https://mal-eats.net/en/Recent content on Mal-EatsHugoenTue, 11 May 2021 16:21:06 +0900https://mal-eats.net/en/profile/Tue, 11 May 2021 08:32:10 +0900https://mal-eats.net/en/profile/<p>「Eat Malware/Maliciousness」</p> <p>“Mal Eats” (<a href="https://twitter.com/mal_eats">@mal_eats</a>) is a Cyber Security Research Team in Japan. We’ll make articles such as malware analysis and threat intelligence from the perspective of the Blue Team.</p> <p>This our research in this blog is based on our personal activities and not the opinion of the company we belong to.</p> <h2 id="member">Member</h2> <ul> <li>Ryo Tamura</li> <li>Shotaro Hamamoto</li> <li>Shuhei Sasada</li> <li>Takuma Matsumoto</li> <li>Yusuke Niwa</li> </ul> <p>*alphabetical order</p> <h2 id="contact">Contact</h2> <p>Please send a DM to <a href="https://twitter.com/mal_eats">@mal_eats</a>.</p>https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/Tue, 11 May 2021 08:23:26 +0900https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/<p>Since around March 2021, campaigns in Japan using an infrastructure called campo/openfield have been observed. This campaign has the potential to deliver subsequent malware depending on the infected organization, and some cases eventually could result in ransomware incidents overseas.</p> <p>We keep tracking this attack campaign, and it started to be observed at least around October 2020 as far as we are aware. We anticipate that attackers will continue to be active in the future, and we are concerned that this could lead to serious impacts including ransomware encryption in the worst case. Therefore, in order to prepare for such threats, we will share in this blog the characteristics of campaigns for Japan and how to check for malware execution traces based on our research.</p>