2026年5月7日の
セキュリティ情報

Subject: [Security Advisory] Cisco CNC/NSO DoS Vulnerability (CVE-2026-20188)

Dear IT Operations and Security Team,

We are sharing critical information regarding a vulnerability in Cisco products.

■ Overview
A Denial of Service (DoS) vulnerability (CVE-2026-20188) has been discovered in Cisco Crosswork Network Controller (CNC) and Network Services Orchestrator (NSO). An unauthenticated remote attacker can exhaust system resources, rendering the system unresponsive until a manual reboot is performed by an administrator.

■ Affected Scope
- Cisco Crosswork Network Controller (CNC) versions 7.1 and below
- Certain versions of Cisco Network Services Orchestrator (NSO) 6.4
*CNC 7.2 and NSO 6.5 are not affected.

■ Remediation Steps
1. Verify the current version of CNC/NSO in use.
2. For NSO 6.4 users, update to version 6.4.1.3.
3. For users of other affected versions, upgrade to the latest patched release.

■ Reference
- Please refer to the official Cisco Security Advisory.

Priority: High
Deadline: Immediate action recommended

Subject: [Security Alert] Beware of Impersonation Attacks via IT Support

Dear Employees,

We have detected sophisticated attacks where threat actors impersonate IT support staff via Microsoft Teams to steal credentials and access internal systems.

Requested Actions:
1. Do not share your screen or provide passwords/MFA codes to anyone contacting you unexpectedly, even if they claim to be from IT support.
2. If you are asked to install remote management software (e.g., AnyDesk), stop immediately and report it to the security team.
3. Never approve Multi-Factor Authentication (MFA) requests that you did not initiate.

Deadline: Immediate

件名: 【共有】MuddyWaterによるランサムウェア偽装攻撃への対応について

お疲れさまです。MuddyWaterによる最新の攻撃手法に関する情報共有です。

■ 概要
イラン系APTグループMuddyWaterが、Chaosランサムウェアを装い、Microsoft Teamsでのソーシャルエンジニアリングを通じて内部侵入を試みる事例が報告されています。目的は暗号化ではなく、データ窃取および永続性の確保です。

■ 影響範囲
- Microsoft Teamsを利用している全ユーザー
- AnyDesk等のリモート管理ツールを許可している環境

■ 対応手順
1. Teamsの外部チャット設定および権限の見直しを行い、不審な外部ユーザーからのアプローチを制限する。
2. AnyDesk等のリモート管理ツールの実行ログを監視し、未承認のインストールや通信がないか確認する。
3. 「Donald Gay」名義のコード署名証明書が付与された不審なファイルの実行を検知・ブロックする設定を検討する。

■ 参考情報
- Rapid7 Analysis Report

対応優先度: 高
対応期限: 速やかに確認・設定変更を推奨

Subject: [Threat Intel] MuddyWater Masquerading as Ransomware Group

Dear Security Team,

This is a technical update regarding the Iranian APT group MuddyWater's recent tactics.

■ Overview
MuddyWater is utilizing a ransomware facade (Chaos) to mask state-sponsored espionage. They employ social engineering via Microsoft Teams to trick users into installing remote access tools (AnyDesk) and bypassing MFA to achieve initial access and data exfiltration.

■ Scope
- Organizations utilizing Microsoft Teams for communication
- Environments allowing remote administration tools (RATs)

■ Mitigation Steps
1. Review and restrict external chat permissions in Microsoft Teams to prevent unauthorized outreach.
2. Monitor endpoint logs for unauthorized installations of AnyDesk or similar remote management software.
3. Implement detection for binaries signed with the 'Donald Gay' certificate, previously linked to MuddyWater.

■ Reference
- Rapid7 Analysis

Priority: High
Deadline: Immediate review recommended

Subject: [Security Alert] Potential Data Breach in Instructure Canvas LMS

Dear IT Security Team,

We are sharing information regarding a reported data breach affecting the Canvas Learning Management System (LMS).

■ Overview
The threat actor 'ShinyHunters' claims to have exfiltrated data from 8,809 educational institutions by exploiting Canvas's API and data export functionalities. The leaked data reportedly includes names, emails, and internal messages of students and staff.

■ Scope
- All organizations utilizing Instructure Canvas LMS.

■ Recommended Actions
1. Review audit logs for any unauthorized API key generation or anomalous bulk data export activities.
2. Enforce password resets and Multi-Factor Authentication (MFA) for all administrative accounts.
3. Audit permissions for integrated SaaS platforms and SSO configurations.

■ Reference
- Official Instructure advisory (Pending)

Priority: High
Deadline: Immediate

Subject: [Urgent] Update Required for DAEMON Tools Lite Users

Dear employees,
It has been reported that some installation files for DAEMON Tools Lite (Free version) were compromised with malware.

Requested Actions:
1. Please check if you are using DAEMON Tools Lite on your system.
2. If you are using version 12.5.x, please uninstall it immediately and install the latest version 12.6 from the official website.

Deadline: End of today

件名: 【共有】DAEMON Tools Lite サプライチェーン攻撃への対応について

お疲れさまです。DAEMON Tools Liteのサプライチェーン攻撃に関する情報共有です。

■ 概要
開発元Disk Soft Ltdのビルド環境が侵害され、正規署名付きのインストールファイルに悪性コードが混入されました。感染後、ホスト名やMACアドレス等の情報収集が行われ、一部の環境ではバックドアが設置される二次感染が確認されています。

■ 影響範囲
- 対象製品: DAEMON Tools Lite (Free version)
- 対象バージョン: 12.5.0.2421 ～ 12.5.0.2434

■ 対応手順
1. 社内端末における対象バージョンの利用状況を調査してください。
2. 該当バージョンが検出された場合、速やかに削除し、最新版（v12.6以降）への更新を強制してください。
3. 感染が疑われる端末については、C2通信の有無を確認し、フォレンジック調査を検討してください。

■ 参考情報
- ベンダー公式通知およびKaspersky分析レポート

対応優先度: 高
対応期限: 2026年5月10日

Subject: [Technical Alert] Supply Chain Attack on DAEMON Tools Lite

Dear Security Team,

This is a technical alert regarding a supply chain attack affecting DAEMON Tools Lite.

■ Overview
Attackers compromised the build infrastructure of Disk Soft Ltd, distributing malicious installation files signed with legitimate certificates. The malware performs system reconnaissance (hostname, MAC address, processes) and deploys a second-stage backdoor for remote command execution.

■ Scope
- Product: DAEMON Tools Lite (Free version)
- Affected Versions: 12.5.0.2421 through 12.5.0.2434

■ Mitigation Steps
1. Audit all corporate endpoints for the presence of the affected versions.
2. Force uninstall of compromised versions and mandate update to v12.6 or later.
3. Monitor network logs for suspicious outbound traffic from infected hosts and perform forensic analysis if necessary.

■ Reference
- Vendor official advisory and Kaspersky analysis

Priority: High
Deadline: 2026-05-10