1. หน้าแรก
  2. กลุ่ม
  3. administrators
ข้อมูลกลุ่ม ส่วนตัว

administrators

รายชื่อสมาชิก
  • Cyber Threat Intelligence 15 May 2026

    Industrial Sector

    • Siemens SIMATIC
      "SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16
    • Universal Robots Polyscope 5
      "Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-17
    • Siemens Siemens ROS#
      "ROS# contains a ROS service file_server, that before version 2.2.2 contains a path traversal vulnerability which could allow an attacker to access, i.e. read and write, arbitrary files, which are accessible with the user rights of the user that runs the service, on the system that hosts service. Siemens has released a new version for ROS# and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-08
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox contains an input validation vulnerability in the Scheduler functionality that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12
    • Siemens SENTRON 7KT PAC1261 Data Manager
      "The web server in SENTRON 7KT PAC1261 Data Manager Before V2.1.0 contains a request smuggling vulnerability in the Go Project's net/http package that could allow an attacker to retrieve authorization tokens that can be used to gain administrative control over the device. Siemens has released a new version for SENTRON 7KT PAC1261 Data Manager and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-14
    • Siemens SIMATIC S7 PLC Web Server
      "SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-15
    • Siemens gWAP
      "Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namely the Axios HTTP client library. The vulnerability stems from a specific "Gadget" attack chain that allows prototype pollution in other third-party libraries, potentially allowing an attacker to execute arbitrary code. Siemens has released a new version for gWAP and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remote attacker to read arbitrary files with root privileges from the underlying operating system's filesystem. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-02
    • Siemens Solid Edge
      "Solid Edge SE2026 before Update 5 is affected by two file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released a new version for Solid Edge SE2026 and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03
    • Siemens Teamcenter
      "Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04
    • Siemens Simcenter Femap
      "Simcenter Femap is affected by heap based buffer overflow vulnerability in Datakit library that could be triggered when the application reads files in IPT format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05
    • Siemens Industrial Devices
      "Multiple industrial devices contain a vulnerability that could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-06
    • Siemens SIMATIC
      "SIMATIC HMI Unified Comfort Panels before V21.0 are affected by a vulnerability that allows an unauthenticated attacker to access the web browser via the help link. This vulnerability allows an attacker to access the web browser through the Control Panel if it is not protected by the corresponding security mechanisms. This opens the possibility for the attacker to find backdoors, which might lead to unwanted misconfigurations. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-07
    • Siemens Opcenter RDnL
      "Opcenter RDnL is affected by missing authentication in critical function in ‘ActiveMQ Artemis’. An unauthenticated attacker within the adjacent network could use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in availability impacts or message injection into any queue via the rogue broker. Breaking the integrity of a message has a low impact due to missing auto refresh functionality and it does not contain any confidential information. ActiveMQ Artemis has released a new version and Siemens recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-09
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-11
    • Siemens SIPROTEC 5
      "The SIPROTEC 5 devices do not use sufficiently random numbers to generate session identifiers. This could facilitate a brute-force attack against a valid session identifier which could allow an unauthenticated remote attacker to hijack a valid user session. The affected session identifiers are only used in a subset of the endpoints that are provided by the affected products. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-13

    Vulnerabilities

    Malware

    • Help-Desk Lures Drop KongTuke's Evolved ModeloRAT
      "Threat actors are impersonating help-desk staff over external Microsoft Teams chats to trick victims into deploying "ModeloRAT" on their own machines. ReliaQuest attributes the activity to financially motivated initial access broker (IAB) "KongTuke" based on reuse of the group's custom Python loader. Previously, KongTuke has compromised WordPress sites to host "ClickFix" and "CrashFix" lures and paste-and-run prompts on fake CAPTCHA or browser-crash pages for access that has historically fed ransomware affiliates. This Teams activity, which appears to add to, rather than replace, that web-based approach, marks the first time we’ve seen KongTuke use a collaboration platform for initial access. In the incidents we investigated, a single external Teams chat moved the operator from cold outreach to a persistent foothold in under five minutes."
      https://reliaquest.com/blog/threat-spotlight-help-desk-lures-drop-kongtukes-evolved-modelorat
      https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/
    • Chinese APT Campaign Targets Entities With Updated FDMTP Backdoor
      "Darktrace have identified activity consistent with Chinese-nexus operations, a Twill Typhoon-linked campaign targeting customer environments, primarily within the Asia-Pacific & Japan (APJ) region. Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework."
      https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor
      https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
      https://www.bankinfosecurity.com/mustang-panda-linked-to-new-modular-fdmtp-backdoor-a-31696
      https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
    • FrostyNeighbor: Fresh Mischief And Digital Shenanigans
      "This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise chain and methods to evade detection – targeting victims located in Eastern Europe, according to our telemetry."
      https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/
      https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html
      https://www.darkreading.com/cyberattacks-data-breaches/frostyneighbor-apt-govt-orgs-poland-ukraine
    • Instead Of a Job—stolen Data And Money. Trojan Stealer Targeting MacOS And Windows Users Conceals Itself In Fake Online Interview Apps
      "Doctor Web’s experts are warning users about the spread of JobStealer, a trojan app that steals confidential information from macOS and Windows computer users. It primarily aims to hijack data from crypto wallets. Fraudsters, under the pretext of conducting online interviews, lure potential victims to malicious websites and ask them to download a video conferencing app. In reality, this software is the JobStealer trojan."
      https://news.drweb.com/show/?i=15253&lng=en
      https://hackread.com/fake-job-interview-jobstealer-malware-windows-macos/
    • OrBit (Re)turns: Tracking An Open-Source Linux Rootkit Across Four Years Of Forks And Deployments
      "In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized. It wasn’t. As we will show below, OrBit is a repackaged and selectively weaponized build of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in December 2022. The story of OrBit’s four-year evolution is not one of novel development; it’s the story of how a publicly available rootkit was forked, configured, and redeployed."
      https://intezer.com/blog/orbit-returns/
    • Device Code Phishing Is An Evolution In Identity Takeover
      "Credential phishing remains an effective technique enabling everything from account takeover and fraud to ransomware and espionage. However, as organizations become better at defending against common phishing techniques such as multifactor authentication (MFA) phishing, cyber threat actors have expanded their capabilities to techniques like device code and OAuth phishing. When combined with LLM-generated tools and social engineering, criminals can use such techniques to target more people with new social engineering tricks at scale."
      https://www.proofpoint.com/us/blog/threat-insight/device-code-phishing-evolution-identity-takeover
    • Kimsuky Targets Organizations With PebbleDash-Based Tools
      "Over the past few months, we have conducted an in-depth analysis of specific activity clusters of Kimsuky (aka APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, and Springtail), a prolific Korean-speaking threat actor. Our research revealed notable tactical shifts throughout multiple phases of the group’s latest campaigns. Kimsuky has continuously introduced new malware variants based on the PebbleDash platform, a tool historically leveraged by the Lazarus Group but appropriated by Kimsuky since at least 2021. Our monitoring indicates various strategic updates to the group’s arsenal, including the use of VSCode Tunneling, Cloudflare Quick Tunnels, DWAgent, large language models (LLMs), and the Rust programming language. This expanding set of tools underscores the group’s ongoing adaptation and evolution."
      https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/
    • Popular Node-Ipc Npm Package Infected With Credential Stealer
      "Socket’s threat feed has detected malicious activity in newly published versions of node-ipc, a long-running npm package previously associated with one of the most widely discussed supply chain incidents in the JavaScript ecosystem."
      https://socket.dev/blog/node-ipc-package-compromised
      https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack
      https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html
    • Operation SilentCanvas : JPEG Based Multistage Powershell Intrusion
      "At CYFIRMA, we identified a highly sophisticated multi-stage intrusion campaign leveraging a weaponized PowerShell payload disguised as a legitimate JPEG image file to deploy a trojanized instance of ConnectWise ScreenConnect for covert and persistent remote access. The intrusion likely originated through social engineering techniques such as phishing emails, malicious attachments, deceptive file-sharing interactions, or fake update lures involving a malicious file named sysupdate.jpeg. The payload was specifically crafted to exploit user trust and bypass conventional file-extension validation mechanisms while blending malicious activity with legitimate enterprise software."
      https://www.cyfirma.com/research/operation-silentcanvas-jpeg-based-multistage-powershell-intrusion/

    Breaches/Hacks/Leaks

    General News

    • Before The First Whistle: How Cyber Criminals Are Targeting World Cup 2026
      "The FIFA World Cup 2026 is one of the most anticipated sporting events in history, and cyber criminals are already capitalizing on excitement. As matches kick off across the United States, Canada, and Mexico, threat actors are flooding the internet with fake merchandise stores, fraudulent betting platforms, and phishing domains designed to steal your money and personal data. This report breaks down the latest threat landscape so fans can stay safe while enjoying the beautiful game."
      https://blog.checkpoint.com/research/before-the-first-whistle-how-cyber-criminals-are-targeting-world-cup-2026/
    • ICO Publishes Five-Step Plan To Counter Emerging AI-Powered Attacks
      "Getting the basics right, understanding the threat and putting in place multi-layered defenses are key to protecting organizations from AI-powered cyber threats, the UK's Information Commissioner’s Office (ICO) has said. Alarmed by the uptick in AI-driven attacks, the data protection regulator today released a five-step guide, urging organizations to proactively prepare for emerging threats. “By investing in cyber resilience and ensuring appropriate security measures are in place, you can build public trust and confidence in how your organization protects the personal data you hold,” said Ian Hulme, executive director of regulatory supervision at the ICO."
      https://www.infosecurity-magazine.com/news/ico-steps-in-advice-handling-ai/
    • Most Organizations Now Use AI Agents For Sensitive Security Tasks
      "The majority (93%) of global organizations use or plan to use AI agents for security tasks such as password resets and VPN access despite the potential for serious breaches and data leaks, according to Semperis. The security vendor polled 1100 organizations in the US, UK France, Germany, Spain, Italy, Singapore and Australia to produce its State of Identity Security in the AI Era study. As well as using agents for sensitive security work, or planning to within 12 months, the majority (92%) of respondents admitted AI is installed on at least some local machines with access to SSH and encryption keys, further exposing them to security risk."
      https://www.infosecurity-magazine.com/news/most-organizations-ai-agents/
    • Nobody Believes The 'criminals And Scumbags' Who Hacked Canvas Really Deleted Stolen Student Data
      "When Instructure “reached an agreement” with data theft and extortion crew ShinyHunters this week, the education tech giant assured Canvas users after attackers claimed to have stolen data tied to 275 million students, teachers, and staff that their private chats and email addresses would not turn up on a dark-web marketplace, and that they would not be extorted over the incident. “We received digital confirmation of data destruction (shred logs),” Instructure assured the nearly 9,000 affected universities and K-12 schools. “We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.”"
      https://www.theregister.com/cyber-crime/2026/05/14/security-pros-doubt-canvas-attackers-really-deleted-stolen-student-data/5240799
    • Mythos For Offensive Security: XBOW's Evaluation
      "About two months ago, Anthropic invited us to help them assess the capability of a new model they thought represented a significant shift in capability. So we put it through our security gauntlet. Benchmarks, workflows, interactive use, and integrations. Today, we can finally share details on how we tested Mythos Preview, what we found, and what it means."
      https://xbow.com/blog/mythos-offensive-security-xbow-evaluation
      https://www.securityweek.com/mythos-proves-potent-in-vulnerability-discovery-less-convincing-elsewhere/

    อ้างอิง
    Electronic Transactions Development Agency (ETDA) adef00ad-aa97-418c-934d-5e3231914d73-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • พบช่องโหว่ Claw Chain ใน OpenClaw เสี่ยงขโมยข้อมูลและยกระดับสิทธิ์

    พบช่องโหว่ Claw Chain ใน OpenClaw เสี่ยงขโมยข้อมูลและย.png

    สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand e15d17e4-474f-4087-a2a8-1ac55beedd45-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • OpenAI ได้รับผลกระทบจาก Supply Chain Attack ผ่านแพ็กเกจ TanStack อันตราย

    OpenAI ได้รับผลกระทบจาก Supply Chain Attack ผ่านแพ็กเกจ TanStack .png

    สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand d472e47f-dea7-44d3-afaf-c6a80a7286b5-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • พบช่องโหว่ร้ายแรงในปลั๊กอิน Funnel Builder บน WordPress ถูกใช้ฝังโค้ดขโมยข้อมูลบัตรเครดิตร้านค้าออนไลน์

    พบช่องโหว่ร้ายแรงในปลั๊กอิน Funnel Builder บน WordPress ถ.png

    สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand 6d1c1bcc-5c48-4c13-a77a-78ce9c42a9e6-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • ด่วน! แจ้งเตือนช่องโหว่ใน NGINX อาจทำให้ระบบหยุดให้บริการ หรือรันโค้ดได้ภายใต้เงื่อนไขบางประการ

    ศูนย์ประสานการรักษาความมั่นคงปลอดภัยระบบคอมพิวเตอร์แห่งชาติ (ThaiCERT) ได้ติดตามสถานการณ์ข่าวสารภัยคุกคามทางไซเบอร์ และพบรายงานการค้นพบช่องโหว่ด้านความมั่นคงปลอดภัยใน NGINX Web Server ซึ่งเป็นซอฟต์แวร์ Web Server และ Reverse Proxy ที่มีการใช้งานอย่างแพร่หลาย โดยบริษัท Depth First ได้เปิดเผยช่องโหว่หลายรายการที่ส่งผลกระทบต่อ NGINX Open Source โดยเฉพาะช่องโหว่ CVE-2026-42945 ใน ngx_http_rewrite_module ซึ่งอาจทำให้ NGINX worker process หยุดทำงาน หรืออาจนำไปสู่การรันโค้ดได้ภายใต้เงื่อนไขบางประการ จึงขอให้ผู้ดูแลระบบเร่งตรวจสอบเวอร์ชัน การตั้งค่า และอัปเดตแพตช์ตามคำแนะนำของผู้ผลิต [1]

    1. รายละเอียดช่องโหว่[2]
      1.1 CVE-2026-42945 (CVSS v3.1: 8.1) [3]
      เป็นช่องโหว่ประเภท Heap Buffer Overflow ใน ngx_http_rewrite_module โดยเกี่ยวข้องกับการทำงานของ rewrite และ set directive รวมถึงการใช้ตัวแปรจากการจับกลุ่มแบบ unnamed capture เช่น $1 หรือ $2 ในบางรูปแบบการตั้งค่า ผู้โจมตีที่ไม่ต้องยืนยันตัวตนอาจส่ง HTTP request ที่สร้างขึ้นเป็นพิเศษ เพื่อทำให้ NGINX worker process หยุดทำงาน และในบางเงื่อนไขอาจนำไปสู่การรันโค้ดบนระบบได้
      1.2 CVE-2026-42946 (CVSS v3.1: 6.5) [4]
      เป็นช่องโหว่ใน ngx_http_scgi_module และ ngx_http_uwsgi_module ที่เกิดจากการจัดการ upstream response ไม่เหมาะสม อาจทำให้เกิดการใช้หน่วยความจำผิดปกติ หรือเกิดการอ่านข้อมูลในหน่วยความจำของ NGINX worker process เกินขอบเขต ส่งผลให้ worker process หยุดทำงานหรืออาจเกิดการเปิดเผยข้อมูลบางส่วนในหน่วยความจำได้ ภายใต้เงื่อนไขที่มีการใช้งาน scgi_pass หรือ uwsgi_pass
      1.3 CVE-2026-40701 (CVSS v3.1: 4.8) [5]
      เป็นช่องโหว่ประเภท Use-After-Free ใน ngx_http_ssl_module ซึ่งเกี่ยวข้องกับการใช้งาน TLS, OCSP และการตรวจสอบ client certificate ในบางรูปแบบการตั้งค่า หาก TLS connection ถูกปิดก่อนกระบวนการ asynchronous OCSP DNS resolution เสร็จสมบูรณ์ อาจทำให้ worker process อ้างอิงหน่วยความจำที่ถูกคืนไปแล้ว และส่งผลให้เกิดการทำงานผิดพลาดหรือ worker process restart ได้
      1.4 CVE-2026-42934 (CVSS v3.1: 4.8) [6]
      เป็นช่องโหว่ประเภท Out-of-Bounds Read ใน ngx_http_charset_module เกิดจากข้อผิดพลาดในการจัดการ UTF-8 sequence ที่ไม่สมบูรณ์ระหว่าง proxy buffer boundaries ในบางรูปแบบการตั้งค่า อาจทำให้ระบบอ่านข้อมูลหน่วยความจำเกินขอบเขต ส่งผลให้เกิดการเปิดเผยข้อมูลในหน่วยความจำอย่างจำกัด หรือทำให้ worker process restart ได้

    2. ผลิตภัณฑ์ที่ได้รับผลกระทบ [7]
      2.1 NGINX Open Source เวอร์ชัน 0.6.27 – 1.30.0
      2.2 ระบบที่มีการใช้งาน ngx_http_rewrite_module และมี rewrite rule ที่เข้าเงื่อนไข
      2.3 ระบบที่มีการใช้งาน scgi_pass หรือ uwsgi_pass
      2.4 ระบบที่เปิดใช้งาน SSL/OCSP และ client certificate verification ตามเงื่อนไขที่ได้รับผลกระทบ
      2.5 ระบบที่ใช้งาน charset conversion และ proxy buffering ตามเงื่อนไขที่ได้รับผลกระทบ

    3. แนวทางการแก้ไข
      3.1 อัปเดต NGINX เป็นเวอร์ชันที่ได้รับการแก้ไขแล้ว เช่น NGINX Open Source 1.30.1 stable หรือ 1.31.0 mainline หรือใหม่กว่า
      3.2 ตรวจสอบ configuration ของ ngx_http_rewrite_module โดยเฉพาะ rewrite rule ที่ใช้ unnamed capture เช่น $1 หรือ $2
      3.3 หากยังไม่สามารถอัปเดตได้ทันที ให้ปรับ rewrite rule โดยหลีกเลี่ยงรูปแบบที่เข้าเงื่อนไข และพิจารณาใช้ named capture แทน
      3.4 ตรวจสอบการใช้งาน scgi_pass, uwsgi_pass, SSL/OCSP, charset conversion และ proxy buffering ว่าตรงกับเงื่อนไขช่องโหว่หรือไม่
      3.5 เฝ้าระวัง log ผิดปกติ การ restart หรือ crash ของ worker process และคำขอ HTTP ที่ผิดปกติซึ่งเกี่ยวข้องกับโมดูลที่ได้รับผลกระทบ
      3.6 เปิดใช้งานมาตรการป้องกันหน่วยความจำ เช่น ASLR และจำกัดสิทธิ์ของ service process ตามหลัก Least Privilege

    4. มาตรการชั่วคราวหากยังไม่สามารถอัปเดตได้ทันที
      4.1 จำกัดการเข้าถึงบริการ NGINX จากอินเทอร์เน็ตเฉพาะที่จำเป็น
      4.2 ตรวจสอบและลดการใช้งาน rewrite rule ที่เข้าเงื่อนไข โดยเฉพาะ rule ที่ใช้ $1, $2 หรือ replacement string ที่มีเครื่องหมาย ?
      4.3 พิจารณาปิดหรือจำกัดการใช้งาน scgi_pass, uwsgi_pass, SSL/OCSP หรือ charset conversion ที่ไม่จำเป็น หลังประเมินผลกระทบต่อระบบ
      4.4 เปิดใช้ ASLR และมาตรการ hardening อื่น ๆ ของระบบปฏิบัติการ
      4.5 เฝ้าระวังการ restart ของ worker process การใช้หน่วยความจำผิดปกติ และ HTTP request ที่มีลักษณะผิดปกติ

    NGINXX.png

    แหล่งอ้างอิง
    [1] https://dg.th/evl9wbh1g0
    [2] https://dg.th/9fbo7qn4id
    [3] https://dg.th/cmtunbh2dy
    [4] https://dg.th/p4mxew3thg
    [5] https://dg.th/m74zfgc18u
    [6] https://dg.th/1kt5x3qzyl
    [7] https://dg.th/871rkqmdt0

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • Microsoft แก้ไขข้อผิดพลาด Windows Autopatch หลังพบการติดตั้งไดรเวอร์ที่ถูกจำกัดโดยไม่ได้รับอนุญาต

    ศูนย์ประสานการรักษาความมั่นคงปลอดภัยระบบคอมพิวเตอร์แห่งชาติ (ThaiCERT) ได้ติดตามสถานการณ์ความผิดปกติในบริการ Windows Autopatch ของ Microsoft ซึ่งมีรายงานว่าเกิดข้อผิดพลาดในการจัดการนโยบาย ทำให้ระบบทำการติดตั้งไดรเวอร์ (Driver Updates) ลงบนเครื่องคอมพิวเตอร์ของผู้ใช้งานโดยอัตโนมัติ ทั้งที่ผู้ดูแลระบบได้ตั้งค่าจำกัดหรือต้องรอการอนุมัติก่อน (Restricted Drivers) ซึ่งความผิดปกตินี้อาจส่งผลต่อเสถียรภาพของระบบในหน่วยงานได้ [1]

    1. รายละเอียดเหตุการณ์
      Microsoft ตรวจพบข้อผิดพลาดในระดับบริการ (Service-side bug) ของ Windows Autopatch ที่ทำให้กลไกการควบคุมการติดตั้งไดรเวอร์ทำงานผิดพลาด ส่งผลให้ไดรเวอร์ประเภท Recommended Drivers ถูกส่งไปยังเครื่องปลายทางและติดตั้งโดยอัตโนมัติ แม้ว่าผู้ดูแลระบบไอทีจะกำหนดนโยบาย (Administrative Policies) ให้ต้องมีการอนุมัติด้วยตนเอง (Manual Approval) ก่อนก็ตาม [2]

    2. ลักษณะของปัญหา
      ปัญหาดังกล่าวเกิดขึ้นจากการประมวลผลในส่วนของ Cloud Machinery ของ Microsoft ที่ทำหน้าที่ตัดสินใจว่าเครื่องปลายทางควรได้รับซอฟต์แวร์ใดบ้าง โดยพบความผิดปกติดังนี้
      2.1 ระบบข้ามขั้นตอนการตรวจสอบสิทธิ์การอนุมัติของผู้ดูแลระบบ
      2.2 มีการติดตั้งไดรเวอร์ที่เป็นตัวเลือก (Optional Drivers) หรือไดรเวอร์ที่ถูกจำกัดไว้ลงในเครื่องกลุ่มเป้าหมายโดยทันที
      2.3 ความผิดปกตินี้เกิดขึ้นในวงจำกัด โดยเฉพาะกับอุปกรณ์ในภูมิภาคสหภาพยุโรป (EU) แต่ส่งผลกระทบต่อความเชื่อมั่นในระบบการจัดการอัปเดตอัตโนมัติ

    3. ผลกระทบ
      3.1 ระบบอาจติดตั้งไดรเวอร์ที่ไม่เหมาะสมกับฮาร์ดแวร์ ส่งผลให้เครื่องเกิดอาการค้างหรือทำงานผิดปกติ
      3.2 อุปกรณ์อาจเกิดการรีสตาร์ท (Unexpected Reboots) โดยไม่คาดคิด
      3.3 ในบางกรณี อาจนำไปสู่ความล้มเหลวของระบบ (System Failures) จนไม่สามารถเข้าใช้งานได้
      3.4 ผู้ดูแลระบบสูญเสียการควบคุมในการทดสอบไดรเวอร์ก่อนการใช้งานจริงในหน่วยงาน

    4. ผลิตภัณฑ์และระบบที่ได้รับผลกระทบ
      4.1 ระบบปฏิบัติการ Windows 11 เวอร์ชัน 25H2, 24H2 และ 23H2
      4.2 อุปกรณ์ที่บริหารจัดการผ่านบริการ Windows Autopatch
      4.3 กลุ่มผู้ใช้งานและอุปกรณ์ที่ตั้งอยู่ในภูมิภาคสหภาพยุโรป (EU)

    5. แนวทางการแก้ไขและป้องกัน
      5.1 Microsoft ระบุว่าได้แก้ไขปัญหานี้แล้วผ่านการปรับปรุงฝั่งบริการ จึงไม่จำเป็นต้องติดตั้ง client-side update เพิ่มเติมเพื่อแก้ไขปัญหา
      5.2 ผู้ดูแลระบบควรตรวจสอบประวัติการติดตั้งไดรเวอร์บนอุปกรณ์ที่อยู่ภายใต้ Windows Autopatch โดยเฉพาะอุปกรณ์ในภูมิภาค EU หรืออุปกรณ์ที่พบอาการผิดปกติหลังได้รับการอัปเดต
      5.3 ตรวจสอบเหตุการณ์รีสตาร์ตผิดปกติ ระบบขัดข้อง หรือความไม่เสถียรของเครื่องหลังช่วงเวลาที่พบปัญหา
      5.4 หากพบว่าไดรเวอร์ที่ติดตั้งส่งผลกระทบต่อการทำงานของระบบ ควรพิจารณา rollback ไดรเวอร์ หรือปรึกษาผู้ผลิตฮาร์ดแวร์/ผู้ให้บริการที่เกี่ยวข้องก่อนดำเนินการเพิ่มเติม
      5.5 ทบทวนนโยบายการจัดการไดรเวอร์และเฟิร์มแวร์ใน Microsoft Intune/Windows Autopatch เพื่อให้มั่นใจว่ายังสอดคล้องกับแนวทาง Change Management ของหน่วยงาน
      5.6 ติดตามประกาศจาก Microsoft Release Health, Microsoft 365 admin center และ Windows Autopatch documentation อย่างต่อเนื่อง เพื่อรับทราบปัญหาที่เกี่ยวข้องกับการอัปเดตในอนาคต

    Windows Autopatch.png

    แหล่งอ้างอิง
    [1] https://dg.th/thxzwm0y36
    [2] https://dg.th/i012xc96zt

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • Cyber Threat Intelligence 15 May 2026

    Industrial Sector

    • Siemens SIMATIC
      "SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16
    • Universal Robots Polyscope 5
      "Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-17
    • Siemens Siemens ROS#
      "ROS# contains a ROS service file_server, that before version 2.2.2 contains a path traversal vulnerability which could allow an attacker to access, i.e. read and write, arbitrary files, which are accessible with the user rights of the user that runs the service, on the system that hosts service. Siemens has released a new version for ROS# and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-08
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox contains an input validation vulnerability in the Scheduler functionality that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12
    • Siemens SENTRON 7KT PAC1261 Data Manager
      "The web server in SENTRON 7KT PAC1261 Data Manager Before V2.1.0 contains a request smuggling vulnerability in the Go Project's net/http package that could allow an attacker to retrieve authorization tokens that can be used to gain administrative control over the device. Siemens has released a new version for SENTRON 7KT PAC1261 Data Manager and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-14
    • Siemens SIMATIC S7 PLC Web Server
      "SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-15
    • Siemens gWAP
      "Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namely the Axios HTTP client library. The vulnerability stems from a specific "Gadget" attack chain that allows prototype pollution in other third-party libraries, potentially allowing an attacker to execute arbitrary code. Siemens has released a new version for gWAP and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remote attacker to read arbitrary files with root privileges from the underlying operating system's filesystem. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-02
    • Siemens Solid Edge
      "Solid Edge SE2026 before Update 5 is affected by two file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released a new version for Solid Edge SE2026 and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03
    • Siemens Teamcenter
      "Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04
    • Siemens Simcenter Femap
      "Simcenter Femap is affected by heap based buffer overflow vulnerability in Datakit library that could be triggered when the application reads files in IPT format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05
    • Siemens Industrial Devices
      "Multiple industrial devices contain a vulnerability that could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-06
    • Siemens SIMATIC
      "SIMATIC HMI Unified Comfort Panels before V21.0 are affected by a vulnerability that allows an unauthenticated attacker to access the web browser via the help link. This vulnerability allows an attacker to access the web browser through the Control Panel if it is not protected by the corresponding security mechanisms. This opens the possibility for the attacker to find backdoors, which might lead to unwanted misconfigurations. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-07
    • Siemens Opcenter RDnL
      "Opcenter RDnL is affected by missing authentication in critical function in ‘ActiveMQ Artemis’. An unauthenticated attacker within the adjacent network could use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in availability impacts or message injection into any queue via the rogue broker. Breaking the integrity of a message has a low impact due to missing auto refresh functionality and it does not contain any confidential information. ActiveMQ Artemis has released a new version and Siemens recommends to update to the latest version."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-09
    • Siemens Ruggedcom Rox
      "Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-11
    • Siemens SIPROTEC 5
      "The SIPROTEC 5 devices do not use sufficiently random numbers to generate session identifiers. This could facilitate a brute-force attack against a valid session identifier which could allow an unauthenticated remote attacker to hijack a valid user session. The affected session identifiers are only used in a subset of the endpoints that are provided by the affected products. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-13

    Vulnerabilities

    Malware

    • Help-Desk Lures Drop KongTuke's Evolved ModeloRAT
      "Threat actors are impersonating help-desk staff over external Microsoft Teams chats to trick victims into deploying "ModeloRAT" on their own machines. ReliaQuest attributes the activity to financially motivated initial access broker (IAB) "KongTuke" based on reuse of the group's custom Python loader. Previously, KongTuke has compromised WordPress sites to host "ClickFix" and "CrashFix" lures and paste-and-run prompts on fake CAPTCHA or browser-crash pages for access that has historically fed ransomware affiliates. This Teams activity, which appears to add to, rather than replace, that web-based approach, marks the first time we’ve seen KongTuke use a collaboration platform for initial access. In the incidents we investigated, a single external Teams chat moved the operator from cold outreach to a persistent foothold in under five minutes."
      https://reliaquest.com/blog/threat-spotlight-help-desk-lures-drop-kongtukes-evolved-modelorat
      https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/
    • Chinese APT Campaign Targets Entities With Updated FDMTP Backdoor
      "Darktrace have identified activity consistent with Chinese-nexus operations, a Twill Typhoon-linked campaign targeting customer environments, primarily within the Asia-Pacific & Japan (APJ) region. Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework."
      https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor
      https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
      https://www.bankinfosecurity.com/mustang-panda-linked-to-new-modular-fdmtp-backdoor-a-31696
      https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
    • FrostyNeighbor: Fresh Mischief And Digital Shenanigans
      "This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise chain and methods to evade detection – targeting victims located in Eastern Europe, according to our telemetry."
      https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/
      https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html
      https://www.darkreading.com/cyberattacks-data-breaches/frostyneighbor-apt-govt-orgs-poland-ukraine
    • Instead Of a Job—stolen Data And Money. Trojan Stealer Targeting MacOS And Windows Users Conceals Itself In Fake Online Interview Apps
      "Doctor Web’s experts are warning users about the spread of JobStealer, a trojan app that steals confidential information from macOS and Windows computer users. It primarily aims to hijack data from crypto wallets. Fraudsters, under the pretext of conducting online interviews, lure potential victims to malicious websites and ask them to download a video conferencing app. In reality, this software is the JobStealer trojan."
      https://news.drweb.com/show/?i=15253&lng=en
      https://hackread.com/fake-job-interview-jobstealer-malware-windows-macos/
    • OrBit (Re)turns: Tracking An Open-Source Linux Rootkit Across Four Years Of Forks And Deployments
      "In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized. It wasn’t. As we will show below, OrBit is a repackaged and selectively weaponized build of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in December 2022. The story of OrBit’s four-year evolution is not one of novel development; it’s the story of how a publicly available rootkit was forked, configured, and redeployed."
      https://intezer.com/blog/orbit-returns/
    • Device Code Phishing Is An Evolution In Identity Takeover
      "Credential phishing remains an effective technique enabling everything from account takeover and fraud to ransomware and espionage. However, as organizations become better at defending against common phishing techniques such as multifactor authentication (MFA) phishing, cyber threat actors have expanded their capabilities to techniques like device code and OAuth phishing. When combined with LLM-generated tools and social engineering, criminals can use such techniques to target more people with new social engineering tricks at scale."
      https://www.proofpoint.com/us/blog/threat-insight/device-code-phishing-evolution-identity-takeover
    • Kimsuky Targets Organizations With PebbleDash-Based Tools
      "Over the past few months, we have conducted an in-depth analysis of specific activity clusters of Kimsuky (aka APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, and Springtail), a prolific Korean-speaking threat actor. Our research revealed notable tactical shifts throughout multiple phases of the group’s latest campaigns. Kimsuky has continuously introduced new malware variants based on the PebbleDash platform, a tool historically leveraged by the Lazarus Group but appropriated by Kimsuky since at least 2021. Our monitoring indicates various strategic updates to the group’s arsenal, including the use of VSCode Tunneling, Cloudflare Quick Tunnels, DWAgent, large language models (LLMs), and the Rust programming language. This expanding set of tools underscores the group’s ongoing adaptation and evolution."
      https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/
    • Popular Node-Ipc Npm Package Infected With Credential Stealer
      "Socket’s threat feed has detected malicious activity in newly published versions of node-ipc, a long-running npm package previously associated with one of the most widely discussed supply chain incidents in the JavaScript ecosystem."
      https://socket.dev/blog/node-ipc-package-compromised
      https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack
      https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html
      Operation SilentCanvas : JPEG Based Multistage Powershell Intrusion
      "At CYFIRMA, we identified a highly sophisticated multi-stage intrusion campaign leveraging a weaponized PowerShell payload disguised as a legitimate JPEG image file to deploy a trojanized instance of ConnectWise ScreenConnect for covert and persistent remote access. The intrusion likely originated through social engineering techniques such as phishing emails, malicious attachments, deceptive file-sharing interactions, or fake update lures involving a malicious file named sysupdate.jpeg. The payload was specifically crafted to exploit user trust and bypass conventional file-extension validation mechanisms while blending malicious activity with legitimate enterprise software."
      https://www.cyfirma.com/research/operation-silentcanvas-jpeg-based-multistage-powershell-intrusion/

    อ้างอิง
    Electronic Transactions Development Agency (ETDA) 3216a206-e2b0-4f38-a59c-29d4bcb761ed-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • Cyber Threat Intelligence 14 May 2026

    Financial Sector

    • Financial Stability Risks Mount As Artificial Intelligence Fuels Cyberattacks
      "Artificial intelligence is transforming how the financial system copes with vulnerabilities and reacts to incidents. Yet it is also amplifying cyber threats that can undermine financial stability when the offensive capabilities of intruders outpace defenses. IMF analysis suggests that extreme cyber‑incident losses could trigger funding strains, raise solvency concerns, and disrupt broader markets. The financial system relies on shared digital infrastructure that’s highly interconnected, including software, cloud services, and networks for payments and other data. Advanced AI models can dramatically reduce the time and cost needed to identify and exploit vulnerabilities, raising the likelihood of simultaneously discovering and targeting weaknesses in widely used systems. As a result, cyber risk is increasingly about correlated failures that could disrupt financial intermediation, payments, and confidence at the systemic level."
      https://www.imf.org/en/blogs/articles/2026/05/07/financial-stability-risks-mount-as-artificial-intelligence-fuels-cyberattacks
      https://www.bankinfosecurity.com/imf-warns-ai-has-made-cyber-risk-financial-stability-threat-a-31679

    Industrial Sector

    • ABB AC500 V3 Stack Buffer Overflow In Cryptographic Message Syntax
      "ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves publicly reported vulnerability. An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-05
    • ABB AC500 V3 Multiple Vulnerabilities
      "ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691)."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-03
    • ABB WebPro SNMP Card PowerValue Multiple Vulnerabilities
      "ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory. Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have - Unauthorized access - Insufficient Session Expiration leading to resource unavailability - Uncontrolled Resource Consumption leading to DOS attack ABB strongly advises customers to update the latest firmware of affected products."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-06
    • Fuji Electric Tellus
      "Successful exploitation of this vulnerability could allow an attacker to elevate privileges from user to system, which may then enable the attacker to cause a temporary denial of service, open files, or delete files."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-01
    • Subnet Solutions PowerSYSTEM Center
      "Successful exploitation of these vulnerabilities could allow an authenticated attacker to expose sensitive information or cause a CRLF injection."
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02
    • ABB Automation Builder Gateway For Windows
      "ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled"
      https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-04
    • ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA
      "Only Siemens, Schneider Electric, CISA, and CERT@VDE have published new ICS security advisories for the May 2026 Patch Tuesday. Siemens has published 18 new security advisories, and several of them describe critical vulnerabilities. The company has addressed critical issues in Sentron 7KT PAC1261 Data Manager (device takeover), Simatic S7 PLC web server (XSS), Ruggedcom Rox (command execution as root, old vulnerabilities in third-party components), ROS# (arbitrary file access), Simatic CN4100 (over 300 third-party component flaws), and Opcenter RDnL (missing authentication)."
      https://www.securityweek.com/ics-patch-tuesday-new-security-advisories-from-siemens-schneider-cisa/

    Vulnerabilities

    Malware
    Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker In Global Spying Campaign
    "Iran-linked attackers spent a week inside the network of a major South Korean electronics manufacturer in February 2026, as part of a sprawling early-year espionage campaign affecting at least nine organizations across four continents. Other targets included government agencies and an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial-services provider, and educational institutions in multiple countries."
    https://www.security.com/threat-intelligence/iran-seedworm-electronics
    https://www.bleepingcomputer.com/news/security/iranian-hackers-targeted-major-south-korean-electronics-maker/

    • Sandworm Activity In Industrial Environments: What The Data Reveals
      "“Without rapid containment, Sandworm does not disengage. It accelerates.” Recent geopolitical events involving publicly disclosed attacks against national critical infrastructure across Europe and the U.S., have once again drawn attention to a highly disruptive threat actor known as Sandworm, the Russian state-sponsored group also tracked as APT44, Seashell Blizzard, and Voodoo Bear. By studying environments where Sandworm activity has been positively identified, we can extract lessons that help future victims detect intrusions earlier, recover more effectively, and — most importantly — prevent Sandworm-related incidents altogether."
      https://www.nozominetworks.com/blog/sandworm-activity-in-industrial-environments-what-the-data-reveals
      https://www.bankinfosecurity.com/russian-attacks-on-polish-water-utilities-use-fear-as-weapon-a-31681
    • FamousSparrow APT Targets Azerbaijani Oil And Gas Industry
      "Bitdefender Labs tracked a multi-wave intrusion targeting an Azerbaijani oil and gas company from late December 2025 through late February 2026. This research documents expansion of Chinese APT activity against South Caucasus energy infrastructure, attributed with moderate-to-high confidence to FamousSparrow (overlapping with the Earth Estries threat ecosystem). The operation demonstrates several notable technical and strategic characteristics, most notably an evolved DLL sideloading technique. Unlike standard DLL sideloading that relies on simple file replacement, this method overrides two specific exported functions within the malicious library. This creates a two-stage trigger that gates the Deed RAT loader’s execution through the host application’s natural control flow, further evolving the defense evasion capabilities of traditional DLL sideloading."
      https://businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-oil-gas-industry
      https://thehackernews.com/2026/05/azerbaijani-energy-firm-hit-by-repeated.html
      https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-apt-south-caucasus-energy-firm
    • The French 2-Step: Exposing a Multi-Stage Scam Targeting The National Railway Company In France
      "While online scams are becoming more advanced, this particular multi-stage scam stands out for its advanced social engineering. These days, it’s not uncommon to receive fake phishing emails. Generally, they are easy to spot because of the ridiculous way they try to make us believe in offers that are too good to be true. However Group-IB’s current research indicates that fraudsters can be very persuasive and meticulous both in the way they carry out their scam and their choice of victims. This blog focuses on one highly-targeted scheme to deceive customers of the French national railway company (SNCF), which is used on a daily basis by 5 millions of travelers through 15 thousand trains."
      https://www.group-ib.com/blog/french-railway-two-step-scam/
    • Sinkholing CountLoader: Insights Into Its Recent Campaign
      "McAfee Labs has recently uncovered a large scale CountLoader campaign that uses multiple layers of obfuscation and staged payload delivery to evade detection and maintain persistence in infected systems. The infection process relies on several layers of loaders, including PowerShell scripts, obfuscated JavaScript executed through mshta.exe, and in memory shellcode injection, each stage decrypting and launching the next. The attackers employ a custom encrypted communication protocol to interact with their C2 servers. By registering a backup domain used by the malware, we were able to sinkhole the traffic and observe thousands of infected machines connecting to the C2 infrastructure. Final payload deployed in this campaign is a cryptocurrency clipper, which monitors clipboard activity and replaces copied wallet addresses with attacker controlled ones to redirect cryptocurrency transactions."
      https://www.mcafee.com/blogs/other-blogs/mcafee-labs/sinkholing-countloader-insights-into-its-recent-campaign/
    • GemStuffer Campaign Abuses RubyGems As Exfiltration Channel Targeting UK Local Government
      "Socket's threat research team is tracking a suspicious RubyGems campaign we’re calling GemStuffer, involving more than 100 gems that appear to use the RubyGems registry as a data transport mechanism rather than a conventional malware distribution channel. The packages do not appear designed for mass developer compromise. Many have little or no download activity, and the payloads are repetitive, noisy, and unusually self-contained. Instead, the scripts fetch pages from UK local government democratic services portals, package the collected responses into valid .gem archives, and publish those gems back to RubyGems using hardcoded API keys. In some samples, the payload creates a temporary RubyGems credential environment under /tmp, overrides HOME, builds a gem locally, and pushes it to rubygems.org. Other variants skip the gem CLI entirely and POST the archive directly to the RubyGems API."
      https://socket.dev/blog/gemstuffer
      https://thehackernews.com/2026/05/gemstuffer-abuses-150-rubygems-to.html
    • Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code To GitHub
      "Breaking News: TeamPCP has gone open source — and the copycats are already here. The group behind Shai-Hulud has leaked their own malware code to GitHub, and independent threat actors have already begun modifying it and expanding its reach. OX Security is actively tracking this as it unfolds. TeamPCP has escalated. The group behind Shai-Hulud is now spreading not just their malware, but their own source code, using what appear to be compromised GitHub accounts. Currently 2 repositories are active, but that number is growing as infections spread. New repositories can be monitored in real time using this link. Search GitHub for “A Gift From TeamPCP.”"
      https://www.ox.security/blog/shai-hulud-open-source-malware-github/
      https://www.theregister.com/security/2026/05/13/malware-crew-teampcp-open-sources-its-shai-hulud-worm-on-github/5239319
    • Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS And Elementary-Data In CI/CD Credential Theft
      "TeamPCP has been identified as running a coordinated campaign from March 19 through April 24, with at least seven distinct waves identified. It finds trusted artifacts in developer tool chains, poisons the distribution channel using that project’s own infrastructure, and harvests credentials before the project’s maintainers or security monitoring catches the substitution. The targets span five programming ecosystems and three registry types. What distinguishes the two most recent operations is how the actor reached the same outcome, despite using different methods to get there. The KICS attack was operationally complex, with simultaneous poisoning across three distribution channels, an obfuscated payload executed via a downloaded runtime, and a downstream npm hijack executed within 24 hours using stolen credentials."
      https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html
    • Undermining The Trust Boundary: Investigating a Stealthy Intrusion Through Third-Party Compromise
      "In recent years, many sophisticated intrusions have increasingly avoided using noisy exploits, obvious malware, or custom tooling, instead leveraging systems that organizations already trust within their environments. By operating through legitimate and trusted administrative mechanisms, threat actors could more easily blend seamlessly into routine operations and remain undetected. Microsoft Incident Response investigated an intrusion that followed this pattern. What initially appeared as routine administrative activity was instead found to be a coordinated campaign abusing trusted operational relationships and authentication processes to establish durable access. The threat actor in this incident leveraged a compromised third-party IT services provider and legitimate IT management tools to conduct a stealthy campaign focusing on long-term access, credential theft, and establishing a persistent foothold."
      https://www.microsoft.com/en-us/security/blog/2026/05/12/undermining-the-trust-boundary-investigating-a-stealthy-intrusion-through-third-party-compromise/

    Breaches/Hacks/Leaks

    • When The Ransomware Gang Gets Hacked: What The Gentlemen Leak Reveals About Modern Ransomware Risk
      "On May 4, 2026, The Gentlemen’s administrator acknowledged on underground forums that their internal backend database had been compromised and leaked, likely connected to a breach of 4VPS, a hosting provider the group used to run their infrastructure. Check Point Research obtained a portion of that data before it was removed: internal chat logs, organizational rosters, ransom negotiation transcripts, and tooling discussions. It is the kind of inside view of a ransomware operation that almost never becomes available to defenders. This blog distills what CPR found, building on our initial analysis published in April 2026. For the full technical breakdown, read the complete CPR research report."
      https://blog.checkpoint.com/research/when-the-ransomware-gang-gets-hacked-what-the-gentlemen-leak-reveals-about-modern-ransomware-risk/
      https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/
      https://www.darkreading.com/threat-intelligence/gentlemen-raas-gang-data-leak
    • 716,000 Impacted By OpenLoop Health Data Breach
      "Hackers stole the personal information of 716,000 individuals during a January 2026 intrusion at telehealth platform OpenLoop Health. The incident was initially disclosed to the relevant authorities in March, but the number of impacted individuals was added to the US Department of Health and Human Services’ breach portal only this week. According to notification letters OpenLoop Health filed with the Attorney General’s Offices in California and Texas, the intrusion was discovered on January 7. “An unauthorized third party had gained access to certain OpenLoop systems and removed certain information,” the notification reads."
      https://www.securityweek.com/716000-impacted-by-openloop-health-data-breach/
      https://securityaffairs.com/192066/uncategorized/openloop-health-confirms-january-2026-data-breach-affecting-716000.html
    • TeamPCP Claims Sale Of Mistral AI Repositories Amid Mini Shai-Hulud Attack
      "Only days after the Mini Shai-Hulud supply chain attack targeted npm and PyPI packages associated with French artificial intelligence company Mistral AI, a threat actor using the TeamPCP identity is now claiming to sell what appear to be internal company repositories and source code on a hacking forum. The forum post, published a few hours ago under the TeamPCP name, advertises roughly 5GB of alleged internal repositories connected to both “mistralai” and “mistral-solutions.” The actor claims the archive contains around 450 repositories covering training systems, fine-tuning projects, benchmarking tools, dashboards, inference infrastructure, experiments, and future AI projects."
      https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/

    General News

    • April 2026 Phishing Email Trends Report
      "in April 2026, the most common threat in phishing email attachments was Trojan (47%). this type was distributed by disguising itself with a double extension or a legitimate file name to trick the user into executing it and installing malware on the system. they continued to spread through multiple variants and social engineering techniques."
      https://asec.ahnlab.com/en/93706/
    • Checkbox Assessments Aren't Fit To Measure To Risk
      "A rapidly evolving threat landscape with highly adaptable and increasingly sophisticated threat actors is no place for checkbox compliance assessments that merely audit organizations' security postures once a year. That's why security professionals and industry experts are calling for compliance models that take a more continuous approach, and more companies continue to emerge in the space. Industry leaders and CISOs continually poke holes in the way governance, risk management, and compliance (GRC) and third-party risk management (TPRM) assessments are conducted – and the holes are only growing bigger. Yearly assessments, with their static questionaries to determine an organization's risk level, are stagnant, the polar opposite of how attackers' behave. Threat actors can now find and exploit vulnerabilities faster and discover new vectors to conduct supply-chain attacks."
      https://www.darkreading.com/cyber-risk/checkbox-assessments-aren-t-fit-to-measure-to-risk
    • Ransomware: Over Half Of CISOs Would Consider Paying Ransom To Hackers
      "In the event of being hit by a ransomware attack, over half of cybersecurity leaders would consider paying the ransom demand to cybercriminals to end the incident and restore systems faster, according to newly released figures. Published on May 13, the report by Absolute Security suggested that 58% of CISOs would realistically think about paying the ransom, if that is what it took to help restore systems encrypted in a ransomware attack. The research suggested that CISOs in the US are more likely to consider paying a ransom demand, at 63%, than their counterparts in the UK, at just 47%."
      https://www.infosecurity-magazine.com/news/ransomware-over-half-cisos-would/
    • Global Cyber Agencies Issue New SBOMs For AI Guidance To Tackle AI Supply Chain Risks
      "Multiple government cyber agencies have a new resource defining the minimum elements for software bills of materials (SBOMs) for AI to strengthen the AI-supply chain. The aim is to help public and private sector stakeholders improve transparency in their artificial intelligence (AI) systems and supply chains. The paper, Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements, was published on 12 May and was written by the G7 Cybersecurity Working Group."
      https://www.infosecurity-magazine.com/news/new-sboms-for-ai-guidance-2026/
      https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_minimum-elements.pdf?__blob=publicationFile&v=4
    • Alleged Dream Market Admin Arrested In Germany After US Indictment
      "German and U.S. authorities arrested the alleged administrator behind Dream Market, a popular dark web forum that shut down in 2019. During a May 7 raid on three locations, German and U.S. law enforcement arrested Owe Martin Andresen, 49, on multiple charges of money laundering. An indictment unsealed this week by the DOJ accused Andresen of being the main administrator of Dream Market. The Justice Department did not respond to requests for comment about whether they will ask for him to be extradited from Germany, where he also faces charges. U.S. Attorney Theodore Hertzberg said Andresen “will be prosecuted in both Germany and the United States as a result of his actions.”"
      https://therecord.media/dream-market-admin-arrested-in-germany
    • Operating Inside The Lethal Trifecta: Blast Radius Reduction In AI Agent Deployments
      "AI agents that can read files, call APIs, and perform actions are already being deployed in enterprises. These agents often operate in the center of what Simon Willison terms ‘the lethal trifecta’: they can access private data, process untrusted content, and communicate externally, making them susceptible to data theft via indirect prompt injection – where an attacker plants instructions in content that the agent reads on behalf of a trusted user, such as an email, a web page, or a document. The agent follows the injected instructions with the user's privileges, and the user never sees the attack. The Agents Rule of Two generalizes the concept: an agent should satisfy at most two of a) processing untrusted inputs, b) accessing sensitive systems, and c) changing state externally."
      https://www.sophos.com/en-us/blog/inside-the-lethal-trifecta-blast-radius-reduction-in-ai-agent-deployments

    อ้างอิง
    Electronic Transactions Development Agency (ETDA) a4379c79-f646-4d4d-b774-e47591b1c505-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • Google ยกระดับความปลอดภัย Android 17 เพิ่มระบบตรวจจับสายปลอมและแอปอันตราย

    Google ยกระดับความปลอดภัย Android 17 เพิ่มระบบตรวจจั.png

    สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand d02d598e-e3b5-4c09-9ee2-938f1874cc77-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT
  • กลุ่ม ShinyHunters อ้างโดเมนทางการถูกระงับ หลังเหตุโจมตี Canvas LMS

    กลุ่ม ShinyHunters อ้างโดเมนทางการถูกระงับ หลังเห.jpg

    สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand 7daccc95-ec22-4549-8948-6013fbfedaab-image.png

    โพสต์ใน Cyber Security News
    NCSA_THAICERTN
    NCSA_THAICERT