Cyber Threat Intelligence 12 June 2026

NCSA_THAICERT

Industrial Sector

Yarbo Android/iOS Mobile Application And Cloud Infrastructure
"Successful exploitation of these vulnerabilities could allow an attacker to obtain hard-coded credentials, gain access to telemetry data, and potentially send operational commands to the robot fleet."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01
Naxclow IoT Platform
"Successful exploitation of these vulnerabilities could allow an attacker to impersonate devices, intercept or manipulate communications, harvest sensitive credentials at scale, or gain unauthorized access."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02
Brickcom Cameras
"Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to gain unauthorized access to live video feeds, retrieve sensitive visual information from affected premises, and obtain administrative control of the device."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03
Segmentation Works For OT If Operators Are Paying Attention
"Separating systems to limit the damage in a cyber attack is still considered the way to secure industrial technology, but it remains a difficult goal. Segmentation only works to secure operational technology (OT) environments if operators know what threats and risks to look for, and in most cases, key concerns are overlooked. Not only does OT help power critical infrastructure sectors, but it’s increasingly converging with IT environments as well. However, security continues to lag despite its critical role across industries."
https://www.darkreading.com/cybersecurity-operations/segmentation-works-for-ot-if-operators-are-paying-attention

Vulnerabilities

Oracle Mitigates PeopleSoft Zero-Day Exploited In Data Theft Attacks
"Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks. The flaw is within Oracle PeopleSoft PeopleTools and has a CVSS base score of 9.8. "This Security Alert addresses vulnerability CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability," reads a new Oracle advisory."
https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/
https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html
https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/
https://www.helpnetsecurity.com/2026/06/11/oracle-peoplesoft-under-attack-cve-2026-35273/
Max Severity Ivanti Sentry Vulnerability Now Exploited In Attacks
"Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root privileges on Internet-exposed secure mobile gateways. Formerly known as MobileIron Sentry, the Ivanti Sentry security gateway appliance secures traffic between back-end corporate systems and remote mobile devices. Tracked as CVE-2026-10520, the maximum-severity vulnerability stems from an OS command injection weakness and was patched by Ivanti on Tuesday with the release of Sentry versions R10.5.2, R10.6.2, and R10.7.1."
https://www.bleepingcomputer.com/news/security/max-severity-ivanti-sentry-vulnerability-now-exploited-in-attacks/
https://www.darkreading.com/vulnerabilities-threats/max-severity-ivanti-sentry-flaw-exploited-24-hours
https://securityaffairs.com/193530/uncategorized/cve-2026-10520-exploited-ivanti-sentry-gateways-compromised-shortly-after-patch-release.html
Splunk, Palo Alto Networks Patch Severe Vulnerabilities
"Splunk and Palo Alto Networks on Wednesday rolled out patches for multiple vulnerabilities across their product portfolios, including critical and high-severity bugs. Palo Alto Networks drew attention to a high-severity security flaw in the Cortex XSOAR and Cortex XSIAM platforms that could allow attackers to access and modify restricted resources. Tracked as CVE-2026-0274, the issue is described as the improper validation of credentials in the CommvaultSecurityIQ integration of the affected products and does not require a special configuration to be triggered."
https://www.securityweek.com/splunk-palo-alto-networks-patch-severe-vulnerabilities/
CISA Adds One Known Exploited Vulnerability To Catalog
"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/06/11/cisa-adds-one-known-exploited-vulnerability-catalog
https://www.bleepingcomputer.com/news/security/cisa-tells-govt-agencies-to-patch-critical-exploited-flaws-in-3-days/
New GreatXML Exploit Bypasses Windows BitLocker Via Recovery Partition XML Files
"Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for Microsoft Defender. "This was an accidental discovery, it took a total of 4 hours to find this," the researcher said in a post on Blogger. "If you ever attempted to use Windows Defender Offline Scan, you're automatically vulnerable to a BitLocker bypass. I'm unsure if you can still trigger the bug without ever using the offline scan feature, because you can definitely.""
https://thehackernews.com/2026/06/new-greatxml-exploit-bypasses-windows.html
https://deadeclipse666.blogspot.com/2026/06/greatxml-bitlocker-that-seems-to-only.html
https://www.securityweek.com/greatxml-zero-day-exploit-bypasses-bitlocker/
https://securityaffairs.com/193516/security/chaotic-eclipse-strikes-again-new-zero-day-unlocks-bitlocker-in-four-hours-of-research.html
https://www.theregister.com/security/2026/06/11/nightmare-eclipse-drops-claimed-bitlocker-bypass-for-microsoft-windows/5254371
CVE-2026-30612: A Vulnerability In Time4Popcorn (PopcornTime)
"Time4Popcorn is a fork of Popcorn Time, a popular download application. This fork is also distributed under the name ‘Popcorn Time’. Since early 2025, a new project started using the PopCorn Time name and is building a legal alternative, this research does not apply to that software. The Windows, Mac and Android versions of this software, contain a vulnerable update component. The updater connects to its update servers over an insecure channel. An attacker that is able to manipulate this traffic can offer his own update. On Windows and Mac, this update occurs in the background without user interaction and will run with full privileges (NT AUTHORITY\SYSTEM or root). On Android, the user is prompted to install an attacker-supplied APK file."
https://research.eye.security/cve-2026-30612-a-vulnerability-in-time4popcorn-popcorntime/

Malware

Threat Actors Weaponize AI Hype To Deliver AsyncRAT
"As AI adoption continues to grow, threat actors have wasted no time exploiting the trend. FortiGuard Labs recently observed a campaign delivering malicious files disguised as AI-related documents, with titles such as "AI-Ready PostgreSQL 18: Building Intelligent Data Systems" and " A Guide for Thinking Marketers in the Age of AI." These lures are designed to target users actively seeking AI-related learning resources. The attack chain behind these files is remarkably complex, using multiple staged scripts to hide activity before ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan and AsynRAT into memory for command-and-control communication and follow-on execution."
https://www.fortinet.com/blog/threat-research/threat-actors-weaponize-ai-hype-to-deliver-asyncrat
https://www.infosecurity-magazine.com/news/fake-ai-guides-dev-tools-spread/
https://hackread.com/hackers-fake-claude-code-guide-ai-pdfs-asyncrat/
Sniper’s Nest: From Brand Impersonation To Browser Hijacking And CPA Fraud
"During an investigation into phishing activity targeting users across the Middle East and North Africa (MENA), Group-IB analysts identified multiple fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations. These accounts promoted fake offers, including free mobile internet packages, financial compensation, and government subsidy programs. Victims were encouraged to click embedded links to claim the advertised benefits, but were instead redirected through a chain of intermediary websites that ultimately led to phishing and traffic monetization infrastructure."
https://www.group-ib.com/blog/inside-sniperdz-phaas-ecosystem/
https://www.infosecurity-magazine.com/news/interpol-dismantles-sniperdz/
https://hackread.com/authorities-dismantle-sniperdz-phishing-network/
A Fake Bug Report Hijacks Your AI Coding Agent – And Nothing Catches It.
"Tenet Threat Labs has demonstrated a new class of attack “Agentjacking” that hijacks AI coding agents into running attacker-controlled code on a developer’s machine, triggered by a single fake error report and invisible to every security control. Using only public Sentry APIs, breaching nothing, we found 2,388 organizations exposed, saw 100+ agents act on injected errors in controlled testing, with confirmed agent execution at organizations spanning from Fortune 500 enterprise down to independent developers."
https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors/
https://www.infosecurity-magazine.com/news/agentjacking-attacks-hijack-ai/
Inside OnyxC2: The New Stealer Targeting 210 Apps
"A new stealer called OnyxC2 surfaced on a cybercrime network in early 2026, sold as a complete product: a web panel, a payload builder, tiered pricing, and refunds if a build gets caught. For $250 a month, operators get a kit that harvests browser credentials, password managers, two-factor authentication (2FA), and crypto wallets across roughly 210 applications and extensions, then ships it all back over an encrypted channel."
https://www.blackfog.com/inside-onyxc2-the-new-stealer-targeting-210-apps/
https://www.securityweek.com/onyxc2-stealer-offers-cybercriminals-enterprise-grade-theft-for-250-a-month/
https://securityaffairs.com/193523/malware/onyxc2-malware-as-a-service-offers-enterprise-grade-data-theft.html
Inside The Phantom Mantis Operation
"Phantom Mantis , initially known as ArmCorp, is a financially motivated threat group active since March 2025. The group conducts intrusions for extortion and is led by a Russian-speaking criminal tracked as LARVA-368 . For about four months, Phantom Mantis operated as an affiliate group conducting double-extortion attacks, leveraging resources from various Ransomware-as-a-Service (RaaS) operations, including Tenacious Mantis (a.k.a. LockBit) and in particular Pestilent Mantis (a.k.a. Qilin)."
https://catalyst.prodaft.com/public/report/inside-the-phantom-mantis-operation/overview
https://thehackernews.com/2026/06/the-gentlemen-ransomware-claims-478.html
OceanLotus: From External Espionage To Domestic Targeting
"Our tracking of OceanLotus activities from 2024–2026 reveals a shift in operational focus. During this period, the Vietnam-aligned OceanLotus adopted a more selective approach to external operations while placing increasing emphasis on domestic espionage. We identified two distinct campaigns involving the SPECTRALVIPER backdoor: a supply-chain attack targeting stock investors in Vietnam and a prolonged espionage operation against a Vietnamese infrastructure and transport construction company. Whether the shift represents a temporary adjustment or a long-term strategic change remains unclear; however, this 15-year-old APT group continues to demonstrate aggressive tactics and a level of craftiness in its tooling."
https://www.welivesecurity.com/en/eset-research/oceanlotus-external-espionage-domestic-targeting/
https://thehackernews.com/2026/06/oceanlotus-hits-vietnam-investors-with.html
ShinyHunters Targets Education Sector With Oracle PeopleSoft Exploit
"Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component. The exploitation of this vulnerability directly aligns with the observed targeting of Environment Management Hub (PSEMHUB) endpoints. Because this activity predates Oracle's June 10, 2026 advisory, the vulnerability was exploited as a zero-day."
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-claims-oracle-peoplesoft-0-day-hit-100-orgs/5254443

Breaches/Hacks/Leaks

Japanese Energy Firm Loses Drive With Data Of 10.9 Million Clients
"Kyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers. In an official announcement, the company explains that the IT staff regularly performs backups to manage server storage. Due to capacity constraints, on April 27 an external storage device was used for the task. The drive was then stored in a server room cabinet protected by multiple physical security layers. On May 26, when IT staff went to retrieve it, they found the cabinet had been left unlocked and the driver was missing."
https://www.bleepingcomputer.com/news/security/japanese-energy-firm-loses-drive-with-data-of-109-million-clients/
Nottingham University Data Breach Affects Over 450,000 Students
"The University of Nottingham confirmed on Wednesday that a hacking group gained access to its student records system in a breach affecting both current students and alums. Nottingham University is a public research university with 7,000 staff and over 46,000 students, ranking in the Top 20 in the United Kingdom and the Top 100 worldwide. The university told BleepingComputer in an emailed statement that the incident exposed a "significant amount of data," and that the breach has been reported to the UK's Information Commissioner's Office."
https://www.bleepingcomputer.com/news/security/nottingham-university-data-breach-affects-over-450-000-students/
https://therecord.media/university-of-nottingham-cyber-incident-shiny-hunters
https://hackread.com/shinyhunters-university-of-nottingham-student-data-leak/
https://www.securityweek.com/university-of-nottingham-confirms-breach-after-hackers-leak-data/
British High School Sends Students Home Following Cyberattack
"The majority of students at a high school in Buckinghamshire, England, were sent home for the second day in a row on Thursday after what the headteacher told parents was “a cybersecurity incident affecting our ICT systems.” Great Marlow School, which has 1,428 pupils according to the Department for Education (DfE), said it was set to remain closed while it works with specialist IT and cybersecurity professionals to resolve the issue."
https://therecord.media/british-school-sends-students-home-cyberattack
Nearly a Million Passports And Photo IDs Were Left Unprotected On The Public Internet
"Typing a few letters and numbers into my web browser, I find myself gaping at the identity documents of complete strangers. The passport of a young woman from Germany. The passport of a man from Spain with glasses resting on his head. The front and back of another man’s driver’s license, a stereotypically goofy expression on his face. They were all sitting unprotected at public URLs, with no password or access control of any sort. If I sent you a link, you could have looked at someone’s passport."
https://www.theverge.com/tech/947157/passports-data-breach-cannabis-club-systems-nefos-puffpal
https://github.com/xn0tsa/because-i-got-high

General News

Ransomware Gangs Cut Off From EUR 336 Million ‘AudiA6’ Crypto Laundering Pipeline
"An international law enforcement operation has dismantled one of the cryptocurrency laundering services most trusted by ransomware gangs and cybercriminal networks, cutting off a key financial pipeline used to wash hundreds of millions in illicit profits. The service, known as ‘AudiA6’, is suspected of laundering more than EUR 336 million between 2022 and 2025. Investigators believe the platform became a central hub for ransomware actors and cybercriminals seeking to cash out stolen digital assets while hiding the money trail from authorities."
https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline
https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/
When Your AI Agent’s Memory Becomes a Security Liability
"Check Point Research discovered how a single overlooked API in LangGraph, one of the world’s most widely used AI agent frameworks, can hand an attacker complete control of your AI infrastructure. LangGraph is not a niche tool. With close to 46.5 million downloads last month alone, it powers AI agents across thousands of production environments, from customer support automation to internal enterprise workflows. That kind of adoption means any security issue in it is worth paying close attention to."
https://blog.checkpoint.com/research/when-your-ai-agents-memory-becomes-a-security-liability/
https://research.checkpoint.com/2026/from-sqli-to-rce-exploiting-langgraphs-checkpointer/
The Hidden Security Risks Of Poor Software Testing
"A system does not need to be attacked by an advanced hacker to fail. One overlooked flaw in the code, one outdated dependency, or one rushed release can give attackers the access they need, especially after the exploitation of AI in cybercrime. Companies can spend heavily on antivirus software, firewalls, endpoint tools, and multi-factor authentication. Those controls matter, but they cannot fully protect a product that was released with avoidable security flaws. Once vulnerable code reaches production, attackers have a real target."
https://hackread.com/the-hidden-security-risks-of-poor-software-testing/
9 Out Of 10 People Can No Longer Distinguish Real From AI-Generated Content
"Online fraud is becoming harder to distinguish from legitimate activity as AI-generated messages, voices, photos, reviews, and identities become more convincing. Nearly nine in ten adults say they can no longer tell what is real from AI-generated content, according to the latest Malwarebytes survey. The share increased from 66% in 2025 to 85% in 2026. The survey covered 1,500 adults aged 18 and older in the United States, the UK, Austria, Germany, and Switzerland."
https://www.helpnetsecurity.com/2026/06/11/ai-scams-deepfakes-survey/
Threat Actors Are Recruiting The People Who Hold Cloud Logins
"Companies keep most of their data and applications in cloud platforms that anyone can reach with the right login. That setup turns each employee holding those credentials into a security variable, and members of the cybercrime underground have built methods to reach those people. Intel 471 tracked this activity into 2026 and sorted insider risk into three categories that cloud-reliant organizations contend with."
https://www.helpnetsecurity.com/2026/06/11/report-cloud-insider-threats/
Prompt Injection Still Drives Most Agentic AI Security Failures In Production
"A backdoor sat on PyPI for three hours in March 2026. Nearly 47,000 downloads occurred during the window. The compromised package, LiteLLM, serves as the language-model gateway for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks. Anyone pulling an update during that window pulled in an autonomous attack bot named hackerbot-claw along with it."
https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/
ISC2 Research: How Enterprises Use Training To Strengthen Cybersecurity Teams
"Cybersecurity professionals face a constantly evolving landscape of threats, new technologies and changing organizational priorities. To stay on top of – and indeed ahead – of these needs, maintaining and developing relevant skills is an essential requirement. However, with many new and emerging cybersecurity skills in short supply, training and development remain among the most pressing challenges for employers and professionals alike. A new research report from ISC2, How Enterprises are Strengthening Their Cybersecurity Teams Through Training, examines how enterprise organizations (5,000+ employees) across Canada, Germany, India, Japan, the U.K. and the U.S. approach security team training."
https://www.isc2.org/Insights/2026/06/enterprise-training-trends
https://edge.sitecorecloud.io/internationf173-xmc4e73-prodbc0f-9660/media/Project/ISC2/Main/Media/Research/ISC2_Enterprise_Training_Trends_Research_Report_2026.pdf
https://www.infosecurity-magazine.com/news/cybersecurity-training-time/
Extortion-Only Attacks Increase, With Data Theft Dominating Ransomware Claims
"Insurance experts have urged organizations to reduce their exposure to extortion-only attacks and better manage the consequences when they occur, after revealing a surge in this category of threats. Insurer Resilience said in a new report that 65% of extortion-related claims it handled in the second half of 2025 did not involve data encryption. That’s up from 49% in the first half of the year. By the end of 2025, only 13% of attacks relied on encryption alone, while data theft – on its own or combined with encryption – accounted for 87% of ransomware claims, it noted."
https://www.infosecurity-magazine.com/news/extortion-only-attacks-surge/
Alert Fatigue Is Becoming a Security Threat Of Its Own
"Alert fatigue and its related effects on SOC efficiency are self-evident problems. Less obvious and more complex are the cause, effect and possible solutions to these problems. SOC analysts are inundated with a huge and continuous volume of alerts generated by security tools. Each alert is often meaningless absent correlation with other alerts. But finding relationships is time-consuming, and even if found, might be irrelevant to business security. Much of the alert volume is simply noise, but attempting correlation to find true positive alerts (signals) from the huge number of false positives (noise) is difficult, boring, and often pointless."
Priority: 3 - Important
Relevance: General

https://www.securityweek.com/alert-fatigue-is-becoming-a-security-threat-of-its-own/
The Defender's Playbook For LLM-Powered Vulnerability Discovery
"My last article on how attackers will behave showed what they’ll do once LLMs flood the system with new Common Vulnerabilities and Exposures (CVEs). This essay looks at what defenders could do in response. Some moves are obvious. Others break norms and carry risk. We group by the four vendor types from that article, then list every move with its trade-offs."
https://blog.barracuda.com/2026/06/11/defenders-playbook-llm-vulnerability-discovery

Hacker Linked To Void Blizzard Faces Charges Over Cyberespionage Campaign
"A Russian national with suspected links to the Void Blizzard hacking group appeared in U.S. federal court this week on charges of supporting a Kremlin-linked cyberespionage campaign that targeted U.S. companies, according to media reports. Denis Obrezko, 36, made his initial appearance in federal court in Boston on Tuesday after being transferred to U.S. custody from Thailand, where he was arrested last November."
https://therecord.media/hacker-linked-to-void-blizzard-faces-charges
https://cyberscoop.com/russian-national-charged-void-blizzard-cyber-espionage/
What Makes Or Breaks Cyber-Readiness For SMBs
"Cybersecurity has a familiar way of saying the storm will come: “a breach is a matter of when, not if.” While the industry’s sternest maxim has probably never been more true, it sometimes feels as though it’s also lost some of its edge over the years. Eveveryone agrees that there could be a ‘cloud on the horizon,’ but will they also hurry to draft or review their IT contingency plan or commit to a level of operational pain that their company can endure while under attack?"
https://www.welivesecurity.com/en/business-security/smb-cyber-readiness-what-makes-breaks-it/
CrowdStrike 2026 Technology Threat Landscape Report: China’s Ambitions Fuel Attacks
"The technology sector has, for the past several years, been the most targeted industry among eCrime and state-sponsored adversaries whose motivations span financial gain, long-term intelligence collection, and industrial espionage. Modern tech companies are building the world’s most valuable and targeted assets. Their cutting-edge innovations, now including AI, represent competitive advantage and heightened risk. Adversaries are taking aim, and defenders that understand them are best equipped to stop them."
https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-technology-threat-landscape-report/
Shadowserver Report Provides Cybersecurity Insights And Recommendations For ECOWAS Member States In West Africa
"In recent years, West African nations have experienced a rapid digital transformation that has helped spur economic growth and development. Yet, this transformation has also brought to light many institutional and operational cybersecurity deficiencies that make the region an attractive and vulnerable target of cyber threat actors. West Africa has experienced an alarming increase in cyberattacks in recent years, with cybercrime accounting for more than 30-percent of all reported crime in the region."
https://www.shadowserver.org/news/shadowserver-report-provides-cybersecurity-insights-and-recommendations-for-ecowas-member-states-in-west-africa/
https://www.shadowserver.org/wp-content/uploads/2026/06/SSF001-ECOWAS-Report-ENG-FINAL.pdf

อ้างอิง
Electronic Transactions Development Agency (ETDA)