2026年11月9日の
セキュリティ情報

Subject: [Security Advisory] SonicWall SonicOS MFA Bypass (CVE-2026-19868)

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in SonicWall SonicOS.

■ Overview
An authentication enforcement vulnerability in the SonicOS SSL-VPN service allows users with valid credentials for alternate authentication methods to bypass SAML authentication and MFA controls. This vulnerability (CVE-2026-19868) has been added to CISA's KEV catalog due to reports of active exploitation.
CVSS Score: 7.1 / 7.5

■ Scope
- Affected Product: SonicWall SonicOS (SSL-VPN service)

■ Action Required
1. Verify the current version of your SonicOS firmware.
2. Update to the latest patched version provided by SonicWall immediately.

■ Reference
- CISA KEV Catalog
- SonicWall Official Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Vigilance Against Phishing Emails Due to External Data Breach

Dear Employees,

A large-scale data breach has occurred at 'Arara Message,' a Japanese email delivery service, affecting numerous domestic companies.

As a result, your email addresses and other personal information may have been compromised. This increases the risk of receiving sophisticated impersonation or phishing emails.

Requested Actions:
1. Do not click on links in emails from unknown senders or those containing suspicious URLs.
2. Exercise caution when opening attachments and report any suspicious emails to the IT Security team immediately.

Deadline: Please remain vigilant starting today.

Subject: [Security Alert] Warning Against Opening Suspicious Files and Shortcuts

Dear employees,
We have observed cyber attacks that use disguised shortcut files and disk images to infect systems with malware.

Requested Actions:
1. Do not open attachments (especially .LNK or .VHDX files) from unknown or untrusted senders.
2. Avoid clicking suspicious links that prompt you to download files.

Deadline: Immediate

件名: 【共有】APTグループ「Bitter」によるPapRATバックドアの展開について

お疲れさまです。脅威アクター「Bitter」による新キャンペーンに関する情報共有です。

■ 概要
南アジアを標的としたサイバー espionage グループ Bitter が、新種の RAT である「PapRAT」を配備しています。C++およびRust実装が存在し、コマンド実行、ファイル操作、スクリーンショット取得などの機能を持ちます。感染経路として、ftp.exeを悪用するLNKファイル、VHDXイメージ、WebDAV経由のURLショートカットが利用されています。

■ 影響範囲
- Windows OS 環境
- 南アジア地域の組織（主標的）

■ 対応手順
1. エンドポイントにおいて、ftp.exe や PowerShell による不審な外部通信およびタスクスケジューラの登録を監視してください。
2. WebDAV 経由の不審なファイル取得を制限するネットワーク制御を検討してください。
3. LNKファイルやVHDXファイルを用いた不審な挙動の検知ルールを EDR 等に適用してください。

■ 参考情報
- Fortinet FortiGuard Labs Report

対応優先度: 中
対応期限: 随時

Subject: [Threat Intel] Deployment of PapRAT Backdoor by APT Group 'Bitter'

Dear Security Team,
This is a technical update regarding a new campaign by the threat actor 'Bitter'.

■ Overview
The group is deploying a new remote access trojan called 'PapRAT' (C++ and Rust versions). It provides capabilities for command execution, file exfiltration, and screenshot capture. The infection vectors include LNK files abusing ftp.exe, VHDX disk images, and URL shortcuts via WebDAV.

■ Scope
- Windows environments
- Organizations in South Asia (primary targets)

■ Mitigation Steps
1. Monitor for suspicious outbound traffic and scheduled task creation initiated by ftp.exe or PowerShell.
2. Evaluate network restrictions on suspicious file downloads via WebDAV.
3. Implement EDR detection rules for anomalous LNK and VHDX file execution patterns.

■ Reference
- Fortinet FortiGuard Labs Report

Priority: Medium
Deadline: Ongoing

Subject: [Security Advisory] Red Hat Product Vulnerabilities (AV26-1136)

Dear IT Administration Team,

This is a notification regarding security advisory AV26-1136 issued by Red Hat.

■ Overview
Red Hat has identified vulnerabilities across a wide range of its product portfolio. Immediate review and patching are recommended to mitigate potential risks.

■ Affected Scope
- Red Hat Enterprise Linux (10/6/7/8/9)
- OpenShift (Serverless, Container Platform 4/5, AI, Dev Spaces)
- Red Hat Ansible Automation Platform 2 / Ansible Core 2
- Red Hat JBoss Enterprise Application Platform 7/8
- Red Hat build of Keycloak (Versions prior to 26.4-29, 26.4-30, 26.4.17-2)
- Others: AMQ Broker, Fuse, Satellite 6, etc.

■ Action Plan
1. Audit the Red Hat products and versions currently deployed in the environment.
2. Check the Red Hat Customer Portal for the specific fixed versions for each product.
3. Apply the latest security patches as soon as possible.

■ Reference
- Red Hat Security Advisory AV26-1136

Priority: High
Deadline: Immediate