2026年6月5日の
セキュリティ情報

Subject: [Security Alert] Mitigation of Internet-Exposed Automatic Tank Gauge (ATG) Systems

Dear IT/Security Team,

We are sharing a critical warning from CISA, FBI, and USDA regarding malicious activity targeting Automatic Tank Gauge (ATG) systems.

■ Overview
Attackers are targeting internet-exposed ATG systems using techniques such as authentication bypass, default credentials, and SQL injection. Successful exploitation allows attackers to remotely modify system settings, control pumps, and disable alarms, potentially leading to operational failure or environmental hazards.

■ Scope
- Automatic Tank Gauge (ATG) systems directly exposed to the public internet.

■ Mitigation Steps
1. Identify and remove any ATG web interfaces or serial ports directly exposed to the internet.
2. Restrict remote access using VPNs, firewalls, or Access Control Lists (ACLs).
3. Change all default passwords to strong, unique credentials and implement Multi-Factor Authentication (MFA) where possible.

■ Reference
- CISA/FBI/USDA Joint Warning

Priority: High
Deadline: Immediate

Subject: [Info] Cloud-based Email Relay Network (PCPJack)

Dear team,

We are sharing information regarding a cloud-based email relay network operated by the threat actor PCPJack.

■ Overview
Researchers discovered that PCPJack compromised 230 cloud servers across AWS, Google Cloud, and Azure to create a covert email relay network. The operation was exposed due to a misconfiguration on the actor's C2 server, revealing toolkits and Sliver C2 files.

■ Scope
- Misconfigured servers in public cloud environments (AWS, GCP, Azure)
- Organizations targeted by emails relayed through this network

■ Recommended Actions
1. Audit public-facing cloud directories to ensure no sensitive tools or logs are exposed without authentication.
2. Monitor for unusual outbound SMTP traffic from cloud instances.

■ Reference
- Hunt.io Research Report

Priority: Low
Deadline: Ongoing

Subject: [Intel] Silent Ransom Group (SRG) utilizing Fast Flux Infrastructure

Dear team,

We are sharing intelligence regarding the infrastructure shift of the Silent Ransom Group (SRG).

■ Overview
Resecurity has identified that SRG is employing DNS Fast Flux techniques to mask their C2 infrastructure and evade detection. Unlike traditional ransomware, SRG focuses on data exfiltration and extortion.

■ Scope
- Organizations in Legal, Healthcare, and Hospitality sectors.
- Environments with limited DNS traffic visibility.

■ Recommended Actions
1. Monitor DNS logs for domains with very low TTLs and rapidly changing IP addresses (Fast Flux indicators).
2. Implement detection rules in SIEM/IDS to identify anomalous DNS query patterns.
3. Enhance monitoring of egress traffic to detect and block communication with suspicious domains.

■ Reference
- Resecurity Report

Priority: Medium
Deadline: Ongoing

Subject: [Security Alert] Beware of Fraudulent IT Support Calls and Emails

Dear employees,
We have observed attacks where threat actors pose as IT support via phone or email to gain remote access to corporate computers.

What we need from you:
1. If you receive an unexpected call or email regarding "data migration" or "invoices," do not follow the instructions and report it immediately.
2. Please be aware that IT support will never ask you to install screen-sharing or remote management software over the phone. Do not download any such tools.

Deadline: Immediate

件名: 【共有】UNC3753によるビッシングを用いた標的型攻撃について

お疲れさまです。UNC3753によるキャンペーンに関する情報共有です。

■ 概要
UNC3753（Luna Moth/Chatty Spider）が、ビッシング（Vishing）とソーシャルエンジニアリングを用いて米国の法律・金融サービスを標的にしています。ITサポートを装い、RMMツールをインストールさせることで初期侵入を達成し、機密データの窃取および恐喝を行います。

■ 影響範囲
- 法律事務所、金融サービス、専門サービス組織
- RMMツール（AnyDesk, ScreenConnect等）を許可している環境

■ 対応手順
1. 許可されていないRMMツールの実行をエンドポイントで制限・監視する。
2. 従業員に対し、電話によるソフトウェアインストール指示への警戒を周知する。
3. 不審なリモート接続ログの有無を確認する。

■ 参考情報
- Mandiant Google Threat Intelligence Report

対応優先度: 高
対応期限: 速やかに

Subject: [Threat Intel] Targeted Campaign by UNC3753 using Vishing

Dear Security Team,

This is a notification regarding a campaign by UNC3753 (Luna Moth/Chatty Spider).

■ Overview
UNC3753 is targeting US law and financial services using vishing and social engineering. They pose as IT support to trick users into installing Remote Monitoring and Management (RMM) tools to gain initial access for data exfiltration and extortion.

■ Scope
- Law firms, financial services, and professional services.
- Environments where unauthorized RMM tools can be executed.

■ Action Items
1. Restrict or monitor the execution of unauthorized RMM tools on endpoints.
2. Conduct security awareness training focusing on vishing and social engineering.
3. Review logs for suspicious remote access sessions.

■ Reference
- Mandiant Google Threat Intelligence Report

Priority: High
Deadline: Immediate