2026年9月28日の
セキュリティ情報

Subject: [Security Alert] Beware of Suspicious Emails and Attachments

Dear employees,
We have observed an increase in sophisticated phishing attacks targeting financial services. Opening suspicious HTML files or links in emails can lead to malware infections and the theft of personal or corporate account information.

Requested Actions:
1. Do not open attachments (especially .html, .js, .pdf) or click links from unknown or suspicious senders.
2. If you have accidentally clicked a suspicious link or downloaded an unknown file, please report it to the IT Security team immediately.

Deadline: Immediate

Subject: [Intel] Ransomware Attack Leveraging Active Directory Group Policies

Dear team,

We are sharing information regarding a new attack technique observed in the 'PAYLOAD' campaign.

■ Overview
Attackers targeted a Middle Eastern manufacturer, gaining access via compromised FortiGate SSL VPN credentials. Notably, the attackers did not use traditional encryption malware; instead, they utilized Active Directory Group Policies to lock systems and exfiltrate data.

■ Scope
- Environments utilizing FortiGate SSL VPN
- Organizations using Active Directory for endpoint management

■ Recommended Actions
1. Ensure Multi-Factor Authentication (MFA) is strictly enforced for all VPN access.
2. Review logs for suspicious login activity on privileged domain accounts.
3. Audit Group Policy Object (GPO) changes to detect unauthorized modifications.

■ Reference
- Xakep (Kaspersky report)

Priority: Medium
Deadline: Ongoing