「うちの会社、大丈夫かな？」

Subject: [Security Advisory] PackageKit Privilege Escalation Vulnerability (CVE-2026-41651)

Dear IT Administration Team,

We are sharing information regarding a critical privilege escalation vulnerability in PackageKit.

■ Overview
A vulnerability identified as CVE-2026-41651 (CVSS 8.8), known as 'Pack2TheRoot', allows unprivileged local users to execute package installation/removal commands without authentication, potentially leading to full root access. This flaw has existed for approximately 12 years.

■ Scope
- Product: PackageKit
- Affected Versions: 1.0.2 through 1.3.4
- Affected Distributions: Ubuntu, Debian, Fedora, Rocky Linux, etc.

■ Remediation Steps
1. Verify the installation and version of PackageKit:
- Debian/Ubuntu: dpkg -l | grep -i packagekit
- RHEL/Fedora/Rocky: rpm -qa | grep -i packagekit
2. Update PackageKit to the latest version (1.3.5 or newer).
3. Check the service status using 'systemctl status packagekit'.

■ Reference
- 12-year-old Pack2TheRoot bug lets Linux users gain root privileges

Priority: High
Deadline: Immediate action recommended

Subject: [Security Alert] Beware of Impersonation Attacks via Microsoft Teams

Dear employees,
We have observed attacks where threat actors pose as IT support staff on Microsoft Teams to trick users into installing malicious software.

What we need from you:
1. Do not click links or open files sent by unknown individuals or unexpected contacts on Microsoft Teams.
2. If you are asked to install a "patch" or "spam-blocking tool," please report it to the IT department immediately.

Deadline: Immediate

件名: 【共有】UNC6692によるMicrosoft Teams経由の「Snow」マルウェア感染について

お疲れさまです。UNC6692による新たな攻撃手法に関する情報共有です。

■ 概要
攻撃者は「メール爆弾」で標的を混乱させた後、TeamsでITヘルプデスクを装い、AutoHotkeyスクリプトを用いて「SnowBelt」という悪意のあるChrome拡張機能を展開します。このスイートはトンネラーとバックドアを含み、最終的にドメイン乗っ取りやデータ窃取を狙います。

■ 影響範囲
- Microsoft Teamsを利用し、Chrome/Edgeブラウザを使用しているエンドポイント

■ 対応手順
1. Teamsにおける外部ユーザーとの通信制限および不審なメッセージの監視を強化してください。
2. ブラウザのグループポリシー（GPO）を用いて、未承認の拡張機能のインストールを制限してください。
3. Quick Assist等のリモートアクセスツールの利用状況を監視し、不審なセッションがないか確認してください。

■ 参考情報
- Mandiant / Microsoft Threat Intelligence reports

対応優先度: 高
対応期限: 速やかに

Subject: [Threat Intel] Deployment of "Snow" Malware by UNC6692 via Microsoft Teams

Dear Security Team,

This is a technical briefing regarding the activities of threat actor UNC6692.

■ Overview
The actor utilizes "email bombing" to create urgency, followed by social engineering via Microsoft Teams posing as IT support. They deploy a dropper that executes AutoHotkey scripts to install "SnowBelt," a malicious browser extension. The full "Snow" suite includes a tunneler and a backdoor for deep network compromise and credential theft.

■ Scope
- Endpoints utilizing Microsoft Teams and Chromium-based browsers (Chrome/Edge).

■ Mitigation Steps
1. Tighten controls on external communications within Microsoft Teams.
2. Implement GPO policies to restrict the installation of unauthorized browser extensions.
3. Monitor for unauthorized use of remote access tools such as Quick Assist.

■ Reference
- Mandiant / Microsoft Threat Intelligence reports

Priority: High
Deadline: Immediate