Cyber Threat Intelligence 20 August 2026

NCSA_THAICERT

Financial Sector

Banks Look For Fraud Signals In Customer Behavior
"Banks are dealing with more fraud in which customers authorize payments after being manipulated by criminals. ThreatMark’s Fraud Readiness Benchmark 2026 describes a banking environment where social engineering, reimbursement requirements and growing case volumes are changing fraud operations. Fifty-five percent of institutions surveyed said social engineering is involved in most of their fraud. Criminals may pose as bank employees or other trusted people to persuade customers to send money."
https://www.helpnetsecurity.com/2026/08/19/threatmark-banking-fraud-prevention-report/

Industrial Sector

Defending Against An Active Threat To Siemens S7 Series PLCs
"The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them."
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
https://www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/
https://therecord.media/nsa-fbi-warns-of-hackers-using-ai-generated-tools-critical-infrastructure
https://cyberscoop.com/hackers-use-ai-target-siemens-plcs-critical-infrastructure/

Vulnerabilities

943 Patches Rolled Out With Oracle’s August 2026 Security Update
"Oracle on Tuesday announced the release of 943 new security patches as part of the August 2026 Critical Security Patch Update (CSPU), its third monthly security rollout. The company’s advisory mentions more than 1,000 unique CVEs across two dozen products, including over 460 vulnerabilities that can be exploited remotely without authentication. The patches for dozens of vulnerabilities address additional security flaws. More than 150 of the security defects are critical-severity bugs, and nearly 90 of them have a CVSS score of 9.8 or higher."
https://www.securityweek.com/943-patches-rolled-out-with-oracles-august-2026-security-update/
Chrome, Firefox Updates Patch Dozens Of Vulnerabilities
"Google and Mozilla on Tuesday announced fresh Chrome and Firefox security updates that address multiple critical- and high-severity vulnerabilities. Firefox 154 was released to the stable channel with patches for 58 CVEs, including 20 high-severity flaws, roughly half of which are memory safety bugs that could be exploited for code execution. Resolved high-severity issues include six use-after-free defects, six privilege escalation vulnerabilities, two information disclosure bugs, one sandbox escape flaw, one site isolation issue, and one mitigation bypass weakness."
https://www.securityweek.com/chrome-firefox-updates-patch-dozens-of-vulnerabilities/
https://www.malwarebytes.com/blog/bugs/2026/08/update-chrome-now-two-critical-vulnerabilities-fixed
CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC And NetScaler Gateway
"On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges. NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality. Because these systems are frequently deployed in enterprise DMZs and exposed to the public internet, authentication bypass vulnerabilities affecting Citrix products are nearly always exploited by threat actors."
https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/
CISA Adds One Known Exploited Vulnerability To Catalog
"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog
Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker At 12 Bits/Second
"Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers, with the JWT intentionally placed in the victim's memory. The research paper stated that no customer data was accessed."
https://thehackernews.com/2026/08/cloudflare-workers-spectre-attack-leaks.html
https://arxiv.org/abs/2608.17043
Yet Another RCE In Gogs, But It's Fixed This Time!
"Gogs is an open-source Git hosting platform like GitHub or GitLab. The application allows users to manage their own repositories and organizations. Under the hood, it relies heavily on the git CLI. There has been a long history of RCE's in Gogs, most taking a while to fix, requiring public disclosure before an officially patched version is even out. This case was different. After a few months of silence, it seems work has started again on securing Gogs by the maintainers, and all our reports were fixed as of version 0.14.3! We hope this trend continues and eventually brings Gogs into a secure state. However, there is currently still one unpatched bypass of a vulnerability we reported that our AI pentest agents found. We provide a manual code patch for that below."
https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813

Malware

Balonx Sistema: The Face Behind The PhaaS Affecting Mexican Banking
"Mexico’s banking infrastructure has emerged as a primary target for sophisticated cyber threats in Latin America, ranking second only to Brazil in banking malware incidents in 2025. This escalation is tightly linked to the rise of Phishing-as-a-Service (PhaaS) platforms, which enable low-capability threat actors to execute industrial-scale financial fraud. More than 20 financial institutions in the country currently face these persistent, subscription-based operational threats. In response to this threat landscape, Group-IB conducted an in-depth technical analysis of Balonx Sistema, a highly structured PhaaS platform developed by an operative based in Mexico."
https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/
Operation CameraSwarm: Over 14,000 Dahua Cameras Compromised Across Ukraine And Russia
"Between 17 June and 22 July 2026, a single operator compromised over 14,000 Dahua IP cameras. The scanning behind it was global: masscan sweeps ran against Russian address space first, then across the full IPv4 range, and the largest single haul actually landed in Mexican and Vietnamese ISP ranges before the operator's focus settled on Russian and CIS telecom netblocks. Where the confirmed, geolocated compromises concentrated was Ukraine and Russia, with Ukraine holding the largest share. This is the second Dahua-related camera compromise operation we've traced back to an exposed operator directory in as many weeks. Where last week's investigation centered on a Russian-speaking operator running a purpose-built platform against 58 cameras, this one is a different scale entirely."
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised
https://www.bleepingcomputer.com/news/security/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/
https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
https://securityaffairs.com/197527/iot/inside-operation-cameraswarm-how-one-actor-took-over-14000-dahua-cameras.html
Describing Attacks With Crime Script Analysis
"Effective defense against cyber attacks requires understanding how attacks are carried out and identifying where the attack can be disrupted or detected. Lockheed Martin’s Cyber Kill Chain was one of the earliest models to describe the steps required to conduct a cyber attack. However, its seven-step linear sequence is too rigid to apply to many attacks. The Attack Flow model of the MITRE ATT&CK framework allows various tactics, techniques, and procedures (TTPs) to be chained together to describe exactly how attacks are conducted, including branches and loops if necessary. The resulting graphs are comprehensive, but can be daunting to a non-technical audience. In a world of evolving threats and shrinking budgets, defenders need techniques to communicate threats to a wider audience."
https://blog.talosintelligence.com/describing-attacks-with-crime-script-analysis/
How Grok Unknowingly Powers Cybercrime
"Our collective safety increasingly depends on frontier AI capabilities being prohibitively expensive for criminals to acquire. Our latest research found that access starts at just $12.99 a month. ‘Kriminal’ is one of the newest and most popular tools in the criminal AI market, and it isn’t hiding on the dark web. It’s living in plain sight on the clearnet, indexed by Google, with a login button and five pricing options. It markets itself as “the AI that answers everything. No filters, no guardrails.” On the surface, Kriminal claims to have done the economically impossible and created a frontier AI from scratch, built by and for cybercriminals. Under the hood its own code reveals that almost nothing is new: no model, no infrastructure, no original capability. It’s a storefront renting intelligence from the same legitimate AI industry it claims to circumvent."
https://www.threatdown.com/blog/kriminal/
https://www.darkreading.com/application-security/no-filter-kriminal-ai-platform-cybercrime-concerns
SilkParasite: Tracking a China-Nexus APT Across Central Asia
"SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously undocumented; we identified and named them: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and professionally engineered, and it carries traces of AI-assisted development."
https://businessinsights.bitdefender.com/silkparasite-tracking-china-nexus-apt-across-central-asia
https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html
https://www.darkreading.com/threat-intelligence/silkparasite-central-asian-orgs-flurry-rats
41 Deceptive Download Sites Show a Real Link, Then Send You Somewhere Else
"We identified a network of 41 websites impersonating popular games and Windows software, all designed to push visitors towards the same Download Studio installer. The sites advertise everything from Counter-Strike, Half-Life, Fallout, Roblox, PUBG, and The Witcher to VLC, 7-Zip, Paint.NET, VMware, Total Commander, and Foxit PDF."
https://www.malwarebytes.com/blog/threat-intel/2026/08/41-deceptive-download-sites-show-a-real-link-then-send-you-somewhere-else
Scammers Are Using Fake Crypto AML Checkers To Drain Your Wallet
"Scammers are creating fake crypto wallet-checking sites that promise to tell you whether a wallet is linked to suspicious activity. Instead, they try to trick you into giving them access to your crypto. AML stands for anti-money laundering. These are rules that require banks and other regulated businesses to screen customers for ties to crime. It’s designed to prevent cybercriminals from hiding or moving illegally obtained money. In the crypto world, this usually means checking whether a wallet address has links to hacks, scams, sanctioned entities, or other suspicious activity based on its transaction history."
https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet
Hunting MacSync Stealer Infrastructure Through Behavioral Pivots
"MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure. Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity."
https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html
https://securityaffairs.com/197514/malware/microsoft-tracks-macsync-stealer-by-its-behavior-not-its-domains.html
Malware-As-a-Service Cocktail: ErrTraffic And Cruciferra - Killing Your EDR Since 2025
"In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. The driver, also known as, "DCRCVDrv.sys", is signed by South Korean IT company MocoMsys and exposes an IOCTL that allows user-mode applications to terminate processes directly from the kernel. The Cruciferra Malware-as-a-Service (MaaS) first appeared in November 2025 and is currently sold for $1200 per month for the package with EDR killing features by the user Cruciferra on underground hacking forums."
https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025
https://www.infosecurity-magazine.com/news/maas-clickfix-errtraffic-cruciferra/
Grandoreiro Goes North: From Brazil To Mexico With a New DLL Sideloading Campaign
"Grandoreiro is a notorious banking trojan that has been operating across Latin America since at least 2016, targeting financial institutions and their customers through phishing campaigns and social engineering techniques. Written in Delphi and Brazilian in origin, it is one of the many of Latin American banking trojans (alongside Guildma, Javali and Melcoz). Over the years, the malware has gone through multiple iterations and infrastructure changes to evade detection and sustain its operations. In January 2024, a coordinated operation led by Brazil's Polícia Federal and coordinated through INTERPOL — with Spanish authorities and private-sector partners — disrupted significant portions of its infrastructure and reduced its overall reach."
https://www.acronis.com/en/tru/posts/grandoreiro-goes-north-from-brazil-to-mexico-with-a-new-dll-sideloading-campaign/
https://www.infosecurity-magazine.com/news/grandoreiro-mexico-dll-sideloading/
A Revisit Of Remote Spectre Attacks On Cloudflare Workers
"In 2021, we assessed remote Spectre attacks against Cloudflare Workers. Based on the results, we shipped a production defense called Dynamic Process Isolation (DyPrIs), which identifies maliciously looking scripts and isolates them into separate processes. Since then, newer techniques in the area of stabilizing Spectre attacks have been discovered. To understand if these techniques posed a threat to our Workers production environment, we decided to internally reassess the remote Spectre attack. Building an updated proof-of-concept on the production environment allowed us to empirically assess the risk of Spectre attacks under production workloads."
https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers/
Ray CVE-2025-62593: Critical Browser-Driven RCE Via DNS Rebinding
"CVE-2025-62593 is a critical remote code execution vulnerability in Ray, a distributed computing framework widely used for Python and machine-learning workloads. The attack combines DNS rebinding with a flawed User-Agent-based browser check. An attacker-controlled webpage can use the victim's browser to reach a locally running Ray Dashboard on port 8265, bypass the browser-request protection, and access the Jobs API without requiring Ray credentials."
https://www.resecurity.com/blog/article/ray-cve-2025-62593-critical-browser-driven-rce-via-dns-rebinding
CopyCop Targets AI Investment In Armenia
"The Russian influence network CopyCop (Storm-1516) very likely targeted the joint United States (US) and Armenian-backed Firebird AI data center in Hrazdan, Armenia, as part of a broader campaign to undermine Armenia's westward geopolitical and economic realignment. Between June 24 and July 13, 2026, Insikt Group documented three separate CopyCop media impersonations targeting the facility ahead of its July 2026 opening. These impersonations fabricated an imminent earthquake risk, cast doubt as to the facility's economic and infrastructure viability, and, most recently, impersonated an official Iranian military communications that justified treating the data center as a legitimate military target. Reach expanded substantially across the three instances, growing from limited initial engagement to over 1.6 million combined views by the third, indicating growing audience viewership as the campaign progressed."
https://www.recordedfuture.com/blog/copycop-targets-ai-investment
PurpleDelta's Fraudulent Employment Operations
"Insikt Group has identified several clusters of activity linked to PurpleDelta, Recorded Future's designation for North Korean IT workers, comprising multiple operators likely based in China. Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors. PurpleDelta operators maintained at least 22 fabricated personas across multiple clusters, some of which were supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service, and were highly likely to be actively employed by at least ten organizations. PurpleDelta operators demonstrate a high operational tempo to this day. In some cases, the operators have applied to at least 60 positions per day across multiple job platforms, used multi-account management browsers and separate Google Chrome profiles to manage distinct personas simultaneously, and maintained detailed tracking spreadsheets to coordinate applications across identities."
https://www.recordedfuture.com/research/purpledelta-fraudulent-employment-operations
https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-nk-2026-0818.pdf
How a Google Search For Claude Led To MacSync
"Picture this: You've just unboxed a shiny new Macbook, and now you're downloading all of your favorite apps. You type "How to install Claude Code on a Mac" in Google and click on the first link at the top of the page. You're presented with the following: Looks legit, right? It's even got a badge stating it's been shared by Apple Support. But look closer. While it's a real page hosted on the actual claude.ai domain, this shared conversation instructs you to paste a curl one-liner into Terminal that ultimately downloads a pernicious infostealer. Instead of Claude, you get MacSync."
https://www.huntress.com/blog/fake-claude-macsync

Breaches/Hacks/Leaks

CareCloud Data Breach Impact Grows To 3.7 Million Individuals
"The recently disclosed CareCloud data breach affects more than 3.7 million individuals, far more than initially believed. The cloud-based healthcare solutions provider revealed in early July that it had detected a network intrusion in mid-March. The breach was discovered following a disruption involving an electronic health record environment. An investigation showed that threat actors gained access to one of CareCloud’s AWS environments between March 10 and March 16. The hackers claimed to have exfiltrated information from databases in the compromised environment, according to the company."
https://www.securityweek.com/carecloud-data-breach-impact-grows-to-3-7-million-individuals/
https://www.bleepingcomputer.com/news/security/healthtech-firm-carecloud-data-breach-impacts-37-million-patients/
https://therecord.media/electronic-health-record-company-carecloud-data-breach
https://www.bankinfosecurity.com/ehr-vendor-notifying-38-million-patients-data-theft-hack-a-32609
Live Stripe Keys For 659 Merchants, Published For Free
"A dataset published on a data-trading forum on 18 August 2026 contains live Stripe API keys for 659 merchant accounts, along with roughly 35 GB of customer and payment data pulled from them. Ransomnews analysed the files offline and reported the exposure to Stripe before publishing. Stripe itself was not compromised. The keys belong to merchants. The listing went up in the early hours of 18 August under a headline claiming a breach of Stripe itself. That framing is wrong, and it matters, so it is worth dealing with first. Nothing in the dataset indicates any failure of Stripe’s own systems. What the files show is 659 merchants whose secret API keys ended up in someone else’s hands, after which that person used the keys the way any developer would, and pulled down everything the API would return."
https://ransomnews.com/stripe-merchant-api-keys-leak-2026/
https://securityaffairs.com/197504/cyber-crime/50000-stripe-secrets-leaked-in-public-code.html
Sakura Internet Hack Exposes Data Of Up To 1.36 Million Accounts
"Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored. In an update today to the initial notification from Monday, the company says the incident may have impacted up to 1,360,563 member accounts. However, as the investigation continues, the exact number of affected accounts remains to be determined."
https://www.bleepingcomputer.com/news/security/sakura-internet-hack-exposes-data-of-up-to-136-million-accounts/
Latvian Officials Resign After Cyberattack Exposes Data On 1.2 Million People
"Latvia’s road traffic agency confirmed that hackers stole data connected to about two-thirds of the country’s population in a major cyberattack that has prompted calls for senior officials to resign. The Road Traffic Safety Directorate, known as CSDD, said Tuesday that its investigation found hackers had accessed data from payment receipts dating back to 2008. The breach affected records belonging to more than 1.2 million people and 200,000 businesses and other legal entities. Latvia has a population of just over 1.8 million. CSDD is the state agency responsible for vehicle registration, driver’s licenses and other road safety services and operates under Latvia’s Transport Ministry."
https://therecord.media/latvia-cyberattack-vehicle-data

General News

UK Fraud Cases Hit Record High In 2026
"Over 220,000 cases were filed with the UK’s National Fraud Database (NFD) between January and June, the highest number ever recorded during the first half of a year, according to Cifas. The non-profit, which runs the NFD and the Insider Threat Database, said identity fraud rose 9% year on year (YoY) to nearly 130,000 cases in the first half of 2026. This figure in turn was driven by scammers targeting bank accounts and plastic cards, which accounted for 68% of all these cases. Impersonation incidents using the victim’s real address increased by 12% YoY."
https://www.infosecurity-magazine.com/news/uk-fraud-cases-hit-record-high/
Password Spraying Attacks Surge 155x As Hackers Exploit MFA Gaps
"Huntress has observed a 155x increase in password spraying attacks in the first half of 2026. Brute force is old news, but the spin driving that spike is new. One major contributor was a campaign targeting Microsoft's Azure CLI, the command-line tool admins use to manage Azure and Entra resources. The traffic originated from an IPv6 range controlled by internet hosting provider LSHIY LLC. The campaign started months earlier, but in mid-June alone Huntress observed more than 81 million related login attempts and 78 account compromises in a two-week window."
https://www.bleepingcomputer.com/news/security/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps/
Rising Number Of Cyberattacks Have AI-Assisted Fingerprints
"Attackers are wielding artificial intelligence tools in semi-autonomous ways to help them perpetrate network intrusions at greater speed and scale than ever before. Their efforts are producing mixed results. "Abuse of AI seems to be business as usual for threat actors now," said Ben Folland, a security researcher at threat intelligence firm Ctrl-Alt-Intel. Proprietary and open-source large language models, often accessed illicitly, are being used to facilitate everything from network penetration and persistent access to data exfiltration and ransomware infections."
https://www.bankinfosecurity.com/rising-number-cyberattacks-have-ai-assisted-fingerprints-a-32602
Back-To-School Cyber Risks Surge As Education Remains The World’s Most Attacked Sector
"As students, teachers and families return to classrooms, campuses and online learning platforms at the end of summer, cyber-criminals are preparing for the new school year as well. According to Check Point Research, the education sector remains the world’s most targeted industry, facing significantly more cyberattacks than any other sector. Between January and July 2026, educational organizations such as colleges and universities, research institutes, and K-12 school systems alike, faced an average of 4,696 weekly cyberattacks per organization, representing an 8% increase compared to the same period in 2025 and more than double the global cross-industry average of 2,150 attacks. Education also ranked highest among all 23 tracked industries, experiencing attack volumes approximately 70% higher than the government sector, the second-most targeted industry."
https://blog.checkpoint.com/research/back-to-school-cyber-risks-surge-as-education-remains-the-worlds-most-attacked-sector/
Staying Ahead Of Adversarial AI Through Agentic Source Code Review
"Adversarial misuse of AI has increased the risk of data theft and extortion events, because when proprietary source code is exposed, defenders must scramble to identify and patch vulnerabilities while attackers deploy machine-speed AI tools against them. By structuring the analysis process, enforcing skeptical validation steps, and injecting domain-specific human expertise directly into the pipeline, we’ve achieved a leap in efficacy. Combining AI models with a deeply structured, human expert-driven orchestration layer to tip the scales so that defenders can beat adversaries to the punch."
https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review
https://www.helpnetsecurity.com/2026/08/19/google-mandiant-avdh-ai-vulnerability-discovery-tool/
Threat Spotlight: The Average Web Application Has 20 Security Vulnerabilities
"The average web application features 20 security vulnerabilities. Information disclosure and brand impersonation vulnerabilities account for 49% of detected flaws — they can help attackers map targets and deceive users. Most web application risk stems from common security oversights rather than sophisticated attacks, highlighting the importance of continuous monitoring, patching and security hygiene."
https://blog.barracuda.com/2026/08/19/average-web-application-20-security-vulnerabilities

อ้างอิง
Electronic Transactions Development Agency (ETDA)