安全工具 Security Tools HyperViper:用于Hyper-V安全性研究的工具包资源 https://github.com/JaanusKaapPublic/HyperViper 针对K8s的后渗透rootkit工具 https://github.com/brant-ruan/k0otkit 安全报告 Security Report ”小黄鸭“挖矿组织分析报告 https://github.com/Loveforkeeps/Lemon-Duck Retrohunting APT37：朝鲜APT使用VBA自解码技术注入RokRat https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/ Earth Wendigo通过注入JavaScript后门以进行邮箱渗透分析报告 https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html 安全研究 Security Research 黑客可以使用新的攻击方式克隆Google Titan 2FA安全密钥 https://thehackernews.com/2021/01/new-attack-could-let-hackers-clone-your.html ThinkPHP v3.2.* （SQL注入&文件读取）反序列化POP链 https://mp.weixin.qq.com/s/S3Un1EM-cftFXr8hxG4qfA Zyxel后门漏洞分析 https://mp.weixin.qq.com/s/Ol3B3PFLLXLFF8ThA9nxEg Netgear-R8300-UPnP RCE漏洞分析复现 https://mp.weixin.qq.com/s/wfY6OcrvM4zsjFMQnP3vgA 安全事件 Security Incident 黑客使用假特朗普的丑闻视频传播QNode恶意软件 https://thehackernews.com/2021/01/hackers-using-fake-trumps-scandal-video.html