Cyber Threat Intelligence

Global coverage · Asia-Pacific focus — September 13, 2026
6
Active Threats
0
Incidents (7d)
5
Critical CVEs
8
APT Groups
Critical High Medium Low
Executive Summary
The 7-14 day window to 13 September 2026 was dominated by an exceptional burst of edge- and developer-infrastructure exploitation, with CISA adding 19 vulnerabilities to the Known Exploited Vulnerabilities catalog between 2 and 11 September alone, including maximum-severity flaws in GitLab (CVE-2026-85706), Cisco Secure Firewall Management Center (CVE-2026-20079), Citrix NetScaler (CVE-2026-19490) and ConnectWise ScreenConnect (CVE-2026-84869). Four separate espionage actors - China-nexus TA412/APT31 plus three uncategorised China-aligned clusters - were observed deploying the same 'BlueMoon' Chrome-plus-Windows exploit kit within a twelve-day span, chaining KEV-listed CVE-2026-85046 and CVE-2026-85880 against targets that included Indonesian and Singaporean government, consulting and financial entities. Asia-Pacific bore disproportionate impact: a DPRK-nexus backdoor was discovered embedded directly inside HAProxy binaries at two South Korean automotive and media firms, Qilin ransomware listed the Philippine Ports Authority, and an exposed Vietnam-linked APIS Elasticsearch cluster held 220.8 million passenger and crew records with passport data. A parallel trend line is the operationalisation of AI agents by both state and criminal actors, evidenced by the SecFlow China-linked multi-country campaign, a Russian-speaking PaperCut operation that compromised 440+ instances across 48 countries, and Anthropic's disruption of APT29-linked GTG-20006.
Sources
43 web sources analyzed
Active Threats 6 campaigns
BlueMoon Chrome/Windows Zero-Day Exploit Kit Proliferation CRITICAL Zero-Day Exploit Kit / Espionage Enablement
A shared exploit kit chaining a Chrome V8 type-confusion flaw (CVE-2026-85046), an unnamed V8 sandbox escape, and a Windows kernel privilege-escalation bug (CVE-2026-85880) was adopted by four distinct nation-state clusters within twelve days of patch availability. TA412 (APT31) began operations on 28 August against US NGOs, mining companies and commodity traders, followed by UNK_LateNight and UNK_DoubleCheck on 2 September and UNK_QuietRacket against Indonesian and Singaporean government, consulting and financial targets after 3 September. The rapid multi-actor convergence on a single kit suggests a common upstream exploit broker or shared quartermaster within the Chinese offensive ecosystem. Both weaponised CVEs are now KEV-listed and patched.
Attribution: China-nexus; TA412/APT31 attributed to MSS Hubei State Security Department, three additional clusters assessed as China-aligned (Proofpoint, Google Threat Intelligence Group, Microsoft MSTIC, Volexity) Targets: United States, Vietnam, Indonesia, Singapore
Qilin Ransomware-as-a-Service CRITICAL Ransomware / Double Extortion
Qilin remains the most prolific ransomware operation globally, ranked first for four consecutive quarters through Q2 2026 and claiming over 500 victims in 2026 alone. In the reporting window the group listed the Philippine Ports Authority following a 5 September intrusion into the transportation sector, alongside Colonial Hyundai and Alaska Electrical Apprenticeship. Cisco Talos separately observed cluster UAT-11988 deploying Qilin payloads after exploiting Cisco Secure FMC authentication bypass flaws, showing affiliate adoption of freshly disclosed edge-device exploits within days.
Attribution: Financially motivated RaaS affiliate ecosystem, Russian-speaking core operators Targets: Philippines, United States, Japan, Australia, United Kingdom
Mass Exploitation of Developer and Artifact Infrastructure CRITICAL Supply Chain / Software Repository Compromise
Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to move from anonymous request to full administrator in under five minutes, while a separate authentication bypass (CVE-2026-82329) drew roughly 406,000 exploitation attempts on 2 September alone. Post-compromise actions included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and cluster join-key theft. In parallel, GitLab's CVSS 10.0 path traversal CVE-2026-85706 saw in-the-wild probing from 06:00 UTC on 11 September, hours after disclosure, enabling extraction of credentials and CI/CD secrets. Compromise of these systems provides a pivot into downstream source code and build pipelines.
Attribution: Multiple unattributed clusters; Wiz, watchTowr and GreyNoise reporting Targets: Global
AI-Agent-Orchestrated Intrusion Operations HIGH Automated Exploitation / Emerging TTP
Multiple independent campaigns in the window demonstrated large language models being wired directly into intrusion tooling rather than used only for content generation. The China-linked SecFlow framework routed Claude, Qwen and DeepSeek through private proxies to automate reconnaissance and exploitation against Taiwanese, Indonesian, Chinese and Vietnamese government, education and industrial targets, pairing with a GLUTTON steganographic webshell. A Russian-speaking actor used hundreds of OpenAI Codex and DeepSeek-backed agents to exploit PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440+ instances across 395 organisations in 48 countries, reaching domain admin at one high school in seven minutes. Anthropic separately disrupted GTG-20006, which had built an AI-driven loop to automatically rebuild and redeploy malware when detected.
Attribution: Mixed: China-nexus (SecFlow, per Hunt.io), Russian-speaking eCrime (PaperCut, per Blackpoint Cyber and GreyNoise), Russia SVR-linked GTG-20006 (per Anthropic) Targets: Taiwan, Indonesia, China, Vietnam, Australia, United States, United Kingdom
Gunra Ransomware Targeting Critical Infrastructure HIGH Ransomware / Double Extortion
Gunra, a Conti-derived double-extortion strain that emerged in April 2025 and moved to a structured RaaS affiliate model in 2026, remains the subject of an active joint advisory (AA26-222A) issued by FBI, CISA, DC3, NSA, USSS and the Republic of Korea National Police Agency. The group gains privileged access by exploiting Fortinet flaws CVE-2024-55591 and CVE-2025-24472, both long-standing KEV entries, before stealing and encrypting data. Healthcare, government and critical-services organisations are the primary focus, and the joint US-ROK authorship signals sustained targeting of South Korean entities.
Attribution: Financially motivated RaaS, Conti source-code lineage Targets: South Korea, United States
DPRK Revenue Generation and Insider Placement Operations HIGH Financial Theft / Insider Threat / Espionage
North Korean operations continue across a now six-cluster Lazarus umbrella spanning espionage, financial theft and sanctions evasion, with DPRK actors accounting for the large majority of global cryptocurrency hack losses into 2026. The open-source ecosystem remains a primary delivery channel, with malicious npm packages impersonating popular libraries to deploy the BeaverTail JavaScript stealer and InvisibleFerret Python backdoor. The Reconnaissance General Bureau's remote IT worker programme also remained active, with five DPRK-linked workers documented as hired into Western companies during 2026 using fabricated identities and proxy infrastructure.
Attribution: North Korea - Reconnaissance General Bureau; Lazarus Group and subordinate clusters Targets: South Korea, United States, Japan, Global
APT Tracker
Group Attribution Recent Activity TTPs
TA412
APT31, Violet Typhoon, Zirconium, JungleBamboo, Judgment Panda
 China - Ministry of State Security, Hubei State Security Department From 28 August 2026 TA412 was the first of four espionage actors observed deploying the BlueMoon exploit kit, chaining Chrome V8 type confusion CVE-2… T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution T1068 - Exploitation for Privilege Escalation T1566.002 - Spearphishing Link
APT37
ScarCruft, Reaper, Ricochet Chollima, InkySquid, Group123
 North Korea - Ministry of State Security Rapid7 Labs disclosed on 8 September 2026 that DPRK-aligned operators had compiled a backdoor, tracked as 'ted', directly into the victims' existing … T1554 - Compromise Host Software Binary T1543.002 - Create or Modify System Process: Systemd Service T1056.001 - Input Capture: Keylogging T1070.002 - Indicator Removal: Clear Linux or Mac System Logs
UNC3569
GRAYRABBIT operator cluster
 China - hacker-for-hire ecosystem, tracked by Google Threat Intelligence since 2021 Google Threat Intelligence reported in September 2026 that UNC3569 exploited CVE-2026-51990 in the Windows Sogou Input Method to achieve one-click co… T1566.002 - Spearphishing Link T1203 - Exploitation for Client Execution T1218 - System Binary Proxy Execution T1105 - Ingress Tool Transfer
Twill Typhoon
Mustang Panda, Bronze President, Camaro Dragon, Earth Preta, TA416, RedDelta
 China - Ministry of State Security nexus Darktrace reported a campaign running from September 2025 through at least April 2026 in which Twill Typhoon targeted Asia-Pacific and Japanese entit… T1574.002 - Hijack Execution Flow: DLL Side-Loading T1053.005 - Scheduled Task/Job: Scheduled Task T1112 - Modify Registry T1082 - System Information Discovery
GTG-20006
Midnight Blizzard, APT29, Cozy Bear, Nobelium, UNC2452
 Russia - Foreign Intelligence Service (SVR) Anthropic disclosed in September 2026 that it had disrupted GTG-20006, a cluster linked to Midnight Blizzard, which had built an AI-driven process to… T1588.007 - Obtain Capabilities: Artificial Intelligence T1566.001 - Spearphishing Attachment T1583.001 - Acquire Infrastructure: Domains T1027.002 - Obfuscated Files or Information: Software Packing
Vulnerability Alerts
CVE-2026-85706
CRITICAL
GitLab Community Edition and Enterprise Edition 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
Unauthenticated path traversal in the repository commits API, rated CVSS 10.0, caused by improper path confinement and missing authentication enforcement. Exploitation requires only that a single public project exists on the instance and permits arbitrary file reads including logs, configuration files, credentials and secrets, enabling downstream compromise of source code and CI/CD pipelines. watchTowr observed in-the-wild probes beginning 06:00 UTC on 11 September 2026. Confirmed in the CISA KEV catalog, added 11 September 2026, with a 14 September 2026 federal remediation deadline.
Exploited in the Wild · Patch: Yes
CVE-2026-20079
CRITICAL
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control Firewall Management web interface
Authentication bypass rated CVSS 10.0 allowing an unauthenticated remote attacker to bypass authentication and execute script files to obtain root access. Cisco Talos identified three distinct post-compromise clusters during August 2026: UAT-12197 deploying JSP web shells and Java command executors for credential harvesting, UAT-11823 delivering reverse shells and Cyclops Blink malware attributed to Russian state-sponsored Sandworm, and UAT-11988 deploying Qilin ransomware. Confirmed in the CISA KEV catalog, added 9 September 2026. The related hard-coded password flaw CVE-2026-20316 has been KEV-listed since 29 July 2026 and is flagged for known ransomware campaign use.
Exploited in the Wild · Patch: Yes
CVE-2026-19490
CRITICAL
Citrix NetScaler ADC and NetScaler Gateway configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)
Authentication bypass using an alternate path or channel, rated CVSS 9.3, affecting NetScaler appliances in the most common remote-access configurations. Fifty-six exploitation attempts were recorded against honeypot systems from 3 September 2026, including 36 on 8 September alone, indicating rapid weaponisation. Confirmed in the CISA KEV catalog, added 9 September 2026. A separate NetScaler memory-corruption flaw, CVE-2026-8452, has been KEV-listed since 26 August 2026, making NetScaler estates a compound exposure.
Exploited in the Wild · Patch: Yes
CVE-2025-25249
HIGH
Fortinet FortiOS, FortiSwitchManager and FortiSASE
Heap-based buffer overflow rated CVSS 7.3 permitting remote code execution via crafted requests. Reporting indicates weaponisation since July 2026 to deliver the PivotC2 remote access trojan, with more than 3,000 IP addresses targeted and 178 devices confirmed infected. Confirmed in the CISA KEV catalog, added 9 September 2026. Fortinet edge devices remain a priority access vector for ransomware crews, with Gunra affiliates separately abusing the older KEV entries CVE-2024-55591 and CVE-2025-24472.
Exploited in the Wild · Patch: Yes
CVE-2026-85046
HIGH
Google Chrome / Chromium V8 JavaScript engine; Chromium patch public 7 August 2026, Chrome stable release 3 September 2026
Type-confusion vulnerability in the V8 JavaScript engine forming the entry stage of the BlueMoon exploit kit, where it is chained with an unnamed V8 sandbox escape and a Windows kernel privilege-escalation flaw. Four separate nation-state clusters weaponised it within twelve days of the Chromium patch becoming public, exploiting the window between upstream fix and downstream Chrome stable rollout. Confirmed in the CISA KEV catalog, added 4 September 2026. A second Chromium V8 out-of-bounds write, CVE-2026-87491, was KEV-listed on 9 September 2026.
Exploited in the Wild · Patch: Yes
CVE-2026-85880
HIGH
Microsoft Windows kernel (ALPC/WNF components)
Heap-based buffer overflow enabling local privilege escalation, used as the post-browser-exploitation stage of the BlueMoon kit to move from sandboxed renderer to SYSTEM. Confirmed in the CISA KEV catalog, added 8 September 2026. A companion Windows link-following flaw, CVE-2026-81963, was added to KEV the same day, and both should be treated as priority items in the September patch cycle.
Exploited in the Wild · Patch: Yes
CVE-2026-86060
CRITICAL
MikroTik RouterOS
Improper neutralisation of argument delimiters in a command, rated CVSS 9.2, allowing an attacker to alter the trusted RouterOS policy mask and achieve privilege escalation. It is paired with CVE-2026-67277, a missing-authentication flaw in the btest service rated CVSS 8.8 that yields kernel memory disclosure and denial of service. Both were confirmed added to the CISA KEV catalog on 10 September 2026 with a 13 September federal deadline. MikroTik devices are heavily deployed as low-cost edge routers across South and Southeast Asia, making this a regionally significant exposure and a recurring source of proxy and botnet infrastructure.
Exploited in the Wild · Patch: Yes
CVE-2026-85102
CRITICAL
Check Point VPN Security Gateway and Security Management Servers R81.20, R82, R82.10, R81.10.x, R82.00.x and end-of-support R80 through R81.10; R82.20 not affected
Improper certificate validation during VPN negotiation enabling arbitrary code execution, rated 9.8, disclosed alongside CVE-2026-85103, a heap overflow in the VPN certificate ASN.1 decoder also permitting remote code execution. The Dutch NCSC assesses both likelihood and impact as high and expects exploitation attempts soon, though no public exploit code was available at time of reporting. Neither CVE is listed in the CISA KEV catalog as of catalog version 2026.09.11. Patches shipped 9 September 2026 via LivePatch Take 24 and branch-specific Jumbo Hotfix Accumulators; interim mitigation is restricting site-to-site VPN access to trusted IP ranges.
No confirmed exploitation; Dutch NCSC assesses exploitation imminent · Patch: Yes
Country Cyber Posture
Country Threat Level Assessment Recent Incidents
Taiwan CRITICAL Taiwan remains the single most contested cyber environment in the region, absorbing sustained PRC state and state-aligned intrusion activity aimed at government, defence, semiconductor and political-party targets. Activity is assessed as dual-purpose, combining conventional intelligence collection with pre-positioning for a potential contingency, and increasingly incorporates AI-assisted tooling that compresses reconnaissance-to-exploitation timelines.
China-linked SecFlow framework campaign documented by Hunt.io in September 2026 targeting Kuomintang Party archives using Claude, Qwen and DeepSeek routed through private proxies
Krybit ransomware activity reported against Taiwanese organisations in early September 2026 alongside India, Thailand, France and Brazil
South_Korea HIGH South Korea faces a persistent dual threat from DPRK espionage and destructive-capable clusters and from financially motivated ransomware affiliates, sufficient for the Korean National Police Agency to co-author a US joint advisory. The discovery of a backdoor compiled into production HAProxy binaries indicates adversary tradecraft has advanced beyond commodity implants into supply-chain-adjacent, log-evading persistence at the network edge.
Rapid7 Labs disclosure on 8 September 2026 of the 'ted' backdoor and curlRAT embedded in HAProxy 2.8.12 at two South Korean automotive and media companies, attributed with medium confidence to APT37
Ongoing FBI/CISA/NSA/DC3/USSS and KNPA joint advisory AA26-222A on Gunra ransomware targeting government, healthcare and critical services
Vietnam HIGH Vietnam combines a large exposed-infrastructure footprint with active targeting by China-nexus espionage actors against manufacturing and industrial hosts. The September disclosure of a 220.8 million record passenger information exposure represents one of the largest travel-data incidents recorded in the region and creates durable downstream risk for counter-intelligence and targeting of travellers.
Exposed Vietnam-linked APIS Elasticsearch cluster 'pax-info' holding 220.8 million passenger and crew records across 107GB, disclosed 8 September 2026 by Kinryu Labs; secured 8 June 2026
UNK_LateNight and UNK_DoubleCheck BlueMoon exploit-kit activity against Vietnamese manufacturing from 2 September 2026
Japan HIGH Japanese enterprises continue to absorb heavy ransomware pressure across manufacturing, retail and real estate, compounded by China-nexus espionage against government and diplomatic targets. Attacks frequently traverse overseas subsidiaries and regional affiliates, indicating that group-wide third-party and subsidiary governance remains the dominant structural weakness.
Japanese retail and e-commerce company compromised by RansomHouse ransomware, reported 11 September 2026
The Gentlemen ransomware attack against a Japanese manufacturer, reported 4 September 2026
China HIGH China is simultaneously the region's most prolific offensive cyber actor and a target of significant intrusion activity, including from domestic and Chinese-speaking criminal operators who exploit poorly secured government office-automation systems. The 8 September CISA advisory naming six Chinese AI firms in industrial-scale model distillation campaigns marks a formal escalation in the treatment of AI intellectual property theft as a state-linked activity.
CISA advisory AA26-251A released 8 September 2026 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI in distillation campaigns against US frontier models, assessed as likely conducted with Chinese government awareness
SecFlow operators breached the Fengtai District government office-automation environment, exfiltrating 822 OA user records and 1.28GB of data including patient health information
Philippines HIGH Philippine critical infrastructure, particularly ports and logistics, is under direct criminal extortion pressure at a time of elevated maritime tension in the South China Sea. Government and port-sector cyber maturity lags the operational importance of the assets involved, and a successful disruption would carry regional trade consequences well beyond the immediate victim.
Qilin ransomware intrusion at the Philippine Ports Authority on 5 September 2026, subsequently listed on the group's data-leak site
Broader regional exposure to Qilin affiliate operations following the group's adoption of freshly disclosed edge-device exploits
India HIGH India sustains the highest per-organisation attack volume of any major economy, with ransomware operators repeatedly listing Indian entities across retail, healthcare, manufacturing and technology. A large MikroTik and edge-router installed base, now exposed by two freshly KEV-listed RouterOS flaws, compounds the risk of devices being conscripted into proxy and botnet infrastructure.
Fiasco ransomware campaign listing India among primary targets across retail, e-commerce, healthcare, manufacturing and biotechnology, reported 4 September 2026
Krybit ransomware activity naming India among its principal target countries
Indonesia ELEVATED Indonesia entered the reporting window as a named target of China-aligned zero-day operations against government and financial entities, while industrial firms face active ransomware extortion. Rapid digitalisation of government services continues to outpace defensive instrumentation, leaving limited detection coverage for the patient, low-noise tradecraft these actors favour.
UNK_QuietRacket BlueMoon exploit-kit targeting of Indonesian government, consulting and financial organisations after 3 September 2026
SecFlow campaign targeting of the Indonesian Ministry of Foreign Affairs documented September 2026
Singapore ELEVATED Singapore's concentration of regional financial, consulting and telecommunications headquarters makes it a high-value collection target rather than a high-volume one, and it was explicitly named in the BlueMoon targeting set. National cyber maturity and regulatory enforcement are among the strongest in the region, which contains impact but does not deter persistent state-nexus interest in its hub organisations.
UNK_QuietRacket BlueMoon exploit-kit targeting of Singaporean government, consulting and financial entities after 3 September 2026
Approximately 2.4 million customer records from a Singapore cryptocurrency platform advertised on criminal forums, reported 11 September 2026
Australia ELEVATED Australia faces sustained criminal exploitation of internet-facing enterprise software, with the education sector specifically named among victims of the AI-agent-driven PaperCut campaign. Nation-state interest is concentrated on defence, critical infrastructure and AUKUS-adjacent research rather than broad-based collection, and mandatory incident reporting continues to improve visibility relative to regional peers.
Australian education institutions among the 395 organisations across 48 countries compromised via PaperCut CVE-2026-81578 and CVE-2026-82078 in the campaign beginning 31 August 2026
Continued exposure to Qilin and RansomHouse affiliate operations targeting regional enterprise and logistics
Sector Threat Matrix
Government
CRITICAL
Government networks across the Asia-Pacific are the primary objective of China-nexus espionage clusters, which combined zero-day exploit kits, input-method software abuse and AI-orchestrated tooling during the reporting window. Ministries of foreign affairs, political party organisations and district-level administrative systems were all confirmed compromised or targeted, showing the collection effort spans strategic and tactical tiers simultaneously.
  • BlueMoon exploit kit deployment by TA412 and three China-aligned clusters against Indonesian and Singaporean government entities
  • SecFlow AI-orchestrated intrusions against Taiwanese, Indonesian and Chinese government systems
  • UNC3569 GRAYRABBIT backdoor delivery via Sogou Input Method exploitation across East and Southeast Asian governments
Technology and Software Supply Chain
CRITICAL
Developer and artifact infrastructure became the highest-velocity attack surface of the period, with GitLab and JFrog Artifactory both under mass exploitation within days of disclosure. Compromise of these systems yields credentials, build secrets and pipeline access, converting a single unauthenticated flaw into potential downstream compromise of every consumer of the affected code.
  • GitLab CVE-2026-85706 CVSS 10.0 path traversal under active in-the-wild probing from 11 September 2026
  • JFrog Artifactory CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329 chained to administrator access in under five minutes, with Rust backdoors and malicious Groovy plugins deployed
  • ConnectWise ScreenConnect CVE-2026-84869 permitting unauthorised file transfer and execution through active remote sessions
Telecommunications
CRITICAL
Telecommunications remains the defining strategic target for PRC-linked collection, with Salt Typhoon activity assessed to span carriers in a large number of countries and providing the communications-metadata picture that underpins broader intelligence operations. Edge devices, Exchange servers and network management platforms are the consistent entry points, and eviction from these environments has repeatedly proven incomplete.
  • Salt Typhoon (Earth Estries, FamousSparrow, GhostEmperor, UNC2286) exploitation of Microsoft Exchange via ProxyNotShell chains, deploying Deed RAT and TernDoor
  • MikroTik RouterOS CVE-2026-86060 and CVE-2026-67277 exploitation against widely deployed regional edge routers
  • Citrix NetScaler CVE-2026-19490 and CVE-2026-8452 targeting remote-access gateways
Financial Services
HIGH
Financial institutions face a bifurcated threat of state-nexus espionage against regional hubs and high-tempo DPRK theft against digital-asset platforms and their developers. Identity-layer attacks, including passkey-themed phishing and fraudulent official requests for customer data, proved effective against well-resourced firms during the period.
  • DPRK cryptocurrency theft operations accounting for the majority of global crypto hack losses into 2026
  • BlueMoon exploit-kit targeting of Singaporean and Indonesian financial organisations
  • Passkey-themed phishing by ShinyHunters, Helix and allied extortion groups leading to Microsoft 365 data theft
Manufacturing
HIGH
Manufacturing was the most consistently victimised commercial sector in Asia-Pacific ransomware reporting, with Japanese, Malaysian, Thai and Indonesian firms all listed within the window. Attackers exploit flat OT/IT boundaries and third-party and subsidiary trust relationships, and the sector's low downtime tolerance sustains high ransom payment rates.
  • The Gentlemen ransomware attacks against a Japanese manufacturer and a Malaysian automotive manufacturer
  • Dire Wolf ransomware leak of 64GB from an Indonesian industrial machinery firm
  • Krybit ransomware compromise of a Thai manufacturing company
Transportation and Maritime
HIGH
Ports, airlines and travel-data systems sustained both direct extortion and catastrophic data exposure during the window. Given South China Sea tensions, disruption of port authority operations carries escalation significance beyond its commercial impact, and passenger data at national scale is of enduring value to hostile intelligence services.
  • Qilin ransomware intrusion at the Philippine Ports Authority on 5 September 2026
  • Exposure of 220.8 million passenger and crew records including passport data in a Vietnam-linked APIS Elasticsearch cluster
  • Iran-linked Mirage Kitten targeting of aviation sector organisations
Healthcare
HIGH
Healthcare providers remain a named priority in the active Gunra joint advisory and continue to appear in regional leak-site postings and dark-web database sales. Legacy clinical systems, high data sensitivity and minimal downtime tolerance keep the sector attractive to double-extortion operators despite policy pressure against targeting it.
  • Gunra ransomware explicitly named as targeting healthcare in joint advisory AA26-222A
  • Fiasco ransomware listing healthcare among targeted verticals across India, Thailand and other markets
  • 24GB Thai healthcare technology database advertised on dark-web forums, reported 4 September 2026
Education
ELEVATED
Education was the primary victim population of the AI-agent-driven PaperCut campaign, which demonstrated compromise-to-domain-admin timelines measured in minutes rather than days. Thin security staffing and large print and identity management estates make the sector a proving ground for automated intrusion tooling before it is turned on higher-value targets.
  • PaperCut CVE-2026-81578 and CVE-2026-82078 exploitation compromising 440+ instances across 395 organisations in 48 countries from 31 August 2026
  • Post-exploitation use of Mimikatz, SharpHound, Certipy, Rubeus and Impacket to reach domain administrator at 12 victim organisations
  • UNC3569 targeting of the education sector across East and Southeast Asia with the GRAYRABBIT backdoor
Cyber News Feed Last 7 days
Incident Log Last 30 days
No incidents logged yet. Incidents are populated automatically from CTI briefs or can be added via Django Admin.