatsApp 推全新私隱保護功能！防止 IP 地址被追蹤
https://reurl.cc/Aj30K3

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
G7舉辦網路安全工作小組會議
https://www.trade.gov.tw/Pages/Detail.aspx?nodeID=45&pid=784074

南韓積極強化資安韌性 確保國安
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1677948

美環保署示警駭客攻擊供水系統 幕後黑手遙指中俄伊朗
https://reurl.cc/EjQ1r0

美國逮捕涉嫌經營暗網Incognito Market的23歲臺灣人
https://www.ithome.com.tw/news/162999

駭客入侵香港兆基創意書院 鎖死600人資料
https://udn.com/news/story/7332/7973765?from=udn-referralnews_ch2artbottom

半導體業者逸昌遭駭客網路攻擊，部分資訊系統受影響，仍在復原中
https://www.ithome.com.tw/news/162954

美國無線電聯盟遭遇網路攻擊，營運被迫中斷
https://www.arrl.org/news/arrl-systems-service-disruption

微軟宣布將於今年下半棄用VBScript，並規畫3階段將其退役
https://www.bleepingcomputer.com/news/microsoft/microsoft-to-start-killing-off-vbscript-in-second-half-of-2024/

The End of an Era: Microsoft Phases Out VBScript for JavaScript and PowerShell
https://thehackernews.com/2024/05/the-end-of-era-microsoft-phases-out.html

駭客組織BlackTech鎖定科技、研究、政府部門而來，利用新的工具Deuterbear發動攻擊，並以罕見的部署手法迴避偵測
https://www.ithome.com.tw/news/163027

中芯數據觀察到GIS系統已成特定組織鎖定的攻擊目標
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11084

南海軍事單位與政府機關遭中國駭客組織Unfading Sea Haze鎖定，暗中從事情報收集超過5年
https://www.ithome.com.tw/news/163055

中國駭客用非法代理伺服器ORB網路隱藏連線行蹤，導致資安偵測難度大幅提升
https://www.ithome.com.tw/news/163058

MITRE公布遭駭細節及攻擊指標
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11081

中國駭客組織APT41鎖定義大利企業組織，散布後門程式KeyPlug
https://www.ithome.com.tw/news/163086

荷蘭網路威脅態勢與防護經驗大公開，荷蘭資安三角洲專家強調資安韌性需擴及各產業供應鏈
https://www.ithome.com.tw/news/163031

CatDDoS-Related Gangs Have Seen a Recent Surge in Activity
https://blog.xlab.qianxin.com/catddos-derivative-en/?ref=news.risky.biz

Deep Dive Into Unfading Sea Haze: A New Threat Actor in the South China Sea
https://www.bitdefender.com/blog/businessinsights/deep-dive-into-unfading-sea-haze-a-new-threat-actor-in-the-south-china-sea

Spring Exacerbation: UAC-0006 increased cyberattacks
https://cert.gov.ua/article/6279366

Master of Puppets: Uncovering the pro-Russian influence campaign
https://blog.sekoia.io/master-of-puppets-uncovering-the-doppelganger-pro-russian-influence-campaign/

APT attack discovered using Facebook and MS management console (Attack signs detected targeting Korea and Japan)
https://www.genians.co.kr/blog/threat_intelligence/facebook

Ikaruz Red Team | Hacktivist Group Leverages Ransomware for Attention Not Profit
https://www.sentinelone.com/blog/ikaruz-red-team-hacktivist-group-leverages-ransomware-for-attention-not-profit/

Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam
https://thehackernews.com/2024/05/chinese-nationals-arrested-for.html

Inside Operation Diplomatic Specter: Chinese APT Group's Stealthy Tactics Exposed
https://thehackernews.com/2024/05/inside-operation-diplomatic-specter.html

Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries
https://thehackernews.com/2024/05/researchers-warn-of-chinese-aligned.html

Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel
https://thehackernews.com/2024/05/iranian-mois-linked-hackers-behind.html

Japanese Experts Warn of BLOODALCHEMY Malware Targeting Government Agencies
https://thehackernews.com/2024/05/japanese-experts-warn-of-bloodalchemy.html

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
為打擊網路詐騙，Coinbase、Meta、Ripple等業者聯手，成立Tech Against Scams聯盟
https://www.ithome.com.tw/news/163014

打詐通報查詢網最快8月上線 阻詐成果拚立竿見影
https://www.cna.com.tw/news/afe/202405220006.aspx

廠商載廢棄物.病歷資料掉滿地　馬偕：加強督導
https://news.cts.com.tw/cts/life/202405/202405192325445.html#google_vignette

臺藝大校友網站個資驚傳外洩，校方緊急關閉網站、請求Google協助清除暫存內容
https://www.ithome.com.tw/news/163078

桃園市埔頂地區變更計畫案公展資料洩露民眾個資，都發局坦承疏失
https://udn.com/news/story/7324/7982008

半導體設備廠京鼎發布資安重訊，說明駭客本月21日公開資料源於1月資安事故外流檔案
https://www.ithome.com.tw/news/163049

半導體製造商OmniVision去年9月遭遇勒索軟體攻擊，證實有出現資料外洩的情況
https://www.securityweek.com/omnivision-says-personal-information-stolen-in-ransomware-attack/

加拿大連鎖藥局London Drugs遭駭，勒索軟體駭客組織LockBit聲稱從中竊得內部資料
https://www.bleepingcomputer.com/news/security/lockbit-says-they-stole-data-in-london-drugs-ransomware-attack/

醫療保健計畫暨保險管理服務業者WebTPA資料外洩，逾240萬人受到影響
https://www.bleepingcomputer.com/news/security/webtpa-data-breach-impacts-24-million-insurance-policyholders/

AI 做的蔡英文假新聞到處竄！台灣每天遭 500 萬次網攻多來自中國，該如何應對
https://buzzorange.com/techorange/2024/05/20/taiwan-cyberattacks-every-day/

注意！遠傳揭LINE陷阱：詐騙新三寶「萌娃、寵物、幫投票」
https://www.setn.com/News.aspx?NewsID=1470862

10組「人氣組合」4字密碼最容易被盜　資安專家分析設密碼禁忌
https://www.ettoday.net/news/20240520/2742404.htm

外出使用機場或酒店免費wifi 如何避免個資在公共網路外洩
https://health.udn.com/health/story/6006/7976229?from=ch1005_msg

結合微軟「快速助理」工具與社交工程，Black Basta 駭客已勒索 500 多家組織
https://infosecu.technews.tw/2024/05/21/windows-quick-assist-abused-in-black-basta-ransomware-attacks/

Samstealer Attacking Windows Systems To Steal Sensitive Data
https://www.cyfirma.com/research/samsstealer-unveiling-the-information-stealer-targeting-windows-systems/

E.研究報告/工具
還堅守使用 Windows XP 有多可怕？實測上網 2 分鐘秒中毒
https://3c.ltn.com.tw/news/58223

科技．人文聯合講座／危機救援的系統復原與資料備份
https://udn.com/news/story/7339/7977056

lightningsand.cfd | Double base64-encoded javascript in your efi partition
https://otx.alienvault.com/pulse/664bd1e870e48b69007e7b1f

New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs
https://thehackernews.com/2024/05/new-xm-cyber-research-80-of-exposures.html

MSSPs and MDRs Moving Fast to Adopt AI-Powered Automation
https://intezer.com/blog/incident-response/mssps-quickly-adopting-ai-soc-automation/

Defending Your Commits From Known CVEs With GitGuardian SCA And Git Hooks
https://thehackernews.com/2024/05/defending-your-commits-from-known-cves.html

Patching vs. Isolating Vulnerabilities
https://thehackernews.com/expert-insights/2024/05/patching-vs-isolating-vulnerabilities.html

Five Core Tenets Of Highly Effective DevSecOps Practices
https://thehackernews.com/2024/05/five-core-tenets-of-highly-effective.html

Researchers Uncover Flaws in Python Package for AI Models and PDF.js Used by Firefox
https://thehackernews.com/2024/05/researchers-uncover-flaws-in-python.html

Windows 11 to Deprecate NTLM, Add AI-Powered App Controls and Security Defenses
https://thehackernews.com/2024/05/windows-11-to-deprecate-ntlm-add-ai.html

NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning
https://thehackernews.com/2024/05/nextgen-healthcare-mirth-connect-under.html

Are Your SaaS Backups as Secure as Your Production Data
https://thehackernews.com/2024/05/are-your-saas-backups-as-secure-as-your.html

DevOps Dilemma: How Can CISOs Regain Control in the Age of Speed
https://thehackernews.com/2024/05/devops-dilemma-how-can-cisos-regain.html

F.商業
攻擊加速、漏洞修補慢 ！Fortinet提漏洞紅區概念及整合平台
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11082

趨勢科技在Trend Vision One平台推出AI輔助功能 防止AI遭誤用與外部濫用
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11080

Veeam 收購 Coveware，提高對勒索軟體攻擊的防範、回應和復原支援
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11075

寶誼資訊正式取得KELA台灣區授權代理
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11071

The Ultimate SaaS Security Posture Management Checklist, 2025 Edition
https://thehackernews.com/2024/05/the-ultimate-saas-security-posture.html

Gogolook以1.5億元併購荷蘭防詐服務商ScamAdviser，盼加速企業服務推向全球市場
https://www.ithome.com.tw/news/163084

身分驗證資安業者CyberArk以15億美元買下機器識別管理公司Venafi
https://www.cyberark.com/press/cyberark-signs-definitive-agreement-to-acquire-machine-identity-management-leader-venafi-from-thoma-bravo/

微軟系統即將推出的Recall功能引發爭議，英國政府啟動調查
https://www.ithome.com.tw/news/163045

16家人工智慧業者共同承諾透過安全的方式開發AI
https://www.ithome.com.tw/news/163015

DeepMind發表AI安全框架Frontier Safety Framework
https://www.ithome.com.tw/news/162971

奧義智慧攜手 NTT-AT 共築臺日數位安全生態圈 以高度自動化的 AI 技術全方位鞏固企業資訊安全
https://n.yam.com/Article/20240519671379#google_vignette

G.政府
「後量子資安產業聯盟」成立 加速提升我國量子安全的競爭力
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11088

政府推動零信任架構，今年完成A級機關導入身分鑑別，2機關將先導入信任推斷機制
https://www.ithome.com.tw/news/163079

響應政府推動零信任架構，多家廠商於臺灣資安大會展示信任推斷技術
https://www.ithome.com.tw/news/162960

國安3.0戰略 新政府應提高資安三個韌性以維護民主發展
https://www.cmmedia.com.tw/home/articles/46892

北水分署與桃園市調處簽署備忘錄 共同維持水資源正常運作
https://tyenews.com/2024/05/603254/

科技人入閣 黃彥男：台灣是好地方 不應有詐騙問題
https://ec.ltn.com.tw/article/breakingnews/4680255

黃彥男：南北各設AI生態園區 數位經濟2年內產值破兆
https://ec.ltn.com.tw/article/breakingnews/4680258

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
市場聚焦數位與綠色兩大趨勢 AloT助力製造業啟動轉型
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?CnlID=13&id=692589

兩名大學生發現CSC ServiceWorks自助洗衣機漏洞，可遠端向洗衣機發送命令進行控制
https://techcrunch.com/2024/05/17/csc-serviceworks-free-laundry-million-machines/

美國公告3個漏洞已出現攻擊行動，影響已終止支援的老舊D-Link路由器
https://www.ithome.com.tw/news/162998

CISA Warns of Actively Exploited D-Link Router Vulnerabilities - Patch Now
https://thehackernews.com/2024/05/cisa-warns-of-actively-exploited-d-link.html

New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks
https://thehackernews.com/2024/05/new-wi-fi-vulnerability-enabling.html

Rockwell Automation針對工業控制系統攻擊行動升溫提出警告，呼籲管理員將設備斷開網路連線
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1672.html

Rockwell Advises Disconnecting Internet-Facing ICS Devices Amid Cyber Threats
https://thehackernews.com/2024/05/rockwell-advises-disconnecting-internet.html

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

iPAS◆資訊安全規劃實務◆中級測驗題庫彙編(123題)
https://reurl.cc/orlD1g

GCP Associate Cloud Engineer (ACE) 學習心得、教材資源與筆記分享 — 學習天然高可用與零信任設計
https://medium.com/blacksecurity/gcp-associate-cloud-engineer-78f736aee7ad

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

一般人也能拿到國際資安認證！CSCU安全電腦使用者認證課程
https://www.ithome.com.tw/pr/160954

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

EC-Council CEH Practical / Master 準備心得 — 讓理論與實作相輔相成的學習
https://medium.com/blacksecurity/ceh-practical-master-3e80cac180a2

EC-Council CEHP考試準備心得
https://hackmd.io/@9dCJrgb6QHGd8dRfgHO0zg/r14xNn1po

ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials
https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4

EC-Council ECSA資安分析專家 v10 考試心得分享
https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html

20180817 EC-Council ECSA v10 PASS
https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html

關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享
https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

CPENT 從暴力到破解
https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295

Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master
https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f

CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證
https://ucom.uuu.com.tw/web/Testimony/Article/4404

kaizensecurity/CPENT
https://github.com/kaizensecurity/CPENT/tree/master

CPENT : Pentesting like NO OTHERS !
https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/

Journey of My CPENT Exam
https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

App防駭學，資安防護實戰課程全面提升安全觀念
https://www.ithome.com.tw/pr/161505

OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享
https://hackmd.io/@henry-ko/HyQ56e8eF

OSCP（Offensive Security Certified Professional）
https://github.com/0x584A/oscp-notes/tree/master

ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年
https://reurl.cc/aVLoX9

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」
https://www.ithome.com.tw/news/156754

用證照證明自己實力之餘，更應將證照視為督促學習的最大動力
https://www.ithome.com.tw/news/156756

打破證照誤解與迷思，資安專家帶你釐清資安證照的意義
https://www.ithome.com.tw/news/156755

Accelerate Your Career with the Global Leader in Cyber Security Training
https://www.sans.org/mlp/promo-partnership-hacker-news/

【成大資安社社課】資安禁術 - 逆向工程地獄試煉
https://www.youtube.com/watch?v=4Yc3-9CjG6U

6.近期資安活動及研討會
2024離島盃資安競賽 2024/5/25
https://shieldx.kktix.cc/events/outlying

【資安工作坊】數位鑑識工作坊：數位劍士 - 快...還要更快 2024/5/25
https://hackersir.kktix.cc/events/forensics-240525

Just a chat - with no Expectations 2024/5/25
https://www.meetup.com/taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-cryptocurrency-meetup/events/lsmkqsygchbhc/

Self-Taught Coding Tuesdays - Study, Code, Design, Build, Network 2024/5/28
https://www.meetup.com/taiwan-code-camp/events/xfxtjtygchblc/

Learning Reimagined: AI in Action 2024/5/30
https://www.meetup.com/taipei-education-technology-meetup-group/events/300695401/

HackingThursday 黑客星期四 - Week meetup Tamsui 固定聚會 淡水 2024/5/30
https://www.meetup.com/hackingthursday/events/psspctygchbnc/

FineEvent 2024台灣帆軟用戶大會【數智．新趨勢】 2024/5/31
https://www.accupass.com/event/2404100159056749078620

資通安全概論--中區--考前複習班 2024/6/4
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X22767

國家高速網路與計算中心 教育訓練 粒子式電漿電磁模擬軟體VSim進階課程 2024/6/6
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4104&from_course_list_url=homepage

國家高速網路與計算中心 教育訓練 NVIDIA 大語言應用 2024/6/19
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4093&from_course_list_url=homepage

Free Startup Fundraising Office Hours Expert AMA with Angel Investor Scott Fox! 2024/6/26
https://www.meetup.com/taipei-startups-investors-masterminds-network/events/299702428/

AI應用系統開發與生成式AI應用人才培訓班第一梯次 2024/6/27
https://www.accupass.com/event/2401100729511706489107

國家高速網路與計算中心 教育訓練 RSC The Merck Index資料庫中文線上 2024/7/4
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4105&from_course_list_url=homepage

國家高速網路與計算中心 教育訓練 ABAQUS基礎訓練課程 2024/7/9
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4099&from_course_list_url=homepage

InfoSec Taiwan 2024 國際資安組織大會 2024/7/9
https://csa.kktix.cc/events/infosectaiwan2024

CraftCon Taiwan 奧義 AI 資安年會 2024/7/12
https://www.accupass.com/event/2404221057531664149101

【第1期】2024企業資訊安全基礎課程 2024/7/17
https://www.accupass.com/event/2402020448251773447860

Free Startup Fundraising Office Hours Expert AMA with Angel Investor Scott Fox! 2024/7/24
https://www.meetup.com/taipei-startups-investors-masterminds-network/events/299702433/

國家高速網路與計算中心 教育訓練 NVIDIA GPU 計算 2024/7/24
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4094&from_course_list_url=homepage

AI應用系統開發與生成式AI應用人才培訓班第一梯次 2024/6/27 ~ 2024/8/9
https://www.accupass.com/event/2401100729511706489107

Free Startup Fundraising Office Hours Expert AMA with Angel Investor Scott Fox! 2024/8/28
https://www.meetup.com/taipei-startups-investors-masterminds-network/events/299702435/