Alert: Warning Regarding Recent Unauthorized Access Incidents in Domestic Organizations (Updated)

* A warning was issued regarding information sharing due to damage across multiple products and services.
* The warning addresses attack types leading to large personal information leakage, separate from sporadic access incidents.
* Exploratory attacks target known software vulnerabilities or mismanagement of equipment configuration/backup files.
* Suspicious source IP 20.210.128[.]125 was confirmed around October 7th.
* Unauthorized modifications occur via improper requests to application management APIs.
* Attack techniques include analyzing public applications for API endpoints and keys, attacking internal APIs via permission changes or injection, and using stolen API keys.
* Specific access from suspicious source IPs (20.210.128[.]125) was confirmed.
* The SQL Injection vulnerability in Metabase (CVE-2026-72898) can be exploited via API requests.
* Suspicious source IPs 213.163.202[.]171, 221.216.140[.]49, and 221.216.140[.]129 were confirmed accessing the Metabase vulnerability.
* Suspicious source IP 124.133.237[.]18 was confirmed accessing a web shell.
* API access measures include rate limiting, setting usage limits, implementing endpoint access controls, and revoking leaked tokens.

The information presents a multifaceted threat landscape where exploitation vectors shift from traditional intrusion to advanced API manipulation and infrastructure compromise. The pattern observed suggests adversaries are not relying on a single vulnerability but employing an iterative reconnaissance phase across multiple targets—scanning for known flaws, manipulating application logic via APIs, and leveraging system misconfigurations (like file access) as an initial foothold. The concurrent focus on specific endpoints like Metabase and publicly exposed web shells indicates a strategy prioritizing data exfiltration through interconnected systems rather than isolated breaches.
The pattern of threat actor behavior involves establishing an initial entry point or reconnaissance phase (Case A), transitioning to exploiting application logic through insecure APIs (Case B and C), and finally achieving remote execution via deployed payloads like web shells (Case D). This indicates a systemic approach where internal data leakage is the ultimate goal, facilitated by chaining together weaknesses in code, configuration, and access control mechanisms. The explicit inclusion of IP addresses ties abstract vulnerability knowledge to concrete, traceable activity, suggesting that security advisory functions are evolving from theoretical warnings to operational threat intelligence tied directly to observed compromises.
The implications point toward a necessary evolution in defense strategies: perimeter security is insufficient when internal application logic and API interactions are the primary attack surface. The call for stringent API controls—rate limiting, granular access control, and token management—is a direct response to documented methods of API abuse. The inherent tension lies between the speed at which attackers can iterate on these exploits and the slower, often bureaucratic process of patching and implementing comprehensive access governance across complex systems. The missing question is how quickly organizational security posture can adapt to the observed pattern of blended attacks against interconnected services.