2026年5月14日の
セキュリティ情報

Subject: [Intel] Kimsuky Campaign using PebbleDash-based Tools

Dear team,

We are sharing intelligence regarding the latest activity of the Kimsuky APT group.

■ Overview
Kimsuky is deploying new malware variants based on the PebbleDash platform, including HelloDoor (Rust-based) and httpMalice. The group is now utilizing advanced evasion techniques such as VSCode Tunneling and Cloudflare Quick Tunnels for C2 infrastructure, and leveraging LLMs to craft more convincing phishing lures.

■ Scope
- Windows environments within targeted organizations
- Development environments (potential abuse of VSCode tools)

■ Recommended Actions
1. Monitor network logs for suspicious outbound traffic associated with Cloudflare Quick Tunnels or VSCode Tunneling.
2. Audit the installation of unauthorized remote administration tools (e.g., DWAgent).
3. Reinforce phishing awareness training for employees, noting the increased sophistication of lures.

■ Reference
- Securelist: Kimsuky targets organizations with PebbleDash-based tools

Priority: High
Deadline: Immediate review

Subject: [Alert] Stability Issues (BSOD) on Dell PCs

Hi everyone,
It has been reported that some Dell PCs are experiencing sudden blue-screen crashes (BSOD) due to a pre-installed support software update.

What we need from you:
1. Please check if your PC has been rebooting unexpectedly or displaying a blue screen.
2. If you encounter this issue, please report it to the IT support team immediately.

Deadline: ASAP

件名: 【共有】Dell SupportAssist による BSOD 発生への対応について

お疲れさまです。Dell SupportAssist の不具合に関する情報共有です。

■ 概要
Dell SupportAssist Remediation サービスの特定バージョンにおいて、クリティカルプロセスエラー（0xEF_DellSupportAss_BUGCHECK_CRITICAL_PROCESS）による BSOD が発生しています。

■ 影響範囲
- 対象製品: Dell SupportAssist / Alienware SupportAssist
- 対象バージョン: SupportAssist Remediation service v5.5.16.0

■ 対応手順
1. 影響を受けている端末の SupportAssist Remediation サービスのバージョンを確認する。
2. 回避策として、当該サービスの無効化、または SupportAssist アプリケーション自体のアンインストールを実施する。

■ 参考情報
- Dell 公式フォーラム

対応優先度: 中
対応期限: 次回メンテナンス時まで

Subject: [Technical Info] BSOD issues caused by Dell SupportAssist

Hi team,
Sharing information regarding a known issue with Dell SupportAssist.

■ Overview
A specific update to the Dell SupportAssist Remediation service is triggering BSODs with the error code 0xEF_DellSupportAss_BUGCHECK_CRITICAL_PROCESS.

■ Scope
- Affected Product: Dell SupportAssist / Alienware SupportAssist
- Affected Version: SupportAssist Remediation service v5.5.16.0

■ Mitigation Steps
1. Identify devices running the affected version of the remediation service.
2. Disable the Dell SupportAssist Remediation service or fully uninstall the SupportAssist application.

■ Reference
- Dell Official Forums

Priority: Medium
Deadline: Next maintenance window

Subject: [Intel] Trend of Cyber-Enabled Cargo Crime

Hi team,

I am sharing information regarding a trend where cybercrime tradecraft is being used to facilitate physical freight theft.

■ Overview
Threat actors are adopting the ransomware playbook (credential theft, persistence, and reconnaissance) to infiltrate logistics ecosystems. Instead of encrypting data, they reroute entire truckloads of goods to the black market by manipulating shipping data.

■ Scope
- Logistics management systems, freight platforms, and privileged accounts with access to routing data.

■ Recommended Actions
1. Enforce Multi-Factor Authentication (MFA) for all logistics and supply chain management systems.
2. Implement monitoring and alerting for unauthorized or suspicious changes to delivery destinations.
3. Review and restrict access permissions for users capable of modifying freight routing.

■ Reference
- NMFTA Report

Priority: Medium
Deadline: Next security review

Subject: [Security Advisory] Risks Associated with Lack of L2 Isolation in ISP Networks

Dear IT Administration Team,

We are sharing information regarding a security risk stemming from improper L2 isolation by some Internet Service Providers (ISPs).

■ Overview
It has been reported that some ISPs fail to isolate corporate clients into separate L2 segments. This allows devices from different customers to see each other, enabling attacks such as ARP spoofing for traffic interception, brute-forcing management interfaces (e.g., MAC Telnet/Winbox), and passive reconnaissance via OSPF.

■ Scope
- Routers and network devices deployed in ISP environments lacking proper L2 isolation (particularly those with active management services on the WAN).

■ Mitigation Steps
1. Review and tighten firewall rules on the WAN interface to drop unauthorized traffic.
2. Disable Neighbor Discovery, MAC Telnet, and MAC Winbox on the WAN interface.
3. Remove all management services from the WAN and restrict them to secure tunnels (e.g., VPN).

■ Reference
- xakep (Соседи по проводу. Препарируем сеть провайдера)

Priority: Medium
Deadline: Next scheduled maintenance window