Vulnerabilities
- Progress Patches Multiple Vulnerabilities In MOVEit WAF, LoadMaster
"Progress Software on Monday rolled out patches for multiple MOVEit WAF and LoadMaster vulnerabilities that could lead to remote code execution (RCE) and OS command injection. Two of the bugs, CVE-2026-3517 and CVE-2026-3519, impact APIs in Progress ADC products and could be exploited by users with ‘Geo Administration’ and ‘VS Administration’ permissions for the execution of arbitrary commands on the LoadMaster appliance. The flaws exist because the ‘addcountry’ and ‘aclcontrol’ commands do not properly sanitize user-supplied input."
https://www.securityweek.com/progress-patches-multiple-vulnerabilities-in-moveit-waf-loadmaster/
https://community.progress.com/s/article/MOVEit-WAF-Critical-Security-Bulletin-April-2026-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 - Actively Exploited Apache ActiveMQ Flaw Impacts 6,400 Servers
"Nonprofit security organization Shadowserver found that over 6,400 Apache ActiveMQ servers exposed online are vulnerable to ongoing attacks exploiting a high-severity code injection vulnerability. Apache ActiveMQ is the most popular open-source multi-protocol message broker for asynchronous communication between Java applications. Tracked as CVE-2026-34197, the vulnerability was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant after remaining undetected for 13 years."
https://www.bleepingcomputer.com/news/security/actively-exploited-apache-activemq-flaw-impacts-6-400-servers/ - Unsecured Perforce Servers Expose Sensitive Data From Major Orgs
"A researcher has analyzed internet-facing Perforce P4 servers and found that many are still misconfigured, exposing highly sensitive information. Perforce P4 (formerly Helix Core) is a centralized version control platform built to handle the massive data requirements of industries like AAA gaming and semiconductor design. While P4 serves an important role, it can be valuable for threat actors if left unprotected. Australian security researcher Morgan Robertson conducted an analysis of internet-exposed Perforce servers in the spring of 2025 and found 6,122 instances."
https://www.securityweek.com/unsecured-perforce-servers-expose-sensitive-data-from-major-orgs/
https://morganrobertson.net/p4wned/
Malware
- Lotus Wiper: a New Threat Targeting The Energy And Utilities Sector
"In light of geopolitical tensions that occurred in the Caribbean region in late 2025 and early 2026, artifacts associated with the attack chain of a destructive wiping campaign targeting the energy and utilities sector in Venezuela were identified on a publicly available resource. They were uploaded in mid-December. Two batch scripts are responsible for initiating the destructive phase of the attack and preparing the environment for executing the final wiper payload. These scripts coordinate the start of the operation across the network, weaken system defenses, and disrupt normal operations before retrieving, deobfuscating and executing a previously unknown wiper that we dubbed ‘Lotus Wiper’. The wiper removes recovery mechanisms, overwrites the content of physical drives, and systematically deletes files across affected volumes, ultimately leaving the system in an unrecoverable state."
https://securelist.com/tr/lotus-wiper/119472/
https://www.bleepingcomputer.com/news/security/new-lotus-data-wiper-used-against-venezuelan-energy-utility-firms/ - New NGate Variant Hides In a Trojanized NFC Payment App
"ESET Research has discovered a new variant of the NGate malware family that abuses a legitimate Android application called HandyPay, instead of the previously leveraged NFCGate tool. The threat actors took the app, which is used to relay NFC data, and patched it with malicious code that appears to have been AI-generated. As with previous iterations of NGate, the malicious code allows the attackers to transfer NFC data from the victim’s payment card to their own device and use it for contactless ATM cash-outs and unauthorized payments. Additionally, the code can also capture the victim’s payment card PIN and exfiltrate it to the operators’ C&C server."
https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/
https://thehackernews.com/2026/04/ngate-campaign-targets-brazil.html
https://www.bleepingcomputer.com/news/security/ngate-android-malware-uses-handypay-nfc-app-to-steal-card-data/
https://www.infosecurity-magazine.com/news/trojanized-android-handle-nfc/
https://www.helpnetsecurity.com/2026/04/21/android-ngate-nfc-malware/ - Bad Apples: Weaponizing Native MacOS Primitives For Movement And Execution
"As macOS adoption in the enterprise reaches record highs, with over 45 percent of organizations now utilizing the platform, the traditional "security through obscurity" narrative surrounding the OS has been rendered obsolete. Mac endpoints, once relegated to creative departments, are now the primary workstations for developers, DevOps engineers, and system administrators. Consequently, these machines have become high-value targets that serve as gateways to source code repositories, cloud infrastructure, and sensitive production credentials. Despite this shift, macOS-native lateral movement and execution tradecraft remain significantly understudied compared to their Windows counterparts. This research was conducted to address this critical knowledge gap. Through a systematic validation of native macOS protocols and system binaries, it is demonstrated how adversaries can “live off the land” (LOTL) by repurposing legitimate administrative tools."
https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ - Threat Advisory: Uptick In Bomgar RMM Exploitation
"Over the past two weeks, the Huntress Security Operations Center (SOC) has seen an uptick in incidents involving compromised Bomgar remote monitoring and management (RMM) instances. The uptick follows intermittent waves of exploitation we have seen over the past two months, after BeyondTrust first disclosed a critical-severity flaw (CVE-2026-1731) in Bomgar in February. On February 6, 2026, BeyondTrust issued fixes for the flaw in Bomgar (rebranded as BeyondTrust Remote Support), which could be exploited by an unauthenticated attacker to remotely execute code. During this timeframe, the SOC observed an initial spike in exploitation of Bomgar RMMs starting on February 12, which involved at least 10 impacted organizations. Then, starting around April 3, the SOC saw another increase in attacks."
https://www.huntress.com/blog/uptick-bomgar-exploitation
https://www.darkreading.com/cyberattacks-data-breaches/surge-bomgar-rmm-exploitation-demonstrates-supply-chain-risk - MacOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections
"Netskope Threat Labs is continuing its coverage of a ClickFix campaign targeting both Windows and macOS users. While our previous post focused on a modular NodeJS-based remote access trojan (RAT) for Windows, this post details a parallel infection chain delivering an AppleScript-based infostealer to macOS users. The macOS infostealer is designed to harvest a wide range of sensitive data, including keychain databases, login credentials, and live session cookies from 12 different browsers, over 200 browser extensions, and 16 standalone cryptocurrency wallets. To secure the victim’s credentials, the malware uses a non-closable persistent dialog box that forces users to provide their system password. This box is highly convincing; it mimics a legitimate system prompt and loads the standard macOS icons from local resources to trick the user into entering their device password."
https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections
https://www.theregister.com/2026/04/21/macos_clickfix_attacks_deliver_applescript/ - Weaponizing Trust Signals: Claude Code Lures And GitHub Release Payloads
"In late March 2026, Anthropic inadvertently released the internal Claude Code source material as part of an npm package that included a large internal source map file. Although the incident stemmed from a simple packaging mistake, threat actors were quick to capitalize on the resulting attention. Only 24 hours after the leak, they were able to create fake GitHub repositories to distribute credential-stealing malware disguised as “leaked” Claude Code downloads. This incident demonstrates that security compromise is not limited to software vulnerabilities: human factors and organizational control gaps often serve as catalyst for threats and are primary drivers of material impact. In this blog entry, we will talk about our analysis of the threats capitalizing on this incident, the downstream risks of the leaked source code, and the actions organizations should take next."
https://www.trendmicro.com/en_us/research/26/d/weaponizing-trust-claude-code-lures-and-github-release-payloads.html - Void Dokkaebi Uses Fake Job Interview Lure To Spread Malware Via Code Repositories
"Void Dokkaebi, also tracked as Famous Chollima, is a North Korea-aligned intrusion set that systematically targets software developers who hold cryptocurrency wallet credentials, signing keys, and access to continuous integration/continuous delivery (CI/CD) pipelines and production infrastructure. As previously documented by TrendAI
Research, the group poses as recruiters from cryptocurrency and AI firms, luring developers into cloning and executing code repositories as part of fabricated job interviews. This is a pattern independently tracked across the industry since 2024, but less attention has been paid to what happens after the initial compromise."
https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html - Chinese APT Targets Indian Banks, Korean Policy Circles
"If you knew only two things about China's state-sponsored advanced persistent threat (APT) Mustang Panda (aka TA416, Bronze President, Stately Taurus), they would probably be, first, that it frequently shifts its tactics, techniques, and procedures (TTPs), and second, that its focus is solely on geopolitical espionage. But Mustang Panda seems to have diverged from that target and has trained its sights on India's banking sector. Square that with its most newly discovered campaign, which employs no interesting TTPs, and though partly focused against American and Korean public policy circles, is aimed largely at financial organizations in India. Despite the differences, researchers at Acronis believe this string of activity belongs to Mustang Panda, thanks to shared code, operational patterns, and more."
https://www.darkreading.com/cyberattacks-data-breaches/chinese-apt-indian-banks-korean-policy - Analyzing The RondoDox Botnet: A DDoS And Mining Threat
"A few weeks ago we published the first part of this series where we described the infrastructure used by the RondoDox threat actors to scan and exploit vulnerable systems. In this second post we’ll take a deep dive into the malware that is deployed into vulnerable systems. Specifically, we’ll look at the initial implant used to fetch the RondoDox binary and the binary itself, detailing its behaviour, how it communicates with the Command and Control (C2), and its malicious capabilities."
https://www.bitsight.com/blog/rondodox-botnet-malware-analysis - Multi-Stage SEO Poisoning Campaign Targets Chinese-Speaking Developers With Kong RAT
"In March 2026, eSentire's Threat Response Unit detected a sophisticated multi-stage malware campaign targeting Chinese-speaking developers and IT professionals through Search engine optimization (SEO) poisoning. Victims searching for popular Chinese developer tools including FinalShell SSH client, Xshell, QuickQ VPN, and Clash proxy, were redirected to convincing lookalike domains that delivered trojanized installers. TRU is tracking this threat as Kong RAT, named for its consistent use of the string "Kong" across registry keys/file paths used by the malware. The campaign's infrastructure consists of a network of spoofed Chinese software domains hosted on shared infrastructure, active from May 2025 through March 2026. Initial payloads were delivered via Alibaba Cloud Object Storage (Hong Kong region), and all stages consistently used oss-cn-hongkong.aliyuncs[.]com for payload hosting and C2 telemetry."
https://www.esentire.com/blog/multi-stage-seo-poisoning-campaign-targets-chinese-speaking-developers-with-kong-rat
Breaches/Hacks/Leaks
- Data Breaches At Healthcare Organizations In Illinois And Texas Affect 600,000
"Three US healthcare organizations — two in Illinois and one in Texas — have disclosed data breaches affecting a total of nearly 600,000 individuals. The data breach tracker operated by the US Department of Health and Human Services (HHS) was updated this week to add three healthcare-related cybersecurity incidents impacting a significant number of people. The biggest breach was disclosed by the North Texas Behavioral Health Authority, affecting 285,000 individuals."
https://www.securityweek.com/data-breaches-at-healthcare-organizations-in-illinois-and-texas-affect-600000/ - Crook Claims To Leak 'video Surveillance Footage' Of Companies
"A Mexican IT infrastructure and digital transformation biz is on clean-up duty after a criminal posted screenshots of what they claimed was company video surveillance footage to a cybercrime forum. Monterrey-based Be Prime confirmed that it was the victim of a "cybersecurity incident" on Thursday, after the criminal, who used the alias "dylanmarly," made sweeping claims about an attack they claim to have carried out. Screenshots published by the attacker depicted access to Be Prime's Cisco Meraki Vision panel, which, if true, would have allowed access to live feeds around its clients' offices, including cameras overlooking different teams' workspaces."
https://www.theregister.com/2026/04/21/be_prime_cctv_leak/ - Adaptavist Group Breach Spawns Imposter Emails As Ransomware Crew Claims Mega-Haul
"UK enterprise software consultancy The Adaptavist Group is investigating a security breach after an intruder logged in with stolen credentials, while a ransomware crew claims it grabbed far more than the company is currently admitting. In a letter to customers, Adaptavist's CEO Simon Haighton-Williams said the biz detected an "IT security incident" in late March after an attacker used compromised login details to gain unauthorized access to some of its systems. The company, which builds and sells tools and services around platforms like Atlassian's Jira and Confluence, has brought in external security specialists and says a forensic investigation is underway to work out what, if anything, was accessed or taken."
https://www.theregister.com/2026/04/21/adaptavist_group_breach_spawns_impostor/
https://www.theadaptavistgroup.com/letters/april-2026
General News
- Researchers Build An Encrypted Routing Layer For Private AI Inference
"Organizations in healthcare, finance, and other sensitive industries want to use large AI models without exposing private data to the cloud servers running those models. A cryptographic technique called Secure Multi-Party Computation (MPC) makes this possible. It splits data into encrypted fragments, distributes them across two or more servers that do not share information with each other, and lets those servers compute an AI result without either one ever seeing the raw input. The catch is speed. A standard mid-sized language model that returns a result in under a second when running normally can take more than 60 seconds when processed under MPC. The encryption overhead is that large."
https://www.helpnetsecurity.com/2026/04/21/securerouter-encrypted-ai-inference/
https://arxiv.org/pdf/2604.15499 - Iran Claims US Used Backdoors To Knock Out Networking Equipment During War
"Iranian media is claiming that the US used backdoors and/or botnets to disable networking equipment during the current war, and Chinese state media is dining out on the allegations. Reports from Iran claim hardware made by Cisco, Juniper, Fortinet, and MikroTik either rebooted or disconnected during recent attacks on Iran – despite the regime disconnecting the nation from the global internet. The reports suggest that’s only possible because someone – probably the US – can sabotage the equipment at will."
https://www.theregister.com/2026/04/21/iran_claims_us_used_backdoors/ - Former Ransomware Negotiator Pleads Guilty To BlackCat Attacks
"41-year-old Angelo Martino, a former employee of cybersecurity incident response company DigitalMint, has pleaded guilty to targeting U.S. companies in BlackCat (ALPHV) ransomware attacks in 2023. Together with two other Sygnia and DigitalMint ransomware negotiators (33-year-old Ryan Clifford Goldberg and 28-year-old Kevin Tyler Martin), Martino was charged with conspiracy to interfere with interstate commerce by extortion, interference with interstate commerce by extortion, and intentional damage to protected computers. Martino was initially identified only as "Co-Conspirator 1" in an October 2025 indictment, but was named in court documents unsealed in March. Martin and Goldberg also pleaded guilty to conspiracy to obstruct commerce by extortion and are facing up to 20 years in prison each."
https://www.bleepingcomputer.com/news/security/former-ransomware-negotiator-pleads-guilty-to-blackcat-attacks/
https://thehackernews.com/2026/04/ransomware-negotiator-pleads-guilty-to.html
https://www.darkreading.com/insider-threats/ransomware-negotiator-pleads-guilty-blackcat-scheme
https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-guilty-plea/
https://www.securityweek.com/third-us-security-expert-admits-helping-ransomware-gang/
https://securityaffairs.com/191100/security/ransomware-negotiator-caught-secretly-assisting-blackcat-extortion-scheme.html
https://www.helpnetsecurity.com/2026/04/21/ransomware-negotiator-blackcat-alphv-group/
https://www.theregister.com/2026/04/21/yet_another_ex_ransomware_negotiator_pleads/ - Mythos Can Find The Vulnerability. It Can’t Tell You What To Do About It.
"Mythos matters. It is a significant step forward in AI-assisted vulnerability discovery. But it does not mean cybersecurity changed overnight, nor does it mean enterprises are suddenly facing fully automated exploitation at internet scale tomorrow. It does mean the offensive side of AI is continuing to improve. The defensive side needs to catch up now. Mythos is the latest step in a longer trend. Over the next several years, expect the same pattern to repeat: incremental progress, then a jump; incremental progress, then a jump. Models will get more capable and cheaper with each cycle, and each jump will put more pressure on security teams still operating at human speed."
https://cyberscoop.com/anthropic-mythos-vulnerability-discovery-op-ed/ - Microsoft Vulnerabilities Drop, But Critical Flaws Double, Report Warns
"The total number of security flaws in Microsoft software has dropped by 6% to 1,273 this year, which on the surface indicates that things are actually getting better. However, it hides a dangerous trend- the most dangerous or critical flaws have doubled. BeyondTrust, a privilege-centric identity security leader, just released its 13th annual Microsoft Vulnerabilities Report, which reveals that while hackers are finding fewer bugs overall, the ones they are finding are far more powerful. “Don’t be distracted by the dip in total vulnerabilities,” says James Maude, Field CTO at BeyondTrust, “critical vulnerabilities doubled. This is a warning that risk is not decreasing, it is concentrating, and it is concentrating around privilege.”"
https://hackread.com/microsoft-vulnerabilities-drop-critical-flaws-double/ - 2026 CISO AI Risk Report [Saviynt]
"Many security leaders didn’t authorize AI expansion. It happened around them. Someone plugged in a copilot in a SaaS tool or an engineering team tested an agent or a business unit installed an assistant without waiting for approval. None of these choices feel significant in isolation, but together they create systems acting on behalf of people, without the structures we rely on to govern human access. In our survey of more than 200 CISOs and security leaders, the same concerns surfaced repeatedly. AI systems already have meaningful access, often with privilege levels no one explicitly granted. They generate activity that can be difficult to trace, behave in ways that don’t match human patterns, and sometimes leave behind incomplete or temporary records. None of this is catastrophic on its own, but it complicates the basic questions security teams rely on, namely: “Who did this?” and “Should this action have been allowed?”"
https://www.cybersecurity-insiders.com/portfolio/2026-ciso-ai-risk-report-saviynt/
https://www.cybersecurity-insiders.com/wp-content/uploads/2026-AI-Identity-Risk-Report-Saviynt-by-CSI-1.6.pdf
https://hackread.com/the-ungoverned-workforce-cybersecurity-insiders-finds-92-lack-visibility-into-ai-identities/ - Unchecked AI Agents Cause Cybersecurity Incidents At Two Thirds Of Firms
"Two thirds of organizations have suffered from a cybersecurity incident related to the deployment of AI agents during the last year, research by the Cloud Security Alliance (CSA) has warned. According to research, conducted alongside Token Security, unchecked AI agents operating on corporate networks caused damage including data exposure, operational disruption and financial losses. The CSA paper, titled Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises, published on April 21, warned that the majority of organizations have no strategy set up around decommissioning AI agents, further putting them at risk of cybersecurity incidents."
https://www.infosecurity-magazine.com/news/unchecked-ai-agents-cause/ - Outdated Software Has Become a Major Cybersecurity Liability
"In the artificial intelligence (AI) era, IT and cybersecurity teams must ensure every device runs the most secure software version available. As cybercriminals gain access to more advanced AI models, the amount of time and effort required to first discover a vulnerability and develop a means to exploit it is now approaching zero. While that is likely to increase the number of unknown zero-day vulnerabilities that might be exploited, most cybercriminals will—at least initially—focus on exploiting known vulnerabilities faster than ever."
https://blog.barracuda.com/2026/04/21/outdated-software-has-become-a-major-cybersecurity-liability - No Exploit Needed: How Attackers Walk Through The Front Door Via Identity-Based Attacks
"The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn't changed: stolen credentials. Identity-based attacks remain a dominant initial access vector in breaches today. Attackers obtain valid credentials through credential stuffing from prior breach databases, password spraying against exposed services, or phishing campaigns — and use them to walk through the front door. No exploits needed. Just a valid username and password."
https://thehackernews.com/2026/04/no-exploit-needed-how-attackers-walk.html - Ukraine Busts ‘bot Farm’ Supplying Thousands Of Fake Telegram Accounts To Russian Spies
"Ukrainian authorities have dismantled a so-called “bot farm” that police say was supplying thousands of fake social media accounts to Russian intelligence services for use in disinformation campaigns against Ukraine. Ukraine’s Security Service (SBU) and the National Police said on Monday they detained the suspected organizer of the network in the northern city of Zhytomyr and blocked nearly 20,000 fraudulent online profiles allegedly used in information operations directed by Moscow."
https://therecord.media/ukraine-sbu-busts-bot-farm-supplying-russian-spies - Nation-States Want To Cause Harm, Not Just Steal Cash - Stop Handing Your Cyber Defenses To The Cheapest Contractor
"State-sponsored cyberattacks from Chinese intelligence and military agencies display "an eye-watering level of sophistication," UK National Cyber Security Centre CEO Richard Horne is expected to say in a less-than-cheery opening speech to kick off its annual conference. The NCSC has in previous years labelled the threat posed by China in cyberspace as "epoch-defining," although Horne re-jiggered this description in his opening plenary at CYBERUK 2026. According to a transcript of his speech shared with The Register ahead of time, Horne will tell delegates attending the Glasgow conference on Wednesday that China is no longer just a capable cyber threat, but thanks to its whole-of-state approach, it now represents "a peer competitor in cyberspace.""
https://www.theregister.com/2026/04/21/ncsc_chinas_cyberattacks_uk/
อ้างอิง
Electronic Transactions Development Agency (ETDA) 
หมายเหตุ - อ้างอิง CVSS จาก 
ThaiCERT ขอแนะนำให้หน่วยงานและประชาชนติดตามพัฒนาการด้าน AI และความมั่นคงปลอดภัยไซเบอร์อย่างใกล้ชิด พร้อมทบทวนมาตรการป้องกันของตนอย่างสม่ำเสมอ เพื่อให้สามารถลดความเสี่ยงและรับมือกับภัยคุกคามรูปแบบใหม่ได้อย่างเหมาะสมและทันท่วงที
