New Research Methods to Predict Attack Trends Using
Public Information

1/25/2023
Macnica Corporation
Yutaka Sejiyama©Macnica,Inc.

self-introduction
Yutaka Sejiyama✓Collect and disseminate information on security
threat trends
Vulnerability-related threat trend research
Twitter @nekono_naha
The Society for the Collection of Scattered Emails(ISC)2 Japan Chapter Annual Conference 2022

✓Macnica Group Global CSIRT Officer
Responding to security incidents in Japanand overseas
Patch Management✓Macnica’s own security service planning andmanagement
Investigation of external public servers, etc.

©Macnica,Inc.

1

Major trend changes over the past few years

conventional

Targeted
attackoffensive initiative

Past few
years

Ransom
actor

Email

SilentHardly ever

initial breachattackdisclosure of damage

External
server

Revealed byencryption andfailure.

Tend to be
publicized andexposedIncident information tends to become public for various reasons.
Can we capture attack trends and tactical changes by using public information?

©Macnica,Inc.

2

Agenda for this session✓Part 1: Analysis of recent incident occurrence trends
Leaked information by the Ransom Gang
Press Release on Damage by Japanese Companies
Public reports from security agencies/vendors✓Part 2: Changes in the management of externally disclosed assets
RDP Publication Status
Use of out-of-support OS
Change in speed of vulnerability response (2020 vs 2022)
Status of Measures Taken by Japanese Companies✓Part 3: Attempting to capture the attacker’s change in tactics
Past survey cases (Pandora, AvosLocker, Deadbolt)
Share how to research with device search engines©Macnica,Inc.

3

Agenda for this session✓Part 1: Analysis of recent incident occurrence trends
Leaked information by the Ransom Gang
Press Release on Damage by Japanese Companies
Public reports from security agencies/vendors✓Part 2: Changes in the management of externally disclosed assets
RDP Publication Status
Use of out-of-support OS
Change in speed of vulnerability response (2020 vs. 2022)
Status of Measures Taken by Japanese Companies✓Part 3: Attempting to capture the attacker's change in tactics
Past survey cases (Pandora, AvosLocker, Deadbolt)
Share how to research with device search engines©Macnica,Inc.

4

Number of global leaks by ransom actors✓ Ransomware attacks, which are targeted ransoms against individual companies and industries and double
threats through data encryption and information leakage, are on the rise worldwide.
✓ Approximately 6932 exposed ransom victims (listed on the leak site) as of the end of November 2022
*Based on data from intelligence vendor DarkTracer (https://darktracer.com/)✓ If we include the number of affected companies by ransomware that has not been leaked, the number ofaffected companies may be several times higher than the above.
380

363
345

343

320
272

259
238

230 237227
199 204

202
180

253

262

261
239
218

191 197

218
184

229

193

148
128
95
51

35

©Macnica,Inc.

5

Ransom-related incidents in Japanese companies and organizations✓As far as we can confirmed from public information, there were 245 security incidents••••

Aggregated press releases from companies and organizations, as well as ransomware attackers' dark web
statements
Aggregated ocorporate NW intrusion incidents, mainly ransom attacks and a small number of APTs. *Excluding
cases of website tampering, information leaks via websites, and Emotet infections.
Aggregated for 31 months from May 2020 to November 2022.
Press releases are collected using Google Alerts, news, and researcher information (@piyokango,@autumn_good_35).
16

16
15

15

13
12 12

12
11

10

10

10
9

10
9

8

8

7

7
6
5

3

5

5

3
2

3

2
1

0

0

©Macnica,Inc.

6

Comparison of Incident Occurrence Trends• The number of victims is increasing globally, and that of Japan increase/decrease with the global trends.
✓Comparison of the number of incidents at global and Japanese organizations
Number of leaks globally
Number of Incidents at Japanese Companies

16 363
343

380

16
15

345

15

320
13
12 12

272

259

10

230

227

199

202

204

180

12
238

237 10
191

197

253

9

0

5

5

218
8

184

193

10229
218
7

6

5

3
2
35

11
239
9

8
148

128

51

261
10

7

95
3

262

3

2
1
0

©Macnica,Inc.

7

Incident Occurrence Trend Analysis*Thisslide only includes the number of incidents inDecember 2022.

• In 2022, the number of cases increased slightly both globally and in Japan• The number of cases is slightly higher domestically than globally✓Number of global (per year)*Number of cases from January 2020 to December 2022

✓Number of cases in Japanese organizations (per year)*For 2022, for the period known up to January 3, 2023.
Likely to increase by several more.

4.5% increase

9.4% increase©Macnica,Inc.

8

Incident Trends in Japanese Organizations••

The percentage of ransom incidents that are discovered through leaks by attackers is decreasing year by year, while the number ofincidents disclosed by companies is increasing.
The increase in the rate of public disclosure may be due to a change in the public perception of ransom incidents.
✓ Number of leaks of Japanese organizations by attackers
100%

100%

90%

38

80%
70%

90%

29

80%

15

13

70%

60%

80

60%

97

existence (at thepresent moment)

50%

without

40%

68

30%
20%

✓ Number of publications in press releases by Japaneseaffiliated organizations

82

50%

existence (at thepresent moment)

40%

without

30%

14

16

20%

10%

10%

0%

0%

26

14

2020年

2021年

2022年

2020年

2021年

2022年

Only about 1/4 is disclosed* ≈ 4 times larger actually?

Only about 1/4 is leaked ≈ 4 times larger actually?
*Total damage in 2022: 2,275 x 4 = 9,100*ExtraHop 2022 CYBER CONFIDENCE INDEX:ASIA PACIFIChttps://assets.extrahop.com/pdfs/industry-reports/cyber-confidence-index-apac.pdf©Macnica,Inc.

9

Press release analysis of Japanese-affiliated organizations*Analysis of 190 ransom-related press releases published between April 2020 and November 2022.
• The number of attacks targeting unoccupied time zones such as holidays, national holidays, nighttime, and early morning is increasing every year.
• This is thought to be a change in the attacker's tactic to expand the scope of damage (number of hosts and files to be encrypted) by delaying recognition
and response.

✓ Date of attack 100%

✓Attacks at night, early mornings, holidays, etc.

90%

100%

80%
70%
60%
50%

12

64

64
90%

Nonholidays

40%
30%
20%
10%
0%

1
2020年

16
2021年

39

80%

33

70%

2022年

60%

44
10
Other

✓ Attack Time

50%

100%

Holidays, nighttime, earlymorning

90%
40%

80%
70%
60%

54

55

not specified

50%
19

30%

10

20%
0%

36

20%

40%

10%

58

30%

11

10%
1
1

16

23

2020年

2021年

2022年

3

0%
2020年

©Macnica,Inc.

2021年

2022年

10

Press release analysis of Japanese-affiliated organizations*Analysis of 190 ransom-related press releases published between April 2020 and November 2022.

• The tendency to target attacks on Saturdays, Sundays, and Fridays instead of weekdays is growing stronger every
year.
• This is thought to be a change in the attacker's tactics to expand the scope of damage (number of hosts and files
encrypted).
Daytoofbethe
week on which the ✓36

attack occurred or was recognized

32

31

26

24

23
18

日曜日

月曜日

火曜日

✓2020

水曜日

木曜日

✓2021

金曜日

土曜日

✓2022

Number of Japanese national holidays

17
5

15

16

15

14

15

14
12

11
3

9

12

13

10

2
1

1

4

1

3
月曜日

火曜日

水曜日

木曜日

金曜日

土曜日

1

日曜日 月曜日 火曜日 水曜日 木曜日 金曜日 土曜日©Macnica,Inc.

2

2

1

日曜日 月曜日 火曜日 水曜日 木曜日 金曜日 土曜日

11

Press release analysis of Japanese-affiliated organizations*Analysis of 190 ransom-related press releases published between April 2020 and November 2022.
✓ Number of days from attack recognition to leak occurrence✓ Number of days from attack recognition to press release*Total of 39 cases with leaks and press releases
100%

6

20

90%
18

4

10

80%
16

1

7

4

70%

14

60%

5

12

7

10

2

6

2
0

50%

1

8

4

20~30

1

5

8~16

40%

4~7

30%

4

20%

1

2020年

7

1

5

1

2
2021年

32
5

27

12
2020年

•
•
•

61~
31~60
21~30
15~20
8~14
4~7
1~3
same day30%• Within a week (red box) is higher 2022.

25

1

3
2022年

15

15

10%

2

1

1

5
1
2
5

2021年

2022年

The interval between attack recognition and pressing is also getting shorter.
In 2022, 70% will be published within a week (red box)
To lower psychological barriers made early incident disclosure or to make the12business impact known?
©Macnica,Inc.

Press Release Content Analysis of Japanese Companies••

In the past, about 30% of the damage was done overseas, but by 2022, the percentage of damage specified for overseas locations has dropped to 20%.
This may be due in part to the fact that attackers are beginning to shift their targets from mainly large corporations to smaller organizations as theirtactics change.

✓Declaration of Damage Base✓ Distribution of sites where damage occurred*Numbers in parentheses indicate the number of cases that were not in the press but were revealed by leaks.

100%
90%
80%

United Kingdom 2

70%
60%

10

57

Europe 6
（+3)

77

50%

not
specified
Overseas40%

China 1（+1)
Taiwa
India (+1) n 5

30%

Vietnam 3
Tie 1

20%
10%

3

23

No country name5（+3)
Asia 1
Singapore 6
Indonesia2 （+1)
Malaysia 2

North
America1
U.S.A. 11(+10)

Brazil (+1)

20

0%
2020年

2021年

2022年

©Macnica,Inc.

13

Trends in Incident Occurrence at Japanese Companies*Analysis of 245 ransom press releases and leaks that can be confirmed from April 2020 to November 2022.

• Previously in 2022 Q4, hospitals and non-profit organizations (~unions, institutions, associations, and schools) were mostoften affected.
• It is possible that the damage is not targeted at large organizations, but at small organizations, or by stray bullets.
100%

90%

80%

8
70%

60%

7

3
13

21

9

32

50%

35

21

34

28

Other

3
40%

hospital
nonprofit
organization

30%

20%

10%

3

1
2

1

0%

6

1
3
1

2
1

2
1

3
2

3

2020年 第2四半 2020年 第3四半 2020年 第4四半 2021年 第1四半 2021年 第2四半 2021年 第3四半 2021年 第4四半 2022年 第1四半 2022年 第2四半 2022年 第3四半 2022年 第4四半
期
期 Q2 Q3 Q4期
Q2 Q3 Q4 Q1期Q2 Q3 Q4 Q1

2020

期

期

期

2021©Macnica,Inc.

期

期

期

2022

期

14

Percentage of incidents that occur via external public assets• Extracting data from public IR reports issued by various security-related organizations on the causes of incidents• Percentage of incidents (yellow letters) originating from external servers is not small
issuing authority Publication Datereport-name

Percentage of external public servers and vulnerabilities were the
cause

Other

uniform resouce locator

Exploitation of remote services 52

Credentials 39% , Commodity malware infection 3%
Drive by download 2% , Phishing 2% , Network misconfiguration2%

https://www.secureworks.com/resources/rp-state-ofthe-threat-2022

Via network devices 25
Via RDP 25

Via e-mail 4%, other 13%, unknown 33

https://www.trendmicro.com/ja_jp/research/22/j/forti
net.html

SecureWorks

October 2022

2022 State of the Threat: A Year in Review

52%

Trend Micro

October 2022

Compromise of network equipment leading directly to
intrusion:.
Beware of a new vulnerability, CVE-2022-40684

50% ofNational Police
AgencySeptember 2022

Threats to Cyberspace in the First Half of 2022

83%

VPN equipment 32 cases (68%)
Remote desktop 7 cases (15%)

Suspicious e-mails and their attachments 4 cases (9%)
Other 4 cases (9%)

https://www.npa.go.jp/publications/statistics/cybersec
urity/data/R04_kami_cyber_jousei.pdf

COVEWARE

July 2022

Fewer Ransomware Victims Pay, as Median Ransom
Falls in Q2 2022

50%

RDP Compromise approx. ~30
Software Vulnerability approx. 20%+ Software
Vulnerability approx. 20%+

Email Phishing approx. 30%～
Other: approx. 20%+https://www.coveware.com/blog/2022/7/27/fewerransomware-victims-pay-as-medium-ransom-falls-inq2-2022

Palo Alto

July 2022

Attackers Move Quickly to Exploit High-Profile ZeroDays: Insights From the 2022 Unit 42 Incident Response
Report46%.

Software vulnerabilities 31
Brute force credential attacks 9%.
Previously leaked credentials 6%.

Phishing 37%, Insider Threats 5%, Social Engineering 5%, Abuse of https://unit42.paloaltonetworks.jp/incident-responseTrusted Relationships/Trusted Tools 4%, Other 3%.
report/SOPHOS

June 2022

The Active Adversary Playbook 2022

55%

Exploited Vulnerability 47
Compromised Credentials 5%
Brute Force Attack 3%

Unknown 36%, Phishing 8%, Download 1%

https://news.sophos.com/en-us/2022/06/07/activeadversary-playbook-2022/

Arctic Wolf

June 2022

Q1 2022 Incident Response Insights from Tetra Defense

82%

External Vulnerabilities 57
RDP 25long vowel mark (usually only used in katakana)https://arcticwolf.com/resources/blog/q1-2022incident-response-insights-from-tetra-defense

Group-IBMay 2022

Ransomware Uncovered 2021/2022

68%.

External remote services 47
Exploit public-facing applications 21

Phishing 26%, Other 6%.

https://www.group-ib.com/media-center/pressreleases/ransomware-2022/

National Police
AgencyApril 2022

Threats to Cyberspace in 2021

74%.

VPN equipment 41 cases (54%)
Remote desktop 15 cases (20%)

Suspicious e-mails and their attachments 5 cases (4%)
Others 15 cases (20%)

https://www.npa.go.jp/publications/statistics/cybersec
urity/data/R03_cyber_jousei.pdf

IBMJanuary 2022

X-Force Threat Intelligence Index 2022

53%.

Vulnerability exploitation 47
Stolen credentials 3%
Brute force 3%

Phishing 40%, Removable media 7%.

https://www.ibm.com/reports/threat-intelligence/

Kaspersky

September 2021

Incident response analyst repot

63%.

brute force attacks 31.6
Vulnerability exploits 31.5

Malicious emails 23.7%, drive-by downloads 7.89%, removable
media 2.63%, insiders 2.63

https://media.kaspersky.com/jp/pdf/pr/Kaspersky_IRA
nalystReport2020-PR-1056.pdf

COVEWARE

April 2021

Ransomware Attack Vectors Shift as New Software
Vulnerability Exploits Abound70%

RDP Compromise approx. ~50
Software Vulnerability approx. 20-percent

Email Phishing approx. 30
Other approx. 5

https://www.coveware.com/blog/ransomware-attackvectors-shift-as-new-software-vulnerability-exploitsabound©Macnica,Inc.

15

Warning reports on vulnerability exploitation trends• 25 reports on vulnerability exploitation trends over the past few years were compiled and the number of times they appeared in each product was investigated.
Only information on exploits in incidents is collected, excluding reports on the number of detected communications that exploit vulnerabilities in NW products and anti-virus software.
No

period of issue

report-namePublication Dateuniform resouce locator

1

CISA

CISA Alets

2022-2022

https://www.cisa.gov/uscert/ncas/alerts

2

Fortinet

Zerobot - New Go-Based Botnet Campaign Targets Multiple Vulnerabilities

Dec-22https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnetcampaign-targets-multiple-vulnerabilities

3

CISA

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

Nov-22https://www.cisa.gov/uscert/ncas/alerts/aa22-320a

4

CISA

StopRansomware: HiveNov-22https://www.cisa.gov/uscert/ncas/alerts/aa22-321a

5

CISA

Top CVEs Actively Exploited By People's Republic of China State-Sponsored Cyber Actors

Oct-22https://www.cisa.gov/uscert/ncas/alerts/aa22-279a

6Arctic Wolf

Root Point Product of Compromise

Sep-22https://arcticwolf.com/resources/blog/incident-response-insights-from-arctic-wolflabs-1h-2022/

7

CISA

Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Disk
Encryption for Ransom Operations

Sep-22https://www.cisa.gov/uscert/ncas/alerts/aa22-257a8Palo Alto

Unit 42

Jul-22https://unit42.paloaltonetworks.jp/incident-response-report/

9Group IB

Ransomware Uncovered2021/2022

Jun-22https://www.group-ib.com/resources/threat-research/ransomware-2022.html

10

CISA

People's Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Jun-22https://www.cisa.gov/uscert/ncas/alerts/aa22-158a

11

IBM

X-Force Research Update: Top 10 Cybersecurity Vulnerabilities of 2021

May-22https://securityintelligence.com/posts/x-force-top-10-cybersecurity-vulnerabilities2021/

12

CISA

2021 Top Routinely Exploited Vulnerabilities

Apr-22https://www.cisa.gov/uscert/ncas/alerts/aa22-117a

13

TenableBehind the Scenes: How We Picked 2021's Top Vulnerabilities - and What We Left Out

Mar-22https://www.tenable.com/blog/behind-the-scenes-how-we-picked-2021s-topvulnerabilities-and-what-we-left-out

14

ANSSI

Panorama de la menace informatique 2021

Mar-22https://www.cert.ssi.gouv.fr/uploads/20220309_NP_WHITE_ANSSI_panoramamenace-ANSSI.pdf

15

CISA

Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical InfrastructureJan-22https://www.cisa.gov/uscert/ncas/alerts/aa22-011a

16

Recorded Future2021 Vulnerability LandscapeJan-22https://go.recordedfuture.com/hubfs/reports/cta-2022-0210.pdf

17

CISA

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities

Nov-21

https://www.cisa.gov/uscert/ncas/alerts/aa21-321a

18

Twitter

Top Critical Vulnerabilities Used by Ransomware Groups

Sep-21

https://twitter.com/uuallan/status/1438899102448820224

19

CISA

Top Routinely Exploited Vulnerabilities

Jul-21

https://www.cisa.gov/uscert/ncas/alerts/aa21-209a20

National Institute of Standards
and Certification

Alert Concerning Ransomware Cyber Attacks

Apr-21

https://www.nisc.go.jp/pdf/policy/infra/ransomware20210430.pdf

21

TenableIN THE 2020 THREAT LANDSCAPE RETROSPECTIVE (TLR), YOU WILL READ ABOUT:

Jan-21

https://www.tenable.com/cyber-exposure/2020-threat-landscape-retrospective

22

CISA

Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets

Oct-20https://www.cisa.gov/uscert/ncas/alerts/aa20-296a

23

CISA

APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

Oct-20https://www.cisa.gov/uscert/ncas/alerts/aa20-283a

24

CISA

Potential for China Cyber Response to Heightened U.S.-China Tensions

Oct-20https://www.cisa.gov/uscert/ncas/alerts/aa20-275a

25

CISA

Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

Sep-20https://www.cisa.gov/uscert/ncas/alerts/aa20-258a©Macnica,Inc.

16

Warning reports on vulnerability exploitation trends• 25 reports on vulnerability exploitation trends over the past few years were compiled and the number of appearances (in yellow) for each product was investigated.
Only information on exploits in incidents is collected, excluding reports on the number of detected communications that exploit vulnerabilities in NW products andanti-virus software.
Product

freq
uen
cy

Report Number
1

2

3

Exchange Server 19 ProxyLogon

Citrix

ProxyShell

14 19781

CVE-2019-

5

6

ProxyLogon,PProxyShellroxyShell

7
ProxyShell

CVE-202122893,.
CVE-20208260, CVE2020-8243,
CVE-201911510

14

Fortinet

13

F5 Big-IP

10 1388,cve1388
2020-5902
9

CVE-202144228

Accellion FTA

6cve-202127101cve202127102,cve202127103,cve2021-27104

SonicWall

6

VMware vCenter
Server

6

ZOHO
ManageEngine
ADSelfService

610

CVE-201911510

not specified

11

12

13

ProxyShell,Pr
ProxyLogon,P
oxyLogon,CV ProxyLogon
roxyShell
E-2020-0688

ProxyShell,Pr ProxyLogon,P
oxyLogon
roxyShell

CVE-201919781

14

CVE-202144228

CVE-202144228

CVE-202144228

CVE-202144228

not specified

CVE-202127101, CVE2021-27102,
CVE-202127103, andCVE-202127104

CVE-202122005

CVE-202140539

CVE-202120016

CVE-201919781

not specified

16

17
ProxyShell

18

19

ProxyShell,Pr
oxyLogonCVE-201919781

CVE-202122893,.
CVE-20208260, CVE2020-8243,
CVE-201911510

CVE-201911510

CVE-201813379

CVE-201813379

CVE-202122893

CVE-201911510

CVE-201813382

CVE-201813379

CVE-201813379

CVE-201813379

cve-2018cve-201813379, cve- 13379, cveCVE 20182020-12812, 2020-12812,
13379
cve-2019cve-20195591
5591

CVE-20205902

cve 2020CVE 20205902, cve5902
2021-22986

CVE-202127101

cve-202127104,cve202127103,cve202127102,cve2021-27101

ProxyLogon

CVE-201919781

cve-2019CVE-202111510,cve22893
2021-22893

CVE-202144228

21

CVE-201919781

cve-201911510,cve2021-22893

CVE-202144228

20

cve-201919781,cve2020CVE-20198195,cve19781
20208196,cve2019-11634
CVE-202122893,.
CVE-20208260, CVE- CVE 20192020-8243, 11510
CVE-201911510, CVE2019-11539

CVE-20205902

22

24

25

CVE-20200688

CVE-20200688

CVE-20200688

CVE-201919781

CVE-201919781

cve-201919781,cve20208193,cve20208195,cve2020-8196

CVE-201919781

CVE-201911510

CVE-201911510

CVE-201911510

CVE-20205902

CVE-20205902

CVE-201813379

23

CVE-201813379

CVE-20205902

CVE-202144228

cve-202127104,cve202127103,cve202127102,cve2021-27101

cve-202127101, cve2021-27102,
cve-202127103, cve2021-27104

cve-202120016, cve2020-5135,
cve-20197481

cve-2021CVE-202120038,cve20016
2021-20016

CVE-202121985.

CVE-202140539

15

ProxyLogon,C
PropxyLogon VE-2020ProxyLogon0688

cve-20205902,cve2022-1388

CVE-2022-

not specified

CVE-202140539

9

CVE-201919781

CVE-202012812

cve-2022-8

CVE-201919781

Pulse Secure
Pulse Connect
SecureLog4j (including
VMHorizon)

4

CVE-202121985.

CVE-202140539©Macnica,Inc.

CVE-202121985.

CVE-202122005

CVE-202120016

CVE-202121985.

CVE-202140539

17

Warning reports on vulnerability exploitation trends• 25 reports on vulnerability exploitation trends over the past few years were compiled and the number of appearances (in yellow) for each product was investigated.
Only information on exploits in incidents is collected, excluding reports on the number of detected communications that exploit vulnerabilities in NW products andanti-virus software.
Report Number

Product

freq
uen
cy

Atlassian
Confluence
Server and Data
Center5

cve-202226134,cve2021-26084

Cisco

5

CVE-20211497

MobileIron

4

QNAP QTS and
QuTS hero

4

Exim

3

D-Link3

Atlassian Crowd
and Crowd Data
Center

2

DrayTek

2

GitLab CE/EE

2

Kaseya VSA

2

1

2

3

4

5

6

7

8

9

10

11

CVE-202126084

12

13

14

15

16

CVE-202126084

cve-20180171,cve20191652,cve2019-15271

17

18

21

22

23

CVE-20180171

24

25

CVE-20193396

cve-20191652,cve20191653,cve2020-3118

CVE-20191653

CVE 202015505

CVE-202015505

CVE-202015505

cve-202128799, cve2020-36195,
cve-20202509

cve-202036198, cve2021-28799

CVE-20202509

CVE-201910149

CVE-202025506

20

CVE-202126084

CVE-202015505

cve-20197192,cve20197193,cve20197194,cve2019-7195

19

CVE-201910149

CVE-201916920

CVE-20186789

CVE-201916920

CVE-201911580

CVE-20208515

CVE-201911580

CVE-20208515

CVE-202122205

CVE-202122205

CVE-202130116

cve-202130116, cve2021-30119,
cve-202130120©Macnica,Inc.

18

Warning reports on vulnerability exploitation trends• 25 reports on vulnerability exploitation trends over the past few years were compiled and the number of appearances (yellow letters) for each product was investigated.
Only information on exploits in incidents is collected, excluding reports on the number of detected communications that exploit vulnerabilities in NW products and antivirus software.
Report Number
12
13
14

Product

frequ
ency

OracleWebLogic
Server2

Palo Alto

2

Progress
Telerik UI

2

Sitecore XP

2

VMwareWorkspace
ONE Access2

cve-202222954,cve2022-22960

CVE-20204006

2

cve-202224682,cve202227924,cve202237042,cve202227925,cve2022-30333

CVE-20199670

Zoho
ManageEngine
2
ServiceDesk
Plus

CVE-202144077

Zimbra

1

2

3

4

5

6

7

8

9

10

11

15

16

17

18

19

20

21

22

23

cve-20192725,cve2020-14882

CVE-202142237

25

CVE-20154852

CVE-20191579, CVE2020-2021

CVE-201918935

24

CVE-20202021

CVE-201918935

CVE-202142237

CVE-202010189

ForgeRockOpenAM
server2

Hikvision
Webserver2

CVE-202136260

Zyxel.

2

CVE-202230525

CVE-202135464

CVE-202135464

CVE-202136260

CVE-202029583©Macnica,Inc.

19

Agenda for this session✓Part 1: Analysis of recent incident occurrence trends
Leaked information by the Ransom Gang
Press Release on Damage by Japanese Companies
Public reports from security agencies/vendors✓Part 2: Changes in the management of externally disclosed assets
RDP Publication Status
Use of out-of-support OS
Change in speed of vulnerability response (2020 vs. 2022)
Status of Measures Taken by Japanese Companies✓Part 3: Attempting to capture the attacker's change in tactics
Past survey cases (Pandora, AvosLocker, Deadbolt)
Share how to research with device search engines©Macnica,Inc.

20

Survey on RDP 3389/TCP
Survey the number of servers and PCs that expose RDP (3389/TCP) to the outside world using Shodan• Globally, there are 4.3 million cases and approximately 120,000 units in the domestic market.
• In Japan, the number of cases increased significantly around the time of the Corona disaster, but peaked at 143,671 in March
2021 and has been on a downward trend since then.
• While many of the PCs are for personal use, we can clearly see at least 500 PCs that are used by at least 500 companies.

Top 30 countries with the highest number of3389/TCPs publishedCountryNov-2019

May-2020

Nov-2020

May-2021

Nov-2021

May-2022

Nov-2022

fluctuation

1
2
3

GlobalUnited States
China
Germany

5,548,173
2,465,109
1,252,901
157,9105,246,373
1,775,745
1,485,333
195,439

4,574,509
1,512,654
1,137,537
190,848

5,326,991
1,675,269
1,412,295
224,883

4,872,514
1,641,343
1,274,560
213,436

4,629,133
1,398,938
1,216,480
219,561

4,329,536
1,281,178
1,234,529
204,047

-22%.
-48%
-1%.
29%

4

Japan

95,499106,456

109,979

128,105

127,740

122,696

120,375

26%.

5
6
7
8
9

Netherlands
UK
Hong Kong
Singapore
Russia108,227
97,89264,44563,051
99,283

123,904
110,345
83,43971,371
108,936

117,754
128,085
81,17681,654
107,153

150,779
135,266
140,919
87,687125,012

135,745
118,249
122,775
109,980
112,107

126,445
123,375
121,117
117,955
103,944

112,322
105,318
95,544
92,76390,156

4%
8%
48%
47%.
-9%

10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

Korea
FranceIndia
BrazilCanadaTurkeyAustralia
Viet Nam
IrelandIsraelItaly
TaiwanMexicoSpain
ThailandSouth Africa
Finland
PolandIndonesia
SwedenCzechia

87,11095,681
49,107
104,606
68,07330,52443,42728,95340,246
6,593
38,89846,13934,75837,627
21,27530,225
6,934
19,691
10,851
15,115
19,281

98,430106,573
54,196112,926
69,14932,26346,92137,53245,5907,679
41,57845,08836,28438,96025,777
24,397
9,007
18,47012,377
14,33918,64689,274
104,676
108,828
146,557
56,41369,31087,252
90,79365,76388,981
31,37336,95651,00051,99540,61640,645
41,571
40,71912,51814,22036,86440,95740,31840,98631,55035,84635,14635,042
21,326
24,58919,38921,142
10,533
16,30722,51523,356
11,823
14,502
14,255
15,21016,928©Macnica,Inc.
16,94991,28582,74472,92373,80273,97833,77245,711
33,04639,34913,437
31,94231,09528,361
27,731
21,95017,313
15,287
17,513
16,861
13,813
14,633

103,532
89,49979,26372,023
72,836
37,466
65,386
37,21936,5585,888
32,52432,47628,60628,13322,896
17,751
16,73018,511
13,963
17,553
13,96385,01282,12881,81567,06860,85940,69839,161
36,841
34,61532,191
29,23629,23025,544
24,951
21,97817,17816,758
16,64815,647
14,646
13,587

-2%
-14%.
67%.
-36%.
-11%.
33%.
-10%.
27% of-14%.
388% (in.)
-25%.
-37%.
-27%.
-34%.
3
-43%.
142%.
-15%.
44%
-3%.
-30%.

21

Survey on RDP 3389/TCP
More than 3,000 PCs with SIMs for telework use can be confirmed based on NW information, etc.
✓ Telework PC of a certain A company✓ Telework PC of a certain B company©Macnica,Inc.

22

Survey on Out-of-Support Windows Operating Systems
Investigate the number of out-of-support units by using Shodan to infer the Windows Version• 1.32 million units are available globally, with approximately 14,000 units in Japan (the 15th largest number in the world).
• Comparing November 2019 and November 2022 volumes, the rate of decline is not good across the board in Asia.
IIS6.0Top 30 countries with the most units

Windows 2003 Server /July 2015 EOL

IIS7.0Windows Server 2008/January 2020 EOL

IIS7.5
Windows Server 2008 R2/January 2020 EOL

In order of decreasing rate of decrease

1
2
3
4
5
6
7
8
9
10
11
12
13
14

Country
GlobalChina
United States
Hong Kong
Korea
Germany
United Kingdom
BrazilTaiwanRussian Federation
Italy
CanadaAustralia
India
Malaysia

Nov-2019
5,500,255
774,106
2,532,017
439,12754,005
108,929
96,194
39,66934,68042,891
36,25554,56454,62052,305
17,225

Nov-2020
2,945,700
641,059
1,179,770
253,189
43,262
67,07357,87728,70927,58025,66835,09536,20935,652
23,67015,359

Nov-2021
1,824,451
595,457
464,793
184,906
40,05041,56735,20526,012
21,784
22,13323,007
24,24920,983
21,235
19,530Nov-2022
1,323,633
493,195
267,506
155,440
31,89428,09724,441
16,954
16,457
16,39016,177
15,776
15,047
14,841
14,66215

Japan

32,10330,69130,88013,932

16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

FranceArgentina
Singapore
Netherlands
Spain
MexicoSouth Africa
TurkeyThailandIndonesia
IranViet Nam
IrelandSwedenCzechia

38,41531,90016,16515,00819,026
24,81843,27027,10622,457
15,991
19,867
14,399628,316
82,35723,96321,36913,758
9,801
11,8155,810
20,75010,84010,617
8,815
13,862
9,514
14,4029,737©Macnica,Inc.
11,354
7,582

18,905
13,578
7,480
12,646
12,153
11,100
7,945
12,5609,602
5,333
10,839
6,918
7,459
6,833
5,750

12,923
11,121
9,079
9,042
8,987
8,449
8,187
7,974
7,962
5,592
5,482
5,004
4,828
4,088
3,913

1
2
3
4
5
6
7
8
9
10

Malaysia
Argentina
China
Korea
ThailandSingapore
TaiwanIndonesia
Viet Nam
Italy

Percentagechange
-15%.
-31%.
-36%.
-41%.
-42%.
-52%.
-53%
-53%
-53%
-55%.

11

Japan

-57%

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

BrazilMexicoSpain
Russian Federation
Hong Kong
IrelandCzechia
FranceTurkeyCanadaSwedenIndia
Australia
Iran
Germany
United Kingdom
Netherlands
United States
South Africa

-57%
-57%
-60%.
-62%.
-65%.
-65%.
-66%%
-66%%
-67%%
-71%%
-72%%
-72%%
-72%%
-74%.
-74%.
-75%.
-79%
-89%
-99%.

Country23

Survey on out-of-support CentOS
Investigate the number of out-of-support units by using Shodan to infer the CentOS version• Approximately 380,000 units have been released globally, and over 70,000 units can be found in Japan (the second largest number inthe world)• CentOS5 series has the largest number in the world with less than 20,000 units in Japan.
Top 30 countries with the most units
Apache/2.2.3 (CentOS)
CentOS 5/2017 EOL

Apache/2.2.15 (CentOS)
CentOS 6/2020 EOL

In order of decreasing rate of decrease

1

Country
GlobalUnited States

Nov-2019
1,138,405
361,371

Nov-2020
993,855
273,302

Nov-2021
570,403
151,814

Nov-2022
378,597
96,6752

Japan

132,819

113,143

94,122

71,33826,31821,912
24,467
16,34914,894
16,311
22,471
15,4109,205
19,063
9,751
10,267
14,021
6,575
5,235
5,272
4,721
3,312
3,925
2,491
3,607
4,539
2,551
3,665
3,222
4,990
3,524
2,214

17,264
16,778
14,97314,082
11,248
10,679
9,994
9,734
7,704
7,671
6,707
6,097
5,164
4,728
4,157
4,123
3,419
3,344
3,112
3,101
2,897
2,571
2,355
2,276
2,221
1,967
1,839
1,656

3 Russian Federation
4
France5China
6 Korea, Republic of
7
Italy
8
Canada9Germany
10
United Kingdom
11
Taiwan12
Ukraine13
Brazil14
Netherlands
15
India
16
Hong Kong
17
Thailand18
Singapore
19
Spain
20
Malaysia
21
Indonesia
22
Mexico23
Czechia24
Romania25
Argentina
26
Australia
27
Turkey28
Poland29
Bulgaria
30
Viet Nam

54,011
61,20638,81134,30854,53040,911
20,895
21,251
18,685
21,392
48,81627,30940,46036,75839,28433,14911,61812,811
20,407
21,921
17,541
15,26826,97023,52830,80928,60911,904
11,212
7,102
6,090
14,146
17,709
9,470
7,683
4,788
4,388
8,239
6,020
5,262
2,968
7,227
5,979
10,125
7,356
4,105
2,891
8,972
6,414
14,703
22,119
7,148
6,069
6,248
3,449
5,466
5,599
©Macnica,Inc.

Country

Percentagechange

1
2
3
4
5
6
7

Malaysia
Korea
TaiwanItaly
MexicoThailand
Argentina

-30%.
-33%.
-34%.
-40%.
-41%.
-41%.
-43%.

8

Japan

-46%.

9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

FranceCzechia
Hong Kong
BrazilIndonesia
UkraineSpain
GlobalRussian Federation
Viet Nam
Bulgaria
Singapore
PolandChina
United States
Romania
Australia
United Kingdom
Germany
CanadaIndia
Turkey

-57%
-60%.
-60%.
-62%.
-62%.
-62%.
-64%
-67%%
-68%.
-70%.
-71%%
-71%%
-72%%
-73%.
-73%.
-75%.
-75%.
-75%.
-75%.
-78%
-83%%
-85%.

24

Country-specific countermeasure trends for Pulse Secure/CVE-2019-11510 vulnerabilities• Patch released in April 2019; attacks increased following announcement by DEVCORE Orange at BlackHat and others in August of the same year.
• Speed of countermeasures by region and country based on scan data published by Bad Packets (@bad_packets)• Western countries are coping fast and Asian countries are slow. It can be seen that Japan is coping at a slightly slower pace than the global average.

Percentage change in vulnerable servers (by region)

Percentage change of vulnerable servers (by country)

100%

100%

100%

Korea

90%

90%

Hong Kong
China

80%

80%

Taiwan
70%

70%

60%

100%

62%

60%

Spain
Japan

62%

France
54%

50%

49%
46%

47%
36%
34%

30%
20%
10%
0%

Europe and America

40%

40%

50%

Global

31%
29%

40%

Asia
34%
27%
25%

30%

32%
28%
23%
21%

20%
17%
14%

10%

43%

43%
39%

GlobalSwitzerland
Belgium

33%
29%

Canada
25%
22%
19%
16%
13%

7%
0%

United Kingdom

2%

United States
Australia
Germany
SwedenSingapore
Netherlands©Macnica,Inc.

25

Exchange Server/CVE-2020-0688 Vulnerability Countermeasure Trends by Country••

A patch was released on February 25, 2020, and attack activity began to be actively observed around March of the same year.
In the Western world, 39% of servers were addressed in six months and 52% in one year, while in Asia, 28% were addressed in six
months and 34% in one year.
Percentage change in vulnerable servers (by region)
100%

100%

Percentage change of vulnerable servers (by country)
100%
Thailand90%

90%

Indonesia
Hong Kong

80%

80%
72%

70%

Korea

76%
73%
69%
67%

70%
66%

61%

60%

62%

60%

58%
54%
51%
47%
44%
41%

ASIA
50%

48%
47%

Europe and America

50%

Global40%

40%Vietnam
Malaysia
China
Italy
TaiwanSingapore
United Kingdom
France
Japan

30%

32%

30%

CanadaUnited States

20%

Australia

20%

Global10%

Switzerland

10%

Netherlands

0%Austria0%
Feb-2020

Jun-2020

Mar-2021

Note that the dates in the graphs are not evenly spaced due to the timing of data acquisition.

Feb-2020©Macnica,Inc.

Jun-2020

Mar-2021

26

Country-specific countermeasure trends for the Atlassian Confluence/CVE-2022-26134 vulnerability•••

Zero-day vulnerability with a patch released on June 2, 2022, and ongoing reports of exploits since then.
As of 12/4/2022, 2303 of 7001 units globally and 28 of 43 units in Japan remain vulnerable
Six Months After Patch Release, Vulnerable Servers Decrease to 20% in Europe and the U.S., but remains 70% in Asia
Percentage change in vulnerable servers (by region)
100%

Percentage change of vulnerable servers (by country)
100%

100%

China
Japan

96%
90%

Hong Kong

90%

89%
85%

86%

Korea

86%

Viet Nam

80%

80%

Russia

77%
70%

73%

72%

59%

62%
57%

64%

64%

58%

58%

60%

65%

Poland61%

Belgium
GlobalGlobal50%

Europe and America
Asia

40%

Canada

50%

49%

40%

40%

33%
30%

33%
30%

25%
23%

FranceAustralia

37%

20%

Singapore
Iran

67%

65%
60%

73%

70%

20%

FinlandUnited Kingdom
United States

26%

Czech Republic

22%

SwedenItaly
Netherlands

11%

10%

10%

IrelandGermany0%

Switzerland

0%3-Jun 9-Jun 21-Jun 15-Jul 25-Jul 3-Aug 3-Oct 4-Dec

Note that the dates in the graphs are not evenly spaced due to the timing of data acquisition.

3-Jun©Macnica,Inc.

9-Jun

21-Jun15-Jul

25-Jul

3-Aug

3-Oct

4-Dec

Austria27

Exchange Server/ProxyNotShell Vulnerability Countermeasure Trends by Country• Reported as a zero-day in September 2022 and patch released November 9, 2022 (CVE-2022-41040, CVE-2022-41082)• Since some versions of a narrow range of Exchange Server are affected, we counted only the number of servers using the affectedversion and the number of servers using the fixed vulnerability version to investigate the percentage of vulnerable servers.
Percentage change in vulnerable servers (by region)

Percentage change of vulnerable servers (by country)
100%

100%
90%

90%

80%

80%
77%
75%

70%

74%
72%

100%

98%

Korea
96%

Indonesia
China

73%
70%

61%

60%

59%

57%
54%

Asia

50%

Global40%

Europe and America

Hong Kong
ThailandIndia
Singapore

57%
54%
52%
49%

Japan
TaiwanItaly
Turkey

40%
34%

30%

Russia

63%
60%

Other

50%

87%
83%
81%
78%
75%
72%
71%
67%

30%

GlobalUnited Kingdom
France20%
20%

United States

10%

Germany
10%

Netherlands

0%30-Sep11-Nov

14-Nov

15-Dec27-DecAustria0%30-SepNote that the dates in the graphs are not evenly spaced due to the timing of data acquisition.

©Macnica,Inc.

11-Nov

14-Nov

15-Dec27-DecSwitzerland

28

2020 vs 2022 Exchange Server Vulnerability Addressed• Comparison of the speed of dealing with CVE-2020-0688 fixed in February 2020 and ProxyNotShell fixed in November 2022 for the same country• In Europe and the U.S., the progress of about 50% in addressing vulnerabilities, which took about one year in 2020, will be achieved in about one month in 2022.
It is possible that this is related to the fact that ProxyNotShell was a vulnerability that affected relatively new versions (many people are highly aware of theneed to apply patches).
• After about 2 years, the gap between the Asian and Western regions is widening in terms of the speed of coping.

Percentage Trends Vulnerable to ✓ProxyNotShell, by Region

Percentage change in vulnerability to ✓CVE-2020-0688, by region
100%

100%

100%

90%

90%

80%

80%

13% difference

72%

70%

100%

97%
94%
93%

79%

77%

24% difference

70%

66%
61%

60%

61%
57%

60%
ASIA

50%

48%
47%

40%

Europe and America
Global

50%

57%
53%

Europe and America
Global

40%

30%

30%

20%

20%

10%

10%

0%

ASIA

0%
Feb-2020

Jun-2020

Mar-2021

Note that the dates in the graphs are not evenly spaced due to the timing of data acquisition.

30-Sep-2022©Macnica,Inc.

14-Nov-2022

15-Dec-2022

27-Dec-202229

2020 vs 2022 Exchange Server Vulnerability Addressed••

Comparison of CVE-2020-0688 fixed in February 2020 and ProxyNotShell fixed in November 2022 for the same country
There is little turnover in the order of coping speed (red box)
CVE-2020-0688
Percentage of vulnerable servers after
approx. 1 year

ProxyNotShell
Percentage of vulnerable servers after
approx. 1.5 months

gap

Progress on CVE-2020-066 after approx.
ranking of the worst countries

Progress after about 1.5 months of
ProxyNotShellranking of the worst countries

Korea

69%.

87%

18%

4

1

Indonesia

73%.

83%

10% (%)

2

2

China

65% of

81%

16%

7

3

Vietnam67%.

78% of11%.

54

65% of78% of

12%.

6

5

69%.

78% of8%

3

6

Thailand76% of

77%

1

1

7

Singapore

58%

72%

14%.

10

8

Japan

54%

71%

16%

13

9

Taiwan61%.

70% (of the total)

9%.

9

10

Italy

62%

67%.

5% (of thetotal)

8

11

Canada53%.

56% of3

14

12

United Kingdom

57%

56% of

-1%.

11

13

Australia

51%

55%

4%

16

14

57%

54%

-3%.

12

15

United States

53%.

54%

1

15

16

Germany

32%

52%

20%.

20

17

Netherlands

44%

50% of6%

18

18

Austria

41%.

49%

8%

19

19

Switzerland

44%

34%

-10%.

17

20

country

Malaysia

Hong Kong

Francearea

ASIA

Europe and America©Macnica,Inc.

30

Reference: Investigation of the speed of vulnerability handling• Survey methodology (when using Shodan CLI)
1. Consider a search query to identify servers affected by the vulnerability
Shodan http.title:outlook
2. Retrieve data from the device search engine DB with a search queryshodan download --limit -1 filename http.title:outlook
3. Repeat 2 on a regular basis, such as every month (note that the data volume is more than a few GB).
4. Parse necessary data items from the acquired data (parse items should be considered for each vulnerability)
shodan parse --fields ip_str,port,location.country_code,data sourcefilename > targetfilename
5. Format the extracted data to make it comparable.

• It is important not to miss the opportunity to conduct a vulnerability response speed survey, as the conditions to do so are extremely rare.

1. The vulnerability must be a server vulnerability that is often exposed externally. Naturally, it is because internal servers cannot be
observed by OSINT.
2. The version information and vulnerability can be determined by HTML, etc. without scanning from outside. This is because
scanning is not legally allowed.
3. Version information must be stored in the data held by device search engines such as Shodan.
*For example, SonicWall displays version information in the source of the VPN login screen, but Shodan and Censys do not retain it.
4. A PoC or attack is observed and the need for patching is widely/strongly announced (not a requirement).
5. The total number of public servers should be neither too many nor too few. If there are too few, trends cannot be read, and if there
are too many, data cannot be processed.
©Macnica,Inc.

31

The Situation of Japanese Companies✓In January 2022, we surveyed the management of the external public servers of the headquarters, overseas offices, and groups of 50 specificcompanies selected from the former Tokyo Stock Exchange First Section.
*No vulnerability scans or server access were conducted, but the investigation was based on information from Shodan.
✓In about 40% of the cases, the headquarter company has the problem, and 90% of the companies, including overseas and even subsidiaries,
were found to have the problem.
✓In addition to this survey, there are almost no other companies that have been surveyed over 100 companies and found no problems at all.

38 companies
Discovered 76% of the respondents were running out-of-support OS (Windows server, CentOS)
Older ones are Windows 2000 (2010 EOL) and Server 2003 (2015 EOL).

Total 50
companies

45 companies
90% found running out-of-support old software
Apache, PHP, OpenSSL, OpenSSH, MariaDB, Serv-U, etc.
*Excluding likely backport modifications from the survey

15 companies
30% use servers with remote desktop published
Telework PCs for 4 of the above companies.
©Macnica,Inc.

32

Agenda for this session✓Part 1: Analysis of recent incident occurrence trends
Leaked information by the Ransom Gang
Press Release on Damage by Japanese Companies
Public reports from security agencies/vendors✓Part 2: Changes in the management of externally disclosed assets
RDP Publication Status
Use of out-of-support OS
Change in speed of vulnerability response (2020 vs. 2022)
Status of Measures Taken by Japanese Companies✓Part 3: Attempting to capture the attacker's change in tactics
Past survey cases (Pandora, AvosLocker, Deadbolt)
Share how to research with device search engines©Macnica,Inc.

33

Major trend changes over the past few years

conventional

Targeted
attackoffensive initiative

Past few
years

Ransom
actor

Email

SilentHardly ever

initial breachattackdisclosure of damage

External
server

Revealed byencryption andfailure.

Tend to be
publicized andexposedIncident information tends to become public for various reasons.
Can we capture attack trends and tactical changes by using public information?

©Macnica,Inc.

34

Example #1 Ransom Actor Pandora• Three Japanese companies were also targeted by the (rebranded) ransom actor, which started its activity in March 2010 and ended soon after.
• Speculated that the victim companies commonly published VMware Horizon, which may have been an entry point.
• In June 2022, Trend Micro also mentioned the connection between the Pandora incident and VMware Horizon (Log4j).
Log4Shell Vulnerability in VMware Leads to Data Exfiltration and Ransomware
https://www.trendmicro.com/en_us/research/22/g/log4shell-vulnerability-in-vmware-leads-to-data-exfiltration-and-ransomware.html✓Tweet alert

List of ✓Damaged Companies
company
sufferingdamagePublicationDatecountry

Company H

22/3/30

Japan

VMware Horizon available

Company U

22/3/30

UnitedStates ofAmerica

VMware Horizon available

Company O

22/3/13

UnitedStates ofAmerica

VMware Horizon available

Company R

22/3/13

UnitedStates ofAmerica

VMware Horizon available

Company D

22/3/13Japan

VMware Horizon available

Company G

22/3/5Japan

VMware Horizon available

Company J

22/3/5

UnitedStates ofAmerica

VMware Horizon available✓Alert on Log4j for VMwareHorizon
timereporter

22/1/5

United Kingdom NHS/CC4002

Unknown Threat Group

22/1/10Microsoft

Ransom Actor DEV-0401 (NightSky)

22/3/14

nekono_nanomotoni

Ransom Actor Pandora

22/3/29

SOPHOS

Mining Bots

22/6/23

U.S.A. CISA/AA22-174A

Multiple threat actors including APT

22/8/16

Trend MicroMultiple cases including Ransom Actor
Pandora22/8/25

Microsoft

Iranian/MERCURY

22/9/7

BlackBerry

Ransom Actor/MONTI

22/9/8

Cisco Thalos

Lazarus/APT38

22/9/14

U.S.A. CISA/AA22-257A

Iranian-affiliated APT/IRGC

suspect site

©Macnica,Inc.

home (i.e. hometown, home country)

35

Example #2 Ransom actor AvosLocker•••

Ransomware employing a RaaS model that began activity around June 2021
The victim companies in June 2022 commonly disclosed Exchange Server, and all of them had either the latest version or the version corresponding to
ProxyShell at the time of the investigation approximately two weeks later. There is a possibility that the server was used as an entry point was inferred fromthe fact that it was either the latest version or the version corresponding to ProxyShell.
In March 2022, the FBI issued an advisory indicating that multiple AvosLocker incidents were caused by the Proxy Shell.
Indicators of Compromise Associated with AvosLocker Ransomware
https://www.ic3.gov/Media/News/2022/220318.pdf

Date of leak site
publication
2022/6/17

Name of company affected

Exchange Yes/No

Exchange Version

C****

ant

unaccessible

2022/6/17

B********

antlatest version

6/8/2022

L*********

ant

Applicable to ProxyShell

6/7/2022

Y***************

antlatest version

6/7/2022

C***********

antlatest version

6/7/2022

C********

ant

Applicable to ProxyShell

6/3/2022

T*************

antlatest version

6/3/2022

C**********************

ant

6/3/2022

P**********************

undiscovered

6/3/2022

B*************

undiscovered

6/3/2022

C*************

undiscovered

2022/4/6

K************

undiscovered

2022/4/6

M****************

undiscovered

Applicable to ProxyShelllong vowel mark (usually
only used in katakana)long vowel mark (usually
only used in katakana)long vowel mark (usually
only used in katakana)long vowel mark (usually
only used in katakana)long vowel mark (usually
only used in katakana)long vowel mark (usually
only used in katakana)

2022/4/6 ©Macnica,Inc.
A*********************

undiscovered*As of late June 201036

Example #3 DeadBolt ransomware•••

Ransomware targeting NAS manufactured by QNAP and ASUSTOR since around January 2022
Multiple campaigns were launched in January, May, June, and around August during 2022, causing a lot of damage in Japan and abroad.
Directly supplemental information on the number and version of NAS units affected as threats are displayed on the login screen

Ransom note displayed on affected NAS
Capture of damaged NAS in Shodan©Macnica,Inc.

37

Example #3 DeadBolt ransomware••

In each campaign, the number of affected units was significantly different from the total number of QNAP NAS (327,000 units),suggesting that specific versions or models may have been targeted.
Investigations were conducted and specific versions/models were targeted from the first to the third round. QNAP was notified, and theresults were used to raise awareness both domestically and internationally.

Number of damages per campaign
monthJanuary
February
March

Number of
Damages

remarks

1,889

First Offensive Campaign

Server response before and after encryption

Security alerts from QNAP, Inc.

3,566
3,678

April

2,300

May

3,696

June

6,494

July

1,5017

Second Offensive
Campaign
Third Offensive Campaign
Fourth Offensive
Campaign

https://www.qnap.com/en-me/security-news/2022/take-immediate-actionsto-secure-qnap-nas-and-update-qts-to-the-latest-available- version
https://www.qnap.com/ja-jp/security-advisory/QSA-22-19©Macnica,Inc.

38

Sharing survey methodology
Leak Information
check

Victim company server
OSINT

Suspected initial point of entry
Extract points in common

1
01

2
02

3
03

Status monitoring of server
outages, version upgrades, etc.

4Note: The main focus of this report is to introduce methods to efficiently investigate at no cost or with minimal man-hours.
OSINT methods that utilize expensive paid tools and intelligence will not be explained at this time due to time and practicalfeasibility.
Note: Since there are various perspectives and methods of product identification, only representative points are listed. Methods
described does not capture servers 100%. Please also aware that there may be products that are not intended in the search.

©Macnica,Inc.

39

1

Check for leaked information

2

3

4

• Monitor the attacker’s leak site and keep track of the victim companies.
*A free account with DarkTracer is also recommended, as tracking by yourself is time-consuming.
https://xoxo.darktracer.com/• Gather domain information of the victim company from the leaked information
Name of company affected
Ransom Gang Name
Publication Date
URL/Domain of the affected company
country
type of industry

Search for damage caused by a specificransomware gangs

Search for damage in
specific countries©Macnica,Inc.

40

1

Identification of Victim Company Servers
•
•

2

3

4

SSL search with device search services (Shodan, Censys, ZoomEye, etc.) based on collected domain information
Efficiently identify servers with domain information owned by the affected organization ≒ servers managed/owned by the organization
Access the following URL and search for the domain identified in STEP 1 as follows
https://www.shodan.io/dashboard
ssl:domain of the affected organization e.g. ssl:macnica.co.jp

For ZoomEye

This search allows servers with the relevant domain in the SSL certificate to be searched at once.

For Censys

If your company name is unusual or unique, you can use the top or second level of the domain name.
If omitted, search at once is more efficient©Macnica,Inc.

The following patterns should also be searched depending on the target location
services.tls.certificates.leaf_data.subject_dn="*targetname*"
services.tls.certificates.leaf_data.issuer_dn ="*targetname*"
services.tls.certificates.leaf_data.issuer.common_name ="*targetname*"
services.tls.certificates.leaf_data.issuer.organization ="*targetname*"
services.tls.certificates.leaf_data.subject.common_name ="*targetname*"
services.tls.certificates.leaf_data.subject.organization ="*targetname*"

41

Identification of Victim Company Servers
•

1

2

3

4

Search the results of the SSL search on the previous page to determine the IP address range owned by the company (Shodan only)
Access the following URL
https://www.shodan.io/search/facet
Enter the domain you searched for on the previous page on the left side
On the right, search with "org" set from the list.

Access Shodan's regular search pagehttps://www.shodan.io/
Search as follows using the organization names identified in STEP3-1.

org: "organization name"org: "Macnica GmbH"The server with the SSL certificate to be searched is owned by which company?
Able to check how many units are operating in an IP address segment
If the name of the company is mentioned, copy and paste the name and write it down in a memo.

org: "MACNICA DHW LTDA"This search will find the name of the searched organization in the IP address range registered in Whois.
Possible to identify servers that are running
If the organization‘s name is unique, a search using only the company name is easier.
It may be possible (e.g., org:macnica )If the organization name includes a comma, such as MACNICA, Inc.,
you need to remove the right side and search.
Example: org: "MACNICA, Inc." → org: "MACNICA"*ZoomEye also allows searches like org:macniac, but unlike Shodan, it also includes servers that ZoomEye has
determined to be relevant*Censys has a weak organization name supplement on Whois andDifficult to use because wildcard search is not available in autonomous_system.name=.

©Macnica,Inc.

42

1

Identification of Victim Company Servers

2

3

4

• What if the suspect server does not appear using the method?
1. hostname searchhostname:targetname

2. Expand the domain to be surveyed

3. List subdomain -> list IP address -> IP search

Viewdns.info

OWASP Amass

https://viewdns.info/reversewhois/

https://github.com/OWASP/Amass

dns.names="*targetname*"
There is a relationship between the search target domain and the Whois
information.
Automatic enumeration of domains (with noise sometimes)

hostname:targetname©Macnica,Inc.

43

Points to focus on when checking search results
For Shodan and ZoomEye
Product identification is done visually from HTTP title
and favicon

1

2

3

4

For Censys
Note the Software Vendor and Software Product in the search results.
*Note the title for some products that do not support identification.

©Macnica,Inc.

44

Summary: Pros and cons of each device search engine

1

2

3

4

・Search and check results according to the characteristics of device search engines

Shodan and ZoomEye

CensysEasier extraction of victim corporate servers because
strings in SSL/TLS certificates can be searched at once.

It is not possible to search for strings in SSL/TLS certificates all at once.
Need to search by Issuer or Subject of the certificate.

ssl:targetname
Can perform targeted searches for organization names
in Whois for IP addresses

org:targetname
Due to the weak ability of search engines to identify
products, it is necessary to remember and refer to
HTTP titles, favicons, and server banners in search
results.

services.tls.certificates.leaf_data.subject_dn="*targetname*"
services.tls.certificates.leaf_data.issuer_dn ="*targetname*"
services.tls.certificates.leaf_data.issuer.common_name ="*targetname*"
services.tls.certificates.leaf_data.issuer.organization ="*targetname*"
services.tls.certificates.leaf_data.subject.common_name ="*targetname*"
services.tls.certificates.leaf_data.subject.organization ="*targetname*"
Cannot perform a targeted search for the organization name in the Whois of an IP address.
*Supplementation of the organization name in Whois also seems to be weak
Because Censys performs product identification to some extent automatically
It is easy to extract the suspected infiltration sites. Some of them do not support
identification, but that is done from the title and favicon hash.

©Macnica,Inc.

45

1

Product Identification Methods
Product

Shodan2

ZoomEye

Censysremarks

3

4

Exchange Server

Identified by HTTP title andfavicon below

The following queries can be used to
identify the software, but due to weakcapture, it is recommended to identify
the software from the TITLE as in Shodan+app: "Outlook WebApp"

Software identification is possible*But 2010 series are unidentifiable andmust be determined from the title.

The organization's domain is often tied to thecertificate and is highly specific.
Shodan records detailed versions so that patchlevels and vulnerability presence can be
determined (some information is missing from
Censys and ZoomEye).

CitrixIdentified by HTTP title andfavicon below (only some arelisted due to the large number oftypes, note the words Citrix andNetscaler)software identifiable+app: "citrix"

Vendor and software identification ispossible. Note "Citrix" in the Vendor
column and Netscaler and Gateway in the
Software column.

The organization's domain is often tied to thecertificate and is highly specific.

https://blog.fox-it.com/2022/12/28/cve-2022-27510-cve2022-27518-measuring-citrix-adc-gateway-version-adoptionon-the-internet/

Also, as with Shodan, the HTTP title
identifies

Pulse Secure

product: "Pulse Secure" can be used to identify the
product, and the HTTP title can also be used to
identify the product.

Software identification is possible.
+app: "PulseSecure Pulse Connect
Secure"Also, as with Shodan, the HTTP title
identifies©Macnica,Inc.

There is also information that detailed
version and vulnerability can be determinedfrom the HTML content.

Software identification is possible, but
the accuracy is low, so as with Shodan,
identification by HTTP title isrecommended.

The organization's domain is often tied to thecertificate and is highly specific.
Version identification is possible from the HTTP
response (Shodan normalizes and displays theversion).

https://gist.githubusercontent.com/lzcensys/856ab8f2b68c2504d036ce34fdf3965d/raw/92f84c7e4753ed4de43bcaf9112d100501dbdbdc/pulse_ vuln_matrix.csv

46

1

Product Identification Methods
Product
Fortinet

ShodanFavicon (displayed on all screens for users andadministrators of Series 6 and below)*Series 7 favicons are not captured by Shodan
and do not appear in search results.

Judging from the responses characteristic of thelogin screen for users and administrators ofSeries 6 and the screen for users of Series 7

ZoomEye

CensysSoftware identification is possible

Vendor and software identification possible(Both Series 6 and below and Series 7 can be
identified)+app: "FortiGate"+app: "Fortinet"

2

3

4

remarks
It is necessary to refer to the organization name in the IP address because thecertificate issued by the product is configured and the organization is often not
identifiable by SSL lookup.
Login screen hash for right users
http.html_hash:-1454941180

The major version can be identified from the favicon design on the login screen
for users and administrators. Series 6 on the left, Series 7 on the right.

Like Shodan, it can be identified by either the favicon hashor the title, but since not many cases are captured, the title
is a better way to determine the identity.

Login screen hash for administrators (Series 6 and below only)
http.html_hash:-1968569468
Login screen hash for administrators (Series 7 and below only)
http.headers_hash:-841816352

Determined from FortiGate/Fortinet in thecertificate

The control panel can identify approximate versions by color and shape. Fromleft to right: Series 5, Series 6, Series 7 (pastel in color)*Screen colors for Series 6 and above are customizable, so other colors areavailable.

F5 BIG-IP

Identified by HTTP title and favicon

Notice the favicon and title similar to Shodan's.

Vendor and software identification is possible, but
it does not bring up a product login screen.

It is necessary to refer to the organization name in the IP address
because the certificate issued by the product is configured and theorganization is often not identifiable by SSL lookup.
It may be possible to infer a rough version from the notation in thefooter of the login screen.

+app: "F5 BIG-IP load balancer" can be used to identify the
product, but the login screen of the same device is not
displayed.
It doesn't come out.

The following query identifies the login screen©Macnica,Inc.

47

1

Product Identification Methods
Product
VMware Horizon

ShodanIdentified by HTTP title andfaviconZoomEye

Censys+app: "VMware Horizon" to identify the
product, also identifiable by HTTP title
and favicon.

Vendor and software identification
possible2

3

4

remarks
The organization's domain is often tied tothe certificate and is highly specific.
Log4j vulnerability inherent in the productis often exploited, but it is not possible toidentify the version or determine thevulnerability in OSINT from the outside.

Atlassian Confluence

Can be identified by
HTTP.COMPONENT:Confluence (note the markin the red box)

+Software can be identified by HTTP title
and favicon.

Vendor and software identification
possible

The name of the company is often included in thecertificate, making the organization highly
identifiable.
The version is displayed in the footer of the login
screen so that vulnerability can be determined

HTTP titles and favicons can also be
identified, but note that titles andfavicons are often customized.

©Macnica,Inc.

48

1

Product Identification Methods
Product
SonicWall

ShodanProduct: Can be identified by "SonicWALL".

ZoomEye

Censys+app: "SonicWALL" to identify it

Vendor and software identification possible

Can be identified in search results by HTTP title
and favicon

2

3

4

remarks
It is necessary to refer to the organization name in the IP address
because the certificate issued by the product is configured and theorganization is often not identifiable by SSL lookup.
Refer to the HTML source of the login screen of the following
design for SecureMobileAccess and Secure Remote Access series tocheck the detailed version and identify the vulnerability.
*Need to switch to ClassicMode (rightmost) as it is not displayed inContemporary Mode (second from left) even in SMA.
*Not identifiable on similarly designed Network Security Applianceand its SSLVPN login screen

The Nsa series of UTM/FW has a major version
notation in the following location of the server
response in the search results*SSL-VPN identifies the SMA series of VPNs.

The SMA series of SSL VPNs have the following
response©Macnica,Inc.

The Nsa series of UTM/FWs listed as Network Security Appliancecan be identified by the design of the login screen as major versions,from left to right: Series 5, 6, and 7 (Series 5 and 6 also have DELL
logos). However, the detailed version cannot be identified.

49

1

Product Identification Methods
Product
Zoho ManageEngine
ServiceDesk Plus

ShodanIdentified by HTTP title and favicon

ZoomEyeJudging from HTML title as the
product is not identifiable (nofavicon is collected)

2

3

4

Censysremarks

Judging from the HTML title as the
product is not identifiable.

If HTTPS is set up, the name of thecompany is often listed in the certificate,making it highly possible to identify theorganization.
Version information is displayed in thefooter of the login page, so it is possible toknow the approximate version.

Zoho ManageEngine
Desktop Central

Identified by HTTP title and favicon

Judging from HTML title as the
product is not identifiable (nofavicon is collected)©Macnica,Inc.

Since the product is not identifiable,
we can only judge from the HTML
title, but only one hit was found, and
it is possible that the title of thesame product was not captured by
Censys.

If HTTPS is set up, the name of thecompany may be listed in the certificate,
and the organization may be identified.
The version information is not displayed on
the login screen, but the Security patch
application notification is displayed, so theversion information may be identifiablefrom this.

50Check for version upgrades and server outages
•

1

2

3

4

Continuously confirming the status of the server suspected of intrusion provides useful information for guessing the
intrusion route.
• Inference of version upgrades (patching) from server responses• Check for communication by accessing the Web. Inaccessible ≒ Possibility of removal•

Device search engines also provide a function to refer to past results, so make use of this function as appropriate.

See Shodan:History tab

See Censys:History tab©Macnica,Inc.

ZoomEye: Scroll through search results to view past
minutes51

In Closing

We believe that identifying and defending the external public servers that attackers target will remain
an important measure in the coming years.
Especially in the Asian region, including Japan, the speed of response is not fast enough, so it is necessary to strengthensome countermeasures.
We hope that we can move the current situation in a better direction with all of you here today.

The third part of the survey method needs additional validation.
If you have any questions, we would be happy to hear from you at the account on the right.

©Macnica,Inc.

52