Cyber Threat Intelligence 13 August 2026

NCSA_THAICERT

Industrial Sector

Rush To Build Data Centers Leaves OT Security Behind
"In the rush to get servers on the ground, and new compute up and running, especially to cater to the artificial intelligence boom, data center owners have neglected security and left vulnerable operational technology devices dangerously close to the public internet, according to experts and recent research. Total U.S. capital expenditure on data centers is expected to top $700 billion this year, according to Moody's Investor Services, as tech giants and their smaller rivals race to power ever larger and more complex large language models and meet the predicted mushrooming demand from business. Over the next five years, predicts market intelligence firm Industrial Info Resources, data center developers and big tech firms plan to start construction on 2,913 data centers at a cost of about $2.4 trillion by 2030."
https://www.bankinfosecurity.com/rush-to-build-data-centers-leaves-ot-security-behind-a-32538
ICS Patch Tuesday: Vulnerabilities Fixed By Siemens, Schneider, Phoenix Contact
"Industrial giants Siemens, Schneider Electric, and Phoenix Contact have published August 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products. Siemens has published 10 new advisories. One covers a maximum-severity missing-authentication vulnerability in Simatic IoT2050 Advanced devices. A remote, unauthenticated attacker can exploit it to execute arbitrary code on the underlying server with elevated privileges. A critical code execution vulnerability has also been fixed by Siemens in the Siveillance Video Management Servers."
https://www.securityweek.com/ics-patch-tuesday-vulnerabilities-fixed-by-siemens-schneider-phoenix-contact-2/
Rockwell Automation/Allen-Bradley MicroLogix PLCs Attack
"Cyber threat actors are targeting Internet-facing programmable logic controllers (PLCs) used by water and wastewater organizations, with successful compromises resulting in operational disruptions. Attackers have gained access to exposed PLCs and manipulated their operation, demonstrating the potential for Internet-accessible OT systems to be directly abused to disrupt physical processes. While the reported activity specifically references Rockwell Automation/Allen-Bradley MicroLogix PLCs, the targeting is not necessarily limited to these products, and other internet-facing PLCs may also be at risk."
https://fortiguard.fortinet.com/threat-signal-report/6498

Vulnerabilities

Adobe Patches Critical Magento Account Takeover (APSB26-92)
"Adobe has released isolated security patches for APSB26-92 for Adobe Commerce and Magento Open Source. The update fixes seven vulnerabilities. Five are rated Critical, including CVE-2026-71362, an unauthenticated customer account takeover with a CVSS score of 9.1. Exploitation needs no existing account, administrator privileges or user interaction."
https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92
https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/
Ivanti EPM Update Patches Remotely Exploitable Flaws
"Enterprise software company Ivanti on Tuesday announced patches for four vulnerabilities in Endpoint Manager (EPM) and Neurons for MDM. The EPM update addresses three high-severity bugs, including two that could be exploited by remote, unauthenticated attackers. Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections."
https://www.securityweek.com/ivanti-epm-update-patches-remotely-exploitable-flaws/
SonicWall Patches Critical Vulnerabilities In Discontinued GMS Platform
"SonicWall on Tuesday announced patches for eight vulnerabilities across two products, including critical-severity remote code execution (RCE) bugs. The cybersecurity firm rolled out fixes for six security defects in Global Management System (GMS), its centralized management, monitoring, and reporting platform that was retired in October 2025. Per SonicWall’s advisory, two of the flaws, namely CVE-2026-66147 (CVSS score of 9.4) and CVE-2026-66145 (CVSS score of 9.1), deserve special attention, as both could allw remote, unauthenticated attackers to execute arbitrary code."
https://www.securityweek.com/sonicwall-patches-critical-vulnerabilities-in-discontinued-gms-platform/
New Microsoft Defender 'ShieldBreak' Zero-Day Grants SYSTEM Privileges
"A security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldBreak" after Microsoft released the August 2026 Patch Tuesday security updates. The new vulnerability is described as a bypass for RoguePlanet, another Defender privilege escalation flaw disclosed in June and patched by Microsoft one month later. However, cybersecurity expert Kevin Beaumont, who also published ShieldBreak exploitation detection queries for Microsoft Defender for Endpoint, said that the two exploits work very differently."
https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/
https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html
https://securityaffairs.com/197063/hacking/shieldbreak-new-windows-zero-day-bypasses-microsofts-rogueplanet-patch.html
Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined
"Intel and AMD on Tuesday announced patches for a total of more than 80 vulnerabilities across their products. Intel has published 42 new advisories covering 72 vulnerabilities. The company patched several high-severity flaws in PROSet/Wireless WiFi software that could allow an attacker to escalate privileges or conduct a denial-of-service (DoS) attack."
https://www.securityweek.com/chipmaker-patch-tuesday-intel-amd-fix-over-80-vulnerabilities-combined/
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
"A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing, even handed to a weaker model in the same provider family to make it reveal the hidden content."
https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html
https://arxiv.org/abs/2608.09867

Malware

Active Exploitation Of CVE-2026–59310: 361 Victim IPs Across 47 Countries
"QUIRSO’s Threat Research team is tracking an active exploitation campaign targeting internet-accessible VMware vCenter systems. Based on evidence collected during a recent incident response engagement, we assess that a suspected advanced persistent threat (APT) actor is exploiting CVE-2026–59310 and using reverse SSH to maintain access to compromised systems. CVE-2026–59310 is a critical directory-traversal vulnerability in the VMware vCenter Syslog server. According to Broadcom, an attacker with network access to vCenter may exploit the vulnerability to execute arbitrary code."
https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
The “City-Forum” Campaign - An Advanced Attacker Is Targeting Salesforce And ServiceNow Instances Worldwide
"Reco is tracking an ongoing campaign we've named the City-Forum Campaign, after a domain tied to the threat actor's IP (more on that below). A single server is pulling records out of Salesforce Experience Cloud sites and ServiceNow (SNOW) Service Portals, from infrastructure that has been standing since March 2025. In the last year, we've seen many threat actors that use Aura enumeration against over-permissioned Salesforce guest users, for example ShinyHunters. This actor is different. Except for Aura, the attacker reaches Salesforce Lightning Web Runtime (LWR) sites through the UI-API, a data layer we have not seen any public tool or write-up about, and it hammers a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open source tools."
https://www.reco.ai/blog/city-forum-campaign-salesforce-servicenow
https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/
https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow
https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/
https://www.helpnetsecurity.com/2026/08/12/salesforce-servicenow-guest-user-exposure/
737 Chrome VPN Extensions Linked To Brand Impersonation And Browser Traffic Redirection
"Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure."
https://socket.dev/blog/chrome-vpn-extension-impersonation
https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html
https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy/
FBI: Hackers Target Online Accounts To Steal Nude Photos
"The FBI warns that cybercriminals are targeting adults' and children's social media and other online accounts to steal sexually explicit images or videos. As the law enforcement agency explained in a public service announcement published this week, the attackers may use the stolen content to blackmail the victims or try to sell it on criminal marketplaces. They may also share the victims' personal information (including names, dates of birth, emails, phone numbers, and social media usernames) with other criminals, who can use it to pressure them into providing additional private images and videos through sextortion."
https://www.bleepingcomputer.com/news/security/fbi-warns-of-hackers-targeting-online-accounts-to-steal-explicit-photos/
https://www.ic3.gov/PSA/2026/PSA260810
https://therecord.media/social-engineering-hackers-explicit-photos-fbi-alert
Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
"On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept (PoC) script. A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline."
https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/
https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/
You're Invited To Get Phished! Why Invitation-Themed Emails Remain Effective
"Threat actors are weaponizing party invitation-themed emails to steal credentials and install malware on victims’ machines. Cofense Intelligence has observed a sustained rise in phishing campaigns disguised as event invitations, spoofing trusted platforms such as Punchbowl, Greenvelope, Paperless Post, and Evite. Behind the familiar branding, these emails deliver credential-harvesting login pages and remote access tools that give threat actors persistent control of a victim’s machine. The same link can fingerprint the recipient’s device and deliver different payloads to desktop and mobile users simultaneously, expanding the reach of each campaign without additional effort. The technology behind these campaigns has evolved, but the underlying lure has not. People are naturally curious about invitations, and attackers continue to exploit that instinct."
https://cofense.com/blog/you-re-invited-to-get-phished!-why-invitation-themed-emails-remain-effective
Inside a Multi-Agent AI Framework Used To Compromise Government Entities In Asia
"What follows is but one concrete example of what appears to be a near-autonomous attack, running off readily available harnesses and models and aimed at a nation state. Details on the attack were initially shared with the Financial Times. In roughly four days, the agentic attacker produced 1,395 files, 85 cracked credentials, thousands of exfiltrated personnel records, and gained a persistent foothold inside state infrastructure. It spells out one thing loudly - the cost of running a competent attack has collapsed, but the cost of defending against one has not."
https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia
https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/
https://securityaffairs.com/197079/apt/china-linked-hackers-use-ai-agents-in-autonomous-attack-on-taiwan.html
Gone With The WindRelay: A New Malware Combo Behind a Growing Fraud Scheme
"Contactless payment fraud has moved from a theoretical risk to an operational one, and the scale is now visible in both industry and regulatory reporting. The European Payments Council’s 2025 Payment Threats and Fraud Trends report identifies NFC relay fraud — and the related “Ghost Tap” technique — as a rising category, noting it frequently overlaps with remote access scams and results in unauthorized transactions and a complete loss of control over funds, with victims sometimes unknowingly drawn into money laundering as a result. The scale behind that assessment shows up clearly in independent telemetry: NFC-based attacks on Android devices rose 188% in the first four months of 2026 compared to the same period in 2025, with 35,600 attacks blocked in that window alone, up from over 12,300 a year earlier (Kaspersky); this followed a more than 35-fold increase in NFC-related attacks recorded in the first half of 2025 compared to the second half of 2024 (ESET)."
https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/
https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
https://www.infosecurity-magazine.com/news/windrelay-nfc-relay-spynote-rat/
CopyEscape: Taking Over Docker Hosts With Docker Cp
"Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. A malicious container or sandbox could exploit the copy process to create or overwrite files outside the destination selected by the user, potentially enabling code execution on the machine running the Docker CLI."
https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/
Dragon Breath (APT-Q-27): RONINGLOADER And Gh0st RAT Explained
"Dragon Breath, also known as APT-Q-27and Golden Eye Dog, is a Chinese cybercrime APT first observed in 2020, targeting Chinese-speaking users and organizations across the Asia-Pacific region, including China, Hong Kong, Taiwan, Singapore, Japan, and the Philippines, with a focus on online gambling and financial services. Dragon Breath stands out for layered execution and defense evasion, combining trojanized installers with double-clean-app DLL side-loading, signed kernel drivers, Protected Process Light abuse, thread-pool process injection, and malicious code-signing. Its recent RONINGLOADER chain also deploys a modified Gh0st RAT over WebSocket-based C2 while actively disabling Windows Defender and regional endpoint security tools."
https://www.picussecurity.com/resource/blog/dragon-breath-apt-q-27-roningloader-and-gh0st-rat-explained
ClickFix Campaign Abuses Deno Runtime For Infostealer Delivery
"Counter Threat Unit (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism within a ClickFix-driven intrusion chain. On June 3 and June 4, compromised WordPress sites served Cloudflare-themed ClickFix lures that prompted users to execute a clipboard-delivered PowerShell command. This command initiated an MSI-based staging process that installed Deno and enabled retrieval and execution of remote JavaScript. CTU analysis indicates that Deno functioned as a key element supporting payload delivery, follow-on tasking, and persistence."
https://www.sophos.com/en-us/blog/clickfix-campaign-abuses-deno-runtime-for-infostealer-delivery
Inside a Russian-Speaking Operator's Toolkit For Compromising Ukrainian IP Cameras
"In late May 2026, Hunt.io Attack Capture identified an open directory on 89.208.97[.]165 containing files pointing to the compromise of a Ukrainian e-commerce site. The intrusion itself, through credential theft and SQL injection, is only the starting point. Bash history and custom scripts recovered from the directory show the operator turned that access into a proxy server, and then used password spray attacks and attempted web shell deployment against Ukrainian government and military sites. During our investigation, we identified a custom platform built to find, exploit, and catalog internet-exposed IP cameras."
https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit

Breaches/Hacks/Leaks

Ransomware Attack Disables Canadian Hospital's Doors, HVAC
"A Canadian hospital is dealing with a ransomware attack on its facility management systems that has affected the building's doors and heating, ventilation and air conditioning equipment. Some experts said the incident underscores growing cyberthreats involving operational technology in healthcare. The attack this week on Manitoba, Ontario's largest hospital - Winnipeg's Health Sciences Centre, which is a facility operated by Shared Health, is under investigation, a Shared Health spokesperson told ISMG."
https://www.bankinfosecurity.com/ransomware-attack-disables-canadian-hospitals-doors-hvac-a-32535
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition
"Colombia's Ministry of Justice confirmed that a ransomware attack struck part of its technology infrastructure and degraded several public-facing services on Aug. 2, just five days before the nation's presidential handover. The attack, which disrupted some services around illicit-drug monitoring and legal processes, came a day after Colombia's national CERT (ColCERT) published a threat intelligence warning that ransomware groups had increased their focus on the country. While some media reports suggested that data had leaked during the Ministry of Justice compromise, then acting Minister of Justice Cielo Rusinque denied that any information had been stolen, during a Spanish-language news interview."
https://www.darkreading.com/cyberattacks-data-breaches/ransomware-hits-colombian-justice-ministry-presidential-transition
2,500+ Companies And 434,000 CI/CD Pipelines Exposed In The Largest AI Supply Chain Breach Of 2026
"In March 2026, the threat actor group TeamPCP orchestrated what is believed to be the largest supply chain attack targeting AI infrastructure by compromising LiteLLM. CloudSEK Threat Intelligence was able to get access to the victim information and is disclosing the details of all the impacted victims . We are sharing this openly so that every affected organization can act proactively The threat is still live: the FBI's July 2026 FLASH advisory (FLASH-20260702-01) warns that affiliated actors are likely to weaponize the harvested credentials long after the original intrusion, which means further supply chain attacks remain a real possibility. Early awareness is the strongest defense; knowing you were impacted lets you rotate credentials, close the exposure, and harden before the next campaign hits."
https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
https://exposure.cloudsek.com/ai-supply-chain-incident
https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/
Three Intrusions At UK Criminal Records Office Went Undetected For Two Years
"Britain's criminal records office has been reprimanded by the country’s data protection regulator after being repeatedly breached over nearly two years, exposing the personal data of thousands of people including victims of domestic violence. The Information Commissioner’s Office (ICO) announced in the reprimand notice Wednesday that it was censuring ACRO Criminal Records Office over a range of security shortcomings, among them alerts from antivirus software going unread and a critical system left unpatched for nearly four years."
https://therecord.media/uk-criminal-records-office-acro-data-breaches

General News

July 2026 Cyber Threats Surge: Ransomware Attacks Double Year Over Year As GenAI Data Exposure Widens
"July’s cyber threat landscape was shaped by pressure across multiple fronts. Global cyber attacks continued to rise, ransomware activity broke from the more stable pattern seen earlier in the year, and GenAI exposure became a clearer operational risk as employees used more tools and generated more prompts across the enterprise."
https://blog.checkpoint.com/security/july-2026-cyber-threats-surge-ransomware-attacks-double-year-over-year-as-genai-data-exposure-widens/
Walmart Leaders Transform Security Operations Without Going Bananas
"As the world's largest retailer, Walmart knows a thing or two about scale. It sells more bananas than any grocer, employs more than 2 million people across 19 countries, and generates more than $700 billion in annual revenue. And like all large companies, it's also in the crosshairs of cyber adversaries, so it's imperative that its leadership team understands the risks and buys into a mitigation plan."
https://www.darkreading.com/cybersecurity-operations/walmart-leaders-transform-security-operations-without-going-bananas
Split-Second Deepfake Glitch Blows Digital Certificate Fraudster’s Cover
"Spanish police have arrested a man in Murcia accused of using deepfake software to trick a certificate provider’s video identity checks in an attempt to obtain digital signatures he could use for financial fraud. According to the police, the man made 38 attempts using this method on more than 30 citizens. Police haven’t said how many of those attempts succeeded before the scheme was uncovered. The National Police said the investigation started after a company that issues electronic certificates flagged a string of suspicious verification requests."
https://www.helpnetsecurity.com/2026/08/12/deepfake-video-identity-verification-fraud-arrest-spain/
Post-Quantum Migration Gets Harder When Every User Holds a Key
"In this Help Net Security interview, Christopher Smith, CEO of Quantus, discusses what cryptographic inventories turn up in banks and hospitals, including default passwords and admin keys still held by former employees. He explains where post-quantum key sizes break old size assumptions in IPsec, SSH, TLS and libp2p, why migrating user keys makes blockchains hard to upgrade, and what a silent quantum break would look like from outside. He also gives the argument for funding work whose payoff stays invisible."
https://www.helpnetsecurity.com/2026/08/12/christopher-smith-quantus-post-quantum-migration/
338 Million Attack Simulations Reveal The State Of Enterprise Defense
"First, a bit of good news: Enterprise defenses are recovering. However, it’s a narrow recovery, with a twist. Today, organizations are better at stopping loud attacks but have barely moved the needle at all against the quiet ones. This data, and a lot more, comes straight from the newly published Blue Report 2026, the fourth annual comprehensive study from Picus Labs. Based on more than 338 million attack simulations run in real production environments in the first half of 2026, the report measures how enterprise prevention and detection actually performed against real attacks, from what controls stopped at the perimeter to what attackers can achieve once they’re inside."
https://www.helpnetsecurity.com/2026/08/12/picus-security-blue-report-2026/
https://thehackernews.com/2026/08/enterprise-defenses-recovered-at-edge.html
AI Deployments Are Stretching Enterprise Security To Its Limits
"CISOs and CTOs expect AI deployments to increase their organizations’ attack surface by an average of 14% over the next year. Nearly all lack visibility into AI deployments, and 90% are concerned about employees using unapproved AI tools outside formal oversight, according to NetFoundry’s 2026 State of Secure AI Access survey. Organizations are under pressure to secure AI deployments, particularly in the retail and travel, healthcare and pharmaceuticals, and technology sectors. AI-related risks are now a top concern for security leaders. Only 15% of respondents said they were very confident their existing security tools could adequately protect AI deployments. Confidence was lower for CISOs."
https://www.helpnetsecurity.com/2026/08/12/netfoundry-securing-ai-deployments-report/
NIST Seeks Public Input On AI-Ready NVD Modernization
"The US National Institute for Standards and Technology (NIST) is looking to modernize its National Vulnerability Database (NVD) to address challenges posed by AI and incorporate more automation and AI workflows. In a request for information (RFI) published on August 12 in the Federal Register, NIST encouraged stakeholder input on opportunities, challenges and priorities for modernizing the NVD in “an evolving cybersecurity landscape increasingly shaped by AI and machine-consumable security data.” The Institute is particularly interested in receiving “forward-looking perspectives, practical recommendations and innovative models” that will improve the NVD’s scalability, automation, interoperability, transparency and utility."
https://www.infosecurity-magazine.com/news/nist-seeks-public-input-ai-nvd/
https://www.federalregister.gov/documents/2026/08/12/2026-16371/request-for-information-rfi-on-modernizing-the-national-vulnerability-database-in-the-age-of
AI-Related Software Vulnerabilities: 2025–2026
"AI and machine learning (ML) software has generated a steady stream of Common Vulnerabilities and Exposures (CVEs) in deep-learning frameworks, model-serving stacks, large language model (LLM) application platforms, agent frameworks and enterprise AI assistants. This article examines that body of AI-related software as a whole and compares it to the rest of the vulnerability corpus across 2025 and the first months of 2026: how severe its vulnerabilities are, how likely they are to be exploited, which weaknesses dominate, and who builds the affected software."
https://blog.barracuda.com/2026/08/12/ai-related-software-vulnerabilities--2025-2026

อ้างอิง
Electronic Transactions Development Agency (ETDA)