Cyber Threat Intelligence 14 October 2026

NCSA_THAICERT

Industrial Sector

Swann Communications SWIFI-SE2KIC
"Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02

Vulnerabilities

SAP Warns Of Maximum Severity OAuth2 SSRF Security Flaw
"SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services. Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials."
https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/
https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
"Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0."
https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html
Microsoft October 2026 Patch Tuesday Fixes 1,411 Flaws, 3 Zero-Days
"Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing."
https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
https://www.darkreading.com/vulnerabilities-threats/zero-days-microsoft-october-patch-tuesday
A Series Of Unauthenticated Events: Chained Exploitation Of Ivanti Connect Secure Zero-Days
"Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred."
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html
https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
https://www.bankinfosecurity.com/ivanti-vpn-zero-day-exploited-in-active-attacks-a-33094
https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/
https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/
Docker Hub Security Advisory: Personal Access Tokens Transferred During Account-To-Organization Conversions
"On September 30, 2026, security researchers reported a vulnerability in Docker Hub’s identity and access management through our Vulnerability Disclosure Program. We confirmed the report and deployed a fix to production the same afternoon, less than four hours after receiving it. We then reviewed every account conversion back to the date the flaw was introduced, and on October 2, notified every user and organization owner whose account could have been impacted by this vulnerability. This post explains what the vulnerability was, what it could and could not do, what we found, and what we have changed."
https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/
https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/
https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html
Adobe Patches 140 Vulnerabilities Across 10 Products
"Adobe has published 10 new security advisories to inform customers about roughly 140 vulnerabilities found and patched in its products. Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation. A significant number of flaws have been patched by Adobe in the Content Credentials SDK. The product received fixes for 30 vulnerabilities, many described as high-severity issues that can lead to a security feature bypass. Some security holes can be exploited to cause a DoS condition."
https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/
Ghostscript Flaw Lets Hackers Hijack Servers Via PDF Uploads
"A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant's platform Wordfence using their Argus AI-powered system. Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, generate thumbnails for previews, and optimize PDF files by compressing embedded images and removing unnecessary font data."
https://www.bleepingcomputer.com/news/security/ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads/
CISA Adds Two Known Exploited Vulnerabilities To Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://securityaffairs.com/200887/security/u-s-cisa-adds-ivanti-connect-secure-flaw-to-its-known-exploited-vulnerabilities-catalog.html
AI Models May Be Capable Of Self-Replicating Without Access To a Datacenter
"Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested."
https://www.anthropic.com/research/self-replicating-ai
https://www.bleepingcomputer.com/news/security/anthropic-warns-self-replicating-ai-could-spread-to-your-smart-devices/
https://www.darkreading.com/perimeter/anthropic-ingredients-future-ai-worms
https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html
https://www.theregister.com/ai-and-ml/2026/10/13/anthropic-conjures-another-threat-that-doesnt-exist-yet-to-stoke-fears-of-ai-apocalypse/5302866
https://www.securityweek.com/small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-anthropic-warns/
https://securityaffairs.com/200880/ai/anthropic-shows-how-small-ai-models-could-replicate-across-iot-devices.html
Check Point Research Discovers High Risk Vulnerabilities In LiteLLM, One Of The Most Widely Used LLM Gateways
"Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications."
https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/
https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/
SlugFest: Millions Of AI Agents Install Npm Packages Exposed To Malicious Takeover Through GitHub
"AI agents are quietly turning people who’ve never installed a code package into new cogs in the supply-chain risk machine. They’re also supercharging the developers who were already part of it, pulling in far more than they ever used to manually. We wanted to see exactly what that looks like in practice, so we studied how millions of AI agents behave across large enterprises. One number jumped out: the average agent installs 70 packages a month, with some developer endpoints hitting 350 a month. So we asked: what does the next shai-hulud look like? We found a way to take over thousands of packages downloaded by your agents daily - and the worst part - the gap was actively exploitable for 4 months after disclosure."
https://bloom.security/blog/slugfest-millions-of-ai-agents-download-exposed-npm-packages
https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html
https://www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/
LG WebOS Sync-Demo Preauth RCE
"This report covers a fullchain built from sync-demo LG-signed manifest replay client-key issuance bypass, cmp-client interactiveUrl PalmServiceBridge SSRF, and pmlogd collectAllLog targetDir command injection. First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. Finally, collectAllLog inserts targetDir and targetFile into shell command strings. Shell metacharacters in targetDir execute in the root PmLogDaemon context."
https://ssd-disclosure.com/lg-webos-sync-demo-preauth-rce/
https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html
VerCellBreak: How We Escaped Vercel's Hardened Sandbox
"In July, OpenAI's agents escaped their evaluation sandbox and breached Hugging Face. They didn't break through the sandbox walls. The sandbox let them reach a single internal service, a package manager, and the agents made it send internet requests on their behalf. A few weeks later, Vercel opened a bug bounty for its sandbox, covering both network and VM isolation. We went looking for the same pattern, and found it. Vercel built its sandbox to run untrusted code while containing what that code can touch: the host it runs on, and the servers it's allowed to reach."
https://www.air.security/blog-posts/vercel-break
https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out

Malware

RSVP To Disaster: How One Click Installs a RAT
"Imagine receiving a digital invite from a friend or relative. The message looks legitimate; the timing feels believable, and curiosity naturally takes over. This sense of curiosity and trust is exactly what cybercriminals are exploiting. The Cofense Phishing Defense Center (PDC) has recently intercepted a malicious email disguised by an online event invitation. Choosing to RSVP through the attached URLs leads users to a fake event page containing malware that grants threat actors remote access to systems."
https://cofense.com/blog/rsvp-to-disaster-how-one-click-installs-a-rat
“Don’t Get Played”: TOKEN2049 Security Event Faces Remote-Access Scam Allegations
"A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded “Don’t Get Played,” was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names “Apex Accelerator” and “Stone Venture.” According to a police report filed by one attendee with the Singapore Police Force, the organizers allegedly pressured guests to install software that would have handed the organizers remote control of their computers. The allegation first gained traction on X, where several other users claimed they had also been approached by the same group."
https://cyble.com/blog/dont-get-played-token2049-scam-allegations/
Kimsuky’s Operation GitPower Targeting Ukraine Behind The Front Lines Of Russia’s War
"This report analyzes a case in which attack tactics observed in Operation GitPower were used to target Ukrainian experts in diplomacy, security, and international politics. In particular, the threat actor has carried out persistent and relentless attacks against Ukrainian civil society figures working to repair war damage and rebuild the country following Russia’s invasion of Ukraine. This attack is particularly noteworthy as it indicates that Kimsuky has expanded its targeting scope beyond its traditional focus on South Korea to include key individuals in Ukraine. Although cyberattack attempts targeting specific individuals in Ukraine were identified, our investigation found that most of the observed attempts were unsuccessful."
https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower
https://www.darkreading.com/cyberattacks-data-breaches/north-korea-phishes-ukrainians-war-intel
https://therecord.media/north-korea-hackers-russia-ukraine
Scammers Know Your Name, And They’re Counting On You To Reply
"Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations. Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing. The one we got this week was a lot simpler. No suspicious link. No overdue payment. No warning that your account is about to be closed. No fake images. Just your name, followed by a question mark."
https://www.malwarebytes.com/blog/threat-intel/2026/10/your-whos-this-reply-is-exactly-what-text-scammers-want
The Noise Inside The Network: How An Unsophisticated Attack Exposed a Third-Party Risk
"When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They discovered unauthorized VPN-based access attempts that spanned several months. They then engaged Unit 42 to determine the full scope of the intrusion, identify any persistent footholds and secure the environment. While the activity appeared to be a stealthy cyberespionage campaign, the actual intrusion was made possible by gaps in foundational security controls. Rather than relying on novel techniques, the threat actor succeeded through persistence, exploiting weaknesses that stronger identity protections and basic security hygiene could have prevented. The case highlights an important lesson: Sometimes the most damaging intrusions begin with the simplest oversights."
https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/
XWorm Reborn: From Infostealer To Surveillance Platform
"In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. Detection volume remains elevated, with Netskope Threat Labs recording 1,236 events across more than 100 customer organizations in Q3 2026, marking a 4x increase over Q3 2025. The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since. The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States."
https://threatlabs.netskope.com/blog/2026/09/xworm-reborn
https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/

Breaches/Hacks/Leaks

UK Housing Ombudsman Service Investigates 'security Incident'
"The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities, and Local Government. The watchdog settles disputes between social housing residents and social landlords in England, including housing associations, landlords, managers, and letting agents."
https://www.bleepingcomputer.com/news/security/uk-housing-ombudsman-service-investigates-security-incident/
TFG London Cyberattack Disrupts Systems At Hobbs And Whistles Retailers
"TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. The company disclosed earlier today that several IT systems remain unavailable, although physical stores remain open for customers. According to the press release, the incident has not affected the group’s other brands, Inside Story and White Stuff, or its operations in Australia and Africa."
https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/
https://therecord.media/foschini-group-south-africa-cyber
https://www.theregister.com/cyber-crime/2026/10/13/owner-of-fashion-brands-hobbs-and-whistles-joins-autumn-pwned-collection/5302752
Russian Internet Provider SkyNet Reports Outages After Cyberattack Claimed By Ukrainian Hackers
"A major internet provider in Russia's second-largest city, St. Petersburg, has reported days of service disruptions following a cyberattack claimed by a Ukrainian hacking group. SkyNet said in a statement on Friday that its network had been disrupted by a distributed denial-of-service (DDoS) attack since October 6, affecting services including online gaming, voice calls and video conferencing. The company said customers could experience slow connections, high latency and interruptions to audio and video services as it worked to mitigate the attack. It did not say when normal operations would resume."
https://therecord.media/russian-internet-provider-skynet-reports-outages-ddos

General News

Enterprises Struggle To Track AI Agent Actions
"Nearly half of organizations say an artificial intelligence agent may have taken an action in the past year that the business did not intend, expect or authorize, new research shows. AI agents are moving into business operations faster than many companies can track their actions or stop them when something goes wrong, creating a growing challenge for technology leaders. The AI and API Security Trends 2026 (H2) report from cybersecurity vendor Salt Security found that nearly half of respondents confirmed or suspected an unintended agent action. Among that group, 54% reported an external API call or transaction, half reported a configuration or permission change and 42% reported that data was modified or deleted. Respondents could select more than one outcome."
https://www.bankinfosecurity.com/enterprises-struggle-to-track-ai-agent-actions-a-33096
The Department Of Justice Announces Results Of Law Enforcement And Private Industry Joint Disruption Week Targeting Online Scam Accounts And Transnational Criminal Networks Operating In West Africa
"Transnational criminal scam networks operating from West Africa suffered major disruptions last week during a coordinated international “Joint Disruption Week,” an effort that produced arrests, seizures, and the largest-ever takedown of fraudulent social media accounts linked to scam centers in the region, announced the Department of Justice. “Criminals beware: Law enforcement from around the world are working together, and with private industry, to find you, stop your schemes, and bring you to justice,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “The Criminal Division’s Cyber-Enabled Scam Initiative (CSI) was built for this brand of collaboration. The millions of bogus social media accounts taken down and dozens of arrests that took place as part of Joint Disruption Week are just the beginning."
https://www.justice.gov/opa/pr/department-justice-announces-results-law-enforcement-and-private-industry-joint-disruption
https://therecord.media/ghana-nigeria-scam-centers-raided-uk-us
https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/
Be a Good AI Ancestor: Cybersecurity Already Gave Us The Playbook
"AI has brought us to a familiar inflection point in the story of privacy, cybersecurity, and online safety. We have an opportunity to apply decades of cybersecurity experience before the next generation of technology creates consequences we cannot easily reverse. I learned the importance of that responsibility through a three-year-old child I’ll call Adia. Her name is a protective pseudonym."
https://www.helpnetsecurity.com/2026/10/13/cybersecurity-ai-safety-red-lines/
Most High-Severity Cloud Security Findings Are Downgraded Once An AI Agent Checks The Environment
"Cloud security platforms turn every failed rule into a finding, and those findings pile up in queues sorted by severity. Research from Sola Security tested what happens to that order when each finding gets checked against the environment where it lives. The researchers, Leon Goldberg and Gal Engelberg, built an AI agent that re-grades findings raised by third-party cloud security platforms. They ran it on 9,967 HIGH findings from two commercial platforms in eight production environments, and the agent changed the grade of 75.1% of them. Most moved down (58.5%), and 16.6% moved up."
https://www.helpnetsecurity.com/2026/10/13/cloud-security-findings-severity-ai-agent/
https://arxiv.org/pdf/2610.08895
The Enterprise Threat Intelligence Report: 2026
"Threat intelligence teams are heading into 2027 with more than ever to monitor, driven by an acceleration in the AI threat landscape. However, their expanded mandate typically doesn’t come with a proportional budget windfall. Instead, teams are under pressure to get greater value from the intelligence, systems, and analyst expertise already available to them. New independent research commissioned by Flashpoint shows where that pressure is being felt most. Alert noise and false positives are the most frequently cited challenges affecting threat intelligence program effectiveness, followed by analyst bandwidth, changes in the threat landscape, and integration across security tools. At the same time, AI-related threats have emerged as the leading area where practitioners want to expand intelligence coverage."
https://flashpoint.io/blog/enterprise-threat-intelligence-report-2026/
https://www.infosecurity-magazine.com/news/defenders-skeptical-agentic-ai/
Fifth Of CISOs Take Time Off To Avoid Patch Tuesday
"One-in-five cybersecurity leaders has either called in sick or deliberately booked holiday time off to avoid Patch Tuesday, according to new data from Socura. The MDR specialist polled 500 UK CSOs, CISOs and heads of IT security to better understand their attitudes to AI and the once-a-month date where Microsoft, Adobe and other vendors release their latest security updates. While a plurality (41%) revealed that they have worked overtime to manage the patching cycle and over a third (37%) claimed they’ve worked late to deploy patches, a significant 22% said they have tried to swerve the date altogether."
https://www.infosecurity-magazine.com/news/fifth-cisos-take-time-off-avoid/
A Five-Step Framework To Sufficient Realism In Cyber Simulations
"In late August 2026, the Army’s chief of Network Command (NETCOM) announced that to take full advantage of artificial intelligence (AI), the Army needed a comprehensive simulation of its networks. While acknowledging the difficulty in building a digital twin, Maj. Gen. Jacqueline Denise McPhail stated in Breaking Defense that a simulation would create “an ultra-realistic training ground for network operators, cyber defenders, and AI algorithms on how the network works and how to keep it working, even when under attack.” Since 2017, the SEI has been developing and expanding the GHOSTS framework as a platform for simulating complex human, organizational, and machine behavior for cyber-training simulations. It began with simulated users operating real applications on hosts, producing the traffic, logs, files, browser history, and other artifacts defenders expect to encounter."
https://www.sei.cmu.edu/blog/a-five-step-framework-to-sufficient-realism-in-cyber-simulations/
Two Arrested As DOJ Takes Down Laptop Farms Responsible For $3 Million In North Korean Revenue
"The Department of Justice disrupted multiple laptop farms across Texas allegedly being used by North Korean nationals to facilitate an IT worker scheme that allows the country to earn millions from U.S. companies. The laptop farm raids, which were conducted September 21-25, targeted more than 40 residences, the DOJ said. Law enforcement seized 187 laptops and other devices used by North Koreans. Such schemes have earned millions over the last eight years by tricking U.S. companies into hiring workers remotely into lucrative IT roles through stolen or purchased identities."
https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas
https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/
What To Do When a Data Breach Notice Doesn't Say Much
"Publicly reported data breaches hit an all-time high in the US last year, with over 3,300 incidents recorded and nearly 280 million victim notices mailed out. But are all of these worth the paper they’re written on? Increasingly, they lack crucial details. As the volume of data breach incidents increases, there’s a growing chance that you’ll be caught up in one. According to the non-profit Identity Theft Resource Center (ITRC), over 471 million victim notices went out in the first half of 2026 alone. Yet just a quarter (24%) contained details about the attack vector. That’s the lowest ever rate recorded by the ITRC."
https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/
AI Turns Familiar Cyberattacks Into a Race Against Time
"In the AI era, phishing remains the top attack vector in both use (17% of breaches) and breach costs (averaging at $5.29 per breach) according to the IBM Cost of a Data Breach Report 2026. AI creates more personalized content for phishing with higher success rates. At the same time, AI can identify vulnerabilities, use the phished entry point and elevate privileges for lateral movement at greater speed. None of this is new – cyberattacks haven’t changed with AI. “It just allows attackers to do the same familiar things much faster and at greater scale than ever before. The pressure comes from minimizing the time for defenders to respond,” says Steve Wallin, director of core integration and R&D labs leader at IBM UK."
https://www.securityweek.com/ai-turns-familiar-cyberattacks-into-a-race-against-time/
Statistical Report On Malware Targeting Linux SSH Servers In The Third Quarter Of 2026
"The AhnLab SEcurity intelligence Center (ASEC) collected attack logs targeting poorly managed Linux SSH servers through honeypots. This report compiles statistics by categorizing the attack sources identified in the third quarter of 2026, the attacks carried out from those sources, and the malware used."
https://asec.ahnlab.com/en/95808/
Q3 2026 Statistical Report On Malware Targeting Windows Database Servers
"The AhnLab SEcurity intelligence Center (ASEC) observed and classified attacks targeting MS-SQL servers and MySQL servers installed on Windows operating systems via the ASD infrastructure. This report summarizes the damage status, attack status, and the types of malware used in the attacks, based on logs identified in the third quarter of 2026."
https://asec.ahnlab.com/en/95809/

อ้างอิง
Electronic Transactions Development Agency (ETDA)