{
 "response": [
  {
   "Event": {
    "uuid": "e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
    "info": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns",
    "date": "2026-11-05",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"Storm-0940\""
     },
     {
      "name": "misp-galaxy:country=\"hong kong\""
     },
     {
      "name": "misp-galaxy:country=\"cambodia\""
     },
     {
      "name": "misp-galaxy:country=\"south korea\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:sector=\"Financial Services\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/",
      "comment": "Check Point Research",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
      "comment": "Microsoft Threat Intelligence",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "1936f227-2555-556b-92d4-7f48f4860626",
    "info": "Binance TH pauses crypto transfers, says Thai funds safe after hack",
    "date": "2026-10-30",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"crypto_theft\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"TraderTraitor\""
     },
     {
      "name": "misp-galaxy:country=\"south korea\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:sector=\"Cryptocurrency\""
     },
     {
      "name": "misp-galaxy:sector=\"Technology\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack",
      "comment": "The Thaiger",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/",
      "comment": "NK Pro",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://newtalk.tw/news/view/2026-10-30/1068375",
      "comment": "New Talk",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://ec.ltn.com.tw/article/breakingnews/5624143",
      "comment": "Liberty Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://en.yna.co.kr/view/AEN20261031000200315",
      "comment": "Yonhap",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://en.yna.co.kr/view/AEN20261031000251315",
      "comment": "Yonhap",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://en.yna.co.kr/view/AEN20261031000252315",
      "comment": "Yonhap",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4",
      "comment": "Japan Today",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.koreaherald.com/article/10921226",
      "comment": "The Korea Herald",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://en.yna.co.kr/view/AEN20261101000300315",
      "comment": "Yonhap",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/",
      "comment": "The Japan Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history",
      "comment": "South China Morning Post",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://newtalk.tw/news/view/2026-11-01/1068564",
      "comment": "New Talk",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.koreaherald.com/article/10921526",
      "comment": "The Korea Herald",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://news.web.nhk/newsweb/na/nd-20261101de69102",
      "comment": "NHK",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.koreaherald.com/article/10921777",
      "comment": "The Korea Herald",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://en.yna.co.kr/view/AEN20261101000351315",
      "comment": "Yonhap",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance",
      "comment": "Free Malaysia Today",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975",
      "comment": "Taipei Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://newtalk.tw/news/view/2026-11-02/1068750",
      "comment": "New Talk",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/",
      "comment": "NK Pro",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/",
      "comment": "The Japan Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html",
      "comment": "Hankyoreh",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/",
      "comment": "NK News",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311",
      "comment": "Channel News Asia",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/",
      "comment": "The Japan Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation",
      "comment": "Free Malaysia Today",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation",
      "comment": "South China Morning Post",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html",
      "comment": "VN Express",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://news.web.nhk/newsweb/na/nd-20261103de69881",
      "comment": "NHK",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 34 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 12, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea, Thailand. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "a967416f-84ac-5091-9236-eec7739030c4",
    "info": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack",
    "date": "2026-10-30",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"data_breach\""
     },
     {
      "name": "misp-galaxy:country=\"hong kong\""
     },
     {
      "name": "misp-galaxy:country=\"japan\""
     },
     {
      "name": "misp-galaxy:country=\"malaysia\""
     },
     {
      "name": "misp-galaxy:country=\"singapore\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:sector=\"Transportation\""
     },
     {
      "name": "misp-galaxy:sector=\"Technology\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack",
      "comment": "South China Morning Post",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516",
      "comment": "Malay Mail",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus",
      "comment": "The Straits Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151",
      "comment": "Channel News Asia",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.matichon.co.th/economy/news_5969157",
      "comment": "Matichon",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach",
      "comment": "Bangkok Post",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe",
      "comment": "The Thaiger",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.matichon.co.th/economy/news_5969937",
      "comment": "Matichon",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "4993de8b-1eda-598c-b85b-f897f4c292c8",
    "info": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
    "date": "2026-09-04",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:country=\"china\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"afghanistan\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Education\""
     },
     {
      "name": "misp-galaxy:sector=\"Manufacturing\""
     },
     {
      "name": "misp-galaxy:sector=\"Healthcare\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  }
 ]
}