「うちの会社、大丈夫かな？」

Subject: [Security Alert] Addressing Privilege Escalation Risk in Qubole-linked AWS Accounts

Dear IT/Security Team,

We are sharing information regarding a security incident where attackers compromised AWS accounts of Qubole customers.

■ Overview
Attackers leveraged Qubole's credentials to perform AssumeRole operations on customer AWS accounts. The primary vector was the existence of unused IAM roles with active Trust Policies and the lack of strict confidentiality for External IDs.

■ Scope
- AWS environments integrated with the Qubole platform.
- Environments with unused IAM roles or improperly managed External IDs.

■ Mitigation Steps
1. Review all IAM roles associated with Qubole and delete any that are no longer required.
2. Audit Trust Policies to ensure they follow the principle of least privilege.
3. Verify that External IDs are treated as secrets and are not easily discoverable.
4. Audit AWS CloudTrail logs for unauthorized AssumeRole activity.

■ Reference
- Wiz / Sentra Research Reports

Priority: High
Deadline: Immediate

Subject: [Intel] Turla's Cereal - Microsoft Exchange Compromise

Dear Team,

We are sharing intelligence regarding a new toolset used by the Russian APT group Turla.

■ Overview
Turla is deploying a modular toolset named "Turla's Cereal" that exploits legitimate Microsoft Exchange, Windows, and .NET assembly functions. A key characteristic is the absence of external C2 infrastructure; instead, the compromised Exchange server is co-opted to serve as the C2.

■ Scope
- Microsoft Exchange Servers
- .NET-based application environments

■ Recommended Actions
1. Enhance monitoring for unusual network traffic or process behavior originating from Exchange servers.
2. Audit .NET assembly loads and check for unauthorized modifications to legitimate binaries.
3. Ensure all Microsoft Exchange and Windows security patches are up to date.

■ Reference
- ESET Threat Intelligence Report

Priority: High
Deadline: Immediate review

Subject: [Alert] Beware of Impersonation Scams and Phishing

Dear employees,
We have been informed of a security incident involving a donation management system used by several non-profit organizations, which may lead to the leak of personal information. As a result, there is an increased risk of phishing attacks and scams where attackers impersonate organization representatives.

Requested Actions:
1. Be vigilant against suspicious emails or phone calls claiming to be from our organization or its partners.
2. Do not share personal or sensitive information over the phone or via email.
3. Avoid clicking on unknown links or opening unexpected attachments.

Deadline: Please remain vigilant starting today.

Subject: [Security Alert] Backdoor 'CWPdoor' targeting Control Web Panel (CWP)

Dear IT Administration Team,

We are sharing information regarding a newly discovered backdoor named 'CWPdoor' targeting the Control Web Panel (CWP) management tool.

■ Overview
CWPdoor replaces the legitimate 'cwpsrv' binary with a malicious version via a fake update script. It remains dormant until it receives a specific encrypted HTTP request verified by an RSA signature, making it highly stealthy and difficult to detect with standard antivirus tools.

■ Scope
- Linux servers running Control Web Panel (CWP).

■ Recommended Actions
1. Audit server logs for the execution of suspicious scripts, specifically 'cwpsrv_update.sh'.
2. Verify the integrity of the 'cwpsrv' binary by comparing its hash against a known clean version.
3. Monitor network traffic for unusual HTTP headers or unauthorized outbound connections.

■ Reference
- XLab Threat Research Team

Priority: High
Deadline: Immediate review