Financial Sector

• Russian Police Bust Bank-Account Hacking Gang That Used NFCGate-Based Malware
  "Russian police said they have dismantled a criminal group that stole millions from bank customers using malware built on NFCGate, a legitimate open-source tool increasingly exploited by cybercriminals worldwide. According to Russia’s Interior Ministry, police detained several suspected members of the group — including the developer and main administrator of the malicious tool — late last week. The ministry did not identify the malware variant."
  https://therecord.media/russian-police-bust-banking-hackers-nfcgate-based-malware

New Tooling

• The Bastion: Open-Source Access Control For Complex Infrastructure
  "Operational teams know that access sprawl grows fast. Servers, virtual machines and network gear all need hands-on work and each new system adds more identities to manage. A bastion host tries to bring order to this problem. It acts as a single entry point for sysadmins and developers who connect to infrastructure through ssh. This model is old in theory, but The Bastion open-source project shows how far a purpose-built access layer can go."
  https://www.helpnetsecurity.com/2025/12/08/open-source-bastion-host-security/
  https://github.com/ovh/the-bastion

Vulnerabilities

• Attackers Actively Exploiting Critical Vulnerability In Sneeit Framework Plugin
  "On June 10th, 2025, we received a submission for a Remote Code Execution vulnerability in Sneeit Framework, a WordPress plugin with an estimated 1,700 active installations. The plugin is bundled in multiple premium themes. This vulnerability can be leveraged to execute code remotely. The vendor released the patched version on August 5th, 2025, and we publicly disclosed this vulnerability in the Wordfence Intelligence Vulnerability Database on November 24th, 2025. Our records indicate that attackers started exploiting the issue the same day on November 24th, 2025. The Wordfence Firewall has already blocked over 131,000 exploit attempts targeting this vulnerability."
  https://www.wordfence.com/blog/2025/12/attackers-actively-exploiting-critical-vulnerability-in-sneeit-framework-plugin/
  https://thehackernews.com/2025/12/sneeit-wordpress-rce-exploited-in-wild.html
• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability
  CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2025/12/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
• Prompt Injection Is Not SQL Injection (it May Be Worse)
  "The term ‘prompt injection’ was coined in 2022 to describe a new class of application vulnerability in genAI applications. Prompt injection is where developers concatenate their own instructions with untrusted content in a single prompt, and then treat the model’s response as if there were a robust boundary between ‘what the app asked for’ and anything in the untrusted content. Whilst initially reported as command execution, the underlying issue has turned out to be more fundamental than classic client/server vulnerabilities. Current large language models (LLMs) simply do not enforce a security boundary between instructions and data inside a prompt."
  https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
  https://cyberscoop.com/uk-warns-ai-prompt-injection-unfixable-security-flaw/

Malware

• The VS Code Malware That Captures Your Screen
  "Over the past year we've detected dozens of malicious VS Code extensions. Most steal credentials or mine crypto. But this malware goes further - it captures your screen and sends it to the attacker. Your code. Your emails. Your Slack DMs. Whatever's on your screen, they're seeing it too. And that's just the start. It also steals your WiFi passwords, reads your clipboard, and hijacks your browser sessions. All delivered through two extensions - a color theme and an AI coding assistant. Both from the same publisher."
  https://www.koi.ai/blog/the-vs-code-malware-that-captures-your-screen
  https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-on-microsofts-registry-drop-infostealers/
• Cydome Research Team Identified "Broadside", A New Mirai Botnet Variant, Active In The Wild
  "Cydome’s Cybersecurity Research Team has identified an active campaign of a new variant of the Mirai botnet, designated as “Broadside”. This campaign targets the maritime logistics sector, exploiting a critical-severity vulnerability (CVE-2024-3721) in TBK DVR (Digital Video Recorders) devices in use by shipping companies on vessels (among others). Cydome has been tracking the associated infrastructure over the past months, observing that active IPs rise and fall in alignment with the campaign’s activity."
  https://cydome.io/cydome-identifies-broadside-a-new-mirai-botnet-variant-targeting-maritime-iot/
  https://www.darkreading.com/threat-intelligence/broadside-mirai-variant-maritime-logistics
• Inside Shanya, a Packer-As-a-Service Fueling Modern Attacks
  "We have covered packer-as-a-service offerings from the computer underworld in the past, previously dissecting impersonation campaigns and the rise of HeartCrypt, both popular among ransomware groups. However, it is a fast-changing landscape, and now we are watching a new incarnation of the same type of service: the Shanya crypter — already favored by ransomware groups and taking over (to some degree) the role that HeartCrypt has played in the ransomware toolkit. We’ll look at its apparent origins, unpack the code, and examine a targeted infection leveraging this tool. Sophos protections against this specific packer are covered at the end of the article."
  https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/
  https://www.bleepingcomputer.com/news/security/ransomware-gangs-turn-to-shanya-exe-packer-to-hide-edr-killers/
• Bellerophon Could Never Have Imagined. The ChimeraWire Trojan Boosts Website Popularity By Skillfully Pretending To Be Human
  "While analyzing one of the affiliate programs, Doctor Web’s experts discovered a unique piece of malware with clicker functionality and dubbed it Trojan.ChimeraWire. This malware targets computers running Microsoft Windows and is based on the open-source projects zlsgo and Rod for automated website and web application management. Trojan.ChimeraWire allows cybercriminals to simulate user actions and boost the behavioral factor of websites by artificially increasing their rankings in search engine results. For this, the malicious app searches target Internet resources in the Google and Bing search engines and then loads them."
  https://news.drweb.com/show/?i=15090&lng=en
  https://hackread.com/chrimerawire-trojan-fakes-chrome-search-activity/
• JS#SMUGGLER: Multi-Stage - Hidden Iframes, Obfuscated JavaScript, Silent Redirectors & NetSupport RAT Delivery
  "The Securonix Threat Research team has analyzed a sophisticated web-based multi-stage malware campaign. The attack chain unfolds across three distinct stages: (1) an obfuscated JavaScript loader injected into a compromised website, (2) a stealthy HTA (HTML Application) that executes encrypted PowerShell stagers via mshta.exe, and (3) a final PowerShell payload that downloads, extracts, executes, and establishes persistence for a Windows-based remote access Trojan."
  https://www.securonix.com/blog/jssmuggler-multi-stage-hidden-iframes-obfuscated-javascript-silent-redirectors-netsupport-rat-delivery/
  https://thehackernews.com/2025/12/experts-confirm-jssmuggler-uses.html
  https://hackread.com/jssmuggler-netsupport-rat-infected-sites/
• How Phishers Hide Banking Scams Behind Free Cloudflare Pages
  "During a recent investigation, we uncovered a phishing operation that combines free hosting on developer platforms with compromised legitimate websites to build convincing banking and insurance login portals. These fake pages don’t just grab a username and password–they also ask for answers to secret questions and other “backup” data that attackers can use to bypass multi-factor authentication and account recovery protections."
  https://www.malwarebytes.com/blog/news/2025/12/how-phishers-hide-banking-scams-behind-free-cloudflare-pages
• AI-Automated Threat Hunting Brings GhostPenguin Out Of The Shadows
  "Hunting high-impact, advanced malware is a difficult task. It becomes even harder and more time-consuming when defenders focus on low-detection or zero-detection samples. Every day, a huge number of files are sent to platforms like VirusTotal, and the relevant ones often get lost in all that noise. Identifying malware with low or no detections is a particularly challenging process, especially when the malware is new, undocumented, and built largely from scratch. When threat actors avoid publicly available libraries, known GitHub code, or code borrowed from other malware families, they create previously unseen samples that can evade detection and make hunting them significantly harder."
  https://www.trendmicro.com/en_us/research/25/l/ghostpenguin.html
• LockBit 5.0 Infrastructure Exposed In New Server, IP, And Domain Leak
  "LockBit 5.0 key infrastructure exposed, revealing the IP address 205[.]185[.]116[.]233, and the domain karma0[.]xyz is hosting the ransomware group’s latest leak site. According to researcher Rakesh Krishnan, hosted under AS53667 (PONYNET, operated by FranTech Solutions), a network frequently abused for illicit activities, the server displays a DDoS protection page branded with “LOCKBITS.5.0,” confirming its role in the group’s operations. This operational security lapse arrives amid LockBit’s resurgence with enhanced malware capabilities.​"
  https://cybersecuritynews.com/lockbit-5-0-infrastructure-exposed/

Breaches/Hacks/Leaks

• Space Bears Ransomware Claims Comcast Data Theft Through Quasar Breach
  "Space Bears ransomware group is claiming that it obtained internal Comcast material by exploiting a breach at Quasar Inc., a telecommunications engineering contractor based in Georgia. The claims were published on the group’s dark web leak site. The same leak site also lists Quasar as an independent victim, which indicates the group is presenting two connected incidents rather than a single combined breach."
  https://hackread.com/space-bears-ransomware-comcast-quasar-breach/
• Tri-Century Eye Care Data Breach Impacts 200,000 Individuals
  "A recently disclosed Tri-Century Eye Care data breach affects roughly 200,000 individuals, according to the healthcare data breach tracker maintained by the US Department of Health and Human Services (HHS). Tri-Century Eye Care provides comprehensive eye care services at several locations in Bucks County, Pennsylvania. In a data security incident notice posted on its website in late October, Tri-Century Eye Care informed patients and employees that their personal and protected health information may have been compromised as a result of a breach detected on September 3."
  https://www.securityweek.com/tri-century-eye-care-data-breach-impacts-200000-individuals/

General News

• FinCEN Says Ransomware Gangs Extorted Over $2.1B From 2022 To 2024
  "A new report by the Financial Crimes Enforcement Network (FinCEN) shows that ransomware activity peaked in 2023 before falling in 2024, following a series of law enforcement actions targeting the ALPHV/BlackCat and LockBit ransomware gangs. From thousands of Bank Secrecy Act filings, the report documents 4,194 ransomware incidents between January 2022 and December 2024. These reports show that organizations paid more than $2.1 billion in ransom payments, nearly reaching the total reported over 8 years from 2013 to 2021."
  https://www.bleepingcomputer.com/news/security/fincen-says-ransomware-gangs-extorted-over-21b-from-2022-to-2024/
  https://www.fincen.gov/system/files/2025-12/FTA-Ransomware.pdf
  https://therecord.media/fincen-treasury-2-billion-ransomware-payments-report
  https://www.darkreading.com/cyberattacks-data-breaches/us-treasury-45b-ransom-payments-2013
  https://cyberscoop.com/ransomware-payments-decline-2024-fincen/
  https://www.securityweek.com/ransomware-payments-surpassed-4-5-billion-us-treasury/
  https://securityaffairs.com/185465/cyber-crime/fincen-data-shows-4-5b-in-ransomware-payments-record-spike-in-2023.html
• Poland Arrests Ukrainians Utilizing 'advanced' Hacking Equipment
  "The police in Poland arrested three Ukrainian nationals for allegedly attempting to damage IT systems in the country using hacking equipment and for obtaining "computer data of particular importance to national defense." The three men, aged between 39 and 43, could not explain why they were carrying the electronic devices. They now face charges of fraud, computer fraud, and possession of devices and software intended for criminal activity. According to the police, the Ukrainians "were visibly nervous" when officers stopped them and said they were heading to Lithuania while traveling around Europe."
  https://www.bleepingcomputer.com/news/security/poland-arrests-ukrainians-utilizing-advanced-hacking-equipment/
• Cyber Threats To The U.S.: What Policymakers Need To Know For 2026
  "Cyber attacks against the United States are no longer isolated events or technical headaches. They are now powerful tools of national strategy used by foreign governments, criminal networks, and ideological groups. A new report explains how these attacks have changed from simple hacks into coordinated campaigns aimed at shaping global politics, weakening U.S. institutions, and putting pressure on American decision-makers. This blog highlights the key takeaways for leaders responsible for national security, public policy, and critical infrastructure resilience."
  https://blog.checkpoint.com/executive-insights/cyber-threats-to-the-u-s-what-policymakers-need-to-know-for-2026/
  https://l.cyberint.com/threats-to-the-homeland-report
• NVIDIA Research Shows How Agentic AI Fails Under Attack
  "Enterprises are rushing to deploy agentic systems that plan, use tools, and make decisions with less human guidance than earlier AI models. This new class of systems also brings new kinds of risk that appear in the interactions between models, tools, data sources, and memory stores. A research team from NVIDIA and Lakera AI has released a safety and security framework that tries to map these risks and measure them inside real workflows. The work includes a new taxonomy, a dynamic evaluation method, and a detailed case study of NVIDIA’s AI-Q Research Assistant. The authors also released a dataset with more than ten thousand traces from attack and defense runs to support outside research."
  https://www.helpnetsecurity.com/2025/12/08/nvidia-agentic-ai-security-framework/
  https://arxiv.org/pdf/2511.21990
• Invisible IT Is Becoming The Next Workplace Priority
  "IT leaders want their employees to work without running into digital hurdles, but many still struggle with fragmented systems that slow teams down. A new report from Lenovo sheds light on how widespread the problem has become and what organizations can do to reduce workplace friction. Hybrid work pushed companies to adopt new tools, devices and management platforms at speed. According to the research, enterprises now manage an average of 897 applications, but only 28 percent are integrated. The report notes that this patchwork environment strains both workers and support teams, since employees must move across several systems before they can resolve problems or complete simple tasks."
  https://www.helpnetsecurity.com/2025/12/08/invisible-it-workplace-priority/
• CISOs Are Spending Big And Still Losing Ground
  "Security leaders are entering another budget cycle with more money to work with, but many still feel no safer. A new benchmark study from Wiz shows a widening gap between investment and impact. Budgets keep rising, cloud programs keep expanding, and AI is reshaping both threats and defenses. Still, CISOs say the fundamentals of risk reduction are not improving fast enough."
  https://www.helpnetsecurity.com/2025/12/08/wiz-cybersecurity-spending-priorities-report/
• CISO Conversations: Keith McCammon, CSO And Co-Founder At Red Canary
  "Keith McCammon was a technologist first and security guru second. He has never received any formal training in cybersecurity; but a love of technology and pleasure in solving puzzles naturally led into the subject, learning on the journey. Kyrus Tech, now owned by Sixgen, was the source of both Carbon Black and Red Canary (now a Zscaler company)."
  https://www.securityweek.com/ciso-conversations-keith-mccammon-cso-and-co-founder-at-red-canary/
• Three Hacking Groups, Two Vulnerabilities And All Eyes On China
  "On the main stage at the Pwn2Own hacking competition in Berlin this March, researchers demonstrated it was possible to remotely compromise sensitive information via Microsoft’s on-premise SharePoint software — the first glimpse that the world got of two dangerous software vulnerabilities threatening governments and enterprises around the globe."
  https://therecord.media/three-hacking-groups-two-vulnerabilities-china-microsoft
• Officials Offer $10M Reward For Information On IRGC-Linked Leader And Close Associate
  "The State Department is seeking help to locate a pair of hackers allegedly working for Shahid Shushtari, a malicious cyber unit operating under Iran’s Revolutionary Guard Corps Cyber-Electronic Command. Officials are offering a reward up to $10 million for information about Mohammad Bagher Shirinkar and Fatemeh Sedighian Kashi. “Help us take the smile off their faces,” the State Department’s Rewards for Justice program posted in a bulletin about the reward on social media last week."
  https://cyberscoop.com/shahid-shushtari-iran-cyber-electronic-command-10m-reward/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Financial Sector

• Russian Police Bust Bank-Account Hacking Gang That Used NFCGate-Based Malware
  "Russian police said they have dismantled a criminal group that stole millions from bank customers using malware built on NFCGate, a legitimate open-source tool increasingly exploited by cybercriminals worldwide. According to Russia’s Interior Ministry, police detained several suspected members of the group — including the developer and main administrator of the malicious tool — late last week. The ministry did not identify the malware variant."
  https://therecord.media/russian-police-bust-banking-hackers-nfcgate-based-malware

New Tooling

• The Bastion: Open-Source Access Control For Complex Infrastructure
  "Operational teams know that access sprawl grows fast. Servers, virtual machines and network gear all need hands-on work and each new system adds more identities to manage. A bastion host tries to bring order to this problem. It acts as a single entry point for sysadmins and developers who connect to infrastructure through ssh. This model is old in theory, but The Bastion open-source project shows how far a purpose-built access layer can go."
  https://www.helpnetsecurity.com/2025/12/08/open-source-bastion-host-security/
  https://github.com/ovh/the-bastion

Vulnerabilities

• Attackers Actively Exploiting Critical Vulnerability In Sneeit Framework Plugin
  "On June 10th, 2025, we received a submission for a Remote Code Execution vulnerability in Sneeit Framework, a WordPress plugin with an estimated 1,700 active installations. The plugin is bundled in multiple premium themes. This vulnerability can be leveraged to execute code remotely. The vendor released the patched version on August 5th, 2025, and we publicly disclosed this vulnerability in the Wordfence Intelligence Vulnerability Database on November 24th, 2025. Our records indicate that attackers started exploiting the issue the same day on November 24th, 2025. The Wordfence Firewall has already blocked over 131,000 exploit attempts targeting this vulnerability."
  https://www.wordfence.com/blog/2025/12/attackers-actively-exploiting-critical-vulnerability-in-sneeit-framework-plugin/
  https://thehackernews.com/2025/12/sneeit-wordpress-rce-exploited-in-wild.html
• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability
  CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2025/12/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
• Prompt Injection Is Not SQL Injection (it May Be Worse)
  "The term ‘prompt injection’ was coined in 2022 to describe a new class of application vulnerability in genAI applications. Prompt injection is where developers concatenate their own instructions with untrusted content in a single prompt, and then treat the model’s response as if there were a robust boundary between ‘what the app asked for’ and anything in the untrusted content. Whilst initially reported as command execution, the underlying issue has turned out to be more fundamental than classic client/server vulnerabilities. Current large language models (LLMs) simply do not enforce a security boundary between instructions and data inside a prompt."
  https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
  https://cyberscoop.com/uk-warns-ai-prompt-injection-unfixable-security-flaw/

Malware

• The VS Code Malware That Captures Your Screen
  "Over the past year we've detected dozens of malicious VS Code extensions. Most steal credentials or mine crypto. But this malware goes further - it captures your screen and sends it to the attacker. Your code. Your emails. Your Slack DMs. Whatever's on your screen, they're seeing it too. And that's just the start. It also steals your WiFi passwords, reads your clipboard, and hijacks your browser sessions. All delivered through two extensions - a color theme and an AI coding assistant. Both from the same publisher."
  https://www.koi.ai/blog/the-vs-code-malware-that-captures-your-screen
  https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-on-microsofts-registry-drop-infostealers/
• Cydome Research Team Identified "Broadside", A New Mirai Botnet Variant, Active In The Wild
  "Cydome’s Cybersecurity Research Team has identified an active campaign of a new variant of the Mirai botnet, designated as “Broadside”. This campaign targets the maritime logistics sector, exploiting a critical-severity vulnerability (CVE-2024-3721) in TBK DVR (Digital Video Recorders) devices in use by shipping companies on vessels (among others). Cydome has been tracking the associated infrastructure over the past months, observing that active IPs rise and fall in alignment with the campaign’s activity."
  https://cydome.io/cydome-identifies-broadside-a-new-mirai-botnet-variant-targeting-maritime-iot/
  https://www.darkreading.com/threat-intelligence/broadside-mirai-variant-maritime-logistics
• Inside Shanya, a Packer-As-a-Service Fueling Modern Attacks
  "We have covered packer-as-a-service offerings from the computer underworld in the past, previously dissecting impersonation campaigns and the rise of HeartCrypt, both popular among ransomware groups. However, it is a fast-changing landscape, and now we are watching a new incarnation of the same type of service: the Shanya crypter — already favored by ransomware groups and taking over (to some degree) the role that HeartCrypt has played in the ransomware toolkit. We’ll look at its apparent origins, unpack the code, and examine a targeted infection leveraging this tool. Sophos protections against this specific packer are covered at the end of the article."
  https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/
  https://www.bleepingcomputer.com/news/security/ransomware-gangs-turn-to-shanya-exe-packer-to-hide-edr-killers/
• Bellerophon Could Never Have Imagined. The ChimeraWire Trojan Boosts Website Popularity By Skillfully Pretending To Be Human
  "While analyzing one of the affiliate programs, Doctor Web’s experts discovered a unique piece of malware with clicker functionality and dubbed it Trojan.ChimeraWire. This malware targets computers running Microsoft Windows and is based on the open-source projects zlsgo and Rod for automated website and web application management. Trojan.ChimeraWire allows cybercriminals to simulate user actions and boost the behavioral factor of websites by artificially increasing their rankings in search engine results. For this, the malicious app searches target Internet resources in the Google and Bing search engines and then loads them."
  https://news.drweb.com/show/?i=15090&lng=en
  https://hackread.com/chrimerawire-trojan-fakes-chrome-search-activity/
• JS#SMUGGLER: Multi-Stage - Hidden Iframes, Obfuscated JavaScript, Silent Redirectors & NetSupport RAT Delivery
  "The Securonix Threat Research team has analyzed a sophisticated web-based multi-stage malware campaign. The attack chain unfolds across three distinct stages: (1) an obfuscated JavaScript loader injected into a compromised website, (2) a stealthy HTA (HTML Application) that executes encrypted PowerShell stagers via mshta.exe, and (3) a final PowerShell payload that downloads, extracts, executes, and establishes persistence for a Windows-based remote access Trojan."
  https://www.securonix.com/blog/jssmuggler-multi-stage-hidden-iframes-obfuscated-javascript-silent-redirectors-netsupport-rat-delivery/
  https://thehackernews.com/2025/12/experts-confirm-jssmuggler-uses.html
  https://hackread.com/jssmuggler-netsupport-rat-infected-sites/
• How Phishers Hide Banking Scams Behind Free Cloudflare Pages
  "During a recent investigation, we uncovered a phishing operation that combines free hosting on developer platforms with compromised legitimate websites to build convincing banking and insurance login portals. These fake pages don’t just grab a username and password–they also ask for answers to secret questions and other “backup” data that attackers can use to bypass multi-factor authentication and account recovery protections."
  https://www.malwarebytes.com/blog/news/2025/12/how-phishers-hide-banking-scams-behind-free-cloudflare-pages
• AI-Automated Threat Hunting Brings GhostPenguin Out Of The Shadows
  "Hunting high-impact, advanced malware is a difficult task. It becomes even harder and more time-consuming when defenders focus on low-detection or zero-detection samples. Every day, a huge number of files are sent to platforms like VirusTotal, and the relevant ones often get lost in all that noise. Identifying malware with low or no detections is a particularly challenging process, especially when the malware is new, undocumented, and built largely from scratch. When threat actors avoid publicly available libraries, known GitHub code, or code borrowed from other malware families, they create previously unseen samples that can evade detection and make hunting them significantly harder."
  https://www.trendmicro.com/en_us/research/25/l/ghostpenguin.html
• LockBit 5.0 Infrastructure Exposed In New Server, IP, And Domain Leak
  "LockBit 5.0 key infrastructure exposed, revealing the IP address 205[.]185[.]116[.]233, and the domain karma0[.]xyz is hosting the ransomware group’s latest leak site. According to researcher Rakesh Krishnan, hosted under AS53667 (PONYNET, operated by FranTech Solutions), a network frequently abused for illicit activities, the server displays a DDoS protection page branded with “LOCKBITS.5.0,” confirming its role in the group’s operations. This operational security lapse arrives amid LockBit’s resurgence with enhanced malware capabilities.​"
  https://cybersecuritynews.com/lockbit-5-0-infrastructure-exposed/

Breaches/Hacks/Leaks

• Space Bears Ransomware Claims Comcast Data Theft Through Quasar Breach
  "Space Bears ransomware group is claiming that it obtained internal Comcast material by exploiting a breach at Quasar Inc., a telecommunications engineering contractor based in Georgia. The claims were published on the group’s dark web leak site. The same leak site also lists Quasar as an independent victim, which indicates the group is presenting two connected incidents rather than a single combined breach."
  https://hackread.com/space-bears-ransomware-comcast-quasar-breach/
• Tri-Century Eye Care Data Breach Impacts 200,000 Individuals
  "A recently disclosed Tri-Century Eye Care data breach affects roughly 200,000 individuals, according to the healthcare data breach tracker maintained by the US Department of Health and Human Services (HHS). Tri-Century Eye Care provides comprehensive eye care services at several locations in Bucks County, Pennsylvania. In a data security incident notice posted on its website in late October, Tri-Century Eye Care informed patients and employees that their personal and protected health information may have been compromised as a result of a breach detected on September 3."
  https://www.securityweek.com/tri-century-eye-care-data-breach-impacts-200000-individuals/

General News

• FinCEN Says Ransomware Gangs Extorted Over $2.1B From 2022 To 2024
  "A new report by the Financial Crimes Enforcement Network (FinCEN) shows that ransomware activity peaked in 2023 before falling in 2024, following a series of law enforcement actions targeting the ALPHV/BlackCat and LockBit ransomware gangs. From thousands of Bank Secrecy Act filings, the report documents 4,194 ransomware incidents between January 2022 and December 2024. These reports show that organizations paid more than $2.1 billion in ransom payments, nearly reaching the total reported over 8 years from 2013 to 2021."
  https://www.bleepingcomputer.com/news/security/fincen-says-ransomware-gangs-extorted-over-21b-from-2022-to-2024/
  https://www.fincen.gov/system/files/2025-12/FTA-Ransomware.pdf
  https://therecord.media/fincen-treasury-2-billion-ransomware-payments-report
  https://www.darkreading.com/cyberattacks-data-breaches/us-treasury-45b-ransom-payments-2013
  https://cyberscoop.com/ransomware-payments-decline-2024-fincen/
  https://www.securityweek.com/ransomware-payments-surpassed-4-5-billion-us-treasury/
  https://securityaffairs.com/185465/cyber-crime/fincen-data-shows-4-5b-in-ransomware-payments-record-spike-in-2023.html
• Poland Arrests Ukrainians Utilizing 'advanced' Hacking Equipment
  "The police in Poland arrested three Ukrainian nationals for allegedly attempting to damage IT systems in the country using hacking equipment and for obtaining "computer data of particular importance to national defense." The three men, aged between 39 and 43, could not explain why they were carrying the electronic devices. They now face charges of fraud, computer fraud, and possession of devices and software intended for criminal activity. According to the police, the Ukrainians "were visibly nervous" when officers stopped them and said they were heading to Lithuania while traveling around Europe."
  https://www.bleepingcomputer.com/news/security/poland-arrests-ukrainians-utilizing-advanced-hacking-equipment/
• Cyber Threats To The U.S.: What Policymakers Need To Know For 2026
  "Cyber attacks against the United States are no longer isolated events or technical headaches. They are now powerful tools of national strategy used by foreign governments, criminal networks, and ideological groups. A new report explains how these attacks have changed from simple hacks into coordinated campaigns aimed at shaping global politics, weakening U.S. institutions, and putting pressure on American decision-makers. This blog highlights the key takeaways for leaders responsible for national security, public policy, and critical infrastructure resilience."
  https://blog.checkpoint.com/executive-insights/cyber-threats-to-the-u-s-what-policymakers-need-to-know-for-2026/
  https://l.cyberint.com/threats-to-the-homeland-report
• NVIDIA Research Shows How Agentic AI Fails Under Attack
  "Enterprises are rushing to deploy agentic systems that plan, use tools, and make decisions with less human guidance than earlier AI models. This new class of systems also brings new kinds of risk that appear in the interactions between models, tools, data sources, and memory stores. A research team from NVIDIA and Lakera AI has released a safety and security framework that tries to map these risks and measure them inside real workflows. The work includes a new taxonomy, a dynamic evaluation method, and a detailed case study of NVIDIA’s AI-Q Research Assistant. The authors also released a dataset with more than ten thousand traces from attack and defense runs to support outside research."
  https://www.helpnetsecurity.com/2025/12/08/nvidia-agentic-ai-security-framework/
  https://arxiv.org/pdf/2511.21990
• Invisible IT Is Becoming The Next Workplace Priority
  "IT leaders want their employees to work without running into digital hurdles, but many still struggle with fragmented systems that slow teams down. A new report from Lenovo sheds light on how widespread the problem has become and what organizations can do to reduce workplace friction. Hybrid work pushed companies to adopt new tools, devices and management platforms at speed. According to the research, enterprises now manage an average of 897 applications, but only 28 percent are integrated. The report notes that this patchwork environment strains both workers and support teams, since employees must move across several systems before they can resolve problems or complete simple tasks."
  https://www.helpnetsecurity.com/2025/12/08/invisible-it-workplace-priority/
• CISOs Are Spending Big And Still Losing Ground
  "Security leaders are entering another budget cycle with more money to work with, but many still feel no safer. A new benchmark study from Wiz shows a widening gap between investment and impact. Budgets keep rising, cloud programs keep expanding, and AI is reshaping both threats and defenses. Still, CISOs say the fundamentals of risk reduction are not improving fast enough."
  https://www.helpnetsecurity.com/2025/12/08/wiz-cybersecurity-spending-priorities-report/
• CISO Conversations: Keith McCammon, CSO And Co-Founder At Red Canary
  "Keith McCammon was a technologist first and security guru second. He has never received any formal training in cybersecurity; but a love of technology and pleasure in solving puzzles naturally led into the subject, learning on the journey. Kyrus Tech, now owned by Sixgen, was the source of both Carbon Black and Red Canary (now a Zscaler company)."
  https://www.securityweek.com/ciso-conversations-keith-mccammon-cso-and-co-founder-at-red-canary/
• Three Hacking Groups, Two Vulnerabilities And All Eyes On China
  "On the main stage at the Pwn2Own hacking competition in Berlin this March, researchers demonstrated it was possible to remotely compromise sensitive information via Microsoft’s on-premise SharePoint software — the first glimpse that the world got of two dangerous software vulnerabilities threatening governments and enterprises around the globe."
  https://therecord.media/three-hacking-groups-two-vulnerabilities-china-microsoft
• Officials Offer $10M Reward For Information On IRGC-Linked Leader And Close Associate
  "The State Department is seeking help to locate a pair of hackers allegedly working for Shahid Shushtari, a malicious cyber unit operating under Iran’s Revolutionary Guard Corps Cyber-Electronic Command. Officials are offering a reward up to $10 million for information about Mohammad Bagher Shirinkar and Fatemeh Sedighian Kashi. “Help us take the smile off their faces,” the State Department’s Rewards for Justice program posted in a bulletin about the reward on social media last week."
  https://cyberscoop.com/shahid-shushtari-iran-cyber-electronic-command-10m-reward/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Telecom Sector

• The Largest Telecommunications Attack In U.S. History: What Really Happened—And How We Fight Back
  "When Senator Ben Ray Luján warned that the United States was facing “the largest telecommunications hack in our nation’s history,” it marked a turning point in how we understand national cyber risk. On December 4, 2024, the White House confirmed a sprawling cyber-espionage campaign targeting 80 global telecom providers across dozens of countries¹. A joint task force—the Operation Enduring Security Framework—was launched by the NSA, Pentagon, and CISA to contain the damage. The adversary behind it: a sophisticated nation-state threat actor Microsoft calls Salt Typhoon, also tracked as Ghost Emperor, FamousSparrow, Earth Estrie, UNC2286, and earlier as LightBasin / UNC1945 / LIMINAL PANDA²⁻⁴."
  https://blog.checkpoint.com/security/the-largest-telecommunications-attack-in-u-s-history-what-really-happened-and-how-we-fight-back/

Vulnerabilities

• Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch
  "A critical security flaw has been disclosed in Apache Tika that could result in an XML external entity (XXE) injection attack. The vulnerability, tracked as CVE-2025-66516, is rated 10.0 on the CVSS scoring scale, indicating maximum severity. "Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF," according to an advisory for the vulnerability."
  https://thehackernews.com/2025/12/critical-xxe-bug-cve-2025-66516-cvss.html
  https://securityaffairs.com/185363/security/maximum-severity-xxe-vulnerability-discovered-in-apache-tika.html
• React2Shell Flaw Exploited To Breach 30 Orgs, 77k IP Addresses Vulnerable
  "Over 77,000 Internet-exposed IP addresses are vulnerable to the critical React2Shell remote code execution flaw (CVE-2025-55182), with researchers now confirming that attackers have already compromised over 30 organizations across multiple sectors. React2Shell is an unauthenticated remote code execution vulnerability that can be exploited via a single HTTP request and affects all frameworks that implement React Server Components, including Next.js, which uses the same deserialization logic."
  https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2025-55182 Meta React Server Components Remote Code Execution Vulnerability"
  https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog
  https://thehackernews.com/2025/12/critical-react2shell-flaw-added-to-cisa.html
• PromptPwnd: Prompt Injection Vulnerabilities In GitHub Actions Using AI Agents
  "Aikido Security discovered a new class of vulnerabilities, which we have named PromptPwnd, in GitHub Actions or GitLab CI/CD pipelines when combined with AI agents like Gemini CLI, Claude Code, OpenAI Codex, and GitHub AI Inference in CI/CD pipelines. At least 5 Fortune 500 companies are impacted, with early indicators suggesting the same flaw is likely present in many others."
  https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents
  https://cyberscoop.com/ai-coding-tools-can-be-turned-against-you-aikido-github-prompt-injection/
  https://hackread.com/promptpwnd-vulnerabilit-ai-systems-data-theft/
• From Inbox To Wipeout: Perplexity Comet’s AI Browser Quietly Erasing Google Drive
  "Polite emails are supposed to keep work civil, not wipe your Google Drive. In this blog, we’re going to unpack a new zero click agentic browser attack on Perplexity Comet that turns a friendly “please organize our shared Drive” email into a quiet Google Drive wiper, driven entirely by a single trusted prompt to an AI browser assistant. We’ll walk through how the attack works, why tone and task sequencing matter for LLM-driven agents, and what security teams should change now to protect Gmail and Google Drive workflows. This research continues Straiker’s STAR Labs work on agentic AI security and opens our agentic browser series with a focus on browser harm. It builds on prior findings showing how a single email could trigger zero click Drive exfiltration. In this attack we’ll cover, Perplexity Comet followed the polite, step by step instructions as valid workflow, allowing the deletion sequence to run unchecked."
  https://www.straiker.ai/blog/from-inbox-to-wipeout-perplexity-comets-ai-browser-quietly-erasing-google-drive
  https://thehackernews.com/2025/12/zero-click-agentic-browser-attack-can.html
• Novel Clickjacking Attack Relies On CSS And SVG
  "Security researcher Lyra Rebane has devised a novel clickjacking attack that relies on Scalable Vector Graphics (SVG) and Cascading Style Sheets (CSS). Rebane demonstrated the technique at BSides Tallinn in October and has now published a summary of her approach. The attack, which has yet to be fully mitigated, relies on the fact that SVG filters can leak information across origins, in violation of the web's same-origin policy."
  https://www.theregister.com/2025/12/05/css_svg_clickjacking/
• Attacking LINE Cryptography For Fun And .. Forensics
  "The pursuit of obscure knowledge offers some of the greatest enjoyment, to understand something deeply. That understanding itself is the reward all researchers seek. Sometimes understanding comes with new insights! While looking at End-To-End-Encryption (e2ee) in the LINE messaging application I identified a few key issues in the Key Derivation Function (KDF) used by LINE and found that it had some cascading effects beyond e2ee."
  https://think.501.team/research/Attacking+LINE+Cryptography+for+Fun+and+..+Forensics
• IDEsaster: A Novel Vulnerability Class In AI IDEs
  "We all know AI reshaped how we build software. Autocomplete evolved into AI agents that can autonomously act on behalf of the user. As vendors compete on “productivity” they add additional capabilities that significantly affect the security posture of their products. Around 6 months ago, I decided to dig into the world of AI IDEs and coding assistants because they were gaining popularity and it was clear they are here to stay. The first vulnerabilities I found were focused on narrow components - a vulnerable tool, writeable agent configuration or writeable MCP configuration that leads to anything from data exfiltration to remote code execution. Those issues are serious, but they only affect a single application at a time (and were publicly disclosed multiple times)."
  https://maccarita.com/posts/idesaster/
  https://thehackernews.com/2025/12/researchers-uncover-30-flaws-in-ai.html

Malware

• FBI Warns Of Virtual Kidnapping Scams Using Altered Social Media Photos
  "The FBI warns of criminals altering images shared on social media and using them as fake proof of life photos in virtual kidnapping ransom scams. This is part of a public service announcement published today about criminals contacting victims via text message, claiming to have kidnapped a family member and demanding ransom payments. However, as the FBI explained, virtual kidnapping scams involve no actual abduction. Instead, criminals use manipulated images found on social networks and publicly available information to create convincing scenarios designed to pressure victims into paying ransoms before verifying that their loved ones are safe."
  https://www.bleepingcomputer.com/news/security/fbi-warns-of-virtual-kidnapping-ransom-scams-using-altered-social-media-photos/
  http://www.ic3.gov/PSA/2025/PSA251205
  https://www.theregister.com/2025/12/05/virtual_kidnapping_scam/
• China-Nexus Cyber Threat Groups Rapidly Exploit React2Shell Vulnerability (CVE-2025-55182)
  "Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda. This critical vulnerability in React Server Components has a maximum Common Vulnerability Scoring System (CVSS) score of 10.0 and affects React versions 19.x and Next.js versions 15.x and 16.x when using App Router. While this vulnerability doesn’t affect AWS services, we are sharing this threat intelligence to help customers running React or Next.js applications in their own environments take immediate action."
  https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
  https://thehackernews.com/2025/12/chinese-hackers-have-started-exploiting.html
  https://www.bleepingcomputer.com/news/security/react2shell-critical-flaw-actively-exploited-in-china-linked-attacks/
  https://therecord.media/chinese-hackers-exploiting-react2shell-vulnerability-amazon
  https://www.darkreading.com/vulnerabilities-threats/react2shell-under-attack-china-nexus-groups
  https://www.bankinfosecurity.com/chinese-nation-state-groups-tied-to-react2shell-targeting-a-30201
  https://cyberscoop.com/attackers-exploit-react-server-vulnerability/
  https://www.securityweek.com/chinese-hackers-exploiting-react2shell-vulnerability/
  https://www.theregister.com/2025/12/05/aws_beijing_react_bug/
• Return Of ClayRat: Expanded Features And Techniques
  "In October, the zLabs team first identified the ClayRat Android spyware, a malware capable of stealing SMS messages, call logs, capturing victim photos, initiating calls, and sending mass SMS messages to the victim's contact list. Our continuous monitoring of this malware family has since uncovered a new variant with significantly upgraded capabilities. This updated ClayRat strain now leverages Accessibility Services in addition to exploiting Default SMS privileges. Misusing Accessibility services enables a range of actions, including:"
  https://zimperium.com/blog/return-of-clayrat-expanded-features-and-techniques
  https://hackread.com/clayrat-android-spyware-variant-device-control/
• Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary
  "Throughout 2025, CrowdStrike has identified multiple intrusions targeting VMware vCenter environments at U.S.-based entities, in which newly identified China-nexus adversary WARP PANDA deployed BRICKSTORM malware. WARP PANDA exhibits a high level of technical sophistication, advanced operations security (OPSEC) skills, and extensive knowledge of cloud and virtual machine (VM) environments. In addition to BRICKSTORM, WARP PANDA has also deployed JSP web shells and two new implants for ESXi environments — now named Junction and GuestConduit — during their operations."
  https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/
  https://www.infosecurity-magazine.com/news/chinalinked-warp-panda/
  https://www.securityweek.com/us-organizations-warned-of-chinese-malware-used-for-long-term-persistence/
• Sanctioned But Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue
  "Despite extensive scrutiny and public reporting, commercial surveillance vendors continue to operate unimpeded. A prominent name continues to surface in the world of mercenary spyware, Intellexa. Known for its “Predator” spyware, the company was sanctioned by the US Government. New Google Threat Intelligence Group (GTIG) analysis shows that Intellexa is evading restrictions and thriving. Intellexa has adapted, evaded restrictions, and continues selling digital weapons to the highest bidders. Alongside research published by our colleagues from Recorded Future and Amnesty, this blog post will shed light on Intellexa’s recent activities, unveil the real-world impact of their surveillance tools, and detail the actions we are taking against this industry."
  https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue
  https://www.infosecurity-magazine.com/news/predator-spyware-intellexa-evades/
  https://www.malwarebytes.com/blog/news/2025/12/leaks-show-intellexa-burning-zero-days-to-keep-predator-spyware-running
• New Prompt Injection Attack Vectors Through MCP Sampling
  "This article examines the security implications of the Model Context Protocol (MCP) sampling feature in the context of a widely used coding copilot application. MCP is a standard for connecting large language model (LLM) applications to external data sources and tools. We show that, without proper safeguards, malicious MCP servers can exploit the sampling feature for a range of attacks. We demonstrate these risks in practice through three proof-of-concept (PoC) examples conducted within the coding copilot, and discuss strategies for effective prevention."
  https://unit42.paloaltonetworks.com/model-context-protocol-attack-vectors/
• Sharpening The Knife: GOLD BLADE’s Strategic Evolution
  "Between February 2024 and August 2025, Sophos analysts investigated nearly 40 intrusions related to STAC6565, a campaign the analysts assess with high confidence is associated with the GOLD BLADE threat group (also known as RedCurl, RedWolf, and Earth Kapre). This campaign reflects an unusually narrow geographic focus for the group, with almost 80% of the attacks targeting Canadian organizations. Once focused primarily on cyberespionage, GOLD BLADE has evolved its activity into a hybrid operation that blends data theft with selective ransomware deployment via a custom locker named QWCrypt."
  https://news.sophos.com/en-us/2025/12/05/sharpening-the-knife-gold-blades-strategic-evolution/
• A Hidden Pattern Within Months Of Credential-Based Attacks Against Palo Alto GlobalProtect
  "On 2 December 2025, GreyNoise observed a concentrated spike of 7,000+ IPs attempting to log into Palo Alto Networks GlobalProtect portals. All activity originated from infrastructure operated by 3xK GmbH and targeted two Palo Alto profiles in GreyNoise’s Global Observation Grid (GOG)."
  https://www.greynoise.io/blog/hidden-pattern-credential-based-attacks-palo-alto-sonicwall
  https://www.bleepingcomputer.com/news/security/new-wave-of-vpn-login-attempts-targets-palo-alto-globalprotect-portals/
  https://securityaffairs.com/185382/hacking/attackers-launch-dual-campaign-on-globalprotect-portals-and-sonicwall-apis.html

Breaches/Hacks/Leaks

• Barts Health NHS Discloses Data Breach After Oracle Zero-Day Hack
  "Barts Health NHS Trust, a major healthcare provider in England, announced that Clop ransomware actors have stolen files from one of its databases after exploiting a vulnerability in its Oracle E-business Suite software. The stolen data are invoices spanning several years that expose the full names and addresses of individuals who paid for treatment or other services at Barts Health hospital. Information of former employees who owed money to the trust, and suppliers whose data is already public, has also been exposed, the organization says."
  https://www.bleepingcomputer.com/news/security/barts-health-nhs-discloses-data-breach-after-oracle-zero-day-hack/
  https://hackread.com/barts-health-nhs-cl0p-ransomware-data-breach/
• Data Brokers Are Exposing Medical Professionals, And Turning Their Personal Lives Into Open Files
  "Large amounts of personal information about medical professionals are available on people search sites. A new analysis by Incogni’s researchers shows how much data about doctors appears online and how easily it can be found. The findings should concern healthcare leaders who support staff safety, workforce protection, and clinical operations."
  https://www.helpnetsecurity.com/2025/12/05/incogni-healthcare-staff-data-exposure-report/

General News

• React Flaw Mitigation Leads To Cloudflare Outage
  "Content delivery network giant Cloudflare is investigating a brief outage early Friday that took down multiple websites. The incident marks the second outage in the span of a month, although the company said the causes are unrelated. The incident affected social media platforms LinkedIn and X as well as Zoom and online design platform Canva. Multiple users took to X on Friday morning to report that they were prompted with an internal server error when they visited these websites. Impacted services have since been restored."
  https://www.bankinfosecurity.com/react-flaw-mitigation-leads-to-cloudflare-outage-a-30207
  https://www.securityweek.com/cloudflare-outage-caused-by-react2shell-mitigations/
  https://www.bleepingcomputer.com/news/technology/cloudflare-down-websites-offline-with-500-internal-server-error/
  https://www.theregister.com/2025/12/05/react2shell_pocs_exploitation/
• Rethinking The CIO-CISO Dynamic In The Age Of AI
  "As artificial intelligence and digital transformation become table stakes for today's enterprises, CIOs and CISOs are being pulled into the spotlight, and the way these two leaders operate is changing. Organizations are beginning to reimagine how these leadership roles should be structured, aligned and empowered as they grapple with regulatory pressures, the unpredictable nature of AI systems and the need for operational resilience in an uncertain business climate."
  https://www.bankinfosecurity.com/rethinking-cio-ciso-dynamic-in-age-ai-a-30211
• Threat Landscape Grows Increasingly Dangerous For Manufacturers
  "Manufacturers continued to be a top target — if not the top target — of financially motivated cyberattacks in 2025, with their sensitivity to operational disruptions and their shortage of expertise and well-designed protections causing issues for the business sector as a whole, experts say. In 2025, half of manufacturers (51%) fell prey to ransomware and paid a ransom, with the average ransom costing $1 million and the average recovery cost (excluding the ransom) approaching $1.3 million, according to data that cybersecurity firm Sophos collected from more than 330 manufacturing organizations."
  https://www.darkreading.com/cyberattacks-data-breaches/threat-landscape-increasingly-dangerous-manufacturers
• CISOs Should Be Asking These Quantum Questions Today
  "This isn't a pitch for a new box or black box. It's a look at how security, compliance, and engineering teams need to evolve as quantum methods quietly move into production workflows. What follows focuses on the practical questions chief information security officers (CISOs), SecOps leaders, and engineering teams should be asking about visibility, validation, and compliance, rather than hardware specs or vendor road maps. Most enterprises aren't running quantum computers. So why should security operations teams care today?"
  https://www.darkreading.com/cybersecurity-operations/cisos-should-be-asking-these-quantum-questions-today
• Building The Missing Layers For An Internet Of Agents
  "Cybersecurity teams are starting to think about how large language model agents might interact at scale. A new paper from Cisco Research argues that the current network stack is not prepared for this shift. The work proposes two extra layers on top of the application transport layer to help agents communicate in a structured way and agree on shared meaning before they act."
  https://www.helpnetsecurity.com/2025/12/05/cisco-research-internet-of-agents-architecture/
  https://arxiv.org/pdf/2511.19699
• Maryland Man Sentenced For N. Korea IT Worker Scheme Involving US Government Contracts
  "A 40-year-old Maryland man has been sentenced to 15 months in prison for his role in a scheme where he allowed North Korean nationals to use his identity to work in software development roles at several U.S. government agencies, including the Federal Aviation Administration (FAA). Minh Phuong Ngoc Vong will also have to serve three years of supervised release as part of his plea agreement with the Justice Department."
  https://therecord.media/north-korea-it-worker-scheme-maryland-man-sentenced
• CheatSheet – A Practical Guide For Securely Using Third-Party MCP Servers 1.0
  "The Practical Guide for Securely Using Third-Party MCP Servers from the OWASP GenAI Security Project provides a detailed framework for safely deploying and managing external Model Context Protocol (MCP) servers. It outlines the unique security risks introduced by connecting AI models to third-party tools and data sources, including tool poisoning, prompt injection, memory poisoning, and tool interference. The guide offers actionable mitigations covering authentication, authorization, client sandboxing, secure server discovery, and governance workflows, emphasizing least-privilege access and human-in-the-loop oversight."
  https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/
  https://www.scworld.com/feature/mcp-servers-emerge-as-new-supply-chain-risk-as-real-attacks-accelerate
• A Tale Of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability
  "QUESTION: What is the difference between an engineering-focused CISO and a holistic CISO, and what does it mean for the organization? David Schwed, COO at SovereignAI: Right now, there is a global CISO hiring spree. AI labs, cryptocurrency exchanges, and financial institutions are competing over the same small pool of security leaders. Also right now, 2025 is on track to be the worst year for digital asset theft, with over $2 billion stolen by midyear and a single $1.5 billion hack of exchange Bybit dominating the losses."
  https://www.darkreading.com/cyber-risk/why-an-engineering-focused-ciso-can-be-a-liability

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

ตรวจพบช่องโหว่ร้ายแรงในกลไก React Server Components (RSC) และ Flight Protocol ซึ่งเป็นส่วนที่ทำให้ React ประมวลผล UI และดึงข้อมูลบนฝั่ง server ก่อนส่งผลลัพธ์ไปประกอบบนฝั่งผู้ใช้ หากถูกโจมตี ผู้ไม่หวังดีสามารถส่ง HTTP Request ที่ถูกปรับแต่งพิเศษเพื่อทำให้ server รันโค้ดที่ไม่พึงประสงค์ได้ทันที (Unauthenticated RCE) โดยไม่ต้องล็อกอินหรือมีสิทธิ์ใด ๆ

กลุ่มระบบที่ “เข้าข่ายเสี่ยง”
•เว็บไซต์หรือระบบที่ใช้ React ในการพัฒนาโปรแกรม และรองรับ RSC
•โปรเจกต์ที่ติดตั้งแพ็กเกจในตระกูล react-server-dom-*
•แม้ไม่ได้สร้าง Server Functions เอง แต่หาก Framework รองรับ RSC → ยังเสี่ยงอยู่
•แอปพลิเคชันฝั่ง Client-only หรือไม่ใช้ RSC → ไม่เข้าข่าย

แพ็กเกจ/เวอร์ชันที่ต้องรีบตรวจสอบ
หากพบแพ็กเกจด้านล่าง และเวอร์ชันเป็น 19.0.0 / 19.1.0 / 19.1.1 / 19.2.0
ถือว่า เสี่ยงทันที
1.react-server-dom-webpack
2.react-server-dom-parcel
3.react-server-dom-turbopack

แนวทางตรวจสอบและบรรเทาความเสี่ยง

1. ตรวจสอบว่ามีแพ็กเกจเสี่ยงหรือไม่
   ใช้คำสั่ง:
   npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
   คำสั่งนี้จะค้นหาแพ็กเกจในตระกูล react-server-dom-* ซึ่งเป็นตัวบ่งชี้ความเสี่ยงสำคัญ
2. ผู้ใช้ Next.js ให้ตรวจสอบเพิ่มเติม
   Next.js มีเครื่องมือช่วยสแกนความเสี่ยง:
   npx fix-react2shell-next
3. วิธีตรวจสอบในสภาพแวดล้อมจริง (สำคัญมาก)
   โดยเฉพาะระบบที่ใช้ Docker / Container
   ควรตรวจสอบว่า:
   •dependency ภายใน container เป็นเวอร์ชันเดียวกับใน source code
   •ไม่มี build layer เก่าค้างอยู่ใน image
   •CI/CD pipeline build image ใหม่ทุกครั้งหลังอัปเดตแพ็กเกจ
   •ใช้ image ที่ผ่านการ build และ patch เวอร์ชันล่าสุดแล้ว
   หลายระบบพบว่า container ที่รันจริงใช้แพ็กเกจเก่า แม้ source code จะ update แล้ว
4. อัปเดตแพตช์เป็นเวอร์ชันที่ปลอดภัย ได้แก่:
   React
   •19.0.1
   •19.1.2
   •19.2.1
   Next.js
   •15.0.5 / 15.1.9 / 15.2.6 / 15.3.6 / 15.4.8 / 15.5.7
   •16.0.7
   แนะนำให้อัปเดต ทั้ง React + Framework เพื่อความปลอดภัยสูงสุด
   สำหรับผู้ใช้งานทั่วไป
   ช่องโหว่นี้กระทบ ผู้ให้บริการเว็บไซต์และทีมพัฒนา ไม่ได้กระทบผู้ใช้โดยตรง หากเว็บไซต์บางแห่งปิดปรับปรุงหรือให้บริการช้าลงในช่วงนี้ เป็นเพราะผู้ดูแลอยู่ระหว่างอัปเดตแพตช์เพื่อความปลอดภัย
   ️ ระดับความเร่งด่วน
   มีรายงานว่าเริ่มพบการโจมตีจริงแล้วหลังเปิดเผยช่องโหว่ไม่นาน
   ขอให้ผู้ดูแลระบบรีบตรวจสอบแพ็กเกจของตน อัปเดตแพตช์ และตรวจสอบความผิดปกติของระบบทันที

ด้วยความปรารถนาดี สำนักงานคณะกรรมการการรักษาความมั่นคงปลอดภัยไซเบอร์แห่งชาติ (สกมช.) / ThaiCERT

ที่มา
[1]: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components "Critical Security Vulnerability in React Server Components – React"
[2]: https://nextjs.org/blog/CVE-2025-66478 "Security Advisory: CVE-2025-66478 | Next.js"
[3]: https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/ "Critical Vulnerabilities in React Server Components and Next.js"
[4]: https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r "Critical Security Vulnerability in React Server Components · Advisory · facebook/react · GitHub"
[5]: https://thehackernews.com/2025/12/chinese-hackers-have-started-exploiting.html?utm_source=chatgpt.com "Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability"

ตรวจพบช่องโหว่ร้ายแรงในระบบภายในของชิปโทรศัพท์มือถือ เสี่ยงถูกแฮกโดยไม่ต้องกดหรือโต้ตอบใด ๆ รีบอัปเดตระบบด่วน️

สำนักงานคณะกรรมการการรักษาความมั่นคงปลอดภัยไซเบอร์แห่งชาติ (สกมช.) / ThaiCERT ขอแจ้งเตือนภัยเกี่ยวกับช่องโหว่หมายเลข CVE-2025-21483 ระดับ Critical คะแนน CVSS 9.8 ซึ่งส่งผลกระทบต่อสมาร์ตโฟน Android ที่ใช้ชิปเซ็ต Qualcomm Snapdragon

ช่องโหว่นี้ถูกตรวจพบและเผยแพร่ข้อมูลในปี 2568
• ผู้ผลิตชิปและผู้ผลิตมือถือออกแพตช์รักษาความปลอดภัย ตั้งแต่ช่วง พฤศจิกายน - ธันวาคม 2568
• ผู้ใช้งานที่ยังไม่ได้อัปเดตเป็นปัจจุบัน ยังเสี่ยงต่อการถูกโจมตี

ช่องทางที่อาจถูกใช้ในการโจมตี
แฮกเกอร์สามารถโจมตีผ่านการส่งข้อมูลจากอินเทอร์เน็ตสู่โทรศัพท์ ซึ่งระบบจะประมวลผลข้อมูลโดยอัตโนมัติ เช่น
• SMS/MMS โดยเฉพาะข้อความแนบภาพหรือวิดีโอ
• แอปพลิเคชันแชทที่มีการโทรผ่านอินเทอร์เน็ต เช่น WhatsApp, LINE, Messenger — การประมวลผลสัญญาณ "การโทรเข้า" อาจเรียกใช้ระบบที่มีช่องโหว่
• ข้อมูลจากอินเทอร์เน็ตบางรูปแบบ ที่ทำให้ระบบในเครื่องเริ่มทำงานอัตโนมัติ (เป็นข้อมูลที่ถูกทำขึ้นมาเฉพาะเพื่อโจมตีระบบ)
เมื่อข้อมูลเหล่านี้เข้ามา เครื่องจะประมวลผลเองทันที หากยังมีช่องโหว่ อาจถูกโจมตีได้โดยที่ผู้ใช้ไม่รู้ตัว

ทำไมไม่ต้องกดลิงก์ก็โดนได้
รูปแบบการโจมตี Zero-Click ผู้ใช้งาน ไม่ต้องกด ไม่ต้องเปิด และไม่ต้องโต้ตอบใด ๆ ระบบก็สามารถถูกโจมตีได้
• โทรศัพท์มือถือจะประมวลผลข้อมูลบางส่วนโดยอัตโนมัติ เพื่อแสดงการแจ้งเตือน เช่น มีคนโทรเข้าหรือได้รับ MMS
• แฮกเกอร์แนบคำสั่งอันตรายไว้ในข้อมูลเหล่านั้น
• ระหว่างที่ระบบกำลังประมวลผลข้อมูล คำสั่งอันตรายนั้นจะทำงานทันที โดยผู้ใช้ไม่ต้องกดลิงก์ รับสาย หรือโต้ตอบใด ๆ

ผู้ที่ได้รับผลกระทบ
• ผู้ที่ใช้สมาร์ตโฟนระบบ Android ทุกยี่ห้อ ควรจะตรวจสอบหากพบว่ายังไม่ได้อัปเดตแพตช์ความปลอดภัยล่าสุด ควรรีบดำเนินการ

️ สัญญาณที่อาจบ่งบอกว่าอาจจะถูกโจมตีแล้ว
· เครื่องร้อนผิดปกติขณะไม่ได้ใช้งาน
· แบตเตอรี่ลดลงรวดเร็วผิดปกติในช่วงเวลาสั้น ๆ
· การใช้อินเทอร์เน็ตพุ่งสูงผิดปกติ
· มีการแจ้งเตือนการโทรเข้า หรือข้อความ แปลก ๆ ที่ไม่ทราบที่มา
หากพบอาการเหล่านี้ร่วมกับการยังไม่ได้อัปเดตแพตช์ความปลอดภัย ถือว่ามีความเสี่ยง

️ วิธีป้องกัน (ควรทำทันที!)
อัปเดตแพตช์ความปลอดภัยเป็นเวอร์ชันล่าสุด
ขั้นตอนการอัปเดต

1. ไปที่ การตั้งค่า (Settings)
2. เลือก อัปเดตซอฟต์แวร์ / เกี่ยวกับโทรศัพท์ (Software Update / About Phone)
3. กด ดาวน์โหลดและติดตั้ง (Download and Install)
4. หากมีอัปเดต ให้ติดตั้งทันที
5. ตรวจสอบว่าแพตช์ความปลอดภัยเป็นเดือน พฤศจิกายน หรือ ธันวาคม 2568

ข้อควรทำก่อนอัปเดต (สำคัญมาก)

1. เชื่อมต่อ Wi-Fi เพื่อความเสถียรและประหยัดเน็ต
2. ชาร์จแบตเตอรี่ให้มีอย่างน้อย 75% ป้องกันเครื่องดับระหว่างดำเนินการ

️ หากอัปเดตไม่ได้/ไม่สำเร็จ
• เช็กพื้นที่จัดเก็บข้อมูล: หากพื้นที่ว่างไม่พอ ระบบอาจไม่ดาวน์โหลดไฟล์อัปเดต ให้ลบไฟล์ที่ไม่จำเป็นออกก่อน
• อุปกรณ์รุ่นเก่า: โทรศัพท์รุ่นเก่าบางรุ่นอาจไม่รองรับ Android เวอร์ชันใหม่หรือแพตช์ความปลอดภัยล่าสุด โปรดตรวจสอบกับผู้ผลิตโทรศัพท์ของท่าน
• สำหรับผู้ที่ยังไม่มีให้อัปเดต หรือใช้เครื่องรุ่นเก่า หากเช็กแล้วยังไม่มีแพตช์ใหม่มา ให้ทำดังนี้เพื่อลดความเสี่ยงชั่วคราว:

1. ปิดการรับ MMS อัตโนมัติ: ไปที่แอปข้อความ (Messages) > การตั้งค่า > ปิด "ดาวน์โหลด MMS อัตโนมัติ" (Auto-retrieve MMS)
2. หลีกเลี่ยงการเปิดไฟล์แปลกปลอมจากคนที่ไม่รู้จักในทุกช่องทาง

ย้ำ! การอัปเดตนี้ฟรีและข้อมูลในเครื่องไม่หาย (เช่น รูปภาพ, รายชื่อผู้ติดต่อ) รีบดำเนินการอัปเดตโดยเร็วที่สุด เพื่อความปลอดภัยของข้อมูลส่วนบุคคลของท่าน

ด้วยความปรารถนาดี
สำนักงานคณะกรรมการการรักษาความมั่นคงปลอดภัยไซเบอร์แห่งชาติ (สกมช.) / ThaiCERT

ที่มา 1.: https://support.google.com/android/answer/7680439
2. https://source.android.com/docs/security/bulletin/2025-11-01?utm&hl=th
3. https://nvd.nist.gov/vuln/detail/CVE-2025-21483

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand