2026年5月1日の
セキュリティ情報

Subject: [Security Advisory] Linux Kernel Privilege Escalation Vulnerability (CVE-2026-31431)

Dear IT Security Team,

We are sharing information regarding a critical local privilege escalation vulnerability in the Linux kernel known as 'CopyFail'.

■ Overview
CVE-2026-31431 is a logical flaw involving AF_ALG and splice() that allows an attacker with local access to manipulate the page cache in memory. This can be leveraged to overwrite setuid binaries and escalate privileges to root. Since the original disk files remain unchanged, standard file integrity monitoring may not detect this attack.

■ Scope
- Major Linux distributions built since 2017 (including Ubuntu, Amazon Linux, RHEL, and SUSE).
- High risk of container escape in Docker, LXC, and Kubernetes environments.

■ Remediation Steps
1. Identify all Linux servers and container hosts running vulnerable kernel versions.
2. Update the kernel to the latest version incorporating the fix from the mainline commit a664bf3d603d (dated April 1, 2026).
3. Reboot the affected systems to ensure the patched kernel is active.

■ Reference
- CVE-2026-31431
- Theori / CERT-EU Advisories

Priority: High
Deadline: Immediate action recommended

Subject: [Security Alert] Caution Regarding Suspicious Email Attachments

Dear Employees,

Our security team has identified a new type of malicious software that steals passwords and cloud service credentials by tricking users into running harmful files.

Please follow these guidelines:
1. Do not open attachments (especially .bat or .exe files) from unknown or untrusted senders.
2. If you have accidentally opened a suspicious file or notice unusual behavior on your computer, please report it to the IT department immediately.

Deadline: Immediate

件名: 【共有】新型Pythonバックドア「DEEP#DOOR」への対応について

お疲れさまです。新型のPythonベースRAT「DEEP#DOOR」に関する情報共有です。

■ 概要
Pythonで実装された高度なバックドアで、bore.pubという公開トンネルサービスをC2として利用します。AMSI/ETWパッチ、NTDLLアンフッキング、Windows Defenderの無効化など、強力な検知回避機能を備えています。また、クラウド認証情報（AWS/GCP/Azure）の窃取機能を有しています。

■ 影響範囲
- Windows OS環境
- Python実行環境が整っている端末

■ 対応手順
1. ネットワーク境界において、C2通信先として利用される「bore.pub」への通信ログを確認し、不審な通信がないか調査してください。
2. EDR等の検知ルールに、不審なバッチファイル（install_obf.bat等）によるPythonスクリプトの動的展開パターンを追加してください。
3. 特権アカウントの多要素認証（MFA）を徹底し、認証情報が窃取された際のリスクを低減してください。

■ 参考情報
- Securonix Report / The Hacker News

対応優先度: 高
対応期限: 速やかに確認

Subject: [Technical Alert] New Python Backdoor "DEEP#DOOR"

Dear Security Team,

We are sharing intelligence regarding a new Python-based RAT known as DEEP#DOOR.

■ Overview
DEEP#DOOR is a sophisticated backdoor that leverages the public tunneling service 'bore.pub' for C2 communication. It implements advanced evasion techniques, including AMSI/ETW patching, NTDLL unhooking, and disabling Windows Defender. It specifically targets browser and cloud provider (AWS, GCP, Azure) credentials.

■ Scope
- Windows OS environments
- Systems with Python runtime capabilities

■ Mitigation Steps
1. Review network logs for any outbound traffic to 'bore.pub' and investigate anomalies.
2. Update EDR/SIEM detection rules to identify patterns of Python payloads being dynamically extracted and executed via batch scripts.
3. Enforce strict Multi-Factor Authentication (MFA) for all cloud service accounts to mitigate the impact of credential theft.

■ Reference
- Securonix Report / The Hacker News

Priority: High
Deadline: Immediate