2026年6月7日の
セキュリティ情報

Subject: [Security Alert] Beware of Fraudulent IT Support Calls

Dear employees,

We have received reports of social engineering attacks where attackers pose as IT support staff via phone to steal sensitive information.

What we need from you:
1. Be cautious of unsolicited calls or emails claiming to be from IT support.
2. Never share your password or grant remote access to your computer over the phone.
3. Report any suspicious contact to the IT security team immediately.

Deadline: Immediate

件名: 【共有】Silent Ransom Group による法律・専門サービス業への攻撃について

お疲れさまです。Silent Ransom Group (UNC3753/Luna Moth/Chatty Spider) による標的型攻撃に関する情報共有です。

■ 概要
偽のITサポートを装った電話（Vishing）を用いたソーシャルエンジニアリング攻撃が確認されています。初期接触から数時間以内にデータ窃取に至る極めて迅速な攻撃サイクルが特徴です。

■ 影響範囲
- 法律事務所、金融、専門サービスセクター

■ 対応手順
1. 従業員に対し、電話によるパスワード要求やリモートアクセス許可の危険性を再周知する。
2. 多要素認証 (MFA) の適用状況を確認し、バイパス手法への対策を検討する。
3. 不審なログイン試行や特権アカウントの挙動を監視する。

■ 参考情報
- Mandiant Report / FBI FLASH Advisory

対応優先度: 高
対応期限: 速やかに

Subject: [Threat Intel] Silent Ransom Group Targeting Professional Services

Dear Security Team,

This is a notification regarding the activity of the Silent Ransom Group (also known as UNC3753, Luna Moth, and Chatty Spider).

■ Overview
The group is utilizing vishing (voice phishing) by impersonating IT support to target law firms and professional services. The attack chain is highly efficient, often resulting in data exfiltration within hours of the initial call.

■ Scope
- Law firms, financial services, and professional service organizations.

■ Recommended Actions
1. Conduct targeted awareness training for employees regarding vishing and social engineering.
2. Review and enforce MFA policies to prevent unauthorized access via stolen credentials.
3. Monitor for anomalous authentication patterns and unauthorized privilege escalation.

■ Reference
- Mandiant Report / FBI FLASH Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] C0XMO Botnet targeting DD-WRT Routers

Dear IT/Security Team,

We are sharing information regarding the C0XMO botnet, a new Gafgyt variant targeting DD-WRT router firmware.

■ Overview
C0XMO exploits vulnerabilities in DD-WRT (including CVE-2021-2) to spread across various CPU architectures (ARM, MIPS, x86, etc.). It is designed for modular updates and is primarily used to launch large-scale DDoS attacks using 19 different methods.

■ Scope
- Routers running DD-WRT firmware
- Vulnerable DVRs, video management platforms, and Android-based devices

■ Mitigation Steps
1. Update DD-WRT firmware to the latest patched version immediately.
2. Restrict external access to router management interfaces (Web UI) and enforce VPN access if necessary.
3. Monitor network traffic for anomalies indicative of DDoS activity (e.g., UDP/TCP/SYN floods).

■ Reference
- Fortinet Threat Intelligence Report

Priority: High
Deadline: Immediate

Subject: [Security Advisory] SolarWinds Serv-U CVE-2026-28318 Mitigation

Dear IT/Security Team,

We are sharing information regarding a vulnerability in SolarWinds Serv-U.

■ Overview
An unauthenticated Denial-of-Service (DoS) vulnerability (CVE-2026-28318, CVSS 7.5) has been identified in SolarWinds Serv-U. This flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

■ Scope
- Affected Product: SolarWinds Serv-U

■ Mitigation Steps
1. Verify if SolarWinds Serv-U is deployed within the environment.
2. Apply the latest security updates provided by SolarWinds immediately.

■ Reference
- CISA KEV Catalog
- SolarWinds Official Advisory

Priority: High
Deadline: Immediate