Macnica Networks Corp. (hereinafter referred to as Macnica networks, head office: 1-5-5 Shin-Yokohama, Kohoku-ku, Yokohama, Kanagawa Prefecture, President: Jun Ikeda) analyzes threats targeting Japanese organizations on a daily basis and provides security solutions. ), which is headquartered in Taiwan and has threat intelligence for cyber espionage activities conducted in the Asia-Pacific region, and Team T5, Inc. (hereinafter referred to as TeamT5, CEO: Sung-ting Tsai), which is headquartered in Taiwan and has threat intelligence for cyber espionage activities conducted in the Asia-Pacific region, and Continuing from last year, we will be co-authoring and publishing a research report on attacks titled ``Actual Status of Targeted Attacks and Countermeasure Approaches.''

In fiscal 2020, telework was promoted, and many security incidents took advantage of this gap. Among them, targeted attacks (cyber espionage) that land in Japan for the purpose of information theft threaten to deprive Japanese companies of their competitiveness and reduce their international industrial competitiveness. Many organizations are unaware of this. Japanese companies need to obtain information on attack campaigns that attempt to steal sensitive information (personal information, policy-related information, manufacturing data, etc.) and prevent information leakage through early detection.

In terms of attack trends in FY2020, compared to the observations of the previous year, the activities of the Tick and BlackTech attack groups targeting domestic organizations, which were relatively active in FY2019, declined, and the APT10 attack group using LODEINFO malware, Actively observed attacks by the reported APT10 threat group of the A41APT attack campaign.

Time chart

In terms of target organizations, the ratio has increased as attacks using APT10's LODEINFO malware targeted media and think tanks throughout the year. APT10's A41APT attack campaign has many observations in the manufacturing industry, but it is a fairly difficult category to detect among targeted attacks, and industries such as government, healthcare, and clothing that are not included here also need to be careful. . In this attack, there was no intrusion from spearfish emails, and most of the terminals infected with malware were the server OS of domestic companies, including overseas affiliated companies, and the number of infected devices was small, and the IP address of the C2 server was different for each infected host. Therefore, it is difficult not only to intrude into bases where countermeasures are weaker than the headquarters network of domestic companies, but also to detect static IOCs such as hash values and IP addresses.

Details are explained in the report, so please check it. The second half of the report includes detection methods, so please refer to them when checking your own organization. Macnica networks will continue to persistently analyze and educate people about targeted attacks that are gradually eroding the industrial competitiveness of Japanese companies, and strive to contribute, however small, to the development of the Japanese economy.