เมื่อวันที่ 13 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
• CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Financial Sector

• When Banks' AI Agents Meet Customers' AI Agents
  "Artificial intelligence agents are beginning to operate on both sides of banking transactions. Financial institutions are deploying agents internally to handle customer service, fraud, risk and operational tasks, while customers are gaining access to agents that can shop, negotiate and make payments on their behalf. As these two models converge, banks face a new challenge: determining how much authority to give AI agents and how to establish trust when machines increasingly transact with other machines."
  https://www.bankinfosecurity.com/blogs/when-banks-ai-agents-meet-customers-ai-agents-p-4216

New Tooling

• Strands Box: The Big Picture
  "I talk to AWS customers about agents nearly every day. I hear a lot of excitement about the results they’re already seeing from agents, including for software development, operations, business processes, and directly serving their customers. I also hear a deep desire for more control, stronger security, and a deeper understanding of how their agents are working. Guided by our customers, we are investing deeply in agent safety, isolation, and policy at AWS. Last summer we released AgentCore, our platform for building and optimizing agents. AgentCore Runtime is at the center of AgentCore: a secure sandbox for running agents, where each session with each agent gets its own dedicated MicroVM (based on Firecracker, and AWS’s two decades of investment in virtualization security). Later last year we released AgentCore Policy, allowing fine-grained control over how cloud-hosted agents use their tools, leveraging the Cedar policy language originally developed at AWS."
  https://strandsagents.com/blog/strands-box-the-big-picture/
  https://www.helpnetsecurity.com/2026/10/12/aws-strands-box-open-source-ai-agent-sandbox/
  https://github.com/strands-agents/box

Vulnerabilities

• GitLab Warns Of Max Severity Code Execution Vulnerability
  "GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle and reported via GitLab's HackerOne bug bounty program. CVE-2026-97229 stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files."
  https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
• Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited In Bricksforge Plugin
  "This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge (opens in new tab) plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. This vulnerability is currently being targeted in the wild. Tracked as CVE-2026-85097 (opens in new tab), the issue allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, leading to remote code execution (RCE). It affects Bricksforge versions up to and including 3.1.8.9. A fix is available in version 3.1.8.10, and organizations running affected versions should upgrade as soon as possible."
  https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/
  https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
  https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/
• Months-Old Palo Alto VPN Vulnerability Remains a Target For Ransomware Groups
  "Ransomware groups continue to target a high-severity vulnerability in Palo Alto Networks products, despite a security patch being released five months ago, according to ReliaQuest. The cyber threat detection provider warned in a social media advisories posted on October 9 that multiple groups, including the Qilin and Settra ransomware operations, are actively targeting CVE-2026-0257 to establish unauthorized VPN sessions and gain initial access to internal networks. CVE-2026-0257 is an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access that affects several Palo Alto Networks products, including PAN-OS versions 10.2.0, 11.1.0, 11.2.0 and 12.1.0 and two versions of Prisma Access (10.2.0 and 11.2.0)."
  https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/

Malware

• From Endpoint To Funhouse: Evolution Of Ransomware Families And Kimsuky-Linked Distribution Cases
  "AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities with Kimsuky’s endpoint ransomware distribution cases observed since the first half of 2026. In this blog post, we analyze the recently identified Funhouse ransomware distribution campaign and summarize its connections to Kimsuky’s previous Endpoint ransomware distribution campaigns."
  https://asec.ahnlab.com/en/95775/
• Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts
  "Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware."
  https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/
  https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html
  https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/
• Inside AvisLoader: A Windows Malware Loader Built To Resist Disruption
  "Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center. The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine. The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator."
  https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
• CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure
  "SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure. More than 628,000 Ukrainian individuals have confirmed data in the actor’s possession, including residents of Kharkiv, a city on an active war front. The entire operation surfaced from a single configuration error: an exposed open directory that served the actor’s live working directory, including AI session logs, scripts with plaintext tokens, and exfiltrated victim data. CyberXero remained active throughout the investigation and was still active at the time of publication."
  https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/
  https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html
  https://securityaffairs.com/200803/cyber-crime/cyberxero-used-51-ai-agents-to-steal-628000-ukrainian-records.html
• Canonical Websites Disrupted In Second DDoS Attack This Year
  "Canonical’s websites were disrupted last week by a distributed denial-of-service (DDoS) attack, months after a larger attack hit the Ubuntu maker’s infrastructure. The company confirmed the attack on October 8 in a post on the Ubuntu Discourse forum. “Canonical’s websites are under a sustained distributed denial of service attack,” the company said, adding that some services might not be reachable at times. The disruption was limited to Canonical’s primary web properties, OMG! Ubuntu reported. These included ubuntu.com, canonical.com, the Ubuntu blog and developer site, and Ubuntu’s security advisory pages and API."
  https://www.securityweek.com/canonical-websites-disrupted-in-second-ddos-attack-this-year/
  https://securityaffairs.com/200832/security/canonical-hit-by-second-ddos-attack-in-2026.html

Breaches/Hacks/Leaks

• Cyberattack Shuts Down Refrigerators At French Supermarkets
  "Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected 250 to 350 stores, causing significant financial losses and food waste. The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system."
  https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
  https://therecord.media/cyberattack-disrupts-refridgeration-in-france
  https://www.infosecurity-magazine.com/news/french-supermarket-chains/
  https://www.helpnetsecurity.com/2026/10/12/france-cyberattack-supermarket-freezers/
• Retail Giant Ahold Delhaize Takes Systems Offline After Cyberattack
  "Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it was forced to take some systems offline after a "cybersecurity incident." As a wholesale company and multinational retailer, Ahold Delhaize operates more than 9,400 local stores across Europe, the United States, and Indonesia, employs nearly 400,000 people, and serves around 60 million customers each week through physical retail locations and online. Ahold Delhaize reported yearly net sales of over $104 billion in 2024, and it owns a wide range of brands, including Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall, and Profi in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the American market."
  https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/
  https://www.bankinfosecurity.com/supermarket-chain-ahold-delhaize-caught-in-cyber-incident-a-33072

General News

• September 2026 Dark Web Breach Incident Trend Report
  "The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources."
  https://asec.ahnlab.com/en/95764/
• September 2026 Dark Web Issue Trend Report
  "The September 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. However, the report notes that due to the nature of the sources, it may be difficult to fully verify the accuracy of some information."
  https://asec.ahnlab.com/en/95769/
• September 2026 Dark Web Threat Actor Trend Report
  "The September 2026 Dark Web Threat Actor Trend Report focuses on threat actors active on the deep web and dark web, as well as publicly reported cyberattack incidents. It is noted that the factual accuracy of some content cannot be independently verified."
  https://asec.ahnlab.com/en/95770/
• No Identity, No Recovery: Cyber Resilience Starts With IAM
  "Enterprises need cyber resilience to ensure that they can sustain operations in the face of ransomware and other cyber threats, and a frequently underappreciated piece of cyber resilience is identity resilience. Identity resilience is a prerequisite to cyber resilience. While you might have a resilience plan for your data and apps, that doesn't matter if teams can't access their apps because your identity infrastructure is inaccessible."
  https://www.darkreading.com/cybersecurity-operations/cyber-resilience-starts-with-iam
• Geopolitics And The Cyber Resilience Gap Belong In Your Threat Model
  "In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern. Joshi explains the widening resilience gap between large and small organizations and between regions, the role of skills shortages, and what public-private cooperation needs to work at scale. He also offers advice for CEOs and boards."
  https://www.helpnetsecurity.com/2026/10/12/akshay-joshi-wef-cyber-resilience-gap/
• AI Vulnerability Patching Has a Grading Problem
  "Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project’s maintainers wrote for the fix. With Claude Opus 4.7, third of the patches that made the crash go away still failed those maintainer tests. If you’re thinking about letting an AI tool patch vulnerabilities for you, this is the number to look at. Many security patching benchmarks grade a fix on one question: does the proof-of-concept input, the sample that triggers the bug, still crash the program? A patch can pass by blocking the path to the crash and leaving the flaw where it was. The authors call that kind of fix “strictly worse than no fix at all,” since it tells you the problem is solved when it isn’t."
  https://www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/
  https://arxiv.org/pdf/2610.10150
• How Much Does It Cost To Use Open Source Software?
  "Open source software is used pervasively, with some estimating that over 90% of codebases contain open source software. Many adopt open source software because it’s free and thus cheaper than writing a proprietary alternative. But as the community saying goes: “open source is free as in puppies, not free as in beer.” Once you or your organization has adopted an open source project, there is still effort (such as engineering time, costs, etc.) associated with ensuring that your version of an open source project is healthy and up to date. While efforts by the research community have investigated the ongoing costs required to maintain open source software, at Google we needed to better understand the resources required to use thousands of open source software packages."
  https://opensource.googleblog.com/2026/10/how-much-does-it-cost-to-use-open-source-software.html
  https://www.helpnetsecurity.com/2026/10/12/google-open-source-maintenance-costs-report/
• Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
  "The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year after the first release of the open-source agent now called OpenClaw, the juggernauts are putting their weight behind the idea that each of us needs a personal assistant."
  https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Financial Sector

• PCI SSC Calls For Human Approval Of AI Agent Actions Involving Cardholder Data
  "The PCI Security Standards Council (PCI SSC) has published Security Considerations for AI Systems, guidance covering the protection of data supplied to AI systems in payment environments and defenses against AI-assisted attacks. Developed with industry stakeholders, the document addresses governance, deployment, access controls, testing and the application of PCI standards. Its recommendations are advisory, and existing PCI requirements take precedence. “As AI is increasingly used in payment environments, there is an obligation for all parties to ensure the technology is used responsibly,” said Gina Gobeyn, Executive Director, PCI SSC. “This additional guidance provides a practical starting point for secure AI implementation.”"
  https://www.helpnetsecurity.com/2026/10/09/pci-ssc-payment-environments-ai-security-guidance/

Industrial Sector

• Thousands Of Wind And Solar Park Systems Sit Exposed On The Internet Across Europe
  "Modat and NCSC-NL, the Dutch government’s cybersecurity center, found 8,547 internet-facing systems at wind farms and solar parks in 35 countries in and around the EU that should not be reachable from the internet. The systems range from login screens to a turbine control page that offers a Stop button to anyone with a browser. Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems. The real number is higher. A system only made the list once the team could link it to a specific solar or wind site."
  https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/
• Super Intelligence Reached OT Systems And Moved Equipment
  "Just 16 minutes and change. That is how long it took frontier super intelligence models in one controlled test to move from a perimeter compromise to actions inside an industrial control network. In another scenario, a model found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes. The models did this without source code, engineering documents, or advanced OT guidance. Across eight scenarios, every defined test objective was achieved. More important, the models connected work that usually spans multiple people and stages, including asset discovery, device research, attack planning, troubleshooting, and execution. Building on Booz Allen’s Cyber Weapon Index, this research extends our examination of super intelligence-enabled offensive capabilities beyond enterprise networks and into operational technology (OT), where cyber actions can directly affect machinery and industrial processes."
  https://www.boozallen.com/insights/cyber/frontier-si-reaches-ot-systems.html
  https://www.boozallen.com/assets/home/docs/cyber/frontier-ai-models-in-ot-environments.pdf
  https://www.theregister.com/security/2026/10/11/ai-systems-are-fully-capable-of-carrying-out-nightmare-attacks-against-infrastructure-and-nobodys-ready/5302450

New Tooling

• Launching An Opt-In Vulnerability-Finding Service For Open-Source Software
  "We’re launching OSS Scanner, an opt-in vulnerability scanner for the open-source ecosystem informed by our experience using Claude to find vulnerabilities during Project Glasswing. Projects that join will receive thorough, periodic security scans by our strongest models at no cost. Language models have rapidly advanced in their ability to discover vulnerabilities, as we have reported extensively on this blog. On CyberGym, one academic vulnerability-finding benchmark, LLMs have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year. As a result, open source maintainers have gone from receiving mostly slop from LLMs to receiving high-quality bug reports."
  https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
  https://github.com/anthropics/oss-scanner
  https://thehackernews.com/2026/10/anthropic-launches-free-ai.html
  https://securityaffairs.com/200685/ai/claude-helps-secure-open-source-as-anthropic-offers-free-vulnerability-scanning.html

Vulnerabilities

• Citrix Warns Admins To Patch New NetScaler RCE Flaw Immediately
  "Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. Tracked as CVE-2026-107406, this flaw stems from a memory overflow weakness that attackers can exploit to gain remote code execution (RCE) on targeted devices or trigger a denial-of-service state that can cause crashes. To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP)."
  https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/
  https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
  https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html
  https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/
  https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212
  https://securityaffairs.com/200670/security/cve-2026-107406-citrix-fixes-critical-netscaler-adc-and-gateway-vulnerability.html
• Researchers Publish Working Exploit For Pre-Auth AnyDesk Linux Flaw That Gives Root Access
  "Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security advisory. The exploit, called AnyPwn, targets a heap buffer overflow in AnyDesk's session protocol, a remote desktop tool. The code was released on GitHub on October 8."
  https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html
• GoBalance Flaw Lets Attackers Hijack .onion Addresses By Recovering Tor-Format Keys
  "A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control. Taking over the address does not grant the attacker access to the site's servers, database, or stored user data."
  https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html

Malware

• Adception: Malvertising Another Search Engine’s Search Results To Redirect To a Malicious Page
  "Push recently detected an attack that began with a Google search ad for "claude mac" whose destination was a Bing search result, which passed the victim through a compromised retail website to a fake Claude installer. This led us to discover a crafty redirect and cloaking technique that we’re (unseriously) referring to as “Adception”."
  https://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results
  https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/
• Threat Actors Exploit Critical AhsayCBS Flaws To Drop Webshells And XMRig Cryptominer
  "On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. As of October 8, Huntress has seen five organizations targeted via these flaws. Post-exploitation, threat actors are conducting reconnaissance, dropping webshells, planting XMRig cryptominers masquerading as Microsoft Edge, and more. They also dropped what appears to be an AI-assisted PowerShell script that monitors the Windows Task Manager and shuts it down if it remains open for too long in the middle of the night. AhsayCBS versions up through 10.3.4 are affected by this issue."
  https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
  https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
  https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/
• Max Severity SonicWall SMA1000 Flaw Now Exploited In Attacks
  "Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. Tracked as CVE-2026-102255, the flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models, but does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls. "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," SonicWall explained."
  https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
• How Luna Moth Runs Data Extortion Like a Business
  "Around October 5, 2026, an anonymous onion site called “The Luna Moth Files” claimed to expose internal material from Silent Ransom Group (SRG), also tracked as Luna Moth and UNC3753. The package includes chat exports, a vishing document, screenshots, and a purported fake employee résumé. Nobody knows who published it or how the archive was obtained, so we treat its claims as unverified unless independent sources back them up. The material contains no new exploit and no new malware. It does offer a view of how a social engineering-led extortion operation may organize its work."
  https://blog.checkpoint.com/security/how-luna-moth-runs-data-extortion-like-a-business/
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials From Entire Git Histories
  "On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10–21:26 UTC."
  https://www.stepsecurity.io/blog/ghostaction-returns
  https://thehackernews.com/2026/10/credential-stealing-github-actions.html
• Sleep, Beacon, Steal, Repeat - The Story Of P7 DarkSword Variant
  "In August 2026 we investigated a DarkSword infection that turned out to be a previously unseen variant, which we call P7 DarkSword. The name P7 comes from the threat actor’s use of the p7_ variable prefix in modifications to original DarkSword’s code. Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure. This post describes the investigation, the variant's capabilities, and the indicators that can be used to detect it."
  https://www.iverify.com/blog/darksword-variant-threat-research
  https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html
• Disrupting AI-Enabled “false Front” Operations
  "Over the past two and a half years, we’ve reported on many of the ways in which threat actors tried to use our models to conduct cyber attacks, covert influence operations (IO), scams, and other violations of our Usage Policies. We publish these reports to inform regulators, our industry peers, and wider society of how we see threat actors trying to leverage AI, and to shine a light on the vulnerabilities they try to exploit. We recently banned two IO—one from Russia and one from Iran—that used our models in combination with more traditional techniques and technologies to support sophisticated “false front” entities. They used those entities to launder geopolitical, conflict-related messaging into their target audiences."
  https://openai.com/index/disrupting-ai-enabled-false-front-operations/
  https://therecord.media/openai-disrupts-russian-iranian-operations-chatgpt
• Dire Wolf Ransomware Attacks: How To Test And Strengthen Your Defenses
  "Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. Its Go-based, UPX-packed encryptor gives every file a unique ChaCha20 key derived through Curve25519 and SHA-256, and encrypts only the first 1 MB of larger files for speed. Before encryption, it kills the Event Log service, deletes shadow copies and backups, disables Windows Recovery, and stops up to 75 services [1]. Afterward, it forces a reboot and deletes itself."
  https://www.picussecurity.com/resource/blog/dire-wolf-ransomware-attacks-how-to-test-and-strengthen-your-defenses
• Turning IDN Edge Cases Into Typosquats
  ""Check the address bar" is the one piece of security advice everybody has heard. It assumes the name there can be read correctly, which held while domain names could only contain English letters, digits, and a hyphen. Since 2003 they can use almost any writing system, so a Berlin bookshop can be bücher.de. Many of those characters look identical to Latin ones. Cyrillic has its own а, е, о, р, and с, which most fonts draw like Latin a, e, o, p, and c but applications treat as different characters. A name can therefore look like apple.com without being it."
  https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats
  https://www.theregister.com/security/2026/10/10/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers/5302383
• Can You Really Make More Than $200M In Six Months Without Encrypting Victims? It Seems Silent Ransom Group Can. (1)
  "DataBreaches has reported on Silent Ransom Group (SRG) since 2022, with particular interest in their numerous attacks on law firms. Those interested in the group should review our past coverage, which often includes exclusive material and details. Do you remember the Conti leaks in 2022 that were variously ascribed to either a Ukrainian researcher or a disgruntled member of Conti? Well, now Conti’s offspring, Silent Ransom Group, has experienced a leak, too, although we do not yet know to whom to ascribe it. This new leak includes material from two servers during the period August 27, 2025 – September 29, 2026 (slplsskdj2836v2jjsx[.]com and aim6umein3kee[.]com)."
  https://databreaches.net/2026/10/07/can-you-really-make-more-than-200m-in-six-months-without-encrypting-victims-it-seems-silent-ransom-group-can/
  https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html

Breaches/Hacks/Leaks

• Hundreds Of Thousands Impacted By Data Breach At Biosensor Firm iRhythm
  "Medical device maker iRhythm said the data of at least 360,000 people was breached in a June cyberattack. The company began filing breach notices in multiple states this week, telling regulators and victims that the incident occurred on June 8 and involved unauthorized access to third-party systems. iRhythm is best known for Zio Patch — a sensor that patients wear on their chest for long-term continuous cardiac monitoring and heart arrhythmia detection."
  https://therecord.media/irhythm-data-breach-reports
• Belarusian Hacktivists Admit To 2023 Breach Of Russian State Healthcare Network
  "Belarusian activist hackers have claimed responsibility for a years-old breach of Moscow's healthcare network, confirming their involvement in an intrusion recently disclosed by a Russian cybersecurity company. In a statement on Friday, the Belarusian Cyber Partisans said they infiltrated the Moscow Department of Health in 2023 and obtained administrator-level access to its infrastructure, including systems connected to other government agencies. The group said it spent months inside the network before abandoning the operation."
  https://therecord.media/belarusian-cyber-partisans-claim-2023-russia-healthcare-hack
• Nippon Columbia Malware Incident Exposes 8.6 Million Karaoke Fan Records
  "Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. The company is the largest karaoke maker in Japan, operating 521 karaoke venues nationwide, including the Big Echo chain, one of the most popular karaoke box chains in the country. Daiichi Kosho outsources the handling of its customers’ personal information to Nippon Columbia Group (NCG), a Japanese entertainment group whose businesses include music, video and game software production and distribution, as well as artist management."
  https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/

General News

• FBI Arrests Executive At Ransomware Negotiation Firm
  "Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel."
  https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
  https://www.bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach/
  https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
  https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html
  https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation
  https://www.bankinfosecurity.com/suspected-shinyhunters-extortion-hacker-arrested-by-fbi-a-33059
  https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/
• Ukrainian-Russian Dual Citizen Pleads Guilty To Running International Money Laundering Organization For Cybercriminals
  "Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty today to running a sophisticated international money laundering organization that laundered millions of dollars stolen from United States victims by cybercriminals around the world. In total, this international criminal organization recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen by hackers from over 750 U.S. bank accounts."
  https://www.justice.gov/opa/pr/ukrainian-russian-dual-citizen-pleads-guilty-running-international-money-laundering
  https://www.bleepingcomputer.com/news/security/ukrainian-russian-dual-citizen-admits-to-laundering-millions-for-cybercriminals/
  https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty
• Hackers Get $1,262,000 For 98 Zero-Days At Pwn2Own Ireland
  "The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. Ikotas Labs security researchers won this year's Pwn2Own Ireland edition with 42.5 Master of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database. They also collected the competition's top reward of $300,000 on the third day after chaining multiple zero-days to hack the Google Pixel 10."
  https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/
  https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html
  https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/
• ASOS Breach Reveals The Risks In Customer-Facing SaaS
  "The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and notifications platforms. On Oct. 6, a threat actor identifying itself as "Xuanye Group" announced that it had breached the multibillion-dollar British retailer. The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million, according to the company. Remarkably, of ASOS's 2,800 employees, the threat actor only needed access to one's login credentials to snowball an attack that eventually led them to compromising multiple, deep-seated corporate systems. One of those systems allowed it to broadcast messages to all of ASOS' mobile app users."
  https://www.darkreading.com/cyberattacks-data-breaches/asos-breach-risks-customer-facing-saas
• Security Threats Don't Stop At The Office: Why Executives' Families Need Training, Too
  "An attacker attempts to breach an executive's personal laptop, but effective multifactor authentication (MFA) blocks them. Actually, it was only a deterrent. The attacker then discovers that the executive's son did not enable MFA on his gaming console and uses that compromised box to move laterally on the home network to eventually reach the corporate network. Cybercriminals' increasingly brazen techniques have expanded beyond office walls to target top executives' family members and friends who may not know how to protect themselves. Worse, these people don't even know that the attackers are coming for them."
  https://www.darkreading.com/cyber-risk/security-threats-don-t-stop-at-the-office-why-executives-families-need-training-too
• Social Engineering AI Agents: The New BEC For 2026
  "Cybersecurity Awareness Month traditionally focuses on teaching employees how to recognize social engineering efforts and how to avoid consequences associated with business email compromise (BEC). But as companies give AI agents authority to interact with business systems, threat actors can target AI agents and manipulate them into taking authorized actions instead — which should reshape how organizations train on BEC attacks. Consider a classic BEC scenario: an accounts-payable employee receives what appears to be a legitimate message from a vendor saying its banking information has changed. The employee believes the request and, using their own legitimate access, redirects a future payment to an attacker-controlled account. The attacker must convince an employee with authority to take the wrong action."
  https://www.darkreading.com/cybersecurity-operations/social-engineering-ai-agents-bec-2026
• What The BPFDoor Backdoor Tells Us About Attacks On The Network Edge
  "A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, VP of Rapid7 Intelligence, explains why its operators go after mail gateways and other edge devices that can’t run endpoint agents, and why a hacked telecom network can put a whole nation at risk. Beek also covers how CISOs should report “no findings” to the board and which simple Linux checks teams can run this week."
  https://www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
• Companies Want Autonomous IT Operations But Hesitate To Let AI Act Alone
  "Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its own, doing the work. Yet 77 percent say their own organization hesitates to let AI make an operational decision without a human approving it. Most of those companies mean autonomy with a person at the approval step, and few have the groundwork for even that. Only 41 percent say their IT environment is prepared for autonomous operations, and 19 percent of their IT operations are automated. Businesses are planning around a technology their own environments cannot support."
  https://www.helpnetsecurity.com/2026/10/09/move-toward-autonomous-it-operations/
• Q3 2026 Sets New Record For Ransomware Attacks
  "Ransomware attacks reached their highest ever quarterly volume in the third quarter of 2026, according to an analysis by Comparitech. The firm identified a total of 2627 claimed attacks during the three-month period from July to September 2026. This is a 27% increase on the previous quarter, Q2 2026, and a 61% rise compared to Q3 2025."
  https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/
• Formula Predicts When AI Chatbots Are At Risk Of Turning Bad
  "Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted; and if predicted, prevented. Since 50% of the world’s population carry devices that can run personal AI companions with no internet connection and limited security, they focused their research here. The lack of cloud-based safety filters, real-time telemetry, live monitoring, or the ability to patch weights once deployed provides a good test bed for analyzing AI’s chat-style transformer behavior when left to its own devices."
  https://www.securityweek.com/formula-predicts-when-ai-chatbots-are-at-risk-of-turning-bad/
  https://www.cell.com/patterns/fulltext/S2666-3899(26)00175-3
• AI Transformation Across The Infrastructure Lifecycle: From Supply Chain To Fleet Operations
  "AI infrastructure is a system, and every part of that system is connected. Decisions made in silicon and systems design influence how infrastructure is sourced, deployed, and operated across the fleet. And what we learn once that hardware is running can inform what we build next. This feedback matters because the system never stands still. Demand shifts, component constraints emerge, new capacity comes online, and hardware requirements evolve across the fleet. Keeping infrastructure reliable means continually learning and adapting as requirements change."
  https://azure.microsoft.com/en-us/blog/ai-transformation-across-the-infrastructure-lifecycle-from-supply-chain-to-fleet-operations/
• Former Employee Of Industrial Company Sentenced To 32 Months In Prison For Computer Attack And Extortion
  "A Kansas City, Missouri man was sentenced to 32 months in prison for crimes related to his intentional damage to computer networks and extortion of employees, U.S. Attorney Robert Frazer announced. Daniel Rhyne, 59, previously pleaded guilty before U.S. District Judge Michael A. Shipp to a two-count Information that charged him with extortion in relation to a threat to cause damage to a protected computer and intentional damage to a protected computer. Judge Shipp imposed the sentence on September 28, 2026 in Trenton federal court."
  https://www.justice.gov/usao-nj/pr/former-employee-industrial-company-sentenced-32-months-prison-computer-attack-and
  https://www.securityweek.com/insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 12 รายการ เมื่อวันที่ 6 และ 8 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-279-01 Johnson Control EasyIO FG
• ICSA-26-279-02 Savannah lwIP
• ICSA-26-279-03 Hitachi Energy Asset Suite
• ICSA-26-279-04 Hitachi Energy SOI
• ICSA-26-279-05 Hitachi Energy REB500
• ICSA-26-279-06 Hitachi Energy RTU500 series CMU Firmware
• ICSA-26-281-01 Red Lion Controls N-Tron 700 Series
• ICSA-26-281-02 Grid Protection Alliance openPDC and openHistorian
• ICSA-26-281-03 Satel Netco Design
• ICSA-26-069-02 Lantronix EDS3000PS and EDS5000 (Update B)
• ICSMA-26-223-02 Pulsetto Vagus Nerve Stimulator (Update A)
• ICSA-25-259-02 Hitachi Energy RTU500 series (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand