2026年5月23日の
セキュリティ情報

Subject: [Intel] Targeted Attacks by Red Lamassu against Telecom Providers

Dear Team,

We are sharing threat intelligence regarding the activities of the China-linked APT group 'Red Lamassu' (also known as 'Calypso').

■ Overview
Red Lamassu has been targeting telecom providers and ISPs in the Asia-Pacific and Middle East regions since mid-2022. They utilize 'Showboat' (Linux) and 'JFMBackdoor' (Windows) to maintain long-term persistence. Showboat is particularly dangerous as it provides SOCKS5 proxy and port forwarding capabilities for internal pivoting and uses public websites (e.g., Pastebin) as dead drops to evade security detection.

■ Scope
- Linux and Windows servers within Telecom, ISP, and Government sectors.

■ Recommended Actions
1. Monitor outbound traffic for unusual connections to public code-sharing or text-hosting sites.
2. Audit Linux systems for unauthorized SOCKS5 proxy configurations or suspicious persistence mechanisms.
3. Review internal network logs for anomalous port forwarding activity.

■ Reference
- Analysis by Lumen Black Lotus Labs and PwC Threat Intelligence

Priority: High
Deadline: Immediate review

Subject: [Info] Methods for Monitoring Per-Process DNS Queries in Windows

Hi all,

I am sharing technical information regarding DNS query monitoring on Windows.

■ Overview
In Windows 10 and later, the DNS Client Service (Dnscache) handles DNS requests via RPC, making it impossible to map specific processes to DNS queries using standard packet captures (e.g., Wireshark). To achieve this, Event Tracing for Windows (ETW) must be used.

■ Scope
- Windows 10 and later versions

■ Recommended Procedure (for Analysis)
1. Use ETW logs to capture DNS activity.
2. Utilize tools such as 'DNSLookupView' to map PIDs to FQDNs in real-time, which is particularly useful for short-lived processes.

■ Reference
- DNSLookupView (NirSoft)
- etw-dns (GitHub)

Priority: Low
Deadline: N/A

Subject: [Action Required] Security Update for Microsoft Windows and Office

Dear employees,

Microsoft has released critical security updates to fix vulnerabilities that could be exploited by attackers.

Requested Actions:
1. Please run Windows Update to ensure your system is up to date.
2. Apply any pending updates for Microsoft Office (Word, Excel, etc.) immediately.
3. Be cautious and do not open attachments or click links from unknown or suspicious emails.

Deadline: By the end of this week

件名: 【共有】Microsoft 2026年1月セキュリティ更新プログラムへの対応について

お疲れさまです。1月のマイクロソフト定例更新に関する情報共有です。

■ 概要
Windows, Office, SQL Server, Azure等を含む112件の脆弱性が修正されました。うち8件がCritical、104件がImportantに分類されています。特にCVE-2026-20805（DWM情報漏洩）は既に野外での利用が確認されており、またOffice/ExcelのRCE脆弱性（CVSS 8.4）も含まれています。

■ 影響範囲
- Windows
- Microsoft Office
- Microsoft SQL Server
- Azure

■ 対応手順
1. WSUSまたはIntune等の管理ツールを用いて、最新の累積更新プログラムを配布・適用する。
2. 特に野外利用が確認されているCVE-2026-20805およびOffice RCEへの対応を優先する。
3. 適用後の再起動をスケジュールし、完了を確認する。

■ 参考情報
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/releaseNote/2026-Jan

対応優先度: 高
対応期限: 速やかに

Subject: [Technical Alert] Microsoft January 2026 Security Updates

Dear IT Security Team,

Microsoft has released the January 2026 security updates addressing 112 vulnerabilities.

■ Overview
Updates cover Windows, Office, SQL Server, and Azure. There are 8 Critical and 104 Important vulnerabilities. Notably, CVE-2026-20805 (DWM Information Disclosure) is reported as exploited in the wild. Additionally, several RCE vulnerabilities in Office/Excel (CVSS 8.4) have been patched.

■ Scope
- Windows
- Microsoft Office
- Microsoft SQL Server
- Azure

■ Remediation Steps
1. Deploy the latest cumulative updates via WSUS, Intune, or other patch management systems.
2. Prioritize patching for CVE-2026-20805 and Office RCE vulnerabilities.
3. Ensure system reboots are performed to complete the installation.

■ Reference
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/releaseNote/2026-Jan

Priority: High
Deadline: Immediate

Subject: [Action Required] Update Microsoft Office and Windows

Dear employees,
Microsoft has identified vulnerabilities in Office and Windows that could allow attackers to execute malicious code if a specially crafted file is opened.

Requested Actions:
1. Please run Windows Update to ensure your system is up to date.
2. Apply any pending updates for Microsoft Office applications (Word, Excel, etc.) immediately.

Deadline: By the end of this week

件名: 【共有】Microsoft 2026年3月度セキュリティ更新プログラムへの対応について

お疲れさまです。3月度のマイクロソフトセキュリティ更新に関する情報共有です。

■ 概要
Windows, Office, SQL Server, Azure等を含む83件の脆弱性が修正されました。うち、重要度「Critical」が8件、「Important」が75件含まれています。特にOfficeのRCE（CVE-2026-26110, CVE-2026-26113）はCVSS 8.4と高く、優先的な対応が推奨されます。

■ 影響範囲
- Microsoft Windows
- Microsoft Office
- Microsoft SQL Server
- Microsoft Azure

■ 対応手順
1. MSRC (Microsoft Security Response Center) の更新ガイドを確認し、対象資産を特定する。
2. 組織のパッチ管理ポリシーに従い、最新の累積更新プログラムを適用する。
3. 適用後、再起動が必要なサーバーおよび端末のスケジュール調整を行う。

■ 参考情報
- https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar

対応優先度: 高
対応期限: 速やかに

Subject: [Technical Alert] Microsoft March 2026 Security Updates

Dear IT Security Team,

Microsoft has released security updates for March 2026, addressing 83 vulnerabilities. This includes 8 Critical and 75 Important vulnerabilities across Windows, Office, SQL Server, and Azure.

■ Overview
High-risk vulnerabilities include RCE in Microsoft Office (CVE-2026-26110, CVE-2026-26113) with CVSS scores of 8.4, and an information disclosure flaw in Excel (CVE-2026-26144).

■ Scope
- Microsoft Windows
- Microsoft Office
- Microsoft SQL Server
- Microsoft Azure

■ Remediation Steps
1. Identify affected assets using the MSRC update guide.
2. Deploy the latest cumulative updates according to the organizational patch management policy.
3. Coordinate reboots for affected servers and workstations.

■ Reference
- https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar

Priority: High
Deadline: Immediate