สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Telecom Sector

• Mobile Industry Warns Patchwork Cyber Regs Are Driving Up Costs
  "Mobile operators' core cybersecurity spending is projected to more than double by 2030 as threats evolve, while poorly designed and fragmented policy frameworks add extra compliance costs, according to industry group the GSMA. The lobbying organization has pushed out a report calling for national policymakers to simplify compliance and incident reporting to make the job of the network operators easier. It also wants to see greater international coordination between governments and regulators to build those frameworks around common standards."
  https://www.theregister.com/2025/11/26/gsma_global_standards_mobile_industry/
  https://www.gsma.com/solutions-and-impact/connectivity-for-good/public-policy/wp-content/uploads/2025/11/Impact-of-Cybersecurity-Regulation-on-Mobile-Operators.pdf

New Tooling

• DeepTeam: Open-Source LLM Red Teaming Framework
  "Security teams are pushing large language models into products faster than they can test them, which makes any new red teaming method worth paying attention to. DeepTeam is an open-source framework built to probe these systems before they reach users, and it takes a direct approach to exposing weaknesses. The tool runs on a local machine and uses language models to simulate attacks as well as evaluate the results. It applies techniques drawn from recent research on jailbreaking and prompt injection, which gives teams a way to uncover issues such as bias or exposure of personal data. Once DeepTeam finds a problem, it offers guardrails that can be added to production systems to block similar issues."
  https://www.helpnetsecurity.com/2025/11/26/deepteam-open-source-llm-red-teaming-framework/
  https://github.com/confident-ai/deepteam

Vulnerabilities

• Old Tech, New Vulnerabilities: NTLM Abuse, Ongoing Exploitation In 2025
  "Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits."
  https://securelist.com/ntlm-abuse-in-2025/118132/
• ASUS Warns Of New Critical Auth Bypass Flaw In AiCloud Routers
  "ASUS has released new firmware to patch nine security vulnerabilities, including a critical authentication bypass flaw in routers with AiCloud enabled. AiCloud is a cloud-based remote access feature that comes with many ASUS routers, turning them into private cloud servers for remote media streaming and cloud storage. As the Taiwanese electronics manufacturer explained, the CVE-2025-59366 vulnerability "can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.""
  https://www.bleepingcomputer.com/news/security/asus-warns-of-new-critical-auth-bypass-flaw-in-aicloud-routers/
• Popular Forge Library Gets Fix For Signature Verification Bypass Flaw
  "A vulnerability in the ‘node-forge’ package, a popular JavaScript cryptography library, could be exploited to bypass signature verifications by crafting data that appears valid. The flaw is tracked as CVE-2025-12816 and received a high severity rating. It arises from the library’s ASN.1 validation mechanism, which allows malformed data to pass checks even when it is cryptographically invalid."
  https://www.bleepingcomputer.com/news/security/popular-forge-library-gets-fix-for-signature-verification-bypass-flaw/
  Dell ControlVault, Lasso, GL.iNet Vulnerabilities
  "Cisco Talos’ Vulnerability Discovery & Research team recently disclosed five vulnerabilities in Dell ControlVault 3 firmware and its associated Windows software, four vulnerabilities in Entr'ouvert Lasso, and one vulnerability in GL.iNet Slate AX. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy. For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website."
  https://blog.talosintelligence.com/dell-controlvault-lasso-gl-inet-vulnerabilities/
• B2B Guest Access Creates An Unprotected Attack Vector
  "Microsoft Teams is a core collaboration platform for Ontinue and for the organisations we protect. Our ability to engage directly with customers inside their own Teams environments is one of our most valued differentiators, and one they consistently highlight as a strength of our service. However, like all powerful collaboration tools, Teams depends on proper configuration and governance to ensure its security boundaries function as intended. Effective protection is not inherent to the platform; it emerges from how each tenant chooses to manage external access, identity boundaries, and integrated security controls."
  https://www.ontinue.com/resource/blog-microsoft-chat-with-anyone-understanding-phishing-risk/
  https://hackread.com/microsoft-teams-guest-chat-flaw-malware/

Malware

• Bloody Wolf: A Blunt Crowbar Threat To Justice
  "Bloody Wolf is an advanced persistent threat (APT) group active since late 2023. The group initially used commercial STRRAT malware. Later, the group switched to deploying the legitimate NetSupport remote administration tool (RAT) in campaigns targeting Kazakhstan and Russia previously described by BI.ZONE analysts. A joint investigation between Group-IB and UKUK has revealed that Bloody Wolf had been conducting a campaign in Kyrgyzstan since at least June 2025. Those threat actors would impersonate the country’s Ministry of Justice through official looking PDF documents and domain names, which in turn hosted malicious Java Archive (JAR) files designed to deploy the NetSupport RAT."
  https://www.group-ib.com/blog/bloody-wolf/
• Dissecting a New Malspam Chain Delivering Purelogs Infostealer
  "The AISI Research Center’s Cybersecurity Observatory publishes the report “Dissecting a new malspam chain delivering Purelogs infostealer” – November 25, 2025. Organizational and personal security remains under constant threat from increasingly sophisticated attack vectors, with malspam continuing to represent one of the most widespread and effective initial infection vectors for distributing malware on a large scale. Despite advances in endpoint protection technologies, malicious campaigns effectively exploit human urgency, curiosity, and trust, often masquerading as legitimate communications, security alerts, or financial documents."
  https://securityaffairs.com/185066/cyber-crime/dissecting-a-new-malspam-chain-delivering-purelogs-infostealer.html
  https://dimanec.unipegaso.it/wp-content/uploads/sites/5/2025/11/Dissecting-a-new-malspam-chain-delivering-Purelogs-infostealer.pdf
• Russian RomCom Utilizing SocGholish To Deliver Mythic Agent To U.S. Companies Supporting Ukraine
  "In September 2025, Arctic Wolf Labs identified a U.S.-based company that was targeted by RomCom threat actors via SocGholish, operated by TA569. While the typical initial SocGholish infection chain was followed, roughly 10 minutes post-exploitation, RomCom’s targeted Mythic Agent loader was delivered to the system. This is the first time that a RomCom payload has been observed being distributed by SocGholish."
  https://arcticwolf.com/resources/blog/romcom-utilizing-socgholish-to-deliver-mythic-agent-to-usa-companies-supporting-ukraine/
  https://thehackernews.com/2025/11/romcom-uses-socgholish-fake-update.html
  https://securityaffairs.com/185084/security/for-the-first-time-a-romcom-payload-has-been-observed-being-distributed-via-socgholish.html
• Fake Battlefield 6 Pirated Versions And Game Trainers Used To Deploy Stealers And C2 Agents
  "Bitdefender Labs has identified malware campaigns exploiting the popularity of EA's Battlefield 6 first-person shooter, distributed via supposedly pirated versions, game installers, and fake game trainers across torrent websites and other easily found domains. Electronic Arts' Battlefield 6, developed by DICE and published by Electronic Arts (EA), was released in October, and it's likely one of the most significant game launches of the year."
  https://www.bitdefender.com/en-us/blog/labs/fake-battlefield-6-pirated-games-trainers
  https://hackread.com/fake-battlefield-6-downloads-malware-data/
• Malicious Chrome Extension Injects Hidden SOL Fees Into Solana Swaps
  "Socket’s Threat Research Team discovered a malicious Chrome extension Crypto Copilot, published on June 18, 2024, which markets itself as a tool to “execute trades instantly from your X feed.” Behind the interface, the extension injects an extra transfer into every Solana swap, siphoning a minimum of 0.0013 SOL or 0.05% of the trade amount to a hardcoded attacker-controlled wallet. The fee behavior is never disclosed on the Chrome Web Store listing, and the logic implementing it is buried inside heavily obfuscated code."
  https://socket.dev/blog/malicious-chrome-extension-injects-hidden-sol-fees-into-solana-swaps
  https://thehackernews.com/2025/11/chrome-extension-caught-injecting.html
• ShadowV2 Casts a Shadow Over IoT Devices
  "At the end of October, during a global disruption of AWS connections, FortiGuard Labs observed malware named “ShadowV2” spreading via IoT vulnerabilities. These incidents affected multiple countries worldwide and spanned seven different industries. So far, the malware appears to have only been active during the time of the large-scale AWS outage. We believe this activity was likely a test run conducted in preparation for future attacks. The following sections provide a detailed analysis of these incidents and the ShadowV2 malware."
  https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices
  https://www.bleepingcomputer.com/news/security/new-shadowv2-botnet-malware-used-aws-outage-as-a-test-opportunity/
  https://www.theregister.com/2025/11/26/miraibased_botnet_shadowv2/
• Shai Hulud Strikes Again (v2)
  "PostHog has published a detailed post mortem describing how one of its GitHub Actions workflows was abused as an initial access vector for Shai Hulud v2. An attacker briefly opened a pull request that modified a script executed via pull_request_target, exfiltrated a bot personal access token from CI, then used that access to steal additional GitHub secrets including an npm publish token and ship malicious versions of several PostHog SDKs. PostHog has since revoked credentials, tightened workflow reviews, moved to trusted publishing, and reworked its secrets management. Their write up highlights how subtle CI workflow choices can create a path from untrusted contributions to package release credentials."
  https://socket.dev/blog/shai-hulud-strikes-again-v2
  https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.html
• The Korean Leaks – Analyzing The Hybrid Geopolitical Campaign Targeting South Korean Financial Services With Qilin RaaS
  "The "Korean Leaks" campaign showcases a sophisticated supply chain attack against South Korea's financial sector. This operation combined the capabilities of a major Ransomware-as-a-Service (RaaS) group, Qilin, with potential involvement from North Korean state-affiliated actors (Moonstone Sleet) leveraging Managed Service Provider (MSP) compromise as the initial access vector."
  https://www.bitdefender.com/en-us/blog/businessinsights/korean-leaks-campaign-targets-south-korean-financial-services-qilin-ransomware
  https://thehackernews.com/2025/11/qilin-ransomware-turns-south-korean-msp.html

Breaches/Hacks/Leaks

• London Councils Hit By Serious Cyber “Incidents”
  "Multiple local authorities in London appear to be dealing with a serious cybersecurity incident, it has emerged. The Royal Borough of Kensington and Chelsea (RBKC) issued a statement on Tuesday revealing that it and Westminster City Council (WCC) were responding to an incident identified on Monday morning. The two have notified the UK Information Commissioner’s Office (ICO) and are working with the National Cyber Security Centre (NCSC) on incident response."
  https://www.infosecurity-magazine.com/news/london-councils-hit-by-serious/
  https://www.theregister.com/2025/11/26/cyberattack_london_councils/
  https://therecord.media/cyber-issue-london-councils-attack
  https://www.bleepingcomputer.com/news/security/multiple-london-councils-it-systems-disrupted-by-cyberattack/
  https://www.bankinfosecurity.com/multiple-london-councils-responding-to-cyberattack-a-30146
  https://securityaffairs.com/185086/security/multiple-london-councils-faced-a-cyberattack.html
• Gainsight Cyber-Attack Affect More Salesforce Customers
  "The cyber-attack targeting Gainsight has affected more Salesforce customers than initially expected. In a customer FAQ, first posted on November 20 and regularly updated since, the customer support platform provider said Salesforce initially provided a list of three customers impacted by the breach. Gainsight later found that the number “has been expanded to a larger list.”"
  https://www.infosecurity-magazine.com/news/gainsight-cyberattack-more/
  https://www.theregister.com/2025/11/26/gainsight_ceos_handful_customers_data_stolen/
  https://www.helpnetsecurity.com/2025/11/26/gainsight-breach-salesforce-details-attack-window/

General News

• Heineken CISO Champions a New Risk Mindset To Unlock Innovation
  "In this Help Net Security interview, Marina Marceta, CISO at Heineken, discusses what it takes for CISOs to be seen as business-aligned leaders rather than technical overseers. She shares how connecting security to business impact can shift perceptions and strengthen partnerships across the company. Marceta focuses on the value of a security culture that supports innovation while keeping risk in check."
  https://www.helpnetsecurity.com/2025/11/26/marina-marceta-heineken-business-aligned-security/
• Small Language Models Step Into The Fight Against Phishing Sites
  "Phishing sites keep rising, and security teams are searching for ways to sort suspicious pages at speed. A recent study explores whether small language models (SLMs) can scan raw HTML to catch these threats. The work reviews a range of model sizes and tests how they handle detection tasks while keeping compute demands in check."
  https://www.helpnetsecurity.com/2025/11/26/research-slms-website-phishing-detection/
  https://arxiv.org/pdf/2511.15434
• Cybersecurity Is Now a Core Business Discipline
  "Cyber risk has become the background noise of modern business. We’re seeing nearly two thousand attacks per organization per week in the first quarter of 2025—a 47% rise year-on-year. That surge reflects two realities moving at once: attacks are genuinely increasing because it’s easier and cheaper than ever to mount them, and defenders are getting better at spotting what previously slipped under the radar. In other words, the problem is growing and we’re measuring it more honestly."
  https://www.securityweek.com/cybersecurity-is-now-a-core-business-discipline/
• The Golden Scale: 'Tis The Season For Unwanted Gifts
  "In October 2025, we published two Insights blogs on threat activity affiliated with the cybercriminal alliance known as Scattered LAPSUS$ Hunters (SLSH). After a few weeks of apparent inactivity, the threat actors have returned with a vengeance based on open-source reporting and conversations obtained from a new Telegram channel (scattered LAPSUS$ hunters part 7). This latest Insights threat blog will detail several notable observations made by Unit 42 since mid-November, and prepares organizations as we head into the holiday season."
  https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/
• Behind The Bargains: Why Phishing Peaks On Black Friday
  "Black Friday has evolved into one of the most active shopping periods of the year. No longer is it just one day of shopping after Thanksgiving; the sales have now turned into a full week of high-volume promotions, beginning before Thanksgiving and stretching through Black Friday and Cyber Monday, with many retailers extending deals even longer. Unsurprisingly, this surge in digital activity is very attractive for threat actors."
  https://cofense.com/blog/behind-the-bargains-why-phishing-peaks-on-black-friday
• Sumsub’s Annual Report: Fraud Shifts To Complex Multi-Step Schemes In 2025, Agentic AI Scams Poised To Surge In 2026
  "Sumsub today released its Identity Fraud Report 2025–2026, analyzing millions of verification checks and 4,000,000+ fraud attempts between 2024–2025*. The study blends global and regional dynamics from internal data with findings from Sumsub’s Fraud Exposure Survey 2025, featuring responses from 300+ risk professionals and 1,200+ end users. In 2024, the rise of fraud-as-a-service platforms and ready-made toolkits “democratized” identity crime, making it widely accessible to non-tech-savvy fraudsters. In 2025, that trend matured into the Sophistication Shift: fewer but more professionalized operations designed for higher-impact damage."
  https://sumsub.com/newsroom/sumsubs-annual-report-fraud-shifts-to-complex-multi-step-schemes-in-2025-agentic-ai-scams-poised-to-surge-in-2026/
  https://sumsub.com/fraud-report-2025/
  https://www.darkreading.com/cyberattacks-data-breaches/digital-fraud-industrial-scale-2025
• Prompt Injections Loom Large Over ChatGPT's Atlas Browser
  "As a new AI-powered Web browser brings agentics closer to the masses, questions remain regarding whether prompt injections, the signature LLM attack type, could get even worse. ChatGPT Atlas is OpenAI's large language model (LLM)-powered Web browser launched Oct. 21 and based on Chromium. Currently available for macOS (with other platforms to come), Atlas comes with native ChatGPT functionality including text generation, Web page summarization, and agent capabilities."
  https://www.darkreading.com/application-security/prompt-injections-loom-large-over-chatgpt-atlas-launch
• Enterprises Aren't Confident They Can Secure Non-Human Identities (NHIs)
  "Non-human identities (NHIs) are poised to experience exponential growth and adoption throughout the coming year, fundamentally transforming how organizations approach cybersecurity. These digital entities, which include service accounts, system identities, machine identities, and other forms of automated identities, serve as the backbone of modern digital infrastructure by enabling communication and interaction between applications, services, and automated systems."
  https://www.darkreading.com/identity-access-management-security/enterprise-not-confident-secure-non-human-identities

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 7 รายการ เมื่อวันที่ 25 พฤศจิกายน 2025 พื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-25-329-01 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
• ICSA-25-329-02 Rockwell Automation Arena Simulation
• ICSA-25-329-03 Zenitel TCIV-3+
• ICSA-25-329-04 Opto 22 groov View
• ICSA-25-329-05 Festo Compact Vision System, Control Block, Controller, and Operator Unit products
• ICSA-25-329-06 SiRcom SMART Alert (SiSA)
• ICSA-22-333-05 Mitsubishi Electric FA Engineering Software (Update C)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/alerts/2025/11/25/cisa-releases-seven-industrial-control-systems-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Zenitel TCIV-3+
  "Successful exploitation of these vulnerabilities could result in arbitrary code execution or cause a denial-of-service condition."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-03
• Festo Compact Vision System, Control Block, Controller, And Operator Unit Products
  "Successful exploitation of these vulnerabilities could result in an attacker accessing devices without authentication or modifying configuration files."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-05
• SiRcom SMART Alert (SiSA)
  "Successful exploitation of this vulnerability could enable an attacker to remotely activate or manipulate emergency sirens."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-06
• Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
  "Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01
• Rockwell Automation Arena Simulation
  "Successful exploitation of this vulnerability could allow local attackers to execute arbitrary code on affected installations of Arena."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-02
• Opto 22 Groov View
  "Successful exploitation of this vulnerability could result in credential exposure, key exposure, and privilege escalation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-04

Vulnerabilities

• Update Firefox To Patch CVE-2025-13016 Vulnerability Affecting 180 Million Users
  "AI security firm AISLE recently discovered a serious vulnerability in the Firefox web browser that went unnoticed for six months. This flaw could have let attackers run their own instructions on a user’s computer, potentially putting over 180 million users at risk."
  https://hackread.com/update-firefox-patch-cve-2025-13016-vulnerability/

Malware

• RelayNFC: The New NFC Relay Malware Targeting Brazil
  "Cyble Research and Intelligence Labs (CRIL) has uncovered an active and evolving phishing campaign targeting users in Brazil. Dubbed RelayNFC, this Android malware family is designed specifically to perform NFC relay attacks for fraudulent contactless payments. RelayNFC is a lightweight yet highly evasive malware because of its Hermes-compiled payload. This makes detection significantly harder, enabling it to stealthily capture victims’ card data and relay it in real time to an attacker-controlled server."
  https://cyble.com/blog/relaynfc-nfc-relay-malware-targeting-brazil/
• Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)
  "Welcome to watchTowr vs the Internet, part 68. That feeling you’re experiencing? Dread. You should be used to it by now. As is fast becoming an unofficial and, apparently, frowned upon tradition - we identified incredible amounts of publicly exposed passwords, secrets, keys and more for very sensitive environments - and then spent a number of months working out if we could travel back in time to a period in which we just hadn't. Remember, kids - a problem shared is a problem that isn't just your problem anymore. It's the Shared Responsibility model(tm)."
  https://labs.watchtowr.com/stop-putting-your-passwords-into-random-websites-yes-seriously-you-are-the-problem/
  https://www.bleepingcomputer.com/news/security/code-beautifiers-expose-credentials-from-banks-govt-tech-orgs/
  https://thehackernews.com/2025/11/years-of-jsonformatter-and-codebeautify.html
  https://www.bankinfosecurity.com/blogs/data-leaks-are-we-so-stupid-about-free-online-services-p-3982
  https://www.helpnetsecurity.com/2025/11/25/code-formatting-sites-exposing-secrets/
• Fake Adult Websites Pop Realistic Windows Update Screen To Deliver Stealers Via ClickFix
  "Novel "JackFix" attack: Acronis TRU researchers discover an ongoing campaign that leverages a novel combination of screen hijacking techniques with ClickFix, displaying a realistic, full-screen Windows Update of “Critical Windows Security Updates” to trick victims into executing malicious commands. Adult content bait strategy: Campaign leverages fake adult websites (xHamster, PornHub clones) as its phishing mechanism, likely distributed via malvertising. The adult theme, and possible connection to shady websites, add to victim’s psychological pressure, making victims more likely to comply with sudden “security update” installation instructions."
  https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/
  https://thehackernews.com/2025/11/jackfix-uses-fake-windows-update-pop.html
  https://www.darkreading.com/threat-intelligence/jackfix-attack-clickfix-mitigations
• The Dual-Use Dilemma Of AI: Malicious LLMs
  "A fundamental challenge with large language models (LLMs) in a security context is that their greatest strengths as defensive tools are precisely what enable their offensive power. This issue is known as the dual-use dilemma, a concept typically applied to technologies like nuclear physics or biotechnology, but now also central to AI. Any tool powerful enough to build a complex system can also be repurposed to break one. This dilemma manifests in several critical ways related to cybersecurity. While defenders can employ LLMs to speed up and improve responses, attackers can also take advantage of them for their workflows."
  https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/
  https://www.securityweek.com/wormgpt-4-and-kawaiigpt-new-dark-llms-boost-cybercrime-automation/
  https://www.theregister.com/2025/11/25/wormgpt_4_evil_ai_lifetime_cost_220_dollars/
• FlexibleFerret Malware Continues To Strike
  "Early in 2025, a SentinelOne blog post brought to light a malware family known as FlexibleFerret. This malware family is attributed to DPRK-aligned operators and tied to fake recruitment lures associated with the Contagious Interview operation. In this operation, individuals are led through staged hiring tasks that result in the execution of malicious instructions. Earlier this month, Validin released a blog highlighting the details of an attack that they identified as a new variant of the Contagious Interview campaign. Jamf Threat Labs has been tracking similar activity stemming from in-the-wild detections that began with the execution of a script called /var/tmp/macpatch.sh."
  https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/
  https://www.darkreading.com/cyberattacks-data-breaches/dprks-flexibleferret-tightens-macos-grip
  https://www.infosecurity-magazine.com/news/flexibleferret-malware-macos-go/
• FBI: Cybercriminals Stole $262M By Impersonating Bank Support Teams
  "The FBI warned today of a massive surge in account takeover (ATO) fraud schemes and said that cybercriminals impersonating financial institutions have stolen over $262 million in ATO attacks since the start of the year. Since January 2025, the FBI's Internet Crime Complaint Center (IC3) has received over 5,100 complaints, with the attacks impacting individuals, as well as businesses and organizations across all industry sectors. In these schemes, criminals gain unauthorized access to online bank, payroll, or health savings accounts using various social engineering techniques or fraudulent websites, the FBI said."
  https://www.bleepingcomputer.com/news/security/fbi-cybercriminals-stole-262-million-by-impersonating-bank-support-teams-since-january/
  https://www.ic3.gov/PSA/2025/PSA251125
  https://therecord.media/millions-in-account-takeover-fbi-warns-ahead-of-holidays
  https://securityaffairs.com/185060/cyber-crime/fbi-bank-impersonators-fuel-262m-surge-in-account-takeover-fraud.html
• Zscaler Threat Hunting Discovers And Reconstructs a Sophisticated Water Gamayun APT Group Attack
  "This blog is intended to share an in-depth analysis of a recent multi-stage attack attributed to the Water Gamayun advanced persistent threat group (APT). Drawing on telemetry, forensic reconstruction, and known threat intelligence, the Zscaler Threat Hunting team reconstructed how a seemingly innocuous web search led to a sophisticated exploitation of a Windows MMC vulnerability, ultimately delivering hidden PowerShell payloads and final malware loaders."
  https://www.zscaler.com/blogs/security-research/water-gamayun-apt-attack
• Smishing Triad Targets Egypt’s Financial Sector And Postal Services
  "Recently, during one of our threat hunting operations, our squad identified multiple malicious domains impersonating major Egyptian service providers, including Fawry, the Egypt Post, and Careem. These domains were likely established to support fraud, phishing campaigns, and other malicious activities targeting users and organizations. Before we begin our analysis, we will provide an overview of the Smishing Triad, the cybercriminal group relevant to this report."
  https://darkatlas.io/blog/smishing-triad-targets-egypts-financial-sector-and-postal-services
  https://www.infosecurity-magazine.com/news/smishing-triad-campaigns-expand/
• Threat Spotlight: Akira Ransomware’s SonicWall Campaign Creates Enterprise M&A Risk
  "The “Akira” ransomware group has been weaponizing vulnerabilities in SonicWall SSL VPN devices, revealing an overlooked threat for larger enterprises navigating mergers and acquisitions (M&A). These devices, widely used by small- and medium-sized businesses due to their affordability and ease of use, have become launchpads for Akira’s fast-spreading attacks. ReliaQuest analyzed a series of Akira attacks between June and October 2025 that targeted SonicWall SSL VPN devices to uncover a troubling trend. In every incident, Akira operators gained a foothold in larger, acquiring enterprises by compromising SonicWall devices inherited from smaller, acquired business during M&A. In these cases, the acquiring enterprises were unaware that these devices existed in their new environments, leaving critical vulnerabilities exposed."
  https://reliaquest.com/blog/threat-spotlight-akira-ransomwares-sonicwall-campaign-creates-enterprise-m&a-risk
  https://www.theregister.com/2025/11/25/akira_ransomware_acquisitions/
• Influencers In The Crosshairs: How Cybercriminals Are Targeting Content Creators
  "It’s not an easy time to be an influencer. Brands are spending less, ad revenue is declining and competition is fierce – including from AI-generated influencers and impersonators. According to one study, around half of the industry makes just $15,000 or less per year, while just one in 10 pull in over $100,000. As if that wasn’t enough, there’s another challenge: influencers are an increasingly popular target for cybercriminals. A recent spear-phishing campaign abusing brands such as Tesla and Red Bull highlights the potential risks."
  https://www.welivesecurity.com/en/social-media/influencers-crosshairs-cybercriminals-targeting-content-creators/
• Russian Hackers Target US Engineering Firm Because Of Work Done For Ukrainian Sister City
  "Hackers working for Russian intelligence attacked an American engineering company this fall, investigators at a U.S. cybersecurity company said Tuesday — seemingly because that firm had worked for a U.S. municipality with a sister city in Ukraine. The findings reflect the evolving tools and tactics of Russia’s cyber war and demonstrate Moscow’s willingness to attack a growing list of targets, including governments, organizations and private companies that have supported Ukraine, even in a tenuous way."
  https://www.securityweek.com/russian-hackers-target-us-engineering-firm-because-of-work-done-for-ukrainian-sister-city/

Breaches/Hacks/Leaks

• Dartmouth College Confirms Data Breach After Clop Extortion Attack
  "​Dartmouth College has disclosed a data breach after the Clop extortion gang leaked data allegedly stolen from the school's Oracle E-Business Suite servers on its dark web leak site. The private Ivy League research university, founded in 1769, has an endowment of $9 billion as of June 30, 2025, over 40 academic departments and programs, and more than 4,000 undergraduate students, with a 7:1 undergraduate-to-faculty ratio. In a breach notification letter filed with the office of Maine's Attorney General, Dartmouth says the attackers exploited an Oracle E-Business Suite (EBS) zero-day vulnerability to steal personal information belonging to 1,494 individuals."
  https://www.bleepingcomputer.com/news/security/dartmouth-college-confirms-data-breach-after-clop-extortion-attack/
  https://www.theregister.com/2025/11/25/clop_dartmouth_college/
• Canon Says Subsidiary Impacted By Oracle EBS Hack
  "Imaging and optical technology giant Canon has confirmed being targeted in the recent Oracle E-Business Suite (EBS) hacking campaign. However, its investigation has shown that the incident is limited to a subsidiary of Canon U.S.A., Inc., the company told SecurityWeek in an emailed statement. “We have confirmed that the incident only affected the web server, and we have already taken security measures and resumed service,” Canon said. “In addition, we are continuing to investigate further to ensure that there is no other impact.”"
  https://www.securityweek.com/canon-says-subsidiary-impacted-by-oracle-ebs-hack/
• OnSolve CodeRED Cyberattack Disrupts Emergency Alert Systems Nationwide
  "Risk management company Crisis24 has confirmed its OnSolve CodeRED platform suffered a cyberattack that disrupted emergency notification systems used by state and local governments, police departments, and fire agencies across the United States. The CodeRED platform enables these agencies to send alerts to residents during emergencies. The cyberattack forced Crisis24 to decommission the legacy CodeRED environment, causing widespread disruption for organizations that use the platform for emergency notifications, weather alerts, and other sensitive warnings."
  https://www.bleepingcomputer.com/news/security/onsolve-codered-cyberattack-disrupts-emergency-alert-systems-nationwide/
• Georgia Court Filing Organization Warns Of Outages After Ransomware Allegations
  "The organization responsible for managing real estate and civil court filings in Georgia has been knocked offline by a cyberattack that began on Friday. The Georgia Superior Court Clerks' Cooperative Authority (GSCCCA) said it is experiencing a “credible and ongoing cybersecurity threat” that forced the organization to temporarily restrict access to its website and services."
  https://therecord.media/georgia-court-filing-org-ransomware-warning

General News

• Supply Chain Sprawl Is Rewriting Security Priorities
  "Organizations depend on long chains of vendors, but many cybersecurity professionals say these relationships create gaps they cannot see or control. A new ISC2 survey of more than 1,000 cybersecurity professionals shows that supply chain risk sits near the top of their concerns. 70% of respondents said their organizations are concerned about cybersecurity risks linked to third party suppliers. Concern is highest in enterprise environments and in sectors that handle financial or government data."
  https://www.helpnetsecurity.com/2025/11/25/isc2-vendor-security-gaps-report/
• The 2026 Tech Tsunami: AI, Quantum, And Web 4.0 Collide
  "The year 2026 will not be defined by incremental upgrades. It will be shaped by an unprecedented collision of forces: next-generation computing, hyper-automation, and a global cyber security reckoning. Technological convergence and the rise of autonomous systems will redefine global resilience. Artificial intelligence is no longer a single discipline. It has become the connective tissue linking cloud, networks, and physical systems. Quantum research is challenging the fundamental mathematics of digital trust, while Web 4.0 is transforming the internet into an immersive, always-on layer of reality."
  https://blog.checkpoint.com/executive-insights/the-2026-tech-tsunami-ai-quantum-and-web-4-0-collide/
• How An AI Meltdown Could Reset Enterprise Expectations
  "In this Help Net Security interview, Graham McMillan, CTO at Redgate Software, discusses AI, security, and the future of enterprise oversight. He explains why past incidents haven’t pushed the industry to mature. McMillan also outlines the structural shifts he expects once failures start to have business impact."
  https://www.helpnetsecurity.com/2025/11/25/graham-mcmillan-redgate-software-ai-security-future/
• Aircraft Cabin IoT Leaves Vendor And Passenger Data Exposed
  "The expansion of IoT devices in shared, multi-vendor environments, such as aircraft cabins, has created tension between the benefits of data collaboration and the risks to passenger privacy, vendor intellectual property, and regulatory compliance. A new study finds that even with protections that scramble data while it moves between devices, sensitive information often remains exposed once it reaches its destination."
  https://www.helpnetsecurity.com/2025/11/25/aircraft-cabin-iot-privacy-exposure/
  https://arxiv.org/pdf/2511.15278
• AI And Deepfake-Powered Fraud Skyrockets Amid Identity Fraud Stagnation
  "AI is reshaping the identity fraud landscape, helping cybercriminals deploy more sophisticated fraud schemes than ever, despite a global stagnation in fraud attempts. The latest of Sumsub’s Identity Fraud Report, published on November 25, 2025, showed that while identity fraud has slightly decreased in 2025, with identity fraud attempts at 2.2% of all analyzed verifications worldwide – compared to 2.6% in 2024 – the most sophisticated of these attempts have jumped 180%."
  https://www.infosecurity-magazine.com/news/ai-deepfake-fraud-skyrockets/
• Mounting Cyber-Threats Prompt Calls For Economic Security Bill
  "UK lawmakers have called on the government to enshrine in law a new approach to economic security, citing a growing menace to the country from cyber and other threats. The House of Commons Business and Trade Committee issued the call as it published a new report yesterday: Toward a new doctrine for economic security. “Britain is now hugely exposed to the risks of economic warfare and bluntly, our current defenses are not fit for the future,” argued committee chair, Liam Byrne."
  https://www.infosecurity-magazine.com/news/mounting-cyber-threats-economic/
• CISOs Get Real About Hiring In The Age Of AI
  "Becky Bracken: Hello, and welcome to Dark Reading Confidential. It's a podcast from the editors of Dark Reading, focused on bringing you real world stories straight from the cyber trenches. Today we are talking about the cybersecurity job market, talent pipeline, and the disruption of both as automation and AI start in earnest to take over those traditional entry level tier one analyst roles."
  https://www.darkreading.com/cybersecurity-operations/ciscos-get-real-about-hiring-age-ai
• Advanced Security Isn't Stopping Ancient Phishing Tactics
  "Phishing is nothing new when it comes to cybersecurity threats, constantly putting users and organizations at risk of compromising sensitive information. But a new study has uncovered alarming insights about the persistent nature of phishing attacks against enterprises in particular, revealing how even some of the most mature companies with the most advanced security systems continue to remain vulnerable — and why phishing attacks aren't going away anytime soon."
  https://www.darkreading.com/cyberattacks-data-breaches/advanced-security-phishing-tactics
• Cyberthreats Targeting The 2025 Holiday Season: What CISOs Need To Know
  "Every year, the holiday season brings a predictable spike in online activity. But in 2025, the volume of newly created malicious infrastructure, account compromise activity, and targeted exploitation of e-commerce systems is markedly higher. Attackers began preparing months in advance, leveraging industrialized tools and services that enable them to scale attacks across multiple platforms, geographies, and merchant categories."
  https://www.fortinet.com/blog/threat-research/cyberthreats-targeting-2025-holiday-season-what-cisos-need-to-know
• Cato CTRL Threat Research: HashJack – Novel Indirect Prompt Injection Against AI Browser Assistants
  "HashJack is a newly discovered indirect prompt injection technique that conceals malicious instructions after the # in legitimate URLs. When AI browsers send the full URL (including the fragment) to their AI assistants, those hidden prompts get executed. This enables threat actors to conduct a variety of malicious activities. Cato CTRL’s findings outline six scenarios including callback phishing, data exfiltration (in agentic modes), misinformation, malware guidance, medical harm, and credential theft. Trusted URL. Clean webpage. Compromised AI browser assistant."
  https://www.catonetworks.com/blog/cato-ctrl-hashjack-first-known-indirect-prompt-injection/
  https://www.theregister.com/2025/11/25/hashjack_attack_ai_browser_hashtag/
• The AI-Fication Of Cyberthreats: Trend Micro Security Predictions For 2026
  "Our annual security predictions report is designed to help organizations navigate an ever-changing threat landscape with confidence so they can face the challenges and seize the opportunities that the coming year has in store. Drawing on insights from Trend Micro’s global team of researchers and security experts, this year’s edition highlights the trends we believe will shape 2026 and beyond. The cybersecurity landscape is entering a new era, one shaped by automation and constant connection. Businesses are embracing AI tools to boost efficiency, sharpen decision-making, and unlock new opportunities. However, cybercriminals are also using these tools to automate reconnaissance, launch phishing campaigns, and carry out attacks at scale. What once required deep expertise can now be done with minimal effort, as AI-driven automation levels the playing field between skilled attackers and opportunistic threat actors."
  https://www.trendmicro.com/vinfo/gb/security/research-and-analysis/predictions/the-ai-fication-of-cyberthreats-trend-micro-security-predictions-for-2026
  https://documents.trendmicro.com/assets/research-reports/the-ai-fication-of-cyberthreats-trend-micro-security-predictions-for-2026.pdf
  https://www.theregister.com/2025/11/25/trend_micro_agentic_ai_assisted_ransomware/
• Is Your Android TV Streaming Box Part Of a Botnet?
  "On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers."
  https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/

อ้างอิง
Electronic Transactions Development Agency (ETDA)