2026年6月2日の
セキュリティ情報

Subject: [Security Alert] Mitigating Container Escape via Docker/Kubernetes Misconfigurations

Dear IT/Security Team,

We are sharing critical information regarding container escape vulnerabilities resulting from misconfigurations in Docker and Kubernetes.

■ Overview
Attackers are exploiting insecure default settings and misconfigurations—specifically the 'privileged' flag and excessive Linux capabilities—to break out of containers and gain root access to the underlying host system. This allows for full system compromise and lateral movement within the infrastructure.

■ Scope
- Docker and Kubernetes environments
- Specifically those utilizing privileged containers or sharing host namespaces (PID, Network, etc.)

■ Mitigation Steps
1. Audit and disable the use of the '--privileged' flag in container runtimes.
2. Review and remove unnecessary Linux capabilities (e.g., CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_SYS_PTRACE).
3. Restrict the use of hostPath, hostPID, and hostNetwork settings.
4. Harden the Kubernetes API server access and review RBAC policies for ServiceAccounts.

■ Reference
- Securelist / CSN Reports

Priority: High
Deadline: Next maintenance window

Subject: [Security Advisory] Samba RCE Vulnerabilities (CVE-2026-4480, CVE-2026-4408)

Dear IT Administration Team,

We are sharing information regarding critical vulnerabilities discovered in Samba.

■ Overview
Two critical vulnerabilities have been identified in Samba that could allow remote code execution (RCE). Both have a CVSS score of 10.0, enabling command injection under specific configurations.

■ Scope
- Product: Samba
- Patched Versions: 4.22.10, 4.23.8, 4.24.3

■ Action Plan
1. Verify the current version of Samba deployed in your environment.
2. Update to the patched versions (4.22.10, 4.23.8, or 4.24.3) immediately.

■ Reference
- Samba Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Caution Regarding Suspicious Email Attachments

Dear employees,

We have received reports of sophisticated phishing attacks targeting various organizations.

Please follow these security guidelines:
1. Do not open ZIP attachments from unknown or untrusted senders.
2. Be extremely cautious of files that appear to be PDFs but are actually shortcuts (.lnk files) or executables.
3. If you receive a suspicious email, do not open it and report it to the IT security team immediately.

Deadline: Immediate

件名: 【共有】Operation Dragon Weave（中国関連アクター）による攻撃キャンペーンについて

お疲れさまです。標的型攻撃キャンペーンに関する情報共有です。

■ 概要
チェコおよび台湾を標的とした「Operation Dragon Weave」が観測されました。ZIPファイル内のLNKファイルまたは実行ファイルから、DLLサイドローディングを用いてAdaptix C2エージェントを導入する手法が用いられています。

■ 影響範囲
- 政府、研究、学術、テクノロジー、金融サービスセクター
- Windows OS環境

■ 対応手順
1. 以下の不審なファイル名の実行および通信の監視・ブロックを検討してください：
- RuntimeBroker_update.exe
- UnityPlayer.dll (サイドローディングによる不審なパスからの読み込み)
2. Adaptix C2に関連する通信パターンの検知ルールを適用してください。

■ 参考情報
- Seqrite Labs Report

対応優先度: 中
対応期限: 随時

Subject: [Threat Intel] Operation Dragon Weave Campaign (China-related)

Dear Security Team,

This is a technical update regarding the 'Operation Dragon Weave' espionage campaign.

■ Overview
Attackers are targeting the Czech Republic and Taiwan using spear-phishing. The infection chain involves ZIP files containing LNKs or executables that trigger DLL side-loading to deploy the Adaptix C2 agent.

■ Scope
- Sectors: Government, Research, Academia, Tech, and Financial Services
- Platform: Windows

■ Mitigation Steps
1. Monitor for and block the execution of suspicious binaries:
- RuntimeBroker_update.exe
- UnityPlayer.dll (specifically when loaded via side-loading)
2. Implement detection rules for Adaptix C2 communication patterns.

■ Reference
- Seqrite Labs Report

Priority: Medium
Deadline: Ongoing

Subject: [Action Required] Update Microsoft 365 Android Apps

Hi everyone,

A security vulnerability has been identified in several Microsoft 365 apps for Android (including Word, Excel, and PowerPoint).

What you need to do:
1. Please update your Microsoft 365 apps (Word, Excel, PowerPoint, OneNote, Loop, Copilot) to the latest version on your Android device.
2. Check the Google Play Store for any available updates.

Deadline: By the end of this week

件名: 【共有】Microsoft 365 Androidアプリにおけるデバッグフラグ有効化の脆弱性について

お疲れさまです。Microsoft 365 Androidアプリの脆弱性に関する情報共有です。

■ 概要
Word, PowerPoint, Excel, Copilot, Loop, OneNoteのAndroid版において、本番コードに `IsDebugMode(true)` が残っていたことが判明しました。これにより、本来ブロックされるべき信頼されていないアプリがアカウントアクセストークンを共有されるリスクがあります。

■ 影響範囲
- 対象製品: Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, OneNote (Android版)

■ 対応手順
1. ユーザーに対し、対象アプリを最新バージョンへアップデートするよう周知してください。
2. MDM（モバイルデバイス管理）を導入している場合は、強制アップデートの適用を検討してください。

■ 参考情報
- SecurityWeek 報道記事

対応優先度: 中
対応期限: 速やかに

Subject: [Technical Alert] Debug Mode Enabled in Microsoft 365 Android Apps

Dear IT/Security Team,

We are sharing information regarding a vulnerability in Microsoft 365 Android applications.

■ Overview
It was discovered that six Microsoft 365 Android apps were shipped with a debug flag (`IsDebugMode(true)`) enabled in production. This allows untrusted applications to bypass protections and receive account access tokens.

■ Scope
- Affected Products: Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote for Android.

■ Mitigation Steps
1. Ensure all users update the affected applications to the latest version via the app store.
2. If using MDM, consider enforcing the update for these specific packages.

■ Reference
- SecurityWeek report

Priority: Medium
Deadline: Immediate

Subject: [Security Alert] Caution Regarding Suspicious Email Attachments

Dear employees,

We have observed an increase in targeted phishing attacks using deceptive attachments to infect systems with malware.

Requested Actions:
1. Do not open attachments (especially ZIP archives or LNK shortcut files) from unknown or untrusted senders.
2. If you have accidentally opened a suspicious file, please disconnect your device from the network and report it to the IT security team immediately.

Deadline: Immediate

件名: 【共有】SideCopyによるXeno RATを用いたキャンペーンについて

お疲れさまです。SideCopyによる新たな攻撃キャンペーンに関する情報共有です。

■ 概要
パキスタン系のAPTグループSideCopy（Transparent Tribe/APT36）が、アフガニスタン政府を標的にXeno RATを配布する「Operation XENOFISCAL」を展開しています。パシュトー語で偽装されたLNKファイルをZIPに格納して配信する手法が用いられています。

■ 影響範囲
- アフガニスタン政府機関（財務省、地方政府職員）
- Xeno RATが動作するWindows環境

■ 対応手順
1. エンドポイントにおいて、不審なLNKファイルの実行を監視・制限する設定を確認してください。
2. Xeno RATの通信挙動（C2通信）に関するIOCが公開され次第、FW/IDS/IPSにてブロック設定を検討してください。
3. ユーザーに対し、標的型メールへの警戒を促す周知を行ってください。

■ 参考情報
- Seqrite Labs Technical Breakdown

対応優先度: 中
対応期限: 随時

Subject: [Threat Intel] SideCopy Campaign deploying Xeno RAT

Dear Security Team,

This is a technical update regarding a new campaign by the Pakistan-linked actor SideCopy (Transparent Tribe/APT36).

■ Overview
Operation XENOFISCAL targets Afghan government officials using spear-phishing emails. The attack chain involves a ZIP archive containing a malicious LNK file (named in Pashto) which subsequently deploys the Xeno RAT.

■ Scope
- Afghan Ministry of Finance and provincial government employees
- Windows-based endpoints

■ Mitigation Steps
1. Review and restrict the execution of LNK files from untrusted sources on endpoints.
2. Monitor for Xeno RAT C2 communication patterns and implement blocks on FW/IDS/IPS as IOCs become available.
3. Conduct targeted awareness training for users regarding spear-phishing lures.

■ Reference
- Seqrite Labs Technical Breakdown

Priority: Medium
Deadline: Ongoing