2026年5月27日の
セキュリティ情報

Subject: [Security Alert] Malicious npm Package 'mouse5212-super-formatter' targeting Claude AI

Dear IT/Security Team,

We are sharing information regarding a supply chain attack involving a malicious npm package designed to exfiltrate data from Claude AI environments.

■ Overview
The package 'mouse5212-super-formatter' (codenamed Malware-Slop) masquerades as a sync utility. Upon installation, it targets the '/mnt/user-data' directory used by Anthropic's Claude AI and uploads files to a remote GitHub repository using stolen or hard-coded tokens.

■ Scope
- Affected Package: mouse5212-super-formatter
- Target: Environments utilizing Claude AI with the aforementioned directory structure.

■ Action Items
1. Audit all development environments and CI/CD pipelines for the presence of the 'mouse5212-super-formatter' package.
2. Review package-lock.json or yarn.lock files for unauthorized dependencies.
3. Review and rotate GitHub access tokens stored in environment variables to ensure the principle of least privilege.

■ Reference
- OX Security Threat Intelligence

Priority: High
Deadline: Immediate

Subject: [Urgent] Remediation for KnowledgeDeliver LMS CVE-2026-5426

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in KnowledgeDeliver LMS.

■ Overview
CVE-2026-5426 is a critical vulnerability caused by shared hard-coded ASP.NET/IIS machineKeys, allowing unauthenticated ViewState deserialization and subsequent Remote Code Execution (RCE). This is being exploited in the wild to deploy Godzilla (BLUEBEAM) web shells and distribute Cobalt Strike Beacons.

■ Scope
- Product: KnowledgeDeliver LMS
- Specifically installations deployed before February 24, 2026.

■ Remediation Steps
1. Update KnowledgeDeliver LMS to the latest patched version immediately.
2. Ensure that the machineKey in the web.config file is changed from the default to a unique, secure value.
3. Audit the IIS worker process for unauthorized shells and check application JavaScript files for unauthorized modifications.

■ Reference
- ThaiCERT Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Veeam Product Vulnerabilities (CVE-2026-32998 et al.)

Dear IT Administration Team,

This is a notification regarding critical security vulnerabilities identified in Veeam products.

■ Overview
Three vulnerabilities have been disclosed in Veeam's management console and backup solutions. These flaws could allow Remote Code Execution (RCE), arbitrary file writes, and privilege escalation, with one rated as 'Critical'.

■ Affected Scope
- Veeam Service Provider Console 9.x (versions prior to 9.2.0.33215)
- Veeam Backup & Replication 13.x (versions prior to 13.0.1.2067)

■ Mitigation Steps
1. Verify the current version of Veeam products deployed in the environment.
2. If an affected version is in use, immediately apply the latest security updates provided by the vendor.

■ Reference
- Veeam Official Security Bulletins

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Synology Chat Server Vulnerability Remediation

Dear IT Administration Team,

We are sharing information regarding security updates for Synology Chat Server.

■ Overview
Three vulnerabilities have been identified in Synology Chat Server, including one critical flaw. These vulnerabilities could allow an attacker to perform arbitrary file read/write operations or cause a Denial of Service (DoS).

■ Scope
- Product: Synology Chat Server for DSM
- Affected Versions: DSM 7.3, 7.2.2, 7.2.1 with Chat Server versions prior to 2.4.5-22148

■ Remediation Steps
1. Verify the current version of Synology Chat Server in your environment.
2. Update the Chat Server to version 2.4.5-22148 or later immediately.

■ Reference
- Synology Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] KnowledgeDeliver Vulnerability (CVE-2026-5426) and Lazarus Activity

Dear Team,

We are sharing critical threat intelligence regarding a zero-day vulnerability in the KnowledgeDeliver LMS and new activity from the Lazarus group.

■ Overview
CVE-2026-5426 in KnowledgeDeliver has been exploited to deploy Godzilla (BlueBeam) Webshells. Simultaneously, the North Korean actor Lazarus is deploying a new malware, RemotePE, targeting financial and cryptocurrency sectors.

■ Scope
- Users of KnowledgeDeliver LMS
- Financial and Cryptocurrency institutions

■ Action Items
1. For KnowledgeDeliver users: Apply the latest security patches and audit the system for unauthorized webshells.
2. For security teams: Monitor for indicators of compromise (IOCs) related to RemotePE and Lazarus campaigns.

■ Reference
- Mandiant / GTIG Reports
- Fox IT Reports

Priority: High
Deadline: Immediate