2026年6月14日の
セキュリティ情報

Subject: [Intel] Long-term Intrusion by Velvet Ant (Operation Highland)

Dear Team,

We are sharing intelligence regarding a long-term intrusion campaign by the Chinese-linked actor 'Velvet Ant.'

■ Overview
Velvet Ant has been discovered maintaining persistence within a critical infrastructure organization for nearly 10 years. The attackers compromised air-gapped networks by leveraging intermediate systems and modified Linux Pluggable Authentication Modules (PAM) and OpenSSH binaries to bypass authentication and harvest credentials.

■ Scope
- Linux-based servers utilizing PAM and OpenSSH
- Internal and air-gapped networks

■ Recommended Actions
1. Verify the integrity of PAM modules (e.g., pam_unix.so) on critical servers using known-good hashes.
2. Inspect OpenSSH binaries (ssh, sshd, scp) for unauthorized modifications.
3. Enhance monitoring for anomalous SSH traffic between internal network segments, especially those leading to isolated zones.

■ Reference
- Signia (Operation Highland Report)

Priority: Medium
Deadline: As applicable

Subject: [Security Alert] Beware of Phishing Emails and Fraudulent Websites

Dear employees,
We have observed an increase in phishing attacks globally, including fake job offers, fraudulent refund notifications, and spoofed event websites.

Requested Actions:
1. Do not click on links or open attachments from unknown or suspicious senders.
2. Always use official bookmarks or apps to access official services.
3. If you receive a suspicious email, please report it to the IT security team immediately without opening it.

Deadline: Immediate

Subject: [Security Alert] Vigilance Against Phishing and Impersonation

Dear employees,

We have received reports regarding a data leak involving account information (such as contact details) from a French notarial digital identity system.

As a result, there is an increased risk of sophisticated phishing emails or impersonation attacks targeting professional accounts.

Requested Actions:
1. Do not click links or open attachments in emails from unknown senders or those containing unusual requests.
2. Verify the identity of the sender via a secondary communication channel (e.g., phone call) for critical business transactions.

Deadline: Immediate

Subject: [Security Alert] Reminder on Password Management and Security Settings

Dear employees,
We are seeing reports of data breaches in public institutions caused by simple configuration errors and leaked credentials.

To protect our organization, please take the following actions:
1. Avoid reusing passwords across different services and use strong, unique passwords.
2. Be cautious of phishing emails and never enter your credentials on suspicious websites.
3. Ensure that Multi-Factor Authentication (MFA) is enabled on all accounts where available.

Deadline: By the end of this week