Alert: Warning Regarding Recent Unauthorized Access Incidents in Domestic Organizations (Updated)

JPCERT-AT-2026-0030 JPCERT/CC Published: 2026-10-08 Updated: 2026-10-23 In the midst of damage occurring across multiple products and services, there is a lack of technical information sharing. Although the information we possess is limited and fragmented, considering the situation regarding the expansion of attack damage, we hereby issue the following warning. Furthermore, this warning addresses attack types that are particularly increasing in the context of leading to the leakage of large amounts of personal information, separate from the usual sporadic and scattered incidents of unauthorized access such as ransomware attacks. There are cases where systems that do not anticipate access from an unspecified large number of users, such as BI (Business Intelligence) tools or employee management systems, are damaged, and information stored internally is leaked. Such systems also require the following inspections. We will update this page if new information regarding the cause of compromise or attack methods is found. *The information in this section is based on information received by JPCERT/CC. It does not indicate that the same attack method is used in all cases. Information may be added based on future developments.* **Case A: Exploration and attempted attacks on known vulnerabilities in various software** Regarding a series of attacks, it is possible that attackers are not exploiting a single common software vulnerability but are scanning for the presence or absence of various known vulnerabilities for each target to explore vulnerabilities and attempt to exploit them, or they are attempting attacks by exploiting mismanagement of equipment (such as stealing environment configuration files or backup files), even if those are not vulnerabilities. The following suspicious source IP addresses have been newly confirmed. *The following IP addresses were used around October 7th.* Suspicious Source IP Addresses - 20.210.128[.]125 **Case B: Unauthorized operations via API** Unauthorized modifications of information occur through improper requests to the management API of an application. JPCERT/CC has received multiple reports regarding the following attack techniques: (a) Analyzing publicly available smartphone applications to identify API endpoints and keys. (b) Attacks against internal APIs that cannot be executed through screen operations. - Changing user permissions - Creating unauthorized accounts - Checking for differences in responses by switching the presence of headers or providing improperly formatted authentication tokens. - Identifying account information through blind exploration via NoSQL injection. (c) Using API keys stolen from the compromise of other systems. The following suspicious source IP addresses have been confirmed to date. *The following IP addresses may be in regular use at the time of investigation.* Please investigate whether access occurred from the following IP addresses to confirm if they were attacked. *In addition to the following IP addresses, access via Tor exit nodes or residential proxies is also being confirmed for the purpose of evading IP address restrictions or diversifying access.* *The dates in parentheses are the observation dates of the attack or the estimated dates when the attack infrastructure was operating (JST). Attacks may have been attempted outside of this period.* User-Agent Examples - curl/7.88.1 - python-requests/2.34.2 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 **Case C: SQL Injection vulnerability in Metabase (CVE-2026-72898)** This vulnerability can also be exploited through improper requests to the API. JPCERT/CC issued a warning regarding this vulnerability on August 14, 2026. For details on affected products and countermeasures, please check the following warning: JPCERT/CC Warning regarding the SQL Injection vulnerability in Metabase (CVE-2026-72898) https://www.jpcert.or.jp/at/2026/at260023.html The following accesses from suspicious source IP addresses have been confirmed to date. *The following IP addresses may be in regular use at the time of investigation.* Please investigate whether access occurred from the following IP addresses to confirm if they were attacked. Suspicious Source IP Addresses - 213.163.202[.]171 - 221.216.140[.]49 - 221.216.140[.]129 User-Agent Examples - python-requests/2.33.1 - Metabase-GHSA-vwf4/2.0 **Case D: Installation of Web Shell on an Application Server Accessible from a Public Web Server** Cases have been confirmed where WAR files (.war) are installed on an application server accessible from a public web server. The JSP files (.jsp) contained in the WAR file operate as malicious simple web shells. Web shells have the functionality to obtain specific query parameters and execute shell commands. The following accesses from suspicious source IP addresses have been confirmed to date. *The following IP addresses were repeatedly accessed via GET and POST requests to the web shell around September.* Suspicious Source IP Addresses - 124.133.237[.]18 **Measures for Access via API:** * For access to the API, limit the number of requests per unit of time to prevent repeated or massive executions in a short period. * Set individual rate limits and usage limits for functions with a high risk of load or abuse, such as login, password reset, SMS sending, and search processing. * Implement access control on each API endpoint, including non-public APIs, to allow access only from authorized users and HTTP methods. * Grant only the minimum necessary permissions to API users and API tokens. * Set appropriate expiration times for API tokens and avoid the use of long-lived tokens. * Ensure that unnecessary or suspected leaked API tokens can be revoked promptly. **Other General Measures:** * If service usage regions are limited, restrict the access origin to that region. * If operating with versions affected by known vulnerabilities, apply corrected updates. * Review countermeasures against lateral spread after a web server, etc., is compromised. * Review the system for detecting unauthorized access and the initial response upon detection. * Implement calls to customers to prevent secondary damage, such as multi-factor authentication, from the time of normal operations (when a leak occurs). * If services or functions that are not necessary for business operations (such as management functions) are exposed to the internet, stop their public availability. * Do not retain data that has exceeded the retention period stipulated by laws or contracts, or data whose purpose of use has ended. As reiterated, there are cases where systems that do not anticipate access from an unspecified large number of users (such as for employees or BI tools) are damaged. We recommend the above inspections for such systems as well. OWASP API Security Project team OWASP Top 10 API Security Risks 2023 https://api-security.owasp.org/editions/2023/en/0x11-t10/ OWASP Cheat Sheets Series REST Security Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html Maknica Security Research Center Regarding the successive information leakage incidents from web systems https://security.macnica.co.jp/blog/2026/10/web-incidents2026.html Contact for Warnings: Japan Cybersecurity Coordination Center (JPCERT/CC) Cybersecurity Coordination Group Email: ew-info@jpcert.or.jp Contact for Incident Response Consultation: https://www.jpcert.or.jp/form/ Consultation response from investigation vendors, etc.: https://www.jpcert.or.jp/ir/consult.html Updates History 2026-10-08 Published 2026-10-09 Added information to "I. Overview" and "II. Confirmed Attack Methods and Traces" 2026-10-23 Added information to "I. Overview", "II. Confirmed Attack Methods and Traces", and "IV. Reference Information" Organized the description in "II. Confirmed Attack Methods and Traces" Japan Cybersecurity Coordination Center (JPCERT/CC) Cybersecurity Coordination Group Email: ew-info@jpcert.or.jp