2026年7月7日の
セキュリティ情報

Subject: [Intel] New Iranian C2 Framework 'Cavern' Targeting Israeli Organizations

Dear Team,

We are sharing intelligence regarding a new C2 framework dubbed 'Cavern' used by the Iranian threat actor 'Cavern Manticore' (affiliated with MOIS).

■ Overview
The Cavern framework is a mature, modular .NET-based toolset. It specifically employs multiple compilation formats (including .NET Framework, Mixed-Mode C++/CLI, and Native AOT) to create an anti-analysis layer, forcing reverse engineers to use multiple toolsets for metadata reconstruction.

■ Scope
- Primary targets: Israeli government sectors and IT providers.
- Technical impact: Execution of modular .NET malware for C2 communication.

■ Recommended Actions
1. Enhance monitoring for unusual .NET process behaviors and unauthorized network connections to unknown C2 infrastructure.
2. Review tactical overlaps with MuddyWater and Lyceum to update detection signatures.

■ Reference
- Check Point Research

Priority: Medium
Deadline: Ongoing Monitoring

Subject: [Security Alert] Beware of Malicious App Installations on Android

Hi everyone,

A new type of Android malware is targeting banking users by tricking them into installing fake apps via phishing links.

These attacks often use fake app store pages that look like Google Play or the Galaxy Store to deceive users.

What we need you to do:
1. Do NOT install apps from sources other than official stores (e.g., Google Play).
2. Do NOT click on suspicious links in SMS or emails that prompt you to download apps.
3. Keep your device OS and security software updated to the latest version.

Deadline: Immediate (Please review your device settings today)

Subject: [Security Advisory] Critical Vulnerabilities in JetBrains Products (CVE-2026-50242 et al.)

Dear IT/Security Team,

This is a notification regarding critical vulnerabilities identified in several JetBrains products.

■ Overview
Critical vulnerabilities have been discovered in JetBrains Hub and other products. Notably, CVE-2026-50242 allows for authentication bypass and administrative access, with a CVSSv3.1 score of 10.0.

■ Affected Products
- JetBrains Hub
- YouTrack
- GoLand
- Kotlin

■ Remediation Steps
1. Identify the versions of JetBrains products currently in use within the environment.
2. Update all affected products to the latest patched versions provided by the vendor.

■ Reference
- JetBrains Official PR/Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Caution Regarding Suspicious Files and Links

Dear employees,
We have observed sophisticated attacks that leverage trusted services (such as Google's Blogspot) to deliver malware.

Requested Actions:
1. Do not open attachments or click links from unknown or untrusted senders.
2. Be aware that files appearing to be documents may actually be malicious scripts. Please report any suspicious activity immediately.

Deadline: Immediate

Subject: [Security Advisory] Data Leakage Risk in GitHub Agentic Workflows (GitLost)

Dear IT/Security Team,

We are sharing information regarding a vulnerability in GitHub Agentic Workflows known as 'GitLost'.

■ Overview
Attackers can trick AI agents into leaking contents of private repositories by creating a public issue with malicious instructions. If the agent has broad read access across the organization, it may pull private data into a public comment.

■ Scope
- Organizations using GitHub Agentic Workflows where the agent is granted read access to multiple repositories, including private ones.

■ Mitigation Steps
1. Review the permissions granted to AI agent tokens and apply the principle of least privilege (PoLP) to restrict access to only necessary repositories.
2. Review and refine the instructions provided to AI agents to prevent the output of sensitive data in public forums.

■ Reference
- Noma Security Research

Priority: Medium
Deadline: Next configuration review