{"id":18163,"date":"2022-06-30T09:50:19","date_gmt":"2022-06-30T08:50:19","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=18163"},"modified":"2022-06-30T09:50:52","modified_gmt":"2022-06-30T08:50:52","slug":"cdt-watch-june-2022","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/","title":{"rendered":"CDT Watch \u2013 June 2022"},"content":{"rendered":"\n<h1 style=\"text-align: center;\"><strong>FOCUS TECH<\/strong><\/h1>\n<h2 style=\"text-align: center;\">Bumblebee<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-18167 aligncenter\" src=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/slide-3-262x191.png\" alt=\"\" width=\"797\" height=\"581\" srcset=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/slide-3-262x191.png 262w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/slide-3-53x39.png 53w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/slide-3-768x561.png 768w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/slide-3.png 1364w\" sizes=\"auto, (max-width: 797px) 100vw, 797px\" \/><\/p>\n<p>\u00a0<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-18171\" src=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/SLIDE-2-272x191.jpg\" alt=\"\" width=\"891\" height=\"626\" srcset=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/SLIDE-2-272x191.jpg 272w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/SLIDE-2-56x39.jpg 56w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/SLIDE-2-768x539.jpg 768w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/SLIDE-2.jpg 1369w\" sizes=\"auto, (max-width: 891px) 100vw, 891px\" \/><\/p>\n<p>\u00a0<\/p>\n<table width=\"622\">\n<tbody>\n<tr>\n<td width=\"156\">\n<h5><strong><u>Initial Access<\/u><\/strong><\/h5>\n<h5><strong><u>(TA0001)<\/u><\/strong><\/h5>\n<\/td>\n<td width=\"156\">\n<h5><strong><u>Execution<\/u><\/strong><\/h5>\n<h5><strong><u>(TA0002)<\/u><\/strong><\/h5>\n<\/td>\n<td width=\"156\">\n<h5><strong><u>Persistence<\/u><\/strong><\/h5>\n<h5><strong><u>(TA0003)<\/u><\/strong><\/h5>\n<\/td>\n<td width=\"156\">\n<h5><strong><u>Privilege Escalation<\/u><\/strong><\/h5>\n<h5><strong><u>(TA0004)<\/u><\/strong><\/h5>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"156\">\n<p><strong>Phishing<\/strong>:<\/p>\n<p>Spearphishing Attachment<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1566\/001\/\">T1566.001<\/a><\/p>\n<\/td>\n<td width=\"156\">\n<p><strong>Command and Scripting Interpreter:<\/strong>\u00a0Visual Basic<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1059\/005\/\">T1059.005<\/a><\/p>\n<\/td>\n<td width=\"156\">\n<p>Scheduled Task\/Job<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1053\/\">T1053<\/a><\/p>\n<\/td>\n<td width=\"156\">\n<p><strong>Process Injection:<\/strong>\u00a0Dynamic-link Library Injection<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1055\/001\/\">T1055.001<\/a><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"156\">\n<p><strong>Phishing:<\/strong> Spearphishing Link<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1566\/002\/\">T1566.002<\/a><\/p>\n<\/td>\n<td width=\"156\">\n<p>Windows Management Instrumentation<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1047\/\">T1047<\/a><\/p>\n<\/td>\n<td width=\"156\">\n<p>\u00a0<\/p>\n<\/td>\n<td width=\"156\">\n<p><strong>Process Injection: <\/strong>Asynchronous Procedure Call<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1055\/004\/\">T1055.004<\/a><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h1>\u00a0<\/h1>\n<table style=\"width: 100%; height: 907px;\">\n<tbody>\n<tr style=\"height: 108px;\">\n<td style=\"height: 108px;\" width=\"155\">\n<h5><strong><u>Defense Evasion<\/u><\/strong><\/h5>\n<h5><strong>(TA0005)<\/strong><\/h5>\n<\/td>\n<td style=\"height: 108px;\" width=\"155\">\n<h5><strong><u>Discovery<\/u><\/strong><\/h5>\n<h5><strong>(TA0007)<\/strong><\/h5>\n<\/td>\n<td style=\"height: 108px;\" width=\"155\">\n<h5><strong><u>Command and Control<\/u><\/strong><\/h5>\n<h5><strong>(TA0011)<\/strong><\/h5>\n<\/td>\n<\/tr>\n<tr style=\"height: 138px;\">\n<td style=\"height: 138px;\" width=\"155\">\n<p><strong>Process Injection:<\/strong> Dynamic-link Library Injection<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1055\/001\/\">T1055.001<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>System Information Discovery<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1082\/\">T1082<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p><strong>Encrypted Channel: <\/strong>Symmetric Cryptography<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1573\/001\/\">T1573.002<\/a><\/p>\n<\/td>\n<\/tr>\n<tr style=\"height: 138px;\">\n<td style=\"height: 138px;\" width=\"155\">\n<p><strong>Process Injection<\/strong>: Asynchronous Procedure Call<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1055\/004\/\">T1055.004<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>Process Discovery<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1057\/\">T1057<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>Ingress Tool Transfer<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1105\/\">T1105<\/a><\/p>\n<\/td>\n<\/tr>\n<tr style=\"height: 138px;\">\n<td style=\"height: 138px;\" width=\"155\">\n<p><strong>Hide Artifacts:<\/strong> Hidden Files and Directories<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1564\/001\/\">T1564.001<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<\/tr>\n<tr style=\"height: 138px;\">\n<td style=\"height: 138px;\" width=\"155\">\n<p><strong>Indicator Removal on Host<\/strong>:\u00a0File Deletion<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1070\/004\/\">T1070.004<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<\/tr>\n<tr style=\"height: 109px;\">\n<td style=\"height: 109px;\" width=\"155\">\n<p>Virtualization\/Sandbox Evasion<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1497\/\">T1497<\/a><\/p>\n<\/td>\n<td style=\"height: 109px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<td style=\"height: 109px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<\/tr>\n<tr style=\"height: 138px;\">\n<td style=\"height: 138px;\" width=\"155\">\n<p>Deobfuscate\/Decode Files or Information<\/p>\n<p><a href=\"https:\/\/attack.mitre.org\/techniques\/T1140\/\">T1140<\/a><\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<td style=\"height: 138px;\" width=\"155\">\n<p>\u00a0<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 style=\"text-align: center;\">SOURCES :<\/h3>\n<p><a href=\"https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/bumblebee-is-still-transforming\"><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-18176 aligncenter\" src=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/proofpoint-437x181.jpg\" alt=\"\" width=\"437\" height=\"181\" srcset=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/proofpoint-437x181.jpg 437w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/proofpoint-71x29.jpg 71w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/proofpoint.jpg 637w\" sizes=\"auto, (max-width: 437px) 100vw, 437px\" \/><\/a><\/p>\n<h6 style=\"text-align: center;\"><a href=\"https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/bumblebee-is-still-transforming\"><strong>Bumblebee is still transforming, Proofpoint<\/strong><\/a><\/h6>\n<p style=\"text-align: center;\">[1] <a href=\"https:\/\/www.malware-traffic-analysis.net\/2022\/index.html\">https:\/\/www.malware-traffic-analysis.net\/2022\/index.html<\/a><\/p>\n<p style=\"text-align: center;\">[2]<a href=\"https:\/\/isc.sans.edu\/forums\/diary\/How+the+Contact+Forms+campaign+tricks+people\/28142\/\">https:\/\/isc.sans.edu\/forums\/diary\/How+the+Contact+Forms+campaign+tricks+people\/28142\/<\/a><\/p>\n<h1>\u00a0<\/h1>\n<h1 style=\"text-align: center;\"><strong>CERT-W: FROM THE FRONT LINE<\/strong><\/h1>\n<h2 style=\"text-align: center;\">The First Responder Word<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-18173\" src=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/first-reponder-383x191.png\" alt=\"\" width=\"906\" height=\"452\" srcset=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/first-reponder-383x191.png 383w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/first-reponder-71x35.png 71w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/first-reponder-768x383.png 768w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/first-reponder-800x400.png 800w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/first-reponder.png 1485w\" sizes=\"auto, (max-width: 906px) 100vw, 906px\" \/><\/p>\n<p>\u00a0<\/p>\n<h1 style=\"text-align: center;\"><strong>Reading Of The Month<\/strong><\/h1>\n<p style=\"text-align: center;\">We recommend the article of Robert Lemos, a darkreading contributing writer about firms which suffers identity-related breaches.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18178 aligncenter\" src=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/firms.jpg\" alt=\"\" width=\"411\" height=\"173\" srcset=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/firms.jpg 411w, https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2022\/06\/firms-71x30.jpg 71w\" sizes=\"auto, (max-width: 411px) 100vw, 411px\" \/><\/p>\n<h6 style=\"text-align: center;\"><a href=\"https:\/\/www.darkreading.com\/operations\/identity-related-breaches-last-12-months\"><strong>80% of firms suffered identity-related breaches in last 12 months, Robert Lemos<\/strong><\/a><\/h6>\n<p>\u00a0<\/p>\n<p style=\"text-align: center;\">SEE YOU NEXT MONTH!!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>FOCUS TECH Bumblebee \u00a0 \u00a0 Initial Access (TA0001) Execution (TA0002) Persistence (TA0003) Privilege Escalation (TA0004) Phishing: Spearphishing Attachment T1566.001 Command and Scripting Interpreter:\u00a0Visual Basic T1059.005 Scheduled Task\/Job T1053 Process Injection:\u00a0Dynamic-link Library Injection T1055.001 Phishing: Spearphishing Link T1566.002 Windows Management Instrumentation&#8230;<\/p>\n","protected":false},"author":1364,"featured_media":16208,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2777,36,3972],"tags":[3480,3438,4086],"coauthors":[3488],"class_list":{"0":"post-18163","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","6":"hentry","7":"category-cybersecurity-digital-trust","9":"category-newsletter-cert","10":"tag-cert-en","11":"tag-malware-en","12":"tag-tech"},"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CDT Watch \u2013 June 2022 - RiskInsight<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CDT Watch \u2013 June 2022 - RiskInsight\" \/>\n<meta property=\"og:description\" content=\"FOCUS TECH Bumblebee \u00a0 \u00a0 Initial Access (TA0001) Execution (TA0002) Persistence (TA0003) Privilege Escalation (TA0004) Phishing: Spearphishing Attachment T1566.001 Command and Scripting Interpreter:\u00a0Visual Basic T1059.005 Scheduled Task\/Job T1053 Process Injection:\u00a0Dynamic-link Library Injection T1055.001 Phishing: Spearphishing Link T1566.002 Windows Management Instrumentation...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\" \/>\n<meta property=\"og:site_name\" content=\"RiskInsight\" \/>\n<meta property=\"article:published_time\" content=\"2022-06-30T08:50:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-30T08:50:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1621\" \/>\n\t<meta property=\"og:image:height\" content=\"455\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"CERT-W\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CERT-W\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\"},\"author\":{\"name\":\"CERT-W\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b3138a95b8559cf24bf256c8e9994eca\"},\"headline\":\"CDT Watch \u2013 June 2022\",\"datePublished\":\"2022-06-30T08:50:19+00:00\",\"dateModified\":\"2022-06-30T08:50:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\"},\"wordCount\":181,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png\",\"keywords\":[\"CERT\",\"malware\",\"tech\"],\"articleSection\":[\"Cybersecurity &amp; Digital Trust\",\"Cybersecurity &amp; Digital Trust\",\"Newsletter CERT\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\",\"name\":\"CDT Watch \u2013 June 2022 - RiskInsight\",\"isPartOf\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png\",\"datePublished\":\"2022-06-30T08:50:19+00:00\",\"dateModified\":\"2022-06-30T08:50:52+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png\",\"contentUrl\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png\",\"width\":1621,\"height\":455},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.riskinsight-wavestone.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CDT Watch \u2013 June 2022\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#website\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/\",\"name\":\"RiskInsight\",\"description\":\"The cybersecurity &amp; digital trust blog by Wavestone&#039;s consultants\",\"publisher\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.riskinsight-wavestone.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#organization\",\"name\":\"Wavestone\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png\",\"contentUrl\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png\",\"width\":50,\"height\":50,\"caption\":\"Wavestone\"},\"image\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b3138a95b8559cf24bf256c8e9994eca\",\"name\":\"CERT-W\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/author\/cert-w\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CDT Watch \u2013 June 2022 - RiskInsight","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/","og_locale":"en_US","og_type":"article","og_title":"CDT Watch \u2013 June 2022 - RiskInsight","og_description":"FOCUS TECH Bumblebee \u00a0 \u00a0 Initial Access (TA0001) Execution (TA0002) Persistence (TA0003) Privilege Escalation (TA0004) Phishing: Spearphishing Attachment T1566.001 Command and Scripting Interpreter:\u00a0Visual Basic T1059.005 Scheduled Task\/Job T1053 Process Injection:\u00a0Dynamic-link Library Injection T1055.001 Phishing: Spearphishing Link T1566.002 Windows Management Instrumentation...","og_url":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/","og_site_name":"RiskInsight","article_published_time":"2022-06-30T08:50:19+00:00","article_modified_time":"2022-06-30T08:50:52+00:00","og_image":[{"width":1621,"height":455,"url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png","type":"image\/png"}],"author":"CERT-W","twitter_misc":{"Written by":"CERT-W","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#article","isPartOf":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/"},"author":{"name":"CERT-W","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b3138a95b8559cf24bf256c8e9994eca"},"headline":"CDT Watch \u2013 June 2022","datePublished":"2022-06-30T08:50:19+00:00","dateModified":"2022-06-30T08:50:52+00:00","mainEntityOfPage":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/"},"wordCount":181,"commentCount":0,"publisher":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage"},"thumbnailUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png","keywords":["CERT","malware","tech"],"articleSection":["Cybersecurity &amp; Digital Trust","Cybersecurity &amp; Digital Trust","Newsletter CERT"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/","url":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/","name":"CDT Watch \u2013 June 2022 - RiskInsight","isPartOf":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage"},"thumbnailUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png","datePublished":"2022-06-30T08:50:19+00:00","dateModified":"2022-06-30T08:50:52+00:00","breadcrumb":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#primaryimage","url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png","contentUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/06\/CDT-WATCH.png","width":1621,"height":455},{"@type":"BreadcrumbList","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2022\/06\/cdt-watch-june-2022\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.riskinsight-wavestone.com\/en\/"},{"@type":"ListItem","position":2,"name":"CDT Watch \u2013 June 2022"}]},{"@type":"WebSite","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#website","url":"https:\/\/www.riskinsight-wavestone.com\/en\/","name":"RiskInsight","description":"The cybersecurity &amp; digital trust blog by Wavestone&#039;s consultants","publisher":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.riskinsight-wavestone.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization","name":"Wavestone","url":"https:\/\/www.riskinsight-wavestone.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png","contentUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png","width":50,"height":50,"caption":"Wavestone"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b3138a95b8559cf24bf256c8e9994eca","name":"CERT-W","url":"https:\/\/www.riskinsight-wavestone.com\/en\/author\/cert-w\/"}]}},"_links":{"self":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/18163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/users\/1364"}],"replies":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/comments?post=18163"}],"version-history":[{"count":6,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/18163\/revisions"}],"predecessor-version":[{"id":18820,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/18163\/revisions\/18820"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/media\/16208"}],"wp:attachment":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/media?parent=18163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/categories?post=18163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/tags?post=18163"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/coauthors?post=18163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}