{
 "response": [
  {
   "Event": {
    "uuid": "bb33be26-9cb1-55d1-813e-f1315b7600ad",
    "info": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget",
    "date": "2026-09-25",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"crypto_theft\""
     },
     {
      "name": "misp-galaxy:country=\"singapore\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:sector=\"Cryptocurrency\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-20260925/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.nknews.org/pro/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-bitget/",
      "comment": "NK Pro",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.channelnewsasia.com/business/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-in-hack-6410806",
      "comment": "Channel News Asia",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://thanhnien.vn/gia-bitcoin-hom-nay-2892026-tin-tac-tau-tan-xong-83-trieu-usd-trong-vu-hack-bitget-185260928081934906.htm",
      "comment": "Thanh Nien News",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://thanhnien.vn/ceo-bitget-khong-may-lac-quan-ve-kha-nang-thu-hoi-3875-trieu-usd-bi-hack-185260930112333106.htm",
      "comment": "Thanh Nien News",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 4 articles in 3 outlets (Channel News Asia, NK Pro, Thanh Nien News), Sep 25 to Sep 30, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Vietnam, Singapore. Largest figure in the headlines: 352,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "4993de8b-1eda-598c-b85b-f897f4c292c8",
    "info": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
    "date": "2026-09-04",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:country=\"china\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"afghanistan\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Education\""
     },
     {
      "name": "misp-galaxy:sector=\"Manufacturing\""
     },
     {
      "name": "misp-galaxy:sector=\"Healthcare\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
    "info": "Four nation-state actors deploy shared BlueMoon Chrome and Windows zero-day exploit kit within twelve days",
    "date": "2026-08-28",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"apt\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"APT31\""
     },
     {
      "name": "misp-galaxy:country=\"united states\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"singapore\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Non-Governmental Organisations\""
     },
     {
      "name": "misp-galaxy:sector=\"Financial Services\""
     },
     {
      "name": "misp-galaxy:sector=\"Manufacturing\""
     },
     {
      "name": "misp-galaxy:sector=\"Mining and Commodities\""
     },
     {
      "name": "misp-galaxy:sector=\"Consulting\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/four-nation-state-actors-deploy-shared-bluemoon-chrome-and-windows-zero-day-exploit-kit-within-twelve-days/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "TA412 (APT31) and three suspected China-aligned clusters tracked as UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket independently deployed the same exploit chain combining Chrome V8 type confusion CVE-2026-85046, an unnamed V8 sandbox escape and Windows kernel privilege escalation CVE-2026-85880. TA412 activity began on 28 August 2026 against US NGOs, mining companies and commodity traders; the other clusters followed from 2 September, hitting Vietnamese manufacturing and then Indonesian and Singaporean government, consulting and financial entities. The Chromium patch had been public since 7 August but Chrome stable only shipped on 3 September, giving the actors a wide exploitation window. The convergence on one kit points to a shared exploit broker or quartermaster.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "74657fff-2b96-5e87-8bba-660969e4162e",
    "info": "China-linked SecFlow campaign uses AI agents against Asian government and industrial targets",
    "date": "2026-08-20",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"china\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Education\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense\""
     },
     {
      "name": "misp-galaxy:sector=\"Industrial\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/china-linked-secflow-campaign-uses-ai-agents-against-asian-government-and-industrial-targets/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Hunt.io documented a Chinese-speaking operation tracked as SecFlow, linked to a username 'Nie' recurring across its infrastructure, which routed Claude, Qwen and DeepSeek through private proxies at niestools.com to automate reconnaissance and exploitation. The toolkit included the GLUTTON webshell framework delivering steganographic payloads inside PNG files, a fake MySQL deserialization service, a Java and CAS exploitation workspace, and Shellshock and credential-testing nodes. Confirmed targeting spanned Kuomintang Party archives in Taiwan, the Indonesian Ministry of Foreign Affairs, and Chinese and Vietnamese government, education and industrial hosts. A confirmed breach of the Fengtai District government office-automation environment yielded 822 OA user records and 1.28GB of data including patient health information.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "2ceaa6d1-4431-5d21-9dce-b5562b5f35f0",
    "info": "Vietnam-linked APIS database exposes 220.8 million passenger and crew records",
    "date": "2026-06-03",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"data_breach\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:sector=\"Transportation and Aviation\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/vietnam-linked-apis-database-exposes-2208-million-passenger-and-crew-records/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198671/data-breach/massive-vietnam-linked-apis-database-exposes-passport-and-flight-data.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Kinryu Labs discovered an unsecured Elasticsearch cluster named 'pax-info' hosted on Viettel-assigned IP space in Hanoi containing 220.8 million Advance Passenger Information System records across 29 indices and roughly 107GB. Exposed fields included names, dates of birth, nationalities, passport and travel-document numbers, flight numbers, airline details, seat assignments and baggage references, covering January 2017 to April 2026. The operator could not be definitively identified; researchers notified Vietnamese authorities, airlines and national CERTs on 3 June and the database was secured by 8 June, with public disclosure following on 8 September. Affected travellers span Asia-Pacific, Europe and the Middle East, and absent server logs no conclusion could be drawn on prior theft.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "2f3f0da8-0a2d-56d3-817a-eba0777e6843",
    "info": "Earth Alux Espionage Campaign Targets ASEAN Defense Ministries",
    "date": "2025-10-15",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"Earth Alux\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:country=\"malaysia\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense Industrial Base\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/earth-alux-espionage-campaign-targets-asean-defense-ministries/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "Trend Micro Research",
       "url": "https://www.trendmicro.com/en_us/research.html"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Trend Micro researchers disclosed an ongoing espionage campaign by Earth Alux (China-linked) targeting defense ministries and military contractors across Thailand, Philippines, Vietnam, and Malaysia. The group deployed VARGEIT and COBEACON implants via trojanized military procurement documents. The campaign has been active since at least Q4 2025, with lateral movement into classified networks confirmed at two ASEAN defense organizations.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  }
 ]
}