2026年8月27日の
セキュリティ情報

Subject: [Intel] C2 Communication via FTP Banners (E4del/PINHOLE)

Dear team,

We are sharing information regarding a novel attack technique using FTP banners for command and control.

■ Overview
Attackers are utilizing FTP server banners (the greeting message sent upon connection) as Dead Drop Resolvers (DDR) to deliver commands to infected hosts. This method is currently being used to deploy two new RATs: E4del and PINHOLE.

■ Scope
- Environments allowing outbound FTP traffic
- Networks without strict egress filtering for FTP services

■ Recommended Actions
1. Review network logs for frequent or anomalous connections to unknown external FTP servers.
2. Inspect IDS/IPS signatures for unusual patterns within pre-authentication FTP banner traffic.
3. Consider implementing a whitelist for authorized external FTP destinations.

■ Reference
- SOCRadar Threat Intelligence

Priority: Medium
Deadline: As soon as possible

Subject: [Security Alert] Phishing Attacks Using Fake CAPTCHA Screens

Dear employees,
We have observed phishing attacks that use fake Cloudflare "Security Check (CAPTCHA)" screens to deceive users and redirect them to fraudulent login pages.

Requested Actions:
1. Be cautious of unexpected "verification screens" or "security checks" appearing while browsing. If suspicious, close the browser immediately.
2. Never enter your credentials or personal information on pages you were redirected to via such screens.

Deadline: Immediate

Subject: [Security Alert] Addressing Internet-Exposed PLCs in Industrial Control Systems

Dear Team,

We are sharing a critical warning from CISA regarding the compromise of internet-exposed Programmable Logic Controllers (PLCs) within the water and wastewater sector.

■ Overview
In July 2026, over 100 systems were compromised due to PLCs being directly connected to the internet via cellular modems without the protection of firewalls or gateways. CISA has issued guidance to help organizations identify and mitigate these exposures.

■ Scope
- PLCs and industrial control devices directly accessible via the public internet.
- ICS networks lacking proper perimeter security (Firewalls/VPNs).

■ Action Plan
1. Conduct a comprehensive audit of all PLCs and industrial devices to identify any internet-facing assets.
2. Isolate PLCs from direct internet access and ensure all remote management is routed through a secure VPN or gateway.
3. Review and tighten Access Control Lists (ACLs) and close unnecessary ports.

■ Reference
- CISA Exposure Reduction Guidance (Published August 21, 2026)

Priority: High
Deadline: Immediate review required

Subject: [Security Advisory] Veeam Backup & Replication / Veeam ONE Vulnerability Update

Dear IT Administration Team,

This is a notification regarding vulnerabilities identified in Veeam products.

■ Overview
Vulnerabilities have been reported in Veeam's backup and monitoring software, and security updates have been released to address them.

■ Affected Scope
- Veeam Backup & Replication: Prior to 13.0.3 (build 13.0.3.63) and prior to 13.1 (build 13.1.0.411)
- Veeam ONE: Prior to or equal to 13.0.2.6723 and 13.1.0.7034

■ Action Plan
1. Verify the current version of Veeam products deployed in the environment.
2. If affected, apply the latest updates as specified in KB4902 and KB4905.

■ Reference
- KB4902: Vulnerability Resolved in Veeam Backup & Replication 13.1
- KB4905: Vulnerability Resolved in Veeam ONE 13.1 Patch 0

Priority: High
Deadline: Immediate