{"published":"2025-09-04 00:00:00","version":"1.0","blog_url":"https://malware-log.hatenablog.com/","width":"100%","author_name":"tanigawa","title":"Russian APT28 Deploys \"NotDoor\" Outlook Backdoor Against Companies in NATO Countries","author_url":"https://blog.hatena.ne.jp/tanigawa/","provider_url":"https://hatena.blog","categories":["\u653b\u6483\u7d44\u7e54: APT28 / Sofacy / Fancy Bear / Tsar Team / Strontium / Forest Blizzard (\u30ed\u30b7\u30a2)","NATO","Malware: NotDoor","\u653b\u6483\u65b9\u6cd5: DLL\u30b5\u30a4\u30c9\u30ed\u30fc\u30c7\u30a3\u30f3\u30b0","\u653b\u6483\u7d44\u7e54: Gamaredon / Armageddon / Shuckworm / Actinium / Trident Ursa / UAC-0010"],"image_url":null,"type":"rich","blog_title":"TT Malware Log","provider_name":"Hatena Blog","description":"\u3010\u8a33\u3011\u30ed\u30b7\u30a2\u306eAPT28\u304cNATO\u52a0\u76df\u56fd\u306e\u4f01\u696d\u3092\u6a19\u7684\u306b\u300cNotDoor\u300dOutlook\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u5c55\u958b \u3010\u8981\u7d04\u3011 \u30ed\u30b7\u30a2\u653f\u5e9c\u7cfbAPT28\u304c\u3001NATO\u52a0\u76df\u56fd\u4f01\u696d\u3092\u72d9\u3044Outlook\u30d0\u30c3\u30af\u30c9\u30a2\u300cNotDoor\u300d\u3092\u5c55\u958b\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002NotDoor\u306fOutlook\u7528VBA\u30de\u30af\u30ed\u3067\u3001\u7279\u5b9a\u30ef\u30fc\u30c9\u3092\u542b\u3080\u30e1\u30fc\u30eb\u3092\u53d7\u4fe1\u3059\u308b\u3068\u8d77\u52d5\u3057\u3001\u30c7\u30fc\u30bf\u7a83\u53d6\u3001\u30d5\u30a1\u30a4\u30eb\u9001\u53d7\u4fe1\u3001\u4efb\u610f\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002OneDrive.exe\u306eDLL\u30b5\u30a4\u30c9\u30ed\u30fc\u30c7\u30a3\u30f3\u30b0\u3067\u5c0e\u5165\u3055\u308c\u3001PowerShell\u3084Webhook\u7d4c\u7531\u3067C2\u901a\u4fe1\u3001Proton Mail\u3078\u6d41\u51fa\u3092\u884c\u3044\u307e\u3059\u3002\u3055\u3089\u306bMicrosoft Dev Tunnels\u3084\u507dCloudf\u2026","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fmalware-log.hatenablog.com%2Fentry%2F2025%2F09%2F04%2F000000_2\" title=\"Russian APT28 Deploys &quot;NotDoor&quot; Outlook Backdoor Against Companies in NATO Countries - TT Malware Log\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","height":"190","url":"https://malware-log.hatenablog.com/entry/2025/09/04/000000_2"}