漏洞 Vulnerability ImageMagick-通过PDF密码进行Shell注入 https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html 安全研究 Security Research 关于Cobalt Strike检测方法与去特征的思考 https://mp.weixin.qq.com/s/r0LHsXrt-VbPhexATRVbTg PsExec 未修补的本地提权漏洞 https://mp.weixin.qq.com/s/onph_Op5UY9hhsI29rInow 基于AI的暗网流量检测识别效果专题研究 https://www.freebuf.com/articles/network/256840.html Windows内存破坏漏洞的现代探索，Part I：堆栈溢出（四） https://www.anquanke.com/post/id/225865 安全资讯 Security Information 新冠疫情医疗信息在暗网中被售卖 https://cybleinc.com/2020/12/18/how-hackers-targeted-the-covid-19-vaccine-supply-chain/ Cellebrite 宣称可以破解 Signal（一款加密聊天工具） https://www.haaretz.com/israel-news/tech-news/.premium-israeli-spy-tech-firm-says-it-can-break-into-signal-app-previously-considered-safe-1.9368581 多个浏览器厂商禁止哈萨克斯坦的MitM HTTPS证书 https://www.zdnet.com/article/apple-google-microsoft-and-mozilla-ban-kazakhstans-mitm-https-certificate/ 聊聊Gartner 2021战略技术趋势——行为互联网 https://www.freebuf.com/articles/neopoints/258202.html 安全工具 Security Tools serpentine：一款 Windows RAT 工具，可以使用多平台RESTful C2服务器 https://github.com/jafarlihi/serpentine 恶意软件 Malware cybereason：Molerats组织滥用云服务的攻击活动分析 https://mp.weixin.qq.com/s/iWYr18hSLBBL4Y1-hAmEeg 微软：关于SolarWinds供应链攻击的分析 https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ fortinet披露：APT组织使用JavaScript RAT针对亚洲银行金融行业的攻击活动 https://www.fortinet.com/blog/threat-research/adversary-playbook-javascript-rat-looking-for-that-government-cheese 隐藏在网站 CSS 中的窃密脚本 https://www.zdnet.com/article/hackers-hide-web-skimmer-inside-a-websites-css-files/