2026年6月12日の
セキュリティ情報

Subject: [Security Alert] Stay Vigilant Against Phishing Attacks

Dear employees,

We would like to inform you that a major global phishing platform has recently been taken down by international law enforcement. While this is positive news, it often leads to a shift in attacker tactics or the misuse of previously stolen data.

What we need from you:
1. Do not click on links or open attachments from unknown or suspicious senders.
2. If you encounter a suspicious page asking for your password, close the browser immediately and report it to the IT security team.

Deadline: Immediate (Please review and stay alert)

Subject: [Info] Breach of US Water Utility by Threat Actor Handala

Dear Team,

We are sharing information regarding a recent attack on California Water Service by the Iran-linked actor Handala.

■ Overview
It is analyzed that the attackers compromised an RTKBase (GNSS base station platform) instance and laterally moved to a customer billing system to exfiltrate approximately 5GB of data.

■ Scope
- Environments utilizing RTKBase or similar GNSS base station platforms.
- Environments where ICS/OT networks are not properly segmented from corporate IT networks.

■ Recommended Actions
1. Review access logs for any externally facing industrial platforms (e.g., RTKBase) for unauthorized access.
2. Ensure that Multi-Factor Authentication (MFA) is enforced for all administrative interfaces.
3. Verify network segmentation between OT/control systems and corporate billing/business systems to prevent lateral movement.

■ Reference
- SecurityWeek Article

Priority: Medium
Deadline: Next scheduled security review

Subject: [Security Advisory] Microsoft Surface Firmware Vulnerability (Bricking Risk)

Dear IT Administration Team,

We are sharing information regarding a critical firmware vulnerability affecting Microsoft Surface devices.

■ Overview
A flaw has been identified that allows a device to be rendered inoperable (bricked) via a single packet, specifically when Secure Core and Secure Boot are disabled. This vulnerability was inadvertently uncovered through a Python script generated by Microsoft Copilot.

■ Scope
- Affected Products: Microsoft Surface series
- Condition: Devices with Secure Core and Secure Boot disabled

■ Mitigation Steps
1. Ensure all Surface devices in the organization have the latest firmware updates applied.
2. Verify that Secure Core and Secure Boot are enabled across all deployed units to prevent exploitation.

■ Reference
- The Register report

Priority: Medium
Deadline: Next scheduled maintenance window

Subject: [Security Advisory] Agentjacking Attacks Targeting AI Coding Agents

Dear IT/Security Team,

We are sharing information regarding a new attack vector called "Agentjacking" that targets AI-powered coding assistants.

■ Overview
Agentjacking exploits a flaw where malicious payloads injected into Sentry error events are returned to AI agents (such as Claude Code and Cursor) as trusted system output. The AI agent then suggests these payloads as legitimate diagnostic or resolution steps, tricking the developer into executing arbitrary code on their local machine.

■ Scope
- Development environments utilizing Sentry MCP servers and AI coding agents (e.g., Claude Code, Cursor).

■ Mitigation Steps
1. Instruct developers to manually review all code and commands suggested by AI agents before execution.
2. Implement the principle of least privilege for AI agent permissions to limit access to sensitive environment variables and credentials.
3. Monitor for updates from Sentry and AI tool providers regarding the handling of external event data.

■ Reference
- Tenet Security Agentjacking Research

Priority: Medium
Deadline: Immediate awareness