{ "response": [ { "Event": { "uuid": "1bc09e60-d48b-59ff-9227-e5d911f09a5f", "info": "SonicWall SSL-VPN authentication bypass vulnerability exploited in actual attacks, multi-factor authentication also neutralized", "date": "2026-11-09", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"exploitation\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/sonicwall-ssl-vpn-authentication-bypass-vulnerability-exploited-in-act-20261109/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209394", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "vulnerability", "category": "External analysis", "value": "CVE-2026-19868", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 9, 2026. Title machine-translated from Korean. Type: exploitation. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "info": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", "date": "2026-11-05", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"Storm-0940\"" }, { "name": "misp-galaxy:country=\"hong kong\"" }, { "name": "misp-galaxy:country=\"cambodia\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/", "comment": "Check Point Research", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "comment": "Microsoft Threat Intelligence", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "ca649294-37b3-58a6-b905-21498e809401", "info": "Personal information of Lee, presidential staff leaked: report", "date": "2026-11-02", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/personal-information-of-lee-presidential-staff-leaked-report-20261102/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261102013200320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261102013251320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261103003700315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10923757", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261103003751315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/asia/east-asia/article/3373065/south-korea-rushes-reissue-passports-president-lee-wife-after-data-leak", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-03/1069015", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261103010400315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261103de70007", "comment": "NHK", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_national/1285585.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_national/1285767.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 11 articles in 6 outlets (Hankyoreh, NHK, New Talk, South China Morning Post, The Korea Herald, Yonhap), Nov 2 to Nov 4, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1936f227-2555-556b-92d4-7f48f4860626", "info": "Binance TH pauses crypto transfers, says Thai funds safe after hack", "date": "2026-10-30", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"crypto_theft\"" }, { "name": "misp-galaxy:threat-actor=\"TraderTraitor\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack", "comment": "The Thaiger", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/", "comment": "NK Pro", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-10-30/1068375", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ec.ltn.com.tw/article/breakingnews/5624143", "comment": "Liberty Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000200315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000251315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000252315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4", "comment": "Japan Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921226", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261101000300315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-01/1068564", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921526", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261101de69102", "comment": "NHK", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921777", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261101000351315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance", "comment": "Free Malaysia Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975", "comment": "Taipei Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-02/1068750", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/", "comment": "NK Pro", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/", "comment": "NK News", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311", "comment": "Channel News Asia", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation", "comment": "Free Malaysia Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html", "comment": "VN Express", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261103de69881", "comment": "NHK", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 34 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 12, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea, Thailand. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "27acc24b-612d-5aeb-8722-ac242eefbaeb", "info": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks", "date": "2026-10-07", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "91b0e4ed-1cae-581b-804b-aaed6cc8a5f8", "info": "North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"APT37\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Manufacturing\"" }, { "name": "misp-galaxy:sector=\"Media\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/north-korean-ted-linux-backdoor-found-inside-trojanised-haproxy-at-south-korean-firms/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Rapid7 Labs disclosed a previously undocumented Linux toolkit compiled directly into trojanised HAProxy 2.8.12 load balancers at two South Korean organisations in the automotive and media sectors. The 'ted' implant and companion 'curlRAT' were delivered by replacing legitimate binaries, including crond, sshd, agetty, atd and polkitd, rather than through vulnerability exploitation, allowing web traffic interception, encrypted SSH credential harvesting and log sanitisation. Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, drawing on APT37 domain infrastructure, Lazarus delivery-model similarities and a Kimsuky-consistent initial access hypothesis involving a compromised groupware vendor.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a33a801c-155e-55ff-a042-ba68fbef2d44", "info": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Healthcare\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "98ed5a28-001f-5c9c-be72-67b4f6d8f172", "info": "North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies", "date": "2026-09-01", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"APT37\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Automotive Manufacturing\"" }, { "name": "misp-galaxy:sector=\"Media and Broadcasting\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/north-korea-linked-backdoor-found-compiled-inside-haproxy-at-two-south-korean-companies/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cyfirma.com/news/weekly-intelligence-report-11-sep-2026/", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Rapid7 Labs disclosed that DPRK-aligned operators compiled a backdoor named 'ted' directly into the victims' existing HAProxy 2.8.12 load balancers using native HAProxy filter APIs, accompanied by a tool named curlRAT and trojanised crond, agetty, atd, sshd and polkitd daemons. C2 mode was triggered by a request for a decoy image path, after which commands were passed via named pipes and the requests were erased from HAProxy logs and statistics without ever reaching the backend. Two South Korean companies in the automotive and media sectors were confirmed affected, with capabilities including credential harvesting, SSH keylogging, session cookie theft and fingerprint-matched drive-by injection. Attribution to APT37 is medium confidence, with possible Lazarus Group overlap.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "555c9614-2fc1-5b9c-9a58-8d1170ae14cd", "info": "SafePay Ransomware Claims Air Liquide Korea", "date": "2026-08-25", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"ransomware\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"manufacturing\"" }, { "name": "misp-galaxy:sector=\"chemicals\"" }, { "name": "misp-galaxy:sector=\"industrial gases\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/safepay-ransomware-claims-air-liquide-korea/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.ransomware.live/id/aW5kdXN0cnkuYWlybGlxdWlkZS5rckBzYWZlcGF5", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "The SafePay ransomware group listed industry.airliquide.kr, the Korean industrial-gases arm of Air Liquide, on its leak site on 25 August 2026. Air Liquide Korea supplies essential gases to major South Korean industries including semiconductor manufacturing; SafePay operates a double-extortion model and had claimed over 530 victims globally by August 2026.", "comment": "summary", "to_ids": false } ] } } ] }