2026年5月3日の
セキュリティ情報

Subject: [Security Alert] Caution Regarding Suspicious Emails and Phishing

Dear employees,

We are seeing an increase in sophisticated cyberattacks targeting various organizations. Attackers often use deceptive emails to steal account credentials.

Please take the following actions:
1. Do not open attachments or click links in emails from unknown or suspicious senders.
2. If you encounter any unexpected prompts to enter your password, please report it to the IT security team immediately.

Deadline: Immediate action required.

件名: 【共有】中国系APT（SHADOW-EARTH-053）による攻撃への対応について

お疲れさまです。中国系ハッキンググループによるアジア圏を標的とした攻撃に関する情報共有です。

■ 概要
MS ExchangeおよびIISの既知の脆弱性（N-day）を悪用して侵入し、GodzillaウェブシェルやShadowPadバックドアを設置する活動が確認されています。また、CVE-2025-55182を悪用したNoodleletマルウェアの配布や、DLLサイドローディングによる検知回避が行われています。

■ 影響範囲
- Microsoft Exchange Server
- Internet Information Services (IIS)
- Linuxサーバー (CVE-2025-55182の影響を受ける環境)

■ 対応手順
1. 外部公開サーバー（Exchange/IIS）のパッチ適用状況を至急確認し、最新の状態に更新してください。
2. サーバー内における不審なウェブシェル（Godzilla等）や、署名済みバイナリによる不審なDLLロードの有無をログから調査してください。
3. AnyDesk等のリモート管理ツールの不正利用がないか監視を強化してください。

■ 参考情報
- Trend Micro Threat Intelligence

対応優先度: 高
対応期限: 2026年5月10日まで

Subject: [Technical Alert] Mitigation for Chinese APT (SHADOW-EARTH-053) Activity

Dear Security Team,

This is a technical briefing regarding the cyber espionage activities of the Chinese-linked group 'SHADOW-EARTH-053'.

■ Overview
The actor exploits N-day vulnerabilities in Microsoft Exchange and IIS to gain initial access, subsequently deploying Godzilla webshells and ShadowPad backdoors. They also utilize DLL side-loading and exploit CVE-2025-55182 to distribute Noodlelet malware on Linux systems.

■ Scope
- Microsoft Exchange Server
- Internet Information Services (IIS)
- Linux servers vulnerable to CVE-2025-55182

■ Mitigation Steps
1. Immediately verify and apply the latest security patches for all internet-facing Exchange and IIS servers.
2. Audit server logs for signs of Godzilla webshells or anomalous DLL loading via signed binaries.
3. Monitor for unauthorized use of remote administration tools such as AnyDesk.

■ Reference
- Trend Micro Threat Intelligence

Priority: High
Deadline: May 10, 2026

Subject: [Intel] Insider Threat and RaaS Case: ALPHV/BlackCat

Dear Team,

We are sharing information regarding the sentencing of individuals involved in ALPHV/BlackCat ransomware attacks.

■ Overview
Two cybersecurity professionals were sentenced to four years in prison for acting as affiliates in the ALPHV/BlackCat RaaS ecosystem. A critical aspect of this case is the betrayal of trust, where a negotiator for the victim organizations collaborated with the attackers to leak sensitive negotiation strategies and insurance limits.

■ Scope
- All organizations targeted by RaaS
- Organizations relying on third-party security consultants or ransomware negotiators

■ Recommended Actions
1. Enhance monitoring of privileged accounts and implement alerts for anomalous data exfiltration.
2. Enforce the Principle of Least Privilege (PoLP) for all external vendors and consultants.
3. Establish a multi-person approval process for incident response and ransom negotiations to prevent single-point-of-failure/insider threats.

■ Reference
- US Department of Justice (DOJ) announcements

Priority: Low
Deadline: Ongoing operational improvement