Cyber Threat Intelligence 05 June 2025

NCSA_THAICERT

Energy Sector

The Future Of Cybersecurity Standards For Global Federal Energy Systems
"According to a report, 71% of energy industry professionals consider their organizations more vulnerable to OT cyber events than ever. These are private organizations, but the stakes are much higher for government-owned systems. Government-owned energy systems such as national grids, nuclear facilities, pipelines, and strategic reserves are foundational to national sovereignty and public welfare."
https://www.tripwire.com/state-of-security/future-cybersecurity-standards-global-federal-energy-systems

Industrial Sector

Ramnit Malware Infections Spike In OT As Evidence Suggests ICS Shift
"Industrial giant Honeywell on Wednesday published its 2025 Cybersecurity Threat Report, which shows that ransomware and other malware attacks have surged in the industrial sector. Honeywell’s report shows — based on OSINT and industry sources — that there has been a significant increase in ransomware attacks on industrial organizations. While these attacks did not necessarily impact operational technology (OT) systems, more than half of the 55 cybersecurity incidents reported to the SEC in 2024 did affect OT."
https://www.securityweek.com/ramnit-malware-infections-spike-in-ot-as-evidence-suggests-ics-shift/
https://www.honeywell.com/content/dam/honeywellbt/en/documents/gated/hon-corp-honeywell-2025-cyber-threat-report.pdf

Vulnerabilities

Cisco Warns Of ISE And CCP Flaws With Public Exploit Code
"Cisco has released patches to address three vulnerabilities with public exploit code in its Identity Services Engine (ISE) and Customer Collaboration Platform (CCP) solutions. The most severe of the three is a critical static credential vulnerability tracked as CVE-2025-20286, found by GMO Cybersecurity's Kentaro Kawane in Cisco ISE. This identity-based policy enforcement software provides endpoint access control and network device administration in enterprise environments. The vulnerability is due to improperly generated credentials when deploying Cisco ISE on cloud platforms, resulting in shared credentials across different deployments."
https://www.bleepingcomputer.com/news/security/cisco-warns-of-ise-and-ccp-flaws-with-public-exploit-code/
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-aws-static-cred-FPMjUcm7
CISA Adds Three Known Exploited Vulnerabilities To Catalog
"CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2025-21479 Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
CVE-2025-21480 Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
CVE-2025-27038 Qualcomm Multiple Chipsets Use-After-Free Vulnerability"
https://www.cisa.gov/news-events/alerts/2025/06/03/cisa-adds-three-known-exploited-vulnerabilities-catalog
https://securityaffairs.com/178610/hacking/u-s-cisa-adds-multiple-qualcomm-chipsets-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Malware

Updated Guidance On Play Ransomware
"CISA, the Federal Bureau of Investigation (FBI), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) have issued an updated advisory on Play ransomware, also known as Playcrypt. This advisory highlights new tactics, techniques, and procedures used by the Play ransomware group and provides updated indicators of compromise (IOCs) to enhance threat detection."
https://www.cisa.gov/news-events/alerts/2025/06/04/updated-guidance-play-ransomware
https://www.bleepingcomputer.com/news/security/fbi-play-ransomware-breached-900-victims-including-critical-orgs/
https://www.theregister.com/2025/06/04/play_ransomware_infects_900_victims/
ViperSoftX Stealing Cryptocurrencies
"AhnLab SEcurity intelligence Center (ASEC) has confirmed that the ViperSoftX attacker is continuously distributing malware to users in Korea. ViperSoftX is a type of malware that resides in infected systems and is responsible for executing threat actors’ commands and stealing cryptocurrencies. ASEC previously published an analysis of a ViperSoftX attack case in May 2024, which covered a distribution case of TesseractStealer, a malware that utilizes Quasar RAT, a remote access Trojan, and Tesseract, an open-source OCR engine that uses deep learning."
https://asec.ahnlab.com/en/88336/
FBI Warns Of NFT Airdrop Scams Targeting Hedera Hashgraph Wallets
"The FBI is warning about a new scam where cybercriminals exploit NFT airdrops on the Hedera Hashgraph network to steal crypto from cryptocurrency wallets. Airdrops are a method of distributing cryptocurrency tokens for free to wallet addresses, usually as part of a marketing, community growth, or reward campaign, but they are also used as bait for scams. "The Hedera Hashgraph is the distributed ledger used by Hedera. The airdrop feature was originally created by the Hedera Hashgraph network for marketing purposes; however, cyber criminals can exploit this tactic to collect victim data to steal cryptocurrency," explains the FBI advisory."
https://www.bleepingcomputer.com/news/security/fbi-warns-of-nft-airdrop-scams-targeting-hedera-hashgraph-wallets/
https://www.ic3.gov/PSA/2025/PSA250603
The Cost Of a Call: From Voice Phishing To Data Extortion
"Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster that specializes in voice phishing (vishing) campaigns specifically designed to compromise organizations' Salesforce instances for large-scale data theft and subsequent extortion. Over the past several months, UNC6040 has demonstrated repeated success in breaching networks by having its operators impersonate IT support personnel in convincing telephone-based social engineering engagements."
https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
https://www.bleepingcomputer.com/news/security/google-hackers-target-salesforce-accounts-in-data-extortion-attacks/
https://www.darkreading.com/application-security/vishing-crew-salesforce-data
https://thehackernews.com/2025/06/google-exposes-vishing-group-unc6040.html
https://therecord.media/google-warns-cybercriminals-targeting-salesforce-apps
https://www.securityweek.com/google-warns-of-vishing-extortion-campaign-targeting-salesforce-customers/
https://cyberscoop.com/google-unc6040-salesforce-attacks/
https://www.helpnetsecurity.com/2025/06/04/salesforce-vishing-attacks/
https://www.theregister.com/2025/06/04/fake_it_support_calls_hit/
ClickFix Campaign Spoofs Booking.com For Malware Delivery
"Over the past few months, Cofense Intelligence has been tracking a series of travel assistance-themed, Booking.com-spoofing emails targeting hotel chains within the accommodation and food services sector. These campaigns are notable for delivering a wide variety of remote access trojans (RATs) or information stealers via an embedded link to a fake CAPTCHA site that delivers a malicious script instead of a verification code. The website will prompt the user to run the malicious script using Windows keyboard shortcuts."
https://cofense.com/blog/clickfix-campaign-spoofs-booking-com-for-malware-delivery
https://www.infosecurity-magazine.com/news/phishing-fake-bookingcom-emails/
The Bitter End: Unraveling Eight Years Of Espionage Antics—Part One
"TA397 (Bitter) is an espionage group with a long history of targeting South Asian entities. While the group is frequently attributed to India (non-publicly), the reasoning behind this is not clearly documented. In this blog we share evidence showing TA397 to be an India-aligned threat actor and release previously undisclosed evidence of the group’s targeting outside of Asia. In part one of this blog series, we explore TA397’s campaigns, targeting, and payload delivery and conduct an in-depth analysis of TA397’s infrastructure. Part two of this blog series expands on this research with a deep dive into TA397’s entire observed malware arsenal, highlighting how the group’s capabilities support its espionage operations."
https://www.proofpoint.com/us/blog/threat-insight/bitter-end-unraveling-eight-years-espionage-antics-part-one
https://www.threatray.com/blog/the-bitter-end-unraveling-eight-years-of-espionage-antics-part-two
From Open-Source To Open Threat: Tracking Chaos RAT’s Evolution
"Chaos RAT is an open-source RAT written in Golang, offering cross-platform support for both Windows and Linux systems. Inspired by popular frameworks such as Cobalt Strike and Sliver, Chaos RAT provides an administrative panel where users can build payloads, establish sessions and control compromised machines. While Golang-based malware tends to be slower and of larger size when compared to those written in C++ or other common languages, it benefits from Golang's cross-compilation capabilities, resulting in reduced development time and greater flexibility."
https://www.acronis.com/en-us/cyber-protection-center/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/
https://thehackernews.com/2025/06/chaos-rat-malware-targets-windows-and.html
The Strange Tale Of Ischhfd83: When Cybercriminals Eat Their Own
"At Sophos X-Ops, we often get queries from our customers asking if they’re protected against certain malware variants. At first glance, a recent question seemed no different. A customer wanted to know if we had protections for ‘Sakura RAT,’ an open-source malware project hosted on GitHub, because of media claims that it had “sophisticated anti-detection capabilities.” When we looked into Sakura RAT, we quickly realized two things. First, the RAT itself was likely of little threat to our customer. Second, while the repository did indeed contain malicious code, that code was intended to target people who compiled the RAT, with infostealers and other RATs. In other words, Sakura RAT was backdoored."
https://news.sophos.com/en-us/2025/06/04/the-strange-tale-of-ischhfd83-when-cybercriminals-eat-their-own/
https://www.bleepingcomputer.com/news/security/hacker-targets-other-hackers-and-gamers-with-backdoored-github-code/
https://www.infosecurity-magazine.com/news/campaign-targets-cybercriminals/
Malware Masquerades As Legitimate, Hidden WordPress Plugin With Remote Code Execution Capabilities
"The Wordfence Threat Intelligence team recently discovered an interesting malware variant that appears in the file system as a normal WordPress plugin containing a comment header, a handful of functions as well as a simple admin interface. Just like previous examples we have seen, this piece of malware contains code that ensures it remains hidden in the administrator dashboard. It has a password extraction feature, which requires configuration through its own admin interface, an AJAX-based remote code execution mechanism and unfinished code suggesting it is still in development."
https://www.wordfence.com/blog/2025/06/malware-masquerades-as-legitimate-hidden-wordpress-plugin-with-remote-code-execution-capabilities/

Breaches/Hacks/Leaks

‘Deliberate Attack’ Deletes Shopping App’s AWS And GitHub Resources
"The CEO of Indian grocery ordering app KiranaPro has claimed an attacker deleted its GitHub and AWS resources in a targeted and deliberate attack and vowed to name the perpetrator. KiranaPro lets users shop at “Kiranas,” the Indian equivalent of convenience stores, which mostly stock basic foodstuffs. Users of the app place an order, which KiranaPro sends to nearby Kiranas who bid to win the sale. The winner arranges delivery of the goods. The elapsed time from ordering to delivery seldom tops 20 minutes."
https://www.theregister.com/2025/06/04/kiranapro_cyberattack_deletes_cloud_resources/
Media Giant Lee Enterprises Says Data Breach Affects 39,000 People
"Publishing giant Lee Enterprises is notifying nearly 40,000 people whose personal information was stolen in a February 2025 ransomware attack. As one of the largest newspaper groups in the United States, Lee Enterprises publishes 77 daily newspapers and 350 weekly and specialty publications across 26 states. The local news provider's newspapers have a daily circulation of over 1.2 million, and a digital audience reaching tens of millions each month. In a filing with the Office of Maine's Attorney General this week, the company revealed that attackers behind a ransomware attack in February stole documents containing personally identifiable information of 39,779 individuals."
https://www.bleepingcomputer.com/news/security/media-giant-lee-enterprises-says-data-breach-affects-39-000-people/
https://therecord.media/newspaper-lee-enterprises-cyberattack-ssn
https://www.theregister.com/2025/06/04/cyberattack_lee_enterprises/
Ukraine Claims It Hacked Tupolev, Russia’s Strategic Warplane Maker
"The Main Intelligence Directorate (GUR) of Ukraine's Ministry of Defense claims it hacked the Russian aerospace and defense company Tupolev, which develops Russia's supersonic strategic bombers. According to Ukrainian news outlets, a source within GUR said the military intelligence hackers breached Tupolev's systems and stole 4.4 gigabytes of classified information. This stolen data includes personal data of Tupolev personnel, internal communications (including messages exchanged by the company's management), procurement documents, resumes of engineers and designers, and minutes of closed meetings."
https://www.bleepingcomputer.com/news/security/ukraine-claims-it-hacked-tupolev-russias-strategic-warplane-maker/
https://therecord.media/ukraine-military-russia-strategic-bomber
https://securityaffairs.com/178641/hacking/ukraines-military-intelligence-agency-stole-4-4gb-of-highly-classified-internal-data-from-tupolev.html
https://www.theregister.com/2025/06/04/ukraine_hack_attack_russia/
Exclusive: Hackers Leak 86 Million AT&T Records With Decrypted SSNs
"Hackers have leaked what they claim is AT&T’s database which was reportedly stolen by the ShinyHunters group in April 2024 after they exploited major security flaws in the Snowflake cloud data platform. But is this really the Snowflake-linked data? We took a closer look. As seen by the Hackread.com research team, the data was first posted on a well-known Russian cybercrime forum on May 15, 2025. It was re-uploaded on the same forum on June 3, 2025, after which it began circulating among other hackers and forums."
https://hackread.com/hackers-leak-86m-att-records-with-decrypted-ssns/
Ransomware Scum Leak Patient Data After Disrupting Chemo Treatments At Kettering
"Kettering Health patients who had chemotherapy sessions and pre-surgery appointments canceled due to a ransomware attack in May now have to deal with the painful prospect that their personal info may have been leaked online. Earlier today, ransomware gang Interlock dumped 941 GB of data purportedly belonging to the healthcare provider. The stolen information appears to include ID cards, payment data, purchasing and financial reports, among a ton of other patient and staff details, and encompasses 732,490 files across 20,418 folders, according to the leak site."
https://www.theregister.com/2025/06/04/ransomware_scum_leak_kettering_patient_data/

General News

The Hidden Risks Of LLM Autonomy
"Large language models (LLMs) have come a long way from the once passive and simple chatbots that could respond to basic user prompts or look up the internet to generate content. Today, they can access databases and business applications, interact with external systems to independently execute complex tasks and make business decisions. This transformation is primarily supported by emerging interoperability standards, such as the Model Context Protocol (MCP) and Agent-to-Agent (A2A) communication."
https://www.helpnetsecurity.com/2025/06/04/llm-agency/
Agentic AI And The Risks Of Unpredictable Autonomy
"In this Help Net Security interview, Thomas Squeo, CTO for the Americas at Thoughtworks, discusses why traditional security architectures often fail when applied to autonomous AI systems. He explains why conventional threat modeling needs to adapt to address autonomous decision-making and emergent behaviors. Squeo also outlines strategies for maintaining control and accountability when AI agents operate with increasing autonomy."
https://www.helpnetsecurity.com/2025/06/04/thomas-squeo-thoughtworks-ai-systems-threat-modeling/
Rethinking Governance In a Decentralized Identity World
"Decentralized identity (DID) is gaining traction, and for CISOs, it’s becoming a part of long-term planning around data protection, privacy, and control. As more organizations experiment with verifiable credentials and self-sovereign identity models, a question emerges: Who governs the system when no single entity holds the reins?"
https://www.helpnetsecurity.com/2025/06/04/governance-decentralized-identity/
Exposure Management:From Subjective ToObjective Cybersecurity
"Exposure management gives business and cybersecurity leaders the methodology and tools to make informed cybersecurity risk management decisions. Significant barriers stand in the way of adoption."
https://www.ivanti.com/resources/research-reports/proactive-security
https://www.helpnetsecurity.com/2025/06/04/ciso-exposure-management/
#Infosec2025: Majority Of Compromises Caused By Stolen Credentials, No MFA
"More than half (56%) of all compromises in Q1 2025 resulted from the theft of valid account credentials with no multi-factor authentication (MFA) in place, according to new research by Rapid7, published during Infosecurity Europe 2025. The researchers expect stolen credentials to continue to be the dominant initial access technique while organizations fail to protect all accounts with MFA. In the previous two quarters, a similar proportion of initial access vectors were related to credential theft and a lack of MFA."
https://www.infosecurity-magazine.com/news/majority-compromises-stolen/
The Security Risks Of Internet-Exposed Solar Power Systems
"On May 14, Reuters reported rogue communication devices were found in Chinese-manufactured solar power inverters. That news prompted governments throughout the world to evaluate the potential impact of these inverters being remotely disabled. Also, last month, the Iberian peninsula experienced a massive power grid failure where societies in Madrid, Lisbon and all over the region were deeply affected by a blackout. Life came to a sudden halt. Airports shutdown. Trains stopped in the middle of nowhere. Traffic lights were out. Digital payment systems to buy food and water were useless. It was a chaotic and stressful time."
https://www.forescout.com/blog/the-security-risks-of-internet-exposed-solar-power-systems/
https://www.securityweek.com/35000-solar-power-systems-exposed-to-internet/
https://www.darkreading.com/vulnerabilities-threats/35k-solar-devices-internet-exposure-hijacking
Hacker Arrested For Breaching 5,000 Hosting Accounts To Mine Crypto
"The Ukrainian police arrested a 35-year-old hacker who breached 5,000 accounts at an international hosting company and used them to mine cryptocurrency, resulting in $4.5 million in damages. "The suspect illegally gained access to over 5,000 accounts belonging to clients of an international hosting company that provides server rental services for the operation of various websites and online platforms," reads the police's announcement. "After gaining access to these accounts, the perpetrator began unauthorized deployment of virtual machines (software that emulates a computer's operation) using the company's server resources.""
https://www.bleepingcomputer.com/news/security/hacker-arrested-for-breaching-5-000-hosting-accounts-to-mine-crypto/
U.S. Government Seizes Approximately 145 Criminal Marketplace Domains
"The U.S. Attorney’s Office for the Eastern District of Virginia announced today the seizure of approximately 145 darknet and traditional internet domains, and cryptocurrency funds associated with the BidenCash marketplace. The operators of the BidenCash marketplace use the platform to simplify the process of buying and selling stolen credit cards and associated personal information. BidenCash commenced operations in March 2022. BidenCash administrators charged a fee for every transaction conducted on the website. The BidenCash marketplace had grown to support over 117,000 customers, facilitated the trafficking of over 15 million payment card numbers and personally identifiable information, and generated over $17 million in revenue during its operations."
https://www.justice.gov/usao-edva/pr/us-government-seizes-approximately-145-criminal-marketplace-domains
https://www.bleepingcomputer.com/news/security/bidencash-carding-market-domains-seized-in-international-operation/
https://therecord.media/bidencash-cybercrime-darknet-market-takedown-us-netherlands
https://www.bankinfosecurity.com/police-seize-carder-site-bidencash-a-28586
https://cyberscoop.com/bidencash-marketplace-domains-seized/
https://hackread.com/feds-seize-bidencash-carding-market-crypto-profits/
How Neuroscience Can Help Us Battle 'Alert Fatigue'
"I often say that cybersecurity professionals today are not drowning, they're suffocating. Research I recently undertook with colleagues at OX Security revealed that an average organization has more than half a million alerts at any given moment. More staggering is the fact that somewhere between 95% and 98% of those alerts are not critical, and many times not even issues that need to be dealt with at all. This deluge has created the alert fatigue crisis, which threatens the foundations of our digital defense and is actually deeply rooted in neuroscience."
https://www.darkreading.com/vulnerabilities-threats/how-neuroscience-battle-alert-fatigue
Researchers Bypass Deepfake Detection With Replay Attacks
"As synthetic audio continues to improve, it's also getting harder for anti-spoofing models to accurately detect. That's according to recent research published on June 1 by a team of researchers at German, Polish, and Romanian universities as well as Resemble AI, a vendor that provides AI voice generation tools as well as deepfake detectors. The research team presented how "replay attacks" are able to bypass audio deepfake detections. "By playing and re-recording deepfake audio through various speakers and microphones, we make spoofed samples appear authentic to the detection model," they wrote."
https://www.darkreading.com/cybersecurity-analytics/researchers-bypass-deepfake-detection-replay-attacks
https://arxiv.org/pdf/2505.14862
Beware Of Device Code Phishing
"Device codes are alphanumeric or numeric codes employed for authenticating an account on a device that does not have a standard login interface, such as a browser or input-limited devices, where it is not practical to require the user to enter text to authenticate. Such use cases include Internet of Things (IoT) devices, streaming apps like Netflix and Apple TV, and cloud applications. Device code authentication specifically binds authentication to a particular device."
https://www.darkreading.com/vulnerabilities-threats/beware-device-code-phishing
How To Approach Security In The Era Of AI Agents
"Artificial intelligence (AI) agents represent an exciting technological evolution, capable of autonomously completing tasks, analyzing outcomes, and adapting their actions based on human-set goals. This next phase of hyperautomation has the potential to unlock unprecedented levels of efficiency and productivity for workers and enterprises — providing that the security team is engaged early and the proper controls are put in place from the start."
https://www.darkreading.com/cyber-risk/how-to-approach-security-era-ai-agents
The State Of DDoS Attacks In APAC In Q1 2025
"Our analysts continue to monitor the DDoS situation across Asia and share key trends in our regular reports. This is our Q1 2025 overview, where we highlight the most targeted industries, emerging techniques used by cybercriminals, and top insights based on data from our global scrubbing centers."
https://stormwall.network/resources/blog/ddos-report-apac-q1-2025
https://hackread.com/stormwall-india-china-us-most-ddos-attacks-q1-2025/
#Infosec2025: Cybersecurity Support Networks Too Fragmented For SMBs, Say Experts
"Sources of cybersecurity advice and support are too diffuse and difficult to find, adding complexity to SMB efforts to build cyber-resilience, a panel of experts has argued. Speaking on the second day of Infosecurity Europe, experts from across industry, academia and government agreed that awareness isn’t necessarily the problem among smaller businesses. In fact, cybersecurity is now the second biggest concern for British SMBs, just after inflation, according to the recently released VikingCloud 2025 SMB Threat Landscape Report."
https://www.infosecurity-magazine.com/news/infosec2025-cybersecurity-support/
#Infosec2025: Device Theft Causes More Data Loss Than Ransomware
"Phishing-related data breaches are the leading causes of data loss, followed by misconfigurations and stolen devices, according to a new survey from data erasure solution provider Blancco. The firm commissioned research agency Coleman Parkes to survey 2000 cybersecurity, IT and sustainability leaders from large enterprises across several countries and industries about their data security and data resilience practices. The results, published on June 4 in Blancco’s 2025 State of Data Sanitization Report, showed that 86% of organizations have experienced a data breach over the past three years."
https://www.infosecurity-magazine.com/news/device-theft-data-loss-ransomware/
Going Into The Deep End: Social Engineering And The AI Flood
"It should come as no surprise that the vast majority of data breaches involve the “human element.” The 2025 Verizon Data Breach Investigations Report cites that human compromise held relatively steady year over year at nearly 70% of breaches. Human emotions and tendencies – and the massive variation in what influences each individual – are a massively dynamic vulnerability. Most equate Social Engineering with vague promises of riches to be had, or urgent or even threatening missives that require immediate action to avoid consequences. On the plus side, increased awareness has brought about a healthy skepticism in individuals and organizations toward something unexpected from a not completely familiar source."
https://www.securityweek.com/going-into-the-deep-end-social-engineering-and-the-ai-flood/
More Than 1,800 People Arrested In Transnational Anti-Scam Operation Involving SPF; 106 Nabbed In Singapore
"Over 1,800 people were arrested during a month-long anti-scam operation by law enforcement authorities from seven Asian jurisdictions. Victims of the scam cases reportedly lost over S$289 million (US$225 million), the Singapore Police Force (SPF) said in a news release on Wednesday (Jun 4). Law enforcement agencies from Singapore, Hong Kong, South Korea, Malaysia, Maldives, Thailand and Macau conducted the operation between Apr 28 and May 28."
https://www.channelnewsasia.com/singapore/scams-1800-arrested-investigated-police-rental-impersonation-bank-transfer-5165696

อ้างอิง
Electronic Transactions Development Agency(ETDA)