2026年4月29日の
セキュリティ情報

Subject: [Info] New GPS Interference Detection Technology

Dear team,

I am sharing information regarding a new development in GPS interference detection.

■ Overview
Researchers at Oak Ridge National Laboratory (ORNL) have developed a portable device capable of detecting both GPS jamming and spoofing. Notably, the device can differentiate between authentic and fake signals even when they possess equal strength, demonstrating higher sensitivity than current industry standards in DHS tests.

■ Scope of Impact
- Logistics, fleet management, and any critical infrastructure relying on GPS for positioning and timing.

■ Recommended Actions
1. Review the resilience of internal GPS-dependent systems against spoofing attacks.
2. Assess risks associated with GPS interference in operational areas.
3. Evaluate the potential integration of advanced detection hardware or alternative positioning systems (e.g., INS).

■ Reference
- The Register: Researchers move in the right direction, develop powerful GPS interference alarm

Priority: Low
Deadline: N/A

Subject: [Info] Deprecation of Legacy TLS (1.0/1.1) for Exchange Online

Hi team,

This is a notification regarding Microsoft's plan to block legacy TLS versions for Exchange Online.

■ Overview
Microsoft will start blocking TLS 1.0 and 1.1 connections for POP3 and IMAP4 in Exchange Online starting July 2026 to improve security and compliance.

■ Scope
- Environments using Exchange Online with legacy email clients (POP3/IMAP4) that do not support TLS 1.2 or later.

■ Action Plan
1. Audit current email clients to identify those relying on TLS 1.0/1.1.
2. Plan upgrades for any clients that do not support TLS 1.2+.
3. Accelerate the transition from basic authentication (POP3/IMAP4) to modern authentication (OAuth2).

■ Reference
- Microsoft Official Advisory / The Register

Priority: Low (due to the long lead time)
Deadline: July 2026

Subject: [Security Alert] Handling Suspicious Shortcut (.lnk) Files

Dear employees,
We have received reports of attacks exploiting Windows shortcut (.lnk) files to steal authentication credentials.

Please take the following actions:
1. Do not open any files with the ".lnk" extension from unknown email attachments or untrusted internet downloads.
2. Ensure your Windows Update is completed to keep your system up to date.

Deadline: By the end of this week

件名: 【共有】Windows LNK脆弱性 (CVE-2026-32202) 対応について

お疲れさまです。Windows LNKファイルの処理に関する脆弱性の悪用について情報共有です。

■ 概要
WindowsシェルにおけるLNKファイルの処理不備により、攻撃者が作成した悪意のあるファイルを介してNTLMv2ハッシュ等の認証情報を外部へ送信させられる脆弱性です。APT28による悪用が指摘されています。

■ 影響範囲
- Windows OS (2026年4月更新プログラム適用前のバージョン)

■ 対応手順
1. 2026年4月の定例セキュリティ更新プログラムを全エンドポイントおよびサーバーに適用する。
2. 外部への不要なSMB通信を制限し、認証情報の漏洩経路を遮断する。
3. SIEM/EDRにて、不審な外部IPへのNTLM認証リクエストおよびSMB接続ログを監視する。

■ 参考情報
- CISA KEV (Known Exploited Vulnerabilities) Catalog
- Microsoft Security Update Guide

対応優先度: 高
対応期限: 2026年5月12日

Subject: [Technical Alert] Windows LNK Vulnerability (CVE-2026-32202) Mitigation

Dear IT Security Team,

This is a technical alert regarding the active exploitation of a Windows LNK file processing vulnerability.

■ Overview
CVE-2026-32202 allows attackers to force a system to attempt authentication to a remote server via a malicious LNK file, leading to the leakage of NTLMv2 hashes. This is linked to APT28 activity.

■ Scope
- Windows OS (Versions prior to April 2026 security updates)

■ Mitigation Steps
1. Deploy the April 2026 Windows Security Updates across all endpoints and servers.
2. Restrict unnecessary outbound SMB traffic to prevent credential exfiltration.
3. Monitor logs for anomalous NTLM authentication attempts and outbound SMB connections to unknown IPs.

■ Reference
- CISA KEV Catalog
- Microsoft Security Update Guide

Priority: High
Deadline: May 12, 2026