2026年11月3日の
セキュリティ情報

Subject: [Intel] AI-driven attacks by Vapor Panda using ARTEX framework

Dear Team,

We are sharing intelligence regarding a global espionage campaign by the Chinese threat actor Vapor Panda.

■ Overview
Attackers are utilizing the AI penetration testing framework "ARTEX" combined with LLMs (such as DeepSeek) to automate the attack lifecycle from reconnaissance to lateral movement. Notably, the actors use AI agents to identify endpoints lacking security software (e.g., CrowdStrike Falcon) to focus their efforts on the weakest links.

■ Scope of Impact
- Government, Semiconductor, Defense, Finance, and Telecommunications sectors globally.
- Environments with inconsistent EDR/endpoint protection coverage.

■ Recommended Actions
1. Conduct a comprehensive asset audit to ensure all endpoints are covered by EDR/security agents.
2. Enhance monitoring for password spraying attempts against privileged accounts.
3. Enforce Multi-Factor Authentication (MFA) for all administrative access.

■ Reference
- CrowdStrike Threat Intelligence Report

Priority: High
Deadline: Immediate review

Subject: [Security Alert] Proper Management of AI Service API Keys

Hi everyone,
We would like to alert you to a threat called 'LLMjacking,' where attackers steal AI service API keys to run expensive tasks at the company's expense.

What we need from you:
1. Never share API keys via email, chat, or shared documents.
2. Do not hard-code API keys directly into source code.
3. Be cautious of phishing emails or links that ask for your AI service login credentials.

Deadline: Immediate (Please ensure these practices are followed)

件名: 【共有】LLMjacking（LLM APIキー窃取）への対策について

お疲れさまです。LLMjackingに関する情報共有です。

■ 概要
攻撃者がフィッシングやソースコード漏洩、設定ミス等を通じてLLMのAPIキーを奪取し、高額な計算リソースを不正利用する攻撃です。従来のクリプトジャッキングと異なり、短時間で極めて高額なクラウド請求が発生するリスクがあります。

■ 影響範囲
- LLM API（Google Vertex AI, OpenAI, Azure OpenAI等）を利用している全環境

■ 対応手順
1. APIキーのハードコードを禁止し、Secret Manager等の安全な管理手法へ移行する。
2. APIキーにクォータ制限（予算上限）を設定し、異常な消費を検知するアラートを有効化する。
3. APIキーの定期的なローテーションを自動化する。
4. クライアントサイドコード（フロントエンド）にAPIキーが露出していないか監査する。

■ 参考情報
- Google Threat Intelligence / Mandiant Report

対応優先度: 高
対応期限: 今週中

Subject: [Security Info] Mitigating LLMjacking (LLM API Key Theft)

Hi team,
This is a technical update regarding 'LLMjacking' attacks.

■ Overview
Threat actors are stealing LLM API keys via phishing, source code leaks, or misconfigurations to fraudulently leverage expensive AI computing resources. Unlike cryptojacking, LLMjacking can cause massive spikes in cloud billing within a few hours.

■ Scope
- All environments utilizing LLM APIs (e.g., Google Vertex AI, OpenAI, Azure OpenAI).

■ Mitigation Steps
1. Prohibit hard-coding of API keys; migrate to secure secret management tools (e.g., Secret Manager).
2. Implement strict quota limits and set up real-time billing alerts for anomalous consumption.
3. Automate the rotation of API keys.
4. Audit client-side code to ensure no API keys are exposed to the end-user.

■ Reference
- Google Threat Intelligence / Mandiant Report

Priority: High
Deadline: End of this week