2026年8月28日の
セキュリティ情報

Subject: [Info] Apple Private Cloud Compute (PCC) CVE-2026-20685 Mitigation

Dear team,

This is a technical update regarding a vulnerability in Apple's Private Cloud Compute (PCC) infrastructure.

■ Overview
A path traversal vulnerability (CVE-2026-20685) was identified in the 'darwin-init' boot component of PCC, which supports Apple Intelligence. An attacker with specific network access could potentially redirect AI inference telemetry data (e.g., request IDs, token counts, latency) to an external server. The CVSS 3.1 score is 6.5.

■ Scope
- Affected Product: Apple Private Cloud Compute (PCC)
- Fixed Version: PCC 5E290.3

■ Action Required
As this is a server-side vulnerability in Apple's managed infrastructure, no manual patching is required by end-users or enterprise admins. However, it is recommended to maintain visibility over AI-related data flows.

■ Reference
- CVE-2026-20685

Priority: Medium
Deadline: N/A (Fixed by vendor)

Subject: [Intel] Observation of New GoCaracal Malware by APT Dark Caracal

Dear team,

We are sharing intelligence regarding a new campaign by the Lebanon-linked APT group Dark Caracal.

■ Overview
Dark Caracal has deployed a new Go-based framework named "GoCaracal" alongside an updated Bandook backdoor. A key technical detail is the implementation of an Ethereum-based fallback for C2 communications, designed to ensure resilience against traditional network-level blocking.

■ Scope
- Communications organizations, government entities, and critical infrastructure.

■ Recommended Actions
1. Monitor network traffic for unusual connections to Ethereum nodes or unexpected external endpoints.
2. Implement detection for unsigned or unknown Go-based binaries executing on endpoints.
3. Perform scans for known Bandook backdoor signatures.

■ Reference
- Arctic Wolf Labs Report

Priority: Medium
Deadline: Ongoing