事件、事故

山形銀行を騙るボイスフィッシングによる不正送金被害が発生

(3/10) 当行を騙る「ボイスフィッシング」による不正送金に関する注意喚起について

(3/10) 山形銀行を騙る不審な電話（ボイスフィッシング）にご注意ください｜山形銀行

(3/10) 被害額は十数億円山形銀行かたる不審な自動音声電話複数の企業がだまし取られたか（2025年3月10日掲載）｜YBC NEWS NNN

(3/12) 山形鉄道、１億円被害企業に相次ぐ山形銀装う電話、県警がフィッシング詐欺で捜査（山形新聞） - Yahoo!ニュース

(参考) 1億円を不正送金された山形鉄道への音声フィッシングについてまとめてみた - piyolog

X でサイバー攻撃による大規模な接続障害が発生

(3/10) X hit by 'massive cyberattack' amid Dark Storm's DDoS claims

(3/11) X、日米などで障害イーロン・マスク氏「大規模なサイバー攻撃」 - 日本経済新聞

(3/11) Xのサイバー攻撃マスク氏「ウクライナ地域のIPアドレス」主張 | NHK | IT・ネット

(3/11) What Really Happened With the DDoS Attacks That Took Down X | WIRED

(3/14) Massive DDoS on X: Dark Storm or Cyber Fog? | Bitsight

Earlier this week, users of the X (formerly Twitter) social network were either unable to access the platform or experienced service degradation somehow. On March 10, 2025, reports emerged of users worldwide being unable to log in, post, or view content. This incident was later attributed to a large-scale distributed denial-of-service (DDoS) attack targeting X's infrastructure.

Naturally, Bitsight TRACE went to look at our available data sources and quickly confirmed that this was indeed a DDoS attack, mostly involving IoT devices (e.g. IP cameras, DVRs, routers). In the past, we’ve mentioned the dangers of having these kinds of devices exposed. Interesting to note that most of the traffic does indeed come from specific geographies. But no, it's not coming from Ukraine. One of the countries that seemed to be driving most IoT traffic attacking X is, well, South Africa, which I found somewhat ironic.

(参考) 2025年3月に発生したXへの大規模サイバー攻撃についてまとめてみた - piyolog

ℹ️ Note: X (formerly Twitter) is experiencing international outages; incident is not related to country-level internet disruptions or filtering #Twitterdown pic.twitter.com/maepY9SN4r
— NetBlocks (@netblocks) March 10, 2025

There was (still is) a massive cyberattack against 𝕏.

We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.

Tracing … https://t.co/aZSO1a92no
— Elon Musk (@elonmusk) March 10, 2025

On March 10, social media platform X experienced a series of five different disruptions of varying duration, rendering the service inaccessible to some users worldwide. The issues were first observed around 9:45 UTC and appeared to be resolved for most users by 18:15 UTC. During… pic.twitter.com/KjcEfllRvI
— Cisco ThousandEyes (@thousandeyes) March 10, 2025

攻撃、脅威

2025年1月に修正されたFortiGate7.0.X系の管理画面を対象としたCVE-2024-55591、CVE-2025-24472を悪用したSuperBlackランサム攻撃をForescout社が報告。調査した所、本日時点でもグローバルで23K台、国内1K台超の脆弱サーバを発見。なお、管理画面閉鎖、パッチ適用済み機器でも以下のような極めて面倒… pic.twitter.com/kpJ4Cr5M7f
— nekono_nanomotoni (@nekono_naha) March 14, 2025

Microsoft が Booking.com を騙るフィッシングキャンペーンについて報告

(3/13) Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware | Microsoft Security Blog

Starting in December 2024, leading up to some of the busiest travel days, Microsoft Threat Intelligence identified a phishing campaign that impersonates online travel agency Booking.com and targets organizations in the hospitality industry. The campaign uses a social engineering technique called ClickFix to deliver multiple credential-stealing malware in order to conduct financial fraud and theft. As of February 2025, this campaign is ongoing.

脆弱性

CISA が Known Exploited Vulnerabilities (KEV) カタログに 5+6+2 個の脆弱性を追加

(3/10) CISA Adds Five Known Exploited Vulnerabilities to Catalog | CISA

CVE-2025-25181 Advantive VeraCore SQL Injection Vulnerability

CVE-2024-57968 Advantive VeraCore Unrestricted File Upload Vulnerability

CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

(3/11) CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA

CVE-2025-24983 Microsoft Windows Win32k Use-After-Free Vulnerability

CVE-2025-24984 Microsoft Windows NTFS Information Disclosure Vulnerability

CVE-2025-24985 Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

CVE-2025-24991 Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

CVE-2025-24993 Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

CVE-2025-26633 Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

(3/13) CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Microsoft が 2025年 3月の月例パッチを公開。すでに悪用が確認されている脆弱性を含む。

(3/11) 2025 年 3 月のセキュリティ更新プログラム (月例) | MSRC Blog | Microsoft Security Response Center

今月のセキュリティ更新プログラムで修正した脆弱性のうち、以下の脆弱性は更新プログラムが公開されるよりも前に悪用が行われていることや脆弱性の詳細が一般へ公開されていることを確認しています。お客様においては、更新プログラムの適用を早急に行ってください。脆弱性の詳細は、各 CVE のページを参照してください。

CVE-2025-26630 Microsoft Access のリモートコードが実行される脆弱性

CVE-2025-26633 Microsoft Management Console セキュリティ機能のバイパスの脆弱性

CVE-2025-24993 Windows NTFS のリモートでコードが実行される脆弱性

CVE-2025-24991 Windows NTFS の情報漏えいの脆弱性

CVE-2025-24985 Windows FAST FAT ファイルシステムドライバーのリモートでコードが実行される脆弱性

CVE-2025-24984 Windows NTFS の情報漏えいの脆弱性

CVE-2025-24983 Windows Win32 カーネルサブシステムの特権の昇格の脆弱性

(3/11) Zero Day Initiative — The March 2025 Security Update Review

#ESETresearch has discovered a zero day exploit abusing #CVE-2025-24983 vulnerability in Windows Kernel to elevate privileges (#LPE). First seen in the wild in March 2023, the exploit was deployed through #PipeMagic backdoor on the compromised machines. 1/4 pic.twitter.com/qCOgYiltfs
— ESET Research (@ESETresearch) March 11, 2025

Apple が macOS Sequoia 15.3.2, iOS 18.3.2 / iPadOS 18.3.2, tvOS 18.3.1, visionOS 2.3.2, Safari 18.3.1 をリリース。すでに悪用が確認されている脆弱性の修正を含む。

(3/11) Apple security releases - Apple Support

Juniper Networks が Junos OS の脆弱性を修正。すでに悪用を確認

(3/12) 2025-03 Out-of-Cycle Security Bulletin: Junos OS: A local attacker with shell access can execute arbitrary code (CVE-2025-21590)

At least one instance of malicious exploitation (not at Amazon) has been reported to the Juniper SIRT. Customers are encouraged to upgrade to a fixed release as soon as it's available and in the meantime take steps to mitigate this vulnerability.

(3/12) 2025-03 Reference Advisory: The RedPenguin Malware Incident

(3/12) Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers | Google Cloud Blog

(3/14) JunOS and RedPenguin | Censys