https://www.akamai.com/blog/security-research/updated-kmsdbot-binary-targeting-iot (#744) - 偵察、初期アクセス、防御回避、横方向移動、漏洩、影響、uses:Go、attack:T1133:External Remote Services、attack:T1021:Remote Services、attack:T1021.004:SSH、attack:T1078.001:Default Accounts、attack:T1110:Brute Force、attack:T1095:Non-Application Layer Protocol、attack:T1048:Exfiltration Over Alternative Protocol、attack:T1567:Exfiltration Over Web Service、attack:T1499:Endpoint Denial of Service、attack:T1498:Network Denial of Service、attack:T1480:Execution Guardrails、Kmsdbot、Linux、IOT
https://www.countercraftsec.com/blog/a-step-by-step-bpfdoor-compromise/ (#643) - 永続化、防御回避、コマンド＆コントロール、attack:T1205.002:Socket Filters、attack:T1036:Masquerading、attack:T1070:Indicator Removal on Host、attack:T1205:Traffic Signaling、attack:T1573:Encrypted Channel、attack:T1106:Native API、attack:T1059.004: Unix Shell、attack:T1070.004:File Deletion、attack:T1036.004:Masquerade Task or Service、attack:T1070.006:Timestomp、uses:RedirectionToNull、uses:Non-persistentStorage、attack:T1036.005:Match Legitimate Name or Location、uses:ProcessTreeSpoofing、attack:T1562.004:Disable or Modify System Firewall、BPFDoor、/malware/binaries/BPFDoor、Unix.Backdoor.RedMenshen、Linux、Solaris
https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux (#510) - 実行、永続化、防御回避、attack:T1036.005:Match Legitimate Name or Location、attack:T1059:Command and Scripting Interpreter、attack:T1569:System Service、attack:T1569.002:Service Execution、attack:T1543:Create or Modify System Process、attack:T1027:Obfuscated Files or Information、uses:Non-persistentStorage、attack:T1057:Process Discovery、attack:T1070.004:File Deletion、attack:T1546.004:Unix Shell、exploit:CVE-2021-3493、Shikitega、/malware/binaries/Shikitega、Linux
https://sansec.io/research/cronrat (#399) - 防御回避、コマンド＆コントロール、uses:Non-persistentStorage、attack:T1053.003:Cron、attack:T1027:Obfuscated Files or Information、attack:T1001.003:Protocol Impersonation、attack:T1036.005:Match Legitimate Name or Location、vertical:Retail、CronRAT、wltm、Linux
https://blog.qualys.com/vulnerabilities-threat-research/2023/05/17/new-strain-of-sotdas-malware-discovered (#693) - 永続化、防御回避、発見、コマンド＆コントロール、attack:T1037.004:RC Scripts、attack:T1543.002:Systemd Service 、attack:T1036:Masquerading: Match Legitimate Name or Location 、attack:T1070.004:File Deletion 、attack:T1222:File and Directory Permissions Modification 、attack:T1564.001:Hidden Files and Directories 、attack:T1082:System Information Discovery 、attack:T1057:Process Discovery 、attack:T1071.004:DNS、Sotdas、Linux
https://sansec.io/research/nginrat (#94) - 防御回避、uses:Non-persistentStorage、attack:T1036.005:Match Legitimate Name or Location、attack:T1574.006:Dynamic Linker Hijacking、attack:T1027:Obfuscated Files or Information、uses:ProcessTreeSpoofing、NginRAT、wltm
https://asec.ahnlab.com/en/50316/ (#621) - 防御回避、発見、コマンド＆コントロール、影響、attack:T1036.005:Match Legitimate Name or Location、attack:T1499:Endpoint Denial of Service、attack:T1082:System Information Discovery、attack:T1095:Non-Application Layer Protocol、uses:ProcessTreeSpoofing、uses:Non-persistentStorage、uses:RedirectionToNull、DDoSClient、ChinaZ、Linux
