2026年6月6日の
セキュリティ情報

Subject: [Info] New Attack Vectors and Vulnerabilities in Autonomous AI Systems

Dear Team,

We are sharing information regarding new attack chains targeting autonomous AI systems.

■ Overview
Microsoft's red teaming has identified 'zero-click human-computer interaction bypass' attack chains. By leveraging 'approval fatigue' and 'session context pollution,' attackers can bypass human oversight to achieve data exfiltration or lateral movement. Additionally, a critical RCE vulnerability in the OpenClaw framework (CVE-2026-25253) has been noted.

■ Scope
- Autonomous AI Agents
- OpenClaw Framework
- Environments utilizing Model Context Protocol (MCP)

■ Recommended Actions
1. Establish a Software Bill of Materials (SBOM) for deployed AI agents, including plugins, MCP servers, and prompt templates.
2. Implement encrypted identity verification for AI agents to prevent impersonation.
3. Review AI approval workflows to mitigate 'approval fatigue' caused by high volumes of low-risk requests.

■ Reference
- Microsoft Failure Mode Taxonomy for Autonomous AI Systems

Priority: Medium
Deadline: Next system review

Subject: [Security Alert] Beware of Impersonation Attacks via Phone and Physical Visits

Dear employees,

We have received reports of attackers posing as IT support or help desk staff to steal sensitive information through phone calls and physical office visits.

Please follow these guidelines:
1. Do not follow instructions from unsolicited calls or emails claiming to be "IT support" or "software updates," and never share your passwords.
2. If someone visits the office claiming to be an IT technician, do not allow them to access your computer or plug in any USB drives unless their identity has been officially verified.
3. Report any suspicious contacts or visitors to the IT department immediately.

Deadline: Immediate action required.

件名: 【共有】UNC3753による物理的・リモート複合攻撃への対応について

お疲れさまです。脅威アクターUNC3753（Luna Moth/Chatty Spider）に関する情報共有です。

■ 概要
米国の専門サービス業を標的に、偽のヘルプデスク電話や請求書メールを用いたソーシャルエンジニアリングを展開しています。特筆すべきは、リモート攻撃が失敗した際に、IT技術者を装って物理的にオフィスへ侵入し、USBメモリを用いてデータを窃取する手法を併用している点です。

■ 影響範囲
- 物理的なオフィスアクセスが可能な全社内環境
- USBポートが有効なエンドポイント

■ 対応手順
1. USBデバイスの利用制限（USBストレージの無効化またはホワイトリスト化）の再確認。
2. 外部ベンダーやIT作業員の入館管理プロセスの厳格化と身分証確認の徹底。
3. ヘルプデスクを装った電話攻撃（Vishing）に関する社員教育の実施。

■ 参考情報
- Mandiant Threat Intelligence

対応優先度: 高
対応期限: 今週中

Subject: [Threat Intel] UNC3753 Hybrid Remote and Physical Attack Campaign

Dear Security Team,

This is a briefing on the activities of threat actor UNC3753 (also known as Luna Moth or Chatty Spider).

■ Overview
UNC3753 is targeting professional services in the US using a combination of social engineering (vishing/phishing) and physical intrusion. If remote access attempts fail, the actors physically enter offices posing as IT technicians to exfiltrate data via USB drives.

■ Scope
- All physical office environments
- Endpoints with enabled USB ports

■ Mitigation Steps
1. Review and enforce USB storage restrictions (disable or whitelist approved devices).
2. Tighten physical access controls and identity verification for external vendors/technicians.
3. Conduct employee awareness training specifically targeting vishing (voice phishing) and impersonation.

■ Reference
- Mandiant Threat Intelligence

Priority: High
Deadline: End of this week