{ "type": "bundle", "id": "bundle--3beca38e-8e79-4118-a2be-c42da579d1b5", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "SecurityStudies.info", "identity_class": "organization", "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5", "created": "2026-11-10T16:32:08.759Z", "modified": "2026-11-13T00:02:47.782Z", "name": "SPH Media hit by cyberattacks; no payment card details or financial information compromised", "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, Free Malaysia Today, Mothership, The Straits Times), Nov 10, 2026. Type: data breach; sectors: financial services, media. Asia-Pacific countries affected: Singapore. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-inf-20261110/" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/politics/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-information-compromised", "description": "SPH Media hit by cyberattacks; no payment card details or financial information compromised" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sph-media-cyberattack-data-breach-6538681", "description": "SPH Media hit by cyberattacks; says no customer financial data or access exposed" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/highlight/2026/11/10/singapore-s-sph-media-hit-by-cyberattacks-personal-database-exposed", "description": "Singapore’s SPH media hit by cyberattacks, personal database exposed" }, { "source_name": "Mothership", "url": "https://mothership.sg/2026/11/sph-media-hit-by-ai-enabled-cyberattacks-subscribers-names-phone-numbers-accessed/", "description": "SPH Media hit by AI-enabled cyberattacks; subscribers' names, phone numbers accessed" } ], "x_securitystudies_occurred_on": "2026-11-10", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services", "Media" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Singapore", "country": "SG" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2971254a-e63e-57e7-86a9-28831990c695", "created": "2026-11-10T16:32:08.759Z", "modified": "2026-11-10T16:32:08.759Z", "relationship_type": "related-to", "source_ref": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-13T00:02:47.646Z", "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/" }, { "source_name": "Check Point Research", "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/", "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns" }, { "source_name": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "description": "ARTEX abuse expands as cybercriminals target financial sector" } ], "x_securitystudies_occurred_on": "2026-11-05", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Hong Kong", "country": "HK" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Cambodia", "country": "KH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "South Korea", "country": "KR" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Thailand", "country": "TH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6", "created": "2026-11-09T04:30:05.339Z", "modified": "2026-11-09T04:30:05.339Z", "name": "Storm-0940", "aliases": [ "CovertNetwork-1658", "ORB07" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/storm-0940/" } ], "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702", "created": "2026-11-10T16:32:08.626Z", "modified": "2026-11-13T00:02:47.603Z", "name": "No evidence of customer data leak in unauthorized transactions: SinoPac", "description": "Detected automatically from 3 articles in 3 outlets (Liberty Times, New Talk, Taipei Times), Nov 4 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 40,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/no-evidence-of-customer-data-leak-in-unauthorized-transactions-sinopac-20261104/" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-04/1069275", "description": "永豐銀行419人遭盜轉！金額約4千餘萬 北檢今分案偵辦" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/05/2003867168", "description": "No evidence of customer data leak in unauthorized transactions: SinoPac" }, { "source_name": "Liberty Times", "url": "https://ec.ltn.com.tw/article/breakingnews/5638871", "description": "永豐銀行資安事件今送報告 金管會全面調查缺失" } ], "x_securitystudies_occurred_on": "2026-11-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government", "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Taiwan", "country": "TW" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ea92fcab-e2b4-5704-8ab2-7dd9d7a0b086", "created": "2026-11-10T16:32:08.626Z", "modified": "2026-11-10T16:32:08.626Z", "relationship_type": "related-to", "source_ref": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--1936f227-2555-556b-92d4-7f48f4860626", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-13T00:02:47.432Z", "name": "Binance TH pauses crypto transfers, says Thai funds safe after hack", "description": "Detected automatically from 34 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 12, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea, Thailand. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack", "description": "Binance TH pauses crypto transfers, says Thai funds safe after hack" }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/", "description": "North Korean actors steal $6.36B from Binance in largest crypto theft in history" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-10-30/1068375", "description": "金將軍又缺錢？ 幣安2千多億加密貨幣遭駭創歷來之最 北韓遭認是兇手" }, { "source_name": "Liberty Times", "url": "https://ec.ltn.com.tw/article/breakingnews/5624143", "description": "史上最大駭客攻擊！幣安遭竊逾2000億 美分析指向北韓" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000200315", "description": "N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000251315", "description": "(LEAD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000252315", "description": "(2nd LD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Japan Today", "url": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4", "description": "Hackers steal $6.3 billion from Binance in record heist blamed on North Korea" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921226", "description": "N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261101000300315", "description": "FBI says N. Korea responsible for over US$6 bln crypto theft from Binance" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/", "description": "FBI blames North Korea for $6 billion Binance crypto hack" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history", "description": "FBI blames North Korea for stolen billions from Binance in biggest hack in history" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-01/1068564", "description": "幣安逾60億美元資產遭竊　FBI指北韓所為" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921526", "description": "FBI says N. Korea responsible for over $6b crypto theft from Binance" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261101de69102", "description": "暗号資産大手バイナンスへのサイバー攻撃 FBI“北朝鮮が関与”" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921777", "description": "North Korean cyberterrorism gains renewed scrutiny after record Binance heist" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261101000351315", "description": "(LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance", "description": "FBI says North Korea behind US$6bil crypto theft from Binance" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975", "description": "N Korea behind US$6bn crypto theft, FBI says" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-02/1068750", "description": "20分鐘盜逾60億美元加密貨幣! 北韓駭客疑感情詐騙滲透幣安工程師 川普這樣說...." }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/", "description": "FBI confirms North Korea behind record $6.36B Binance crypto heist" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/", "description": "Binance outflows hit $4.7 billion after record North Korea hack" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html", "description": "FBI identifies North Korean hackers as responsible for unprecedented Binance breach" }, { "source_name": "NK News", "url": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/", "description": "Kim Yo Jong denies North Korean involvement in $6B Binance crypto theft" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311", "description": "North Korea slams FBI allegations over Binance hack as 'grave' provocation" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/", "description": "North Korea calls U.S. claims it was behind Binance hack ‘a grave political provocation’" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation", "description": "N. Korea slams FBI allegations over Binance hack as ‘grave’ provocation" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation", "description": "Sister of North Korea’s Kim slams FBI’s Binance hack allegations as ‘grave’ provocation" }, { "source_name": "VN Express", "url": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html", "description": "Triều Tiên đáp trả cáo buộc 'tấn công mạng Binance' từ FBI" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261103de69881", "description": "世界的な暗号資産取引所へのサイバー攻撃　北朝鮮が関与否定" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 5, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2dc31aa3-0df9-5ff5-8935-df97ac69a0c9", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8d42d050-12da-57fe-addc-71e86dc8ac78", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a", "created": "2026-11-09T04:30:05.217Z", "modified": "2026-11-09T04:30:05.217Z", "name": "TraderTraitor", "aliases": [ "Jade Sleet", "Pukchong", "UNC4899" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/tradertraitor/" } ], "description": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--55952837-5ab0-5bcc-b705-b0d57744ac9d", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a967416f-84ac-5091-9236-eec7739030c4", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-13T00:02:47.442Z", "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack", "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack", "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516", "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus", "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151", "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969157", "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต" }, { "source_name": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach", "description": "THAI passenger data compromised in Amadeus security breach" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe", "description": "Thai Airways confirms passenger data leak but credit card details safe" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969937", "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Transportation", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Japan", "country": "JP" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Malaysia", "country": "MY" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-11T20:40:49.496Z", "name": "Unauthorized access: 'Possibility that the stage has shifted to targeting financial institutions'", "description": "Detected automatically from 1 article in 1 outlet (NHK), Oct 21, 2026. Title machine-translated from Japanese. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/incident-20261021/" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261021de62921", "description": "不正アクセス“金融機関が狙われる段階に変わってきた可能性”" } ], "x_securitystudies_occurred_on": "2026-10-21", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--15167757-32a5-5dae-ac45-cb8bfc38855a", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-10T16:32:08.267Z", "relationship_type": "related-to", "source_ref": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700", "created": "2026-11-10T16:32:08.071Z", "modified": "2026-11-10T16:40:20.464Z", "name": "Man loses over RM12mil in suspected crypto theft", "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Oct 10, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Malaysia. Largest figure in the headlines: 12,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/man-loses-over-rm12mil-in-suspected-crypto-theft-20261010/" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/nation/2026/10/10/man-loses-over-rm12mil-in-suspected-crypto-theft", "description": "Man loses over RM12mil in suspected crypto theft" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/10/10/man-loses-over-rm12m-in-suspected-crypto-theft/238570", "description": "Man loses over RM12m in suspected crypto theft" } ], "x_securitystudies_occurred_on": "2026-10-10", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--437f539d-d38e-565c-83bb-b7434db3be93", "created": "2026-11-10T16:32:08.071Z", "modified": "2026-11-10T16:32:08.071Z", "relationship_type": "related-to", "source_ref": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51", "created": "2026-11-10T16:32:08.013Z", "modified": "2026-11-10T16:40:20.414Z", "name": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says", "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, New York Times China, Taipei Times, The Japan Times), Oct 8, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: China. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/south-korea-bank-hack-suspect-may-be-26-year-old-in-china-us-firm-says-20261008/" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/10/08/south-korea-cyberattack-china-suspect/", "description": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-6441386", "description": "CrowdStrike says China-based suspect used AI tools in South Korean bank hacks" }, { "source_name": "New York Times China", "url": "https://www.nytimes.com/2026/10/08/world/australia/south-korea-bank-hack-china-us-ai.html", "description": "Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/front/archives/2026/10/09/2003865655", "description": "S Korean banks likely hacked by China-based actor: CrowdStrike" } ], "x_securitystudies_occurred_on": "2026-10-08", "x_securitystudies_severity": 5, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--231e90b4-4920-54e1-af65-e3447d240a54", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "China", "country": "CN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2c908ce6-1ad8-53ce-862f-6f73cc5830a9", "created": "2026-11-10T16:32:08.013Z", "modified": "2026-11-10T16:32:08.013Z", "relationship_type": "related-to", "source_ref": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51", "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb", "created": "2026-11-10T16:32:08.007Z", "modified": "2026-11-10T16:40:20.409Z", "name": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks", "description": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html", "description": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks" } ], "x_securitystudies_occurred_on": "2026-10-07", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b735b72-62fa-5c94-980b-26bd9658327a", "created": "2026-11-10T16:32:08.007Z", "modified": "2026-11-10T16:32:08.007Z", "relationship_type": "related-to", "source_ref": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:40:20.195Z", "name": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget", "description": "Detected automatically from 4 articles in 3 outlets (Channel News Asia, NK Pro, Thanh Nien News), Sep 25 to Sep 30, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Vietnam, Singapore. Largest figure in the headlines: 352,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-20260925/" }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-bitget/", "description": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-in-hack-6410806", "description": "Crypto exchange Bitget pauses withdrawals after $350 million stolen in hack" }, { "source_name": "Thanh Nien News", "url": "https://thanhnien.vn/gia-bitcoin-hom-nay-2892026-tin-tac-tau-tan-xong-83-trieu-usd-trong-vu-hack-bitget-185260928081934906.htm", "description": "Giá Bitcoin hôm nay 28.9.2026: Tin tặc tẩu tán xong 83 triệu USD trong vụ hack Bitget" }, { "source_name": "Thanh Nien News", "url": "https://thanhnien.vn/ceo-bitget-khong-may-lac-quan-ve-kha-nang-thu-hoi-3875-trieu-usd-bi-hack-185260930112333106.htm", "description": "CEO Bitget: 'Không mấy lạc quan về khả năng thu hồi 387,5 triệu USD bị hack'" } ], "x_securitystudies_occurred_on": "2026-09-25", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--db02ef0f-ae60-50ba-8bc8-cf8199b3ccbb", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:32:07.760Z", "relationship_type": "related-to", "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Vietnam", "country": "VN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--03abcbf0-41cf-5c95-a2ec-d4428c33673c", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:32:07.760Z", "relationship_type": "related-to", "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-10T16:26:37.587Z", "name": "GitLab maximum-severity path traversal exploited within hours of disclosure", "description": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.", "confidence": 50, "labels": [ "supply_chain", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog" } ], "x_securitystudies_occurred_on": "2026-09-11", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology and Software Supply Chain", "Financial Services", "Government" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United States", "country": "US" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fc3a7591-bd53-50ae-8a72-e41de1afbd37", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United Kingdom", "country": "GB" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2659c6c3-953e-58b2-9aa3-3265700a2b97", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Germany", "country": "DE" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--689583b4-610b-5c43-be4e-fd6b7195d101", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a7ac4e90-1e57-5eb8-ab78-8e93cbae1ba1", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--095279bc-69f1-5155-a576-8cfad052b57e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "India", "country": "IN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1e5d137b-c900-551e-a96d-d91718577e9d", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--43d29671-3132-541c-b643-0985fe12aebb", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Dutch NCSC warns critical Check Point VPN flaws face imminent exploitation", "description": "The Dutch National Cyber Security Centre issued a warning that exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN Security Gateway and Security Management Servers is imminent, assessing both likelihood and impact as high. CVE-2026-85102 is an improper certificate validation flaw during VPN negotiation enabling arbitrary code execution, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder permitting remote code execution; both are rated 9.8. Affected versions include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80 through R81.10, with R82.20 unaffected. No public exploit code existed at time of reporting and neither CVE appears in the CISA KEV catalog as of version 2026.09.11. Patches shipped 9 September 2026.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/dutch-ncsc-warns-critical-check-point-vpn-flaws-face-imminent-exploitation/" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html" } ], "x_securitystudies_occurred_on": "2026-09-09", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Financial Services", "Critical Infrastructure", "Manufacturing" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Netherlands", "country": "NL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--56561444-f2fa-5f98-a150-4192444a07ac", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--5bde517c-7bdd-5a8b-9e12-4357c671ee3f", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c8f1404a-837d-5b97-b4ef-9facfcc40be8", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1620e02b-0832-534f-b54b-9b94c8547bc6", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--afcd4fe1-ec8e-5dad-b123-13144bc09f07", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Australia", "country": "AU" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e458f5b5-c8f5-52a2-87ac-d3b80558d13c", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--f7d316db-381f-51e6-a4ea-729844292af2", "created": "2026-11-08T21:16:16.715Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Qilin ransomware compromises the Philippine Ports Authority", "description": "The Philippine Ports Authority was compromised on 5 September 2026 in an intrusion attributed to the Qilin ransomware operation and subsequently added to the group's data-leak site as part of a double-extortion campaign. The victim sits squarely in the transportation and maritime logistics sector at a time of heightened South China Sea tension, giving the incident strategic as well as commercial significance. Qilin remained the most prolific ransomware brand globally in 2026, with more than 500 victims claimed during the year.", "confidence": 50, "labels": [ "ransomware", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/qilin-ransomware-compromises-the-philippine-ports-authority/" }, { "source_name": "source", "url": "https://www.hookphish.com/blog/ransomware-group-qilin-hits-philippine-ports-authority/" }, { "source_name": "source", "url": "https://ctiwatch.com/victims/0e550d65-88dc-4a3b-9d25-8d5d367e65e4-philippine-ports-authority" }, { "source_name": "source", "url": "https://www.moxfive.com/blog/qilin-ransomware-2026-ttps-victims-and-defense-guide" } ], "x_securitystudies_occurred_on": "2026-09-05", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Transportation and Maritime", "Government" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Philippines", "country": "PH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--851892c9-c7f0-5d2e-9644-a4577e6c74b4", "created": "2026-11-08T21:16:16.715Z", "modified": "2026-11-08T21:16:16.715Z", "relationship_type": "related-to", "source_ref": "incident--f7d316db-381f-51e6-a4ea-729844292af2", "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Unpatched StyleSmuggler Zero-Day Exploited Across Magento and Adobe Commerce Stores", "description": "Dutch security firm Sansec disclosed active exploitation, beginning 4 September 2026, of an unpatched flaw affecting Magento Open Source 2.4.6 through 2.4.9 and Adobe Commerce. Attackers plant PHP code into files Magento writes, such as failure reports, and execution is triggered automatically when the platform renders its routine Payment Transaction Failed Reminder email, requiring no user interaction. The resulting backdoor runs as a process disguised as the Linux kernel thread [kworker/u:8:0], installs binaries in the user home directory rather than the web root, and re-adds cron entries every five minutes. No CVE, patch or official workaround existed as of 6 September 2026, with the next scheduled Adobe security release set for 8 September.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/unpatched-stylesmuggler-zero-day-exploited-across-magento-and-adobe-commerce-stores/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Retail & E-commerce", "Technology" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--0e406bb3-0a39-5075-8f96-d9cd6e06de90", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d0c66848-781e-57bb-9bb1-d2a4a77b0773", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--3a268a25-e664-5085-8aa6-967531515923", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--f51a42fc-c1bc-5f11-a014-b06620be9890", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d715dae8-45d7-58c8-9d8b-8b8fc6ebfdcc", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "description": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/" }, { "source_name": "source", "url": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Technology", "Financial Services", "Healthcare" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7f4ae124-6b26-520d-8306-f3df41bdc29a", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--61f8abc6-b0fd-5c03-ac7f-45ee19b1d8a6", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--0f08bb4e-8dc7-5fda-8c39-751c887e6e04", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--343d1641-2005-55b4-a2ff-02e0f31e83a4", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8d466d58-e466-5116-9c0d-9743d902f512", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-10T16:26:37.587Z", "name": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets", "description": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/" }, { "source_name": "source", "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Education", "Manufacturing", "Healthcare" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e7abb989-2773-57b7-ae68-ece06d3664fd", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-08T21:16:16.708Z", "relationship_type": "related-to", "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Indonesia", "country": "ID" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--4f4f93e7-0fc6-5ae0-a6a0-54fca02eacca", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-08T21:16:16.708Z", "relationship_type": "related-to", "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--46ddf5df-0dfa-5683-b9b8-91ab537721e4", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-08T21:16:16.708Z", "relationship_type": "related-to", "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fb865868-8a32-500d-8fd8-2f35681509ce", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-08T21:16:16.708Z", "relationship_type": "related-to", "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1df41102-2f1d-5e81-b020-e232fb5f92f8", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-08T21:16:16.708Z", "relationship_type": "related-to", "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Afghanistan", "country": "AF" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8e9b5194-01ee-57c0-8e08-073a02c4576d", "created": "2026-11-08T21:16:16.708Z", "modified": "2026-11-08T21:16:16.708Z", "relationship_type": "related-to", "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8", "target_ref": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8", "created": "2026-11-08T21:16:16.707Z", "modified": "2026-11-10T16:26:37.587Z", "name": "North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms", "description": "Rapid7 Labs disclosed a previously undocumented Linux toolkit compiled directly into trojanised HAProxy 2.8.12 load balancers at two South Korean organisations in the automotive and media sectors. The 'ted' implant and companion 'curlRAT' were delivered by replacing legitimate binaries, including crond, sshd, agetty, atd and polkitd, rather than through vulnerability exploitation, allowing web traffic interception, encrypted SSH credential harvesting and log sanitisation. Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, drawing on APT37 domain infrastructure, Lazarus delivery-model similarities and a Kimsuky-consistent initial access hypothesis involving a compromised groupware vendor.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/north-korean-ted-linux-backdoor-found-inside-trojanised-haproxy-at-south-korean-firms/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Manufacturing", "Media", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c4eb5c6c-d312-591e-9abd-78b237948d1e", "created": "2026-11-08T21:16:16.707Z", "modified": "2026-11-08T21:16:16.707Z", "relationship_type": "related-to", "source_ref": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837", "created": "2026-11-09T04:30:08.705Z", "modified": "2026-11-09T04:30:08.705Z", "name": "APT37", "aliases": [ "APT 37", "APT-C-28", "ATK4", "G0067", "Group 123", "Group123", "InkySquid", "Moldy Pisces", "Operation Daybreak", "Operation Erebus", "PLAIN NEPTUNE", "Reaper", "Reaper Group", "Red Eyes", "Ricochet Chollima", "ScarCruft", "TEMP.Reaper", "Venus 121" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G0067", "url": "https://attack.mitre.org/groups/G0067/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/apt37/" } ], "description": "APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--02c303aa-d0a6-5130-bbee-416e070f1828", "created": "2026-11-08T21:16:16.707Z", "modified": "2026-11-08T21:16:16.707Z", "relationship_type": "related-to", "source_ref": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8", "target_ref": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837", "description": "attribution" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--dda27c44-0117-5591-abf6-2cffa8099661", "created": "2026-11-08T21:16:16.710Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Citrix NetScaler Authentication Bypass CVE-2026-19490 Under Active Attack", "description": "Security firm Previdian reported that on 3 September 2026 one of its NetScaler sensors received requests matching public proof-of-concept code from three distinct source IPs geolocated to Australia, the United States and Germany. CVE-2026-19490 permits unprivileged remote attackers to bypass authentication on NetScaler ADC and Gateway appliances configured as AAA virtual servers or gateways, depending on firmware version and SAML Action configuration. Belgium's National Cybersecurity Coordination Centre issued a parallel warning, and more than 22,000 NetScaler ADC appliances are tracked as internet-exposed. Citrix released fixed builds in mid-August 2026.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/citrix-netscaler-authentication-bypass-cve-2026-19490-under-active-attack/" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/" } ], "x_securitystudies_occurred_on": "2026-09-03", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Financial Services", "Healthcare", "Technology" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e7883170-4258-5022-ac87-d26ac2502370", "created": "2026-11-08T21:16:16.710Z", "modified": "2026-11-08T21:16:16.710Z", "relationship_type": "related-to", "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--0b238368-454f-5156-bb93-34eeb86cd472", "created": "2026-11-08T21:16:16.710Z", "modified": "2026-11-08T21:16:16.710Z", "relationship_type": "related-to", "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--39c557e8-6841-50a6-9a0a-9862dc0e6b56", "created": "2026-11-08T21:16:16.710Z", "modified": "2026-11-08T21:16:16.710Z", "relationship_type": "related-to", "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--f8de1409-c8bc-547e-863c-07817401d9a2", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Belgium", "country": "BE" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--64580759-d4cc-58eb-8d86-aecc9f422b2d", "created": "2026-11-08T21:16:16.710Z", "modified": "2026-11-08T21:16:16.710Z", "relationship_type": "related-to", "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661", "target_ref": "location--f8de1409-c8bc-547e-863c-07817401d9a2", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-10T16:26:37.587Z", "name": "SonicWall SMA 1000 Zero-Day Chain Exploited for Remote Code Execution", "description": "SonicWall disclosed that threat actors are chaining two previously unknown vulnerabilities in SMA 1000 remote-access appliances. CVE-2026-83548, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, is used to reach internal functionality, and CVE-2026-83549, a CVSS 7.8 OS command injection in the Appliance Management Console, converts that access into arbitrary command execution. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 September 2026 with a remediation deadline of 5 September. Compromise of these appliances yields authenticated network position behind perimeter controls.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/sonicwall-sma-1000-zero-day-chain-exploited-for-remote-code-execution/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html" } ], "x_securitystudies_occurred_on": "2026-09-02", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Technology", "Financial Services" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--93a4b897-9098-5258-8f78-c11ca62c9c2d", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7c1fb9eb-6517-5d3f-a593-dbe41586b7ec", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1e87d0f6-5cc6-563d-884f-7c283893a9e7", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--75c8ae31-9b94-5ba7-a159-38dd7168e3f1", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--70de3750-edaf-5bef-8617-848f92724d94", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-10T16:26:37.587Z", "name": "JFrog Artifactory flaws chained to administrator access and Rust backdoor deployment", "description": "Wiz disclosed coordinated exploitation of CVE-2026-42018, which returns an internal anonymous-user token to an unauthenticated caller, chained with CVE-2026-42016 to escalate that token to administrator scope, taking attackers from first request to new admin account in under five minutes. Separately CVE-2026-82329, a CVSS 9.8 authentication bypass, was exploited between 1 and 8 September with approximately 406,000 attempts detected on 2 September alone. Post-compromise activity included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and extraction of cluster join keys for lateral movement. Cloud instances were unaffected; CISA KEV-listed CVE-2026-42016 and CVE-2026-42018 on 11 September and CVE-2026-82329 on 2 September.", "confidence": 50, "labels": [ "supply_chain", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/jfrog-artifactory-flaws-chained-to-administrator-access-and-rust-backdoor-deployment/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog" } ], "x_securitystudies_occurred_on": "2026-09-01", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology and Software Supply Chain", "Financial Services", "Telecommunications" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--cfec3d19-bfa2-575a-803c-48d5a663cd46", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--623d501b-23aa-52d8-a2d8-074c27fb5234", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Israel", "country": "IL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e6aba39b-8a85-516e-aec0-d40f54fe57cf", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--259590b5-9f37-55c7-b69b-83fb922fc57b", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8015834a-a6cd-53fd-804b-fde3f523a5d9", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172", "created": "2026-11-08T21:16:16.713Z", "modified": "2026-11-10T16:26:37.587Z", "name": "North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies", "description": "Rapid7 Labs disclosed that DPRK-aligned operators compiled a backdoor named 'ted' directly into the victims' existing HAProxy 2.8.12 load balancers using native HAProxy filter APIs, accompanied by a tool named curlRAT and trojanised crond, agetty, atd, sshd and polkitd daemons. C2 mode was triggered by a request for a decoy image path, after which commands were passed via named pipes and the requests were erased from HAProxy logs and statistics without ever reaching the backend. Two South Korean companies in the automotive and media sectors were confirmed affected, with capabilities including credential harvesting, SSH keylogging, session cookie theft and fingerprint-matched drive-by injection. Attribution to APT37 is medium confidence, with possible Lazarus Group overlap.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/north-korea-linked-backdoor-found-compiled-inside-haproxy-at-two-south-korean-companies/" }, { "source_name": "source", "url": "https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html" }, { "source_name": "source", "url": "https://www.cyfirma.com/news/weekly-intelligence-report-11-sep-2026/" } ], "x_securitystudies_occurred_on": "2026-09-01", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Automotive Manufacturing", "Media and Broadcasting" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--5f94e84a-ffce-5a57-a5e0-5a3451e7db0c", "created": "2026-11-08T21:16:16.713Z", "modified": "2026-11-08T21:16:16.713Z", "relationship_type": "related-to", "source_ref": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e29e5553-6900-5058-871f-f3e3b779c601", "created": "2026-11-08T21:16:16.713Z", "modified": "2026-11-08T21:16:16.713Z", "relationship_type": "related-to", "source_ref": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172", "target_ref": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837", "description": "attribution" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Russian-speaking actor uses hundreds of AI agents to exploit PaperCut across 48 countries", "description": "Blackpoint Cyber and GreyNoise Intelligence reported a Russian-speaking actor operating from 45.142.193[.]132 who used hundreds of AI agents powered by OpenAI Codex and DeepSeek models to exploit PaperCut CVE-2026-81578 and CVE-2026-82078. Vulnerability research began on 31 August 2026 and remote code execution against the first victim was achieved in under four hours, with 11 organisations compromised within 26 seconds of campaign launch and one high school taken from initial access to domain admin in seven minutes. In total 440+ PaperCut MF/NG instances across 395 organisations in 48 countries were compromised, with education targets in Australia, the US, UK, France, Spain, Canada, Belgium, Portugal, Germany and Switzerland. Post-exploitation tooling included Mimikatz, SharpHound, Certipy, Rubeus and Impacket; domain administrator was obtained at 12 organisations.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/russian-speaking-actor-uses-hundreds-of-ai-agents-to-exploit-papercut-across-48-countries/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html" }, { "source_name": "source", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "x_securitystudies_occurred_on": "2026-08-31", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Education", "Government", "Professional Services" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6c899edb-5dd1-57ff-8c6f-a43cede344b0", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e91bd8e7-8960-5be2-9b2f-c4c765833a5d", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8b495a5b-8600-5b3a-95b0-888dc02210c8", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--f9d2ee61-54dd-59f4-bd2d-fbac39debc46", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "France", "country": "FR" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--08b210a2-2294-5716-9964-7bae63b44f38", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--f9d2ee61-54dd-59f4-bd2d-fbac39debc46", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--562bb4c5-4ed9-580f-b37e-c9ae676755f0", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Spain", "country": "ES" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--b9797bf5-7ce0-51b3-84c6-5a99c433cc27", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--562bb4c5-4ed9-580f-b37e-c9ae676755f0", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--7f77e251-85bd-53e4-bc72-1edcb2d04d5d", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Canada", "country": "CA" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--f253adaa-4dbc-5476-8cfd-5622ac6d9a2a", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--7f77e251-85bd-53e4-bc72-1edcb2d04d5d", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--67b1d27a-748d-56d6-a1fa-4d0634924114", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--f8de1409-c8bc-547e-863c-07817401d9a2", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--dd1bec90-2604-53f0-953a-bab543805077", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Portugal", "country": "PT" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--4c3eefe1-da2d-56c5-8e34-790324e9bbc5", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--dd1bec90-2604-53f0-953a-bab543805077", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8b803bdb-0ca1-5685-be70-4eacad913cac", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--aa8b441f-2a10-5e00-b00e-56ba6bfa70f6", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Switzerland", "country": "CH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--b9b6c5c4-944f-5c7b-a4ce-071374ff250a", "created": "2026-11-08T21:16:16.720Z", "modified": "2026-11-08T21:16:16.720Z", "relationship_type": "related-to", "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a", "target_ref": "location--aa8b441f-2a10-5e00-b00e-56ba6bfa70f6", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04", "created": "2026-11-08T21:16:16.712Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Four nation-state actors deploy shared BlueMoon Chrome and Windows zero-day exploit kit within twelve days", "description": "TA412 (APT31) and three suspected China-aligned clusters tracked as UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket independently deployed the same exploit chain combining Chrome V8 type confusion CVE-2026-85046, an unnamed V8 sandbox escape and Windows kernel privilege escalation CVE-2026-85880. TA412 activity began on 28 August 2026 against US NGOs, mining companies and commodity traders; the other clusters followed from 2 September, hitting Vietnamese manufacturing and then Indonesian and Singaporean government, consulting and financial entities. The Chromium patch had been public since 7 August but Chrome stable only shipped on 3 September, giving the actors a wide exploitation window. The convergence on one kit points to a shared exploit broker or quartermaster.", "confidence": 50, "labels": [ "apt", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/four-nation-state-actors-deploy-shared-bluemoon-chrome-and-windows-zero-day-exploit-kit-within-twelve-days/" }, { "source_name": "source", "url": "https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog" } ], "x_securitystudies_occurred_on": "2026-08-28", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Non-Governmental Organisations", "Financial Services", "Manufacturing", "Mining and Commodities", "Consulting" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--33536cf2-31dc-52b6-9de7-2540505f4ff7", "created": "2026-11-08T21:16:16.712Z", "modified": "2026-11-08T21:16:16.712Z", "relationship_type": "related-to", "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1428f606-b7b8-5664-8d37-1a536e6adc6c", "created": "2026-11-08T21:16:16.712Z", "modified": "2026-11-08T21:16:16.712Z", "relationship_type": "related-to", "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04", "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--404fb36c-6be0-553e-bab5-abe8231b4b39", "created": "2026-11-08T21:16:16.712Z", "modified": "2026-11-08T21:16:16.712Z", "relationship_type": "related-to", "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04", "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ccd3bd92-7e66-5469-9340-df2377d29dfc", "created": "2026-11-08T21:16:16.712Z", "modified": "2026-11-08T21:16:16.712Z", "relationship_type": "related-to", "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--eba46e04-3a48-519e-92af-b6843d4a64e9", "created": "2026-11-09T04:30:08.701Z", "modified": "2026-11-09T04:30:08.701Z", "name": "APT31", "aliases": [ "BRONZE VINEWOOD", "JUDGMENT PANDA", "Red keres", "TA412", "TIDE CASTLE", "Violet Typhoon", "ZIRCONIUM", "Zirconium" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G0128", "url": "https://attack.mitre.org/groups/G0128/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/apt31/" } ], "description": "FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8930a8c1-02ca-5f17-ab1b-f6a440f98dbe", "created": "2026-11-08T21:16:16.712Z", "modified": "2026-11-08T21:16:16.712Z", "relationship_type": "related-to", "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04", "target_ref": "intrusion-set--eba46e04-3a48-519e-92af-b6843d4a64e9", "description": "attribution" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--555c9614-2fc1-5b9c-9a58-8d1170ae14cd", "created": "2026-11-08T21:16:16.699Z", "modified": "2026-11-10T16:26:37.587Z", "name": "SafePay Ransomware Claims Air Liquide Korea", "description": "The SafePay ransomware group listed industry.airliquide.kr, the Korean industrial-gases arm of Air Liquide, on its leak site on 25 August 2026. Air Liquide Korea supplies essential gases to major South Korean industries including semiconductor manufacturing; SafePay operates a double-extortion model and had claimed over 530 victims globally by August 2026.", "confidence": 50, "labels": [ "ransomware", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/safepay-ransomware-claims-air-liquide-korea/" }, { "source_name": "source", "url": "https://www.ransomware.live/id/aW5kdXN0cnkuYWlybGlxdWlkZS5rckBzYWZlcGF5" } ], "x_securitystudies_occurred_on": "2026-08-25", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "manufacturing", "chemicals", "industrial gases" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c017906f-0b88-5d27-8b94-96d5b382c1b7", "created": "2026-11-08T21:16:16.699Z", "modified": "2026-11-08T21:16:16.699Z", "relationship_type": "related-to", "source_ref": "incident--555c9614-2fc1-5b9c-9a58-8d1170ae14cd", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--74657fff-2b96-5e87-8bba-660969e4162e", "created": "2026-11-08T21:16:16.719Z", "modified": "2026-11-10T16:26:37.587Z", "name": "China-linked SecFlow campaign uses AI agents against Asian government and industrial targets", "description": "Hunt.io documented a Chinese-speaking operation tracked as SecFlow, linked to a username 'Nie' recurring across its infrastructure, which routed Claude, Qwen and DeepSeek through private proxies at niestools.com to automate reconnaissance and exploitation. The toolkit included the GLUTTON webshell framework delivering steganographic payloads inside PNG files, a fake MySQL deserialization service, a Java and CAS exploitation workspace, and Shellshock and credential-testing nodes. Confirmed targeting spanned Kuomintang Party archives in Taiwan, the Indonesian Ministry of Foreign Affairs, and Chinese and Vietnamese government, education and industrial hosts. A confirmed breach of the Fengtai District government office-automation environment yielded 822 OA user records and 1.28GB of data including patient health information.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/china-linked-secflow-campaign-uses-ai-agents-against-asian-government-and-industrial-targets/" }, { "source_name": "source", "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html" } ], "x_securitystudies_occurred_on": "2026-08-20", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Education", "Defense", "Industrial" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--71e28321-0abc-5e25-965c-aa00c51fe6c5", "created": "2026-11-08T21:16:16.719Z", "modified": "2026-11-08T21:16:16.719Z", "relationship_type": "related-to", "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6f5180ac-106f-503e-86ac-5890fc36ea67", "created": "2026-11-08T21:16:16.719Z", "modified": "2026-11-08T21:16:16.719Z", "relationship_type": "related-to", "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e", "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--25b1769c-a3f9-5501-9181-7fe452a1ef4b", "created": "2026-11-08T21:16:16.719Z", "modified": "2026-11-08T21:16:16.719Z", "relationship_type": "related-to", "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e", "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6ca59b95-4835-5e06-8708-e735d0538a5c", "created": "2026-11-08T21:16:16.719Z", "modified": "2026-11-08T21:16:16.719Z", "relationship_type": "related-to", "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e", "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--8da29e79-0082-5823-b874-886f01521c8d", "created": "2026-11-08T21:16:16.716Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Three threat clusters exploit Cisco Secure FMC flaws to steal credentials and deploy Qilin ransomware", "description": "Cisco Talos identified three distinct clusters exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center, alongside the lower-severity CVE-2026-20316. UAT-12197 deployed JSP web shells and Java command executors to harvest credentials and authentication data from internal databases; UAT-11823 delivered reverse shells and configuration harvesting scripts and deployed Cyclops Blink, previously attributed to Russian state-sponsored Sandworm; UAT-11988 used legitimate FMC tooling for reconnaissance and credential collection before deploying Qilin ransomware. CISA added CVE-2026-20079 to the KEV catalog on 9 September 2026 with a 12 September federal deadline.", "confidence": 50, "labels": [ "ransomware", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/three-threat-clusters-exploit-cisco-secure-fmc-flaws-to-steal-credentials-and-deploy-qilin-ransomware/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html" }, { "source_name": "source", "url": "https://securityaffairs.com/198884/cyber-crime/attackers-exploit-critical-cisco-fmc-flaw-to-deploy-qilin-ransomware.html" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-three-known-exploited-vulnerabilities-catalog" } ], "x_securitystudies_occurred_on": "2026-08-15", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology", "Critical Infrastructure", "Government", "Financial Services" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--17605ae0-95ba-5855-9399-554213716d97", "created": "2026-11-08T21:16:16.716Z", "modified": "2026-11-08T21:16:16.716Z", "relationship_type": "related-to", "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8afda179-e386-520e-9d50-139939763d98", "created": "2026-11-08T21:16:16.716Z", "modified": "2026-11-08T21:16:16.716Z", "relationship_type": "related-to", "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ace93ef1-0e87-532c-96b6-ee889dfbb28a", "created": "2026-11-08T21:16:16.716Z", "modified": "2026-11-08T21:16:16.716Z", "relationship_type": "related-to", "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--bf715ab9-663b-51d6-bc29-4d565ea0a3de", "created": "2026-11-08T21:16:16.716Z", "modified": "2026-11-08T21:16:16.716Z", "relationship_type": "related-to", "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" } ] }