2026年4月26日の
セキュリティ情報

Subject: [Intel] Latest Malware Trends and D-Link Vulnerability (CVE-2025-29635)

Hi team,

I am sharing the latest threat intelligence summary from the Security Affairs Malware Newsletter.

■ Overview
Several high-profile threats have been identified, including a Mirai campaign targeting D-Link devices (CVE-2025-29635), the Lotus Wiper targeting energy/utility sectors, and supply chain attacks leveraging malicious npm packages.

■ Scope
- D-Link network devices
- Energy and Utility sectors
- Development environments using npm packages
- iOS devices (in targeted scenarios)

■ Action Items
1. Review D-Link device firmware and apply the latest security patches for CVE-2025-29635.
2. Audit npm dependencies in development pipelines to ensure no malicious packages are present.
3. Enhance monitoring for anomalous outbound traffic associated with known APT C2 patterns.

■ Reference
- Security Affairs Malware Newsletter Round 94

Priority: High
Deadline: Early May 2026

Subject: [Security Alert] Beware of Fake IT Support Messages on MS Teams

Dear employees,
We have detected a security threat where attackers impersonate IT support staff via Microsoft Teams to trick users into installing malicious software.

What we need from you:
1. Do NOT click any links or download any files sent via Teams by unknown users or external accounts, especially those claiming to be 'security patches.'
2. If you receive any suspicious messages, please report them to the IT Security team immediately.

Deadline: Immediate

件名: 【共有】UNC6692によるMS Teams悪用攻撃（Snowマルウェア）への対応について

お疲れさまです。UNC6692による標的型攻撃に関する情報共有です。

■ 概要
攻撃者は大量のメール送信で混乱を誘発した後、MS TeamsでITヘルプデスクを装い、AutoHotkeyスクリプトおよび「SnowBelt」という悪性ブラウザ拡張機能を含むマルウェアスイート「Snow」を配布します。最終的な目的は認証情報の窃取およびドメイン権限の奪取です。

■ 影響範囲
- Microsoft Teamsを利用し、外部ユーザーとのコラボレーションを許可している組織

■ 対応手順
1. Teamsの外部アクセス設定（External Access）を見直し、必要最小限の制限をかける。
2. EDR/SIEMにて、AutoHotkeyの不審な実行や、AWS S3からの不審なバイナリダウンロードを監視する。
3. ユーザーに対し、ITサポートがTeamsで個別にパッチ配布を行うことはない旨を再徹底する。

■ 参考情報
- Mandiant Research

対応優先度: 高
対応期限: 速やかに

Subject: [Threat Intel] UNC6692 Campaign utilizing MS Teams and 'Snow' Malware

Dear Security Team,

This is a technical alert regarding the activities of threat actor UNC6692.

■ Overview
The actor employs a social engineering tactic involving an initial email flood followed by impersonation of IT support via MS Teams. They distribute a custom malware suite named 'Snow,' which includes a malicious Chromium-based extension (SnowBelt), tunneling tools, and backdoors to achieve domain dominance.

■ Scope
- Organizations utilizing Microsoft Teams with enabled external collaboration features.

■ Mitigation Steps
1. Review and restrict MS Teams External Access settings to minimize the attack surface.
2. Monitor EDR/SIEM for unauthorized AutoHotkey execution and suspicious downloads from AWS S3 buckets.
3. Conduct security awareness training focusing on 'Helpdesk Impersonation' via collaboration tools.

■ Reference
- Mandiant Research

Priority: High
Deadline: Immediate

Subject: [Intel] Trigona Ransomware Adopting Custom Data Exfiltration Tool

Dear Security Team,

We are sharing intelligence regarding a tactical shift in Trigona ransomware operations.

■ Overview
Symantec researchers have reported that Trigona ransomware has transitioned from using common utilities like Rclone and MegaSync to a custom-built data exfiltration tool. This change is designed to bypass security solutions that typically flag well-known public tools, thereby increasing the stealth and efficiency of their data theft operations.

■ Scope
- All organizations targeted by Trigona ransomware affiliates.

■ Recommended Actions
1. Update EDR/SIEM detection rules to monitor for suspicious command-line activity and unknown processes initiating large data transfers.
2. Enhance network traffic monitoring to detect anomalies in outbound data volume (Exfiltration).
3. Implement strict monitoring of privileged accounts to identify the execution of unauthorized proprietary tools.

■ Reference
- Symantec Research Report

Priority: High
Deadline: Immediate review