米国CISAが連邦政府機関への攻撃についての分析レポートを公開していますね。。。

こんにちは、丸山満彦です。

米国CISAが「連邦政府機関への攻撃についての分析レポートを公開していますね。。。

参考になりますね。。。

● CISA

・2020.09.24 Analysis Report (AR20-268A) Federal Agency Compromised by Malicious Cyber Actor

---

Summary

This Analysis Report uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor tactics and techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) responded to a recent threat actor’s cyberattack on a federal agency’s enterprise network. By leveraging compromised credentials, the cyber threat actor implanted sophisticated malware—including multi-stage malware that evaded the affected agency’s anti-malware protection—and gained persistent access through two reverse Socket Secure (SOCKS) proxies that exploited weaknesses in the agency’s firewall.

---