ポッドキャスト収録用のメモですよ。
podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。
事件、事故
ソフトバンクはプロキシーサーバーの不具合により、回線認証において他人の情報が表示される事象が発生
(1/27) プロキシーサーバーの不具合による事象の発生について | 企業・IR | ソフトバンク
ソフトバンク株式会社（以下「弊社」）は、プロキシーサーバーの不具合により、携帯電話回線で本人確認を行う回線認証において「My SoftBank」にログインした際に他人の情報が表示されるという事象が発生しました。また、メッセージングサービスにおいて“ソフトバンク”の「S!メール（MMS）」および“ワイモバイル”のMMSで送信元が他人のものに入れ替わるなどの事象が発生したことなどが判明しましたのでお知らせします。これらの事象は現時点で全て復旧しています。なお、今回の事象が発生した原因は、プロキシーサーバーのソフトウエアの不具合によるものと判明しており、外部からのサイバー攻撃などではありません。
中国当局が世界最大の漫画海賊版サイトの運営者を摘発
(1/29) 世界最大の漫画海賊版サイト「BATO.TO」運営者を中国で刑事摘発 | 一般社団法人コンテンツ海外流通促進機構（CODA）
中国上海市公安局は、2025年11月19日、世界最大の海賊版サイト「BATO.TO（xbato.com、bato.to、mangapark.ioなど計60サイト）」を運営し、英語など50カ国以上の言語に翻訳した日本漫画などを権利者に無断で配信していたとして、著作権法違反の疑いで広西チワン族自治区在住の男性の自宅を家宅捜索しました。男性は勾留(身柄拘束による取調べ)を経て現在は保釈されていますが、これらサイト群すべてを運営していたことを認めており、今後起訴される見通しです。
攻撃、脅威
ESET がロシアの攻撃者グループ Sandworm によるポーランドの電力システムへの攻撃活動について報告
(1/23) ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025
In late 2025, Poland’s energy system faced what has been described as the “largest cyberattack” targeting the country in years. ESET Research has now found that the attack was the work of the notorious Russia-aligned APT group Sandworm.
(1/30) DynoWiper update: Technical analysis and attribution
Okta などの SSO プラットフォームを狙うボイスフィッシングの攻撃キャンペーンに関する注意喚起
A massive identity-theft campaign is currently active, targeting Okta Single Sign-On (SSO) and other SSO platform accounts across 100+ high-value enterprises.
(1/28) Unpacking the latest SLH phishing campaign
(1/31) Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft | Google Cloud Blog
Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites to gain initial access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. Once inside, the threat actors target cloud-based software-as-a-service (SaaS) applications to exfiltrate sensitive data and internal communications for use in subsequent extortion demands.
(1/31) Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS | Google Cloud Blog
Google が WinRAR の脆弱性 (CVE-2025-8088) を悪用する様々な攻撃グループの活動について報告
(1/28) Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088 | Google Cloud Blog
The Google Threat Intelligence Group (GTIG) has identified widespread, active exploitation of the critical vulnerability CVE-2025-8088 in WinRAR, a popular file archiver tool for Windows, to establish initial access and deliver diverse payloads. Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated threat actors continue to exploit this n-day across disparate operations. The consistent exploitation method, a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence, underscores a defensive gap in fundamental application security and user awareness
TRM Labs が "2026 Crypto Crime Report" を公開
(1/28) 2026 Crypto Crime Report – Illicit Crypto Trends & Typologies | TRM Labs
Google が法執行機関や他のパートナー企業などと連携して、Residential Proxy サービス最大手の IPIDEA をテイクダウン
(1/29) Disrupting the World's Largest Residential Proxy Network | Google Cloud Blog
This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA’s proxy infrastructure is a little-known component of the digital ecosystem leveraged by a wide array of bad actors.
(1/29) Inside the IPIDEA residential proxy network disrupted by Google
脆弱性
CISA が Known Exploited Vulnerabilities (KEV) カタログに 5+1+1 個の脆弱性を追加
(1/26) CISA Adds Five Known Exploited Vulnerabilities to Catalog | CISA
- CVE-2018-14634 Linux Kernel Integer Overflow Vulnerability
- CVE-2025-52691 SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
- CVE-2026-21509 Microsoft Office Security Feature Bypass Vulnerability
- CVE-2026-23760 SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-24061 GNU InetUtils Argument Injection Vulnerability
(1/27) CISA Adds One Known Exploited Vulnerability to Catalog | CISA
- CVE-2026-24858 Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
(1/29) CISA Adds One Known Exploited Vulnerability to Catalog | CISA
- CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Fortinet の複数の製品に認証バイパスの脆弱性。すでに悪用が確認されている
(1/27) Administrative FortiCloud SSO authentication bypass | PSIRT | FortiGuard Labs
This vulnerability was found being exploited in the wild by two malicious FortiCloud accounts, which were locked out on 2026-01-22. In order to protect its customers from further exploit, Fortinet disabled FortiCloud SSO on FortiCloud side on 2026-01-26. It was re-enabled on 2026-01-27 and no longer supports login from devices running vulnerable versions. Consequently, customers must upgrade to the latest versions listed below for the FortiCloud SSO authentication to function.
(1/22) Analysis of Single Sign-On Abuse on FortiOS | Fortinet Blog
Ivanti EPMM にリモートコード実行可能な脆弱性。すでに悪用が確認されている
(1/29) Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1281 & CVE-2026-1340)
Ivanti has released updates for Endpoint Manager Mobile (EPMM) which addresses two critical severity vulnerabilities. Successful exploitation could lead to unauthenticated remote code execution.
We are aware of a very limited number of customers whose solution has been exploited at the time of disclosure.
This vulnerability does not impact any other Ivanti products, including any cloud products, such as Ivanti Neurons for MDM. Ivanti Endpoint Manager (EPM) is a different product and also not impacted by these vulnerabilities. Customers using an Ivanti cloud product with Sentry are also not impacted by this vulnerability.
(1/30 Ivanti Endpoint Manager Mobile（EPMM）の脆弱性（CVE-2026-1281、CVE-2026-1340）に関する注意喚起
Spike in Ivanti EPMM CVE-2026-1281 RCE exploitation attempts seen by our sensors last 24 hours from at least 13 source IPs. In our scans, we see ~1600 exposed instances worldwide (no vulnerability assessment). Top exposed: Germany
— The Shadowserver Foundation (@Shadowserver) January 31, 2026
Ivanti hotfix guidance: https://t.co/Eo9JlE30cs pic.twitter.com/LpaQWHPxyD
その他
1Password が新しいフィッシング防止機能をリリース
(1/22) As AI Supercharges Phishing Scams, 1Password Introduces Built-In Protection | 1Password
WhatsApp がアカウントを保護する新機能 "Strict Account Settings" をリリース
(1/27) WhatsApp's Latest Privacy Protection: Strict Account Settings - WhatsApp Blog
個人情報保護委員会が「不正アクセス発生時のフォレンジック調査の有効活用に向けた着眼点」を公表
(1/28) 不正アクセス発生時のフォレンジック調査の有効活用に向けた着眼点
IPA が「情報セキュリティ10大脅威 2026」を公表
(1/29) 情報セキュリティ10大脅威 2026 | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構
2026年サイバーセキュリティ月間がスタート
(2/1) NCOサイバーセキュリティ月間2026
