2026年4月30日の
セキュリティ情報

Subject: [Threat Intel] Activity of China-linked APT Group "Shadow-Earth-053"

Dear Team,

We are sharing intelligence regarding a newly identified threat actor, Shadow-Earth-053.

■ Overview
TrendAI researchers have uncovered a novel China-linked group targeting critical networks in Poland and Asia. The attackers leverage vulnerabilities in Microsoft Exchange Servers for initial access and deploy the ShadowPad backdoor. A key characteristic of this campaign is the use of C2 communication on a 'sleep cycle' to maintain persistence while evading detection.

■ Scope
- Organizations utilizing Microsoft Exchange Servers
- Government, Defense, Technology, and Transportation sectors

■ Mitigation Steps
1. Ensure all Microsoft Exchange Servers are fully patched against known vulnerabilities.
2. Monitor network traffic for irregular, long-interval beaconing patterns indicative of sleep-cycle C2.
3. Conduct endpoint hunting for indicators associated with the ShadowPad backdoor.

■ Reference
- TrendAI Research Report

Priority: High
Deadline: Immediate review

Subject: [Info] Data Breach at Vimeo via Third-Party Vendor

Dear Team,

This is a technical update regarding the data breach at Vimeo.

■ Overview
Due to a security incident at Anodot (a third-party analytics vendor), unauthorized access was gained to Vimeo's Snowflake and BigQuery environments. The threat actor, ShinyHunters, claims to have exfiltrated technical data, metadata, and some customer email addresses. This is a supply chain compromise leveraging third-party credentials.

■ Scope
- A subset of Vimeo customers and users.
- Cloud data warehouses integrated with third-party services.

■ Recommended Actions
1. Review IAM roles and permissions granted to third-party vendors in your cloud environments (e.g., Snowflake, BigQuery) to ensure the Principle of Least Privilege (PoLP).
2. Audit and revoke any unnecessary third-party integrations, outdated API keys, or authentication tokens.
3. Monitor access logs for any anomalous activity associated with third-party service accounts.

■ Reference
- Source: dailysecu

Priority: Medium
Deadline: As soon as possible

Subject: [Alert] Supply Chain Attack targeting SAP, npm, and PyPI packages

Dear Team,

This is a technical alert regarding a supply chain attack campaign known as "Mini Shai-Hulud."

■ Overview
Attackers have poisoned several npm and PyPI packages with credential-stealing malware. The campaign specifically targets developer tools and cloud application ecosystems.

■ Affected Scope
- npm: [email protected], 7.0.5
- PyPI: [email protected], 2.6.3
- SAP-related npm: [email protected], @cap-js/[email protected], @cap-js/[email protected], @cap-js/[email protected]

■ Mitigation Steps
1. Audit all project dependencies to identify if any of the compromised versions are in use.
2. Immediately update affected packages to a known secure version.
3. Rotate all credentials, API keys, and secrets that may have been exposed in environments where these packages were installed.

■ Reference
- The Register / Wiz / Socket reports

Priority: High
Deadline: Immediate