Thailand
Southeast Asia · capital Bangkok · cyber picture, physical security and relations with the EU on one page
Who targets Thailand
All 9 actors →
China (6) · 
North Korea (1) · 
Russia (1)| Actor | Suspected sponsor | In its news · 30d | Techniques |
|---|---|---|---|
| TraderTraitor named in the news only | North Korea |
1 | — |
| APT17 named in the news only | China |
1 | 16 |
| SAMURAI PANDA named in the news only | China |
1 | — |
| Lazarus Group | North Korea |
— | 30 |
| APT27 | China |
— | 57 |
| APT10 | China |
— | 46 |
| Earth Lusca | China |
— | 44 |
| TA505 | Russia |
— | 34 |
| ToddyCat | not attributed | — | 25 |
| Naikon | China |
— | 14 |
| APT41 | China |
— | 6 |
| APT30 | China |
— | 2 |
Cyber news 30 days
Every cyber article that mentions it →- AI threats see banks bolster cybersecurity measures
- Sihasak meets Min Aung Hlaing to discuss border security, cracking down on scammers and solving cross-border river pollution TH
- Editorial – Cyber threats are intensifying TH
- Exodus in Karen State’s Shwe Kokko as Chinese-run cyber scams relocate to Payathonzu
- Chaiyanak sets up joint working group to solve cyber threats, confirms government is not involved with spyware TH
- House committee seeks answers on spyware
- Summary of discussions: ‘Chaiyanat’, Minister of DE, joins 14 tech companies to set up a working group to connect data and handle cyber threats TH
- Watch the Shuffle.com gambling website case linked to the husband of a Chaiyaphum MP; DSI reveals it's difficult to reach shareholders, considers transferring the case; Cyber police find evidence of 3 Thai users TH
- Thai official targeted by spyware, Apple steps in ID
- Yotsanan congratulates Nong Pond, a 1st-year student at Khon Kaen University, for discovering a NASA vulnerability; accelerating the training of cyber talent to look after Thai systems TH
Exploited vulnerabilities in its news 90 days
Incidents
Register →- Elevated CAAT says only 2 from 7 main Thai airlines affected by data breach Detected
- Elevated Deputy Chief of Kut Chok Subdistrict Administrative Organization files a report with Cyber Police to find the person who hacked his Facebook Detected
- Critical Binance TH pauses crypto transfers, says Thai funds safe after hack Detected
- High Data Breach at Major Thai Hospital Chain
- High Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns Detected
- High Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack Detected
- High SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets
- High Earth Alux Espionage Campaign Targets ASEAN Defense Ministries
National CERT advisories
All →- Warning of critical vulnerability in Apache HTTP Server, risk of RCE attack without authentication TH
- ASUS and Zoom release updates to fix vulnerabilities, risking remote code execution with high privileges and privilege escalation on the system TH
- Attackers found using AntiFox AI Agent to attack Cloud systems and steal AWS Credentials via Alibaba Cloud infrastructure TH
- Over 35,000 applications created with Grok AI found to be public, risking corporate data and password leaks TH
- Alert: Plex2Shell vulnerability attack found on QNAP NAS, risk of remote command execution and system takeover without authentication TH
- Warning! Critical vulnerability found in WordPress plugin 'Confection', risk of website takeover TH
Cyber threat landscape as described in the country report of Nov 12 Machine-generated
Thailand faced a significant and evolving cyber threat landscape during this period, characterized by daily, sophisticated attacks. The National Security Council (NSC) confirmed on November 9, 2026, that the country is under daily AI-powered cyberattack attempts targeting government agencies, banks, and public utilities. These attackers are increasingly leveraging artificial intelligence to identify system weaknesses and penetrate protected networks. While critical systems are reportedly under effective protection, the methods employed by cyber attackers are continuously evolving, necessitating ongoing vigilance and enhanced preparedness.
Notable incidents included a data breach affecting Thai Airways, disclosed on November 9, 2026, where approximately 60,529 passenger booking records were potentially accessed through its third-party provider, Amadeus. This incident was part of a broader series of breaches impacting several Asian airlines. The Civil Aviation Authority of Thailand (CAAT) responded by ordering tighter aviation cybersecurity measures. Additionally, several local government entities, specifically the Kut Chok and Sam Bandit Subdistrict Administrative Organizations, reported their Facebook pages being hacked between November 7 and November 11, 2026, leading to the posting of abusive content and subsequent police investigations. Furthermore, on November 11, 2026, Thailand's Digital Economy and Society Minister met with Apple representatives following mercenary spyware alerts received by politicians, indicating targeted surveillance attempts. The government's response includes Prime Minister Anutin Charnvirakul ordering heightened cyber defenses, the National Cyber Security Agency (NCSA) monitoring threats, and coordination with technology companies to develop a national security plan.
Background: Threat actors known to target Thailand include Lazarus Group (North Korea-linked), APT27 (China-linked), APT10 (China-linked), Earth Lusca (China-linked), TA505 (Russia-linked), ToddyCat, Naikon (China-linked), and APT41 (China-linked). The FBI attributed the global Binance hack in late October 2026 to the North Korea-linked hacking group TraderTraitor, which is relevant context for the broader cyber threat landscape, though not directly against Thailand in this specific reporting period.
Hotspots from the country report of Nov 12
Machine-generated- Elevated Mae Sot, Tak Province — Increased military patrols and risk of spillover from Myanmar conflict, including stray rounds and refugee movements.
- Moderate Chai Nat Province — Location of Kut Chok SAO Facebook hack, indicating vulnerability of local government digital assets.
- Moderate Phra Nakhon Si Ayutthaya Province — Location of Sam Bandit SAO Facebook hack, highlighting widespread local government cyber vulnerabilities.
- High Bangkok — Center of government, financial institutions, and critical infrastructure targeted by daily AI-powered cyberattacks and mercenary spyware.
- Elevated Thai-Cambodia Border — Diplomatic tensions over border disputes and past combat experience with newly commissioned drones.
- Moderate Gulf of Thailand — Area for potential maritime security concerns and unresolved territorial claims with Cambodia.
Threat level last reports
Machine-generatedLatest country report
Read the full report →Relations with the EU
Factsheet →Mentioned 1 times in latest briefing. Last updated: 2026-08-04
- 17 EU cooperation projects · 14 active
- 1 EU Digital & ICT project: cyber activity here touches EU digital cooperation
- 3 trade or cooperation agreements on record
EU relations and implications country report of Nov 12
Machine-generatedThailand's relations with the European Union saw significant progress in trade cooperation during this period. The 10th round of negotiations for a Thailand-EU Free Trade Agreement (FTA) concluded on October 6, 2026, with both sides expressing optimism about finalizing the deal by the end of the year. Thai Commerce Minister Suphajee Suthumpun noted substantial progress, with most chapters, including raw materials, rules of origin, energy, and sanitary and phytosanitary measures, largely settled. EU Ambassador Luisa Ragher, speaking on November 4, 2026, underscored the strategic importance of the FTA, envisioning Thailand as Europe's platform in Southeast Asia and highlighting the agreement's potential to boost Thai GDP by 1.25% and exports by 2.8%. This ongoing dialogue and the anticipated agreement signify a stable and strengthening economic partnership, aligning with the "Stable" outlook assessed in August 2026.
The security and cyber developments, particularly the daily AI-powered cyberattacks and significant data breaches, carry implications for EU interests and cooperation projects in Thailand. While the EU's cooperation projects in sectors like Trade & Investment, Infrastructure & Transport, Development Cooperation, Governance & Rule of Law, and Education & Skills are assessed as stable, the heightened cyber threat landscape could pose risks to the SCOPE Digital — Copernicus Earth Observation Southeast Asia project and other digital initiatives. The need for robust cybersecurity measures, as emphasized by the Thai government, will be crucial to protect shared digital infrastructure and ensure the integrity of data exchanged within these cooperation frameworks. Continued collaboration on cybersecurity best practices and threat intelligence sharing will be vital to safeguard mutual digital interests.
| Agreement | Type | Budget | Organisation | Period | Status | |
|---|---|---|---|---|---|---|
| ARISE Plus — ASEAN Regional Integration Support | Trade & Cooperation | EUR 94M | ASEAN | 2017–2024 | COMPLETED | Source ↗ |
| ASEAN Customs Transit System (ACTS) | Trade & Cooperation | — | ASEAN | 2020–2025 | ACTIVE | Source ↗ |
| EU-Thailand FTA Negotiations (Relaunched) | Free Trade Agreement | — | ASEAN | 2023 | PLANNED | Source ↗ |
Previous reports
Machine-generated- Thailand Security Report — November 11, 2026
- Thailand Security Report — November 10, 2026
- Thailand Security Report — November 09, 2026
- Thailand Security Report — November 08, 2026
- Thailand Security Report — November 07, 2026
- Thailand Security Report — November 06, 2026
- Thailand Security Report — November 05, 2026
- Thailand Security Report — November 04, 2026
- Thailand Security Report — November 02, 2026
- Thailand Security Report — November 01, 2026