2026年5月22日の
セキュリティ情報

Subject: [Info] Takedown of Malware-Signing-as-a-Service (MSaaS) Infrastructure

Dear team,

We are sharing information regarding Microsoft's recent operation to dismantle a malicious code-signing service.

■ Overview
Microsoft has seized the domain signspace[.]cloud, which provided 'Malware-Signing-as-a-Service (MSaaS)'. The threat actor, Fox Tempest, abused Azure Trusted Signing to generate fraudulent certificates, enabling malware to bypass security controls by appearing as legitimate Windows software.

■ Scope
- Windows environments (potential for detection bypass via signed malware).

■ Recommended Actions
1. Review EDR/AV logs for any suspicious binaries that may have been signed by fraudulent certificates.
2. Reinforce policies restricting the installation of software from untrusted sources.

■ Reference
- Microsoft Threat Intelligence / OpFauxSign

Priority: Low
Deadline: N/A

Subject: [Intel] Abuse of Cloud Services by Webworm (GraphWorm/EchoCreep)

Dear Team,

We are sharing intelligence regarding new malware campaigns by the China-linked actor Webworm.

■ Overview
Webworm is deploying "GraphWorm," which abuses the Microsoft Graph API to use OneDrive as a C2 channel, and "EchoCreep," which utilizes Discord for C2 communications. By leveraging trusted cloud services, the attackers can effectively blend in with legitimate traffic and bypass traditional security controls.

■ Scope
- Environments utilizing Microsoft OneDrive and Discord.
- While European government agencies are primary targets, other sectors should remain vigilant.

■ Recommended Actions
1. Monitor for suspicious directory creation in OneDrive and anomalous API calls via Microsoft Graph API.
2. Since C2 traffic is AES-256-CBC encrypted and Base64 encoded, focus on traffic patterns and destination analysis rather than payload inspection.
3. Enhance endpoint monitoring for unauthorized processes communicating with Discord API endpoints.

■ Reference
- ESET Security Report

Priority: Medium
Deadline: Ongoing monitoring