Vulnerabilities

• New n8n Vulnerability (9.9 CVSS) Lets Authenticated Users Execute System Commands
  "A new critical security vulnerability has been disclosed in n8n, an open-source workflow automation platform, that could enable an authenticated attacker to execute arbitrary system commands on the underlying host. The vulnerability, tracked as CVE-2025-68668, is rated 9.9 on the CVSS scoring system. It has been described as a case of a protection mechanism failure. Cyera Research Labs' Vladimir Tokarev and Ofek Itach have been credited with discovering and reporting the flaw, which has been codenamed N8scape."
  https://thehackernews.com/2026/01/new-n8n-vulnerability-99-cvss-lets.html
  https://github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v
• New D-Link Flaw In Legacy DSL Routers Actively Exploited In Attacks
  "Threat actors are exploiting a recently discovered command injection vulnerability that affects multiple D-Link DSL gateway routers that went out of support years ago. The vulnerability is now tracked as CVE-2026-0625 and affects the dnscfg.cgi endpoint due to improper input sanitization in a CGI library. An unauthenticated attacker could leverage this to execute remote commands via DNS configuration parameters. Vulnerability intelligence company VulnCheck reported the problem to D-Link on December 15, after The Shadowserver Foundation observed a command injection exploitation attempt on one of its honeypots."
  https://www.bleepingcomputer.com/news/security/new-d-link-flaw-in-legacy-dsl-routers-actively-exploited-in-attacks/
  https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint
• Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write On Servers
  "Users of the "@adonisjs/bodyparser" npm package are being advised to update to the latest version following the disclosure of a critical security vulnerability that, if successfully exploited, could allow a remote attacker to write arbitrary files on the server. Tracked as CVE-2026-21440 (CVSS score: 9.2), the flaw has been described as a path traversal issue affecting the AdonisJS multipart file handling mechanism. "@adonisjs/bodyparser" is an npm package associated with AdonisJS, a Node.js framework for developing web apps and API servers with TypeScript. The library is used to process AdonisJS HTTP request body."
  https://thehackernews.com/2026/01/critical-adonisjs-bodyparser-flaw-cvss.html
  https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h
• Cato CTRL Threat Research: Vulnerability Discovered In Open WebUI Enables Account Takeover And Remote Code Execution (CVE-2025-64496)
  "Cato CTRL’s Vitaly Simonovich (senior security researcher) has discovered a vulnerability (CVE-2025-64496 with a “High” severity rating of 7.3 out of 10) in Open WebUI in versions 0.6.34 and older. This flaw affects the Direct Connections feature, which lets users connect to external AI model servers (ex: OpenAI’s API). If a threat actor tricks a user into connecting to a malicious server, it can lead to an account takeover attack. If the user also has workspace.tools permission enabled, it can lead to remote code execution (RCE). Which means that a threat actor can control the system running Open WebUI."
  https://www.catonetworks.com/blog/cato-ctrl-vulnerability-discovered-open-webui-cve-2025-64496/
  https://www.infosecurity-magazine.com/news/flaw-open-webui-affects-ai/
  TOTOLINK EX200 Firmware-Upload Error Handling Can Activate An Unauthenticated Root Telnet Service
  "A flaw in the firmware-upload error-handling logic of the TOTOLINK EX200 extender can cause the device to unintentionally start an unauthenticated root-level telnet service. This condition may allow a remote authenticated attacker to gain full system access."
  https://kb.cert.org/vuls/id/295169
  https://thehackernews.com/2026/01/unpatched-firmware-flaw-exposes.html
  https://securityaffairs.com/186597/security/cert-cc-warns-of-critical-unfixed-vulnerability-in-totolink-ex200.html
• Critical Dolby Vulnerability Patched In Android
  "The January 2026 Android update patches a single vulnerability, a critical Dolby audio decoder issue whose existence came to light in October 2025. The flaw, tracked as CVE-2025-54957, was described at the time of its disclosure as a medium-severity out-of-bounds write issue impacting the widely used Dolby Digital Plus (DD+) Unified Decoder. The vulnerability, exploitable using specially crafted media files, was discovered by Google researchers and reported to Dolby in June 2025, with a patch released in September."
  https://www.securityweek.com/critical-dolby-vulnerability-patched-in-android/
  https://securityaffairs.com/186591/security/google-fixes-critical-dolby-decoder-bug-in-android-january-update.html

Malware

• Cyber Counterintelligence (CCI): When 'Shiny Objects' Trick 'Shiny Hunters'
  "It is worth noting that "Shiny Hunters" (tricked by our team with a honeytrap), or more accurately, their rebranded version involving new members, which calls itself "Scattered Lapsus$ Hunters" (SLH) or "Scattered Lapsus$ Shiny Hunters (SLSH)," linked to 'The Com' (short for 'The Community'), a predominantly English-speaking cybercriminal ecosystem. This loosely organized network operates more like a cybercrime youth movement, encompassing a broad and constantly shifting range of actors, mainly teenagers. Some announcements of successful data breaches by these actors were published on the associated Telegram channel, "The Comm Leaks." The FBI issued a Public Service Announcement (PSA) last year warning about the risks associated with joining such movements."
  https://www.resecurity.com/blog/article/cyber-counterintelligence-cci-when-shiny-objects-trick-shiny-hunters
  https://databreaches.net/2026/01/06/cyber-counterintelligence-cci-resecurity-releases-data-on-john-erin-binns-irdev/
  https://securityaffairs.com/186586/cyber-crime/resecurity-went-on-the-cyber-offensive-when-shiny-objects-trick-shiny-hunters.html
• 900K Users Compromised: Chrome Extensions Steal ChatGPT And DeepSeek Conversations
  "The OX Research team detected a new malware campaign stealing ChatGPT and DeepSeek conversations – from over 900,000 Chrome extension downloads. Two malicious extensions were found exfiltrating user conversations and all Chrome tab URLs to a remote C2 server every 30 minutes. The malware deceives users by impersonating a legitimate extension by a company called AITOPIA, which adds a sidebar on top of any website, with the ability to chat with the most popular LLMs in the market."
  https://www.ox.security/blog/malicious-chrome-extensions-steal-chatgpt-deepseek-conversations/
  https://thehackernews.com/2026/01/two-chrome-extensions-caught-stealing.html

General News

• Taiwan Says China's Attacks On Its Energy Sector Increased Tenfold
  "The National Security Bureau in Taiwan says that China's attacks on the country's energy sector increased tenfold in 2025 compared to the previous year. A report from the agency highlights that attackers targeted critical infrastructure in nine key sectors, and the total number of cyber incidents linked to China grew by 6%. The emergency rescue and hospitals sectors saw an increase in cyberattacks of 54%, while communications and transmissions recorded 6.7% more incidents."
  https://www.bleepingcomputer.com/news/security/taiwan-says-chinas-attacks-on-its-energy-sector-increased-tenfold/
• 7 Types Of Hacker Motivations
  "Hackers are not created equal, nor do they have the same purpose. Some hackers are paid to scrutinize security systems, find loopholes, fix weaknesses, and ultimately protect organizations and people. Others exploit those same gaps for profit, power, or disruption. What separates hackers isn’t just skill level or tactics; it’s intent. The purpose behind an attack changes everything about how hackers shape their tactics and how the hacking process unfolds: who is targeted, which methods and tools are used, how patient the attacker is, and the kind of damage they want to cause."
  https://www.mcafee.com/blogs/internet-security/7-types-of-hacker-motivations/
• CISOs Face a Tighter Insurance Market In 2026
  "Cyber-risk leaders may not want to get too cozy with the current dynamics in the cyber-insurance market. After a couple of years of softening rates and cutthroat competition, the pace of premium rate reductions shows signs of slowing, and insurers are asking for more proof of best practices before writing policies or paying claims. Boards and enterprise risk management stakeholders increasingly see cyber insurance as a non-negotiable part of cyber-risk management strategies, but while it may be easier and cheaper to get coverage now, all it takes is one or two mega loss events — a supply chain problem or AI-related incident — to cause underwriting stances to shift dramatically."
  https://www.darkreading.com/endpoint-security/cisos-face-tighter-insurance-market
• Startup Trends Shaking Up Browsers, SOC Automation, AppSec
  "Entrepreneurs, investors, and CISOs working in startups are often developing new artificial intelligence (AI) technologies, infrastructure, and attack surfaces long before most early adopters. It's instructive for us to pay attention to what they've been up to in 2025 to see where the industry is headed. The following trends have emerged in the startup space over the past year that will disrupt Web security, threat modeling, and AI SOC automation for years to come."
  https://www.darkreading.com/endpoint-security/startup-trends-shaking-up-browsers-soc-automation-appsec
• How To Avoid Phishing Incidents In 2026: A CISO Guide
  "By 2026, most phishing emails will look legitimate enough to pass filters and first checks. Trusted platforms, clean-looking links, and delayed execution make fast decisions risky and slow ones dangerous. As a result, investigations drag on, queues grow during phishing waves, and confidence in verdicts drops. Read on to see how security leaders can regain confidence in phishing decisions and reduce investigation pressure as these attacks become harder to spot."
  https://hackread.com/how-to-avoid-phishing-incidents-2026-ciso-guide/
• Turning Plain Language Into Firewall Rules
  "Firewall rules often begin as a sentence in someone’s head. A team needs access to an application. A service needs to be blocked after hours. Translating those ideas into vendor specific firewall syntax usually involves detailed knowledge of zones, objects, ports, and rule order. New research from New York University examines a different starting point, one that treats natural language as the entry point for firewall configuration."
  https://www.helpnetsecurity.com/2026/01/06/research-natural-language-firewall-configuration/
  https://arxiv.org/pdf/2512.10789
• The Roles And Challenges In Moving To Quantum-Safe Cryptography
  "A new research project examines how organizations, regulators, and technical experts coordinate the transition to quantum safe cryptography. The study draws on a structured workshop with public sector, private sector, and academic participants to document how governance, security, and innovation systems shape cryptographic migration planning. The paper focuses on the Netherlands as a case study. The authors frame the transition to quantum safe systems as a socio technical process that involves institutions, standards bodies, and operational decision makers alongside cryptographic engineering work."
  https://www.helpnetsecurity.com/2026/01/06/quantum-safe-cryptography-transition-research/
  https://arxiv.org/pdf/2512.16974
• Cyber Risk Trends For 2026: Building Resilience, Not Just Defenses
  "If there’s one lesson from the past year, it’s this: we won’t outpace the adversary by trying to stop every attack. We will, however, outlast them by becoming measurably more resilient. In my recent lecture on emerging threats for 2026, I made the case that cyberattacks will be more complex, more persistent, more intelligent, and far more automated than we’ve seen before. That means our odds of outright prevention diminish. The imperative shifts to resilience; the ability to take a punch, adapt in the moment, and rebound quickly with minimal damage."
  https://www.securityweek.com/cyber-risk-trends-for-2026-building-resilience-not-just-defenses/
• HackerOne 'ghosted' Me For Months Over $8,500 Bug Bounty, Says Researcher
  "Last fall, Jakub Ciolek reported two denial-of-service bugs in Argo CD, a popular Kubernetes controller, via HackerOne's Internet Bug Bounty (IBB) program. Both were assigned CVEs and have since been fixed. But instead of receiving an $8,500 reward for the two flaws, Ciolek says, HackerOne ghosted him for months. The open source bug bounty program finally contacted Ciolek on Tuesday, but only after The Register reached out to HackerOne asking about the status of his reward payment and the IBB program in general."
  https://www.theregister.com/2026/01/07/hackerone_ghosted_researcher/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Healthcare Sector

• Pharma’s Most Underestimated Cyber Risk Isn’t a Breach
  "Chirag Shah, Global Information Security Officer & DPO at Model N examines how cyber risk in pharma and life sciences is shifting beyond traditional breaches toward data misuse, AI-driven exposure and regulatory pressure. He explains why executives still underestimate silent control failures, how ransomware groups are weaponizing compliance risk, and why proof of security will increasingly require real-time governance, not audits, as cybersecurity and compliance continue to converge."
  https://www.helpnetsecurity.com/2026/01/05/chirag-shah-model-n-pharma-cyber-risk/

New Tooling

• OpenAEV: Open-Source Adversarial Exposure Validation Platform
  "OpenAEV is an open source platform designed to plan, run, and review cyber adversary simulation campaigns used by security teams. The project focuses on organizing exercises that blend technical actions with operational and human response elements, all managed through a single system. At the core of OpenAEV is the concept of a scenario. A scenario defines a threat context and turns it into a structured plan made up of events called injects. Scenarios can include background material such as documents, media files, and contextual data that help frame the exercise for participants. Players and assets are defined at this level, linking people and endpoints to the planned activity."
  https://www.helpnetsecurity.com/2026/01/05/openaev-open-source-adversarial-exposure-validation-platform/
  https://github.com/OpenAEV-Platform/openaev

Vulnerabilities

• Claude In Chrome: A Threat Analysis
  "Claude in Chrome, made available in beta to all paid plan subscribers on Dec 18th, is the new agentic chrome extension by Anthropic. Following the likes of Perplexity's Comet, ChatGPT’s Atlas, and others, Anthropic brought Claude’s capabilities into the browser. It's less a browser extension than a new kind of browser altogether. This paradigm shift demands a corresponding shift in how we think about security. The threat model for an agentic browser includes both familiar as well as novel risks. In this post, we map the attack surface of Claude Chrome where the agent—not the user—is in the driver's seat."
  https://labs.zenity.io/p/claude-in-chrome-a-threat-analysis
  https://hackread.com/data-exposure-risk-claude-chrome-extension/
• WhatsApp Silent Fix Of Device Fingerprinting Privacy Issue Assessment: The Good, The (Not So) Bad, And The (Somewhat) Ugly
  "Using our research tool, we discovered that WhatsApp is silently implementing fixes for device fingerprinting privacy vulnerabilities. While the fix remains incomplete, it signals WhatsApp is finally starting to address vulnerabilities that were responsibly disclosed by the security community."
  https://medium.com/@TalBeerySec/whatsapp-silent-fix-of-device-fingerprinting-privacy-issue-assessment-the-good-the-not-so-bad-9127b5215e28
  https://www.securityweek.com/researcher-spotlights-whatsapp-metadata-leak-as-meta-begins-rolling-out-fixes/

Malware

• Dozens Of Global Companies Hacked Via Cloud Credentials From Infostealer Infections & More At Risk
  "A high-profile threat actor, operating under the moniker “Zestix” (also operating under the alias “Sentap”), has been identified auctioning data exfiltrated from the corporate file-sharing portals of approximately 50 major global enterprises. This report serves as an exhaustive analysis of this campaign, offering direct evidence for key compromises, detailing the breach of ShareFile, OwnCloud, and Nextcloud instances belonging to critical entities across the aviation, robotics, housing, and government infrastructure sectors."
  https://www.infostealers.com/article/dozens-of-global-companies-hacked-via-cloud-credentials-from-infostealer-infections-more-at-risk/
  https://www.bleepingcomputer.com/news/security/cloud-file-sharing-sites-targeted-for-corporate-data-theft-attacks/
• Analyzing PHALT#BLYX: How Fake BSODs And Trusted Build Tools Are Used To Construct a Malware Infection
  "Securonix threat researchers have been tracking a stealthy campaign targeting the hospitality sector using click-fix social engineering, fake captcha and fake blue screen of death to trick users into pasting malicious code. It leverages a trusted MSBuid.exe tool to bypass defenses and deploys a stealthy, Russian-linked DCRat payload for full remote access and the ability to drop secondary payloads."
  https://www.securonix.com/blog/analyzing-phaltblyx-how-fake-bsods-and-trusted-build-tools-are-used-to-construct-a-malware-infection/
  https://www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-bsod-screens-to-push-malware/
  https://therecord.media/russian-hackers-europe-hospitality-blue-screen
• How We Prevented Cursor, Windsurf & Google Antigravity From Recommending Malware
  "We discovered that the most popular AI IDEs were officially recommending extensions that didn't exist, namespaces anyone could claim and upload malware to. So we claimed them first. Cursor, Windsurf, Google Antigravity, Trae: these are the hottest tools in software development right now. Cursor alone has over a million daily active users and a $9.9 billion valuation. Windsurf hit a million users within months of launch. Google Antigravity launched just weeks ago, backed by the $2.4 billion acquisition of Windsurf's team and technology. They all have something in common: they're all forked from VSCode."
  https://www.koi.ai/blog/how-we-prevented-cursor-windsurf-google-antigravity-from-recommending-malware
  https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/
• The DocuSign Impersonation Wave With Real-Time Customizable LogoKit
  "Phishing remains one of the most significant cyberattack entry points worldwide. According to Group-IB’s High-Tech Crime Trends Report 2025, phishing activity grew by 22% year-on-year — highlighting how heavily attackers still rely on social-engineering to gain initial access. Meanwhile, the FBI’s IC3 recorded 193,407 phishing and spoofing complaints in 2024, the year’s top cyber-crime category, contributing to $16.6 billion in reported losses."
  https://www.group-ib.com/blog/docusign-impersonation-logokit/
• A Broken System Fueling Botnets
  "Synthient continues to track the Kimwolf DDoS and proxy botnet with this report, delivering significant findings on the inner workings, infection chain, and reliance on the residential proxy ecosystem. Kimwolf has been highly active since early August of 2025, with substantial growth over the past four months. The Synthient’s research team assesses with high confidence that the total number of infected devices has surpassed 2 million, primarily targeting Android devices running an exposed Android Debug Bridge (ADB) service via residential proxies. These findings further reveal an expansive network of compromised TV streaming devices used by providers to obtain large pools of IP addresses."
  https://synthient.com/blog/a-broken-system-fueling-botnets
  https://thehackernews.com/2026/01/kimwolf-android-botnet-infects-over-2.html
  https://www.securityweek.com/kimwolf-android-botnet-grows-through-residential-proxy-networks/
  https://securityaffairs.com/186559/malware/kimwolf-botnet-leverages-residential-proxies-to-hijack-2m-android-devices.html
• Russia-Aligned Hackers Abuse Viber To Target Ukrainian Military And Government
  "The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. "This organization has continued to conduct high-intensity intelligence gathering activities against Ukrainian military and government departments in 2025," the 360 Threat Intelligence Center said in a technical report. Also tracked as Hive0156, the hacking group is primarily known for leveraging war-themed lures in phishing emails to deliver Hijack Loader in attacks targeting Ukrainian entities. The malware loader subsequently acts as a pathway for Remcos RAT infections."
  https://thehackernews.com/2026/01/russia-aligned-hackers-abuse-viber-to.html
  https://securityaffairs.com/186571/apt/russia-linked-apt-uac-0184-uses-viber-to-spy-on-ukrainian-military-in-2025.html
• Fake WordPress Domain Renewal Phishing Email Stealing Credit Card And 3-D Secure OTP
  "I investigated a phishing email impersonating WordPress.com that claims a domain renewal is due soon and urges immediate action to prevent service disruption. The campaign leads victims to a fake WordPress payment portal hosted on attacker infrastructure and performs theft of credit card details and 3-D Secure OTPs, which are exfiltrated to the attacker via Telegram."
  https://malwr-analysis.com/2025/12/31/fake-wordpress-domain-renewal-phishing-email-stealing-credit-card-and-3-d-secure-otp/

Breaches/Hacks/Leaks

• US Broadband Provider Brightspeed Investigates Breach Claims
  "Brightspeed, one of the largest fiber broadband companies in the United States, is investigating security breach and data theft claims made by the Crimson Collective extortion gang. Founded in 2022, the U.S. telecommunications and Internet service provider (ISP) serves rural and suburban communities across 20 states. "We take the security of our networks and protection of our customers' and employees' information seriously and are rigorous in securing our networks and monitoring threats. We are currently investigating reports of a cybersecurity event," Brightspeed told BleepingComputer. "As we learn more, we will keep our customers, employees and authorities informed.""
  https://www.bleepingcomputer.com/news/security/us-broadband-provider-brightspeed-investigates-breach-claims/
  https://www.securityweek.com/brightspeed-investigating-cyberattack/
• Ledger Customers Impacted By Third-Party Global-e Data Breach
  "Ledger is informing some customers that their personal data has been exposed after hackers breached the systems of third-party payment processor Global-e. In a statement for BleepingComputer, the blockchain company underlines that its network has not been impacted and that the platform's hardware and software systems remain secure. "Some of the data accessed as part of this incident pertained to customers who purchased on Ledger.com using Global-e as a Merchant of Record," the company told BleepingComputer."
  https://www.bleepingcomputer.com/news/security/ledger-customers-impacted-by-third-party-global-e-data-breach/
• NordVPN Denies Breach Claims, Says Attackers Have "dummy Data"
  "NordVPN denied allegations that its internal Salesforce development servers were breached, saying that cybercriminals obtained "dummy data" from a trial account on a third-party automated testing platform. The company's statement comes after a threat actor (using the 1011 handle) claimed on a hacking forum over the weekend that they stole more than 10 databases containing sensitive information like Salesforce API keys and Jira tokens, following a brute-force attack against a NordVPN development server."
  https://www.bleepingcomputer.com/news/security/nordvpn-denies-breach-claims-says-attackers-have-dummy-data/
  https://hackread.com/nordvpn-denies-breach-hacker-salesforce-dev-data/
• New Zealand Probes Ransomware Hack Of Health Portal
  "The New Zealand government is probing a year-end ransomware hack of private healthcare service provider Manage My Health that impacted thousands of patients. Digital extortion group Kazu has claimed responsibility and threatened to leak the data on Jan. 15 unless it receives a $60,000 ransom. Manage My Health is an online portal used by more than 1.85 million New Zealanders for booking medical appointments and accessing health records and prescriptions. Kazu has claimed that it stole 4.15 terabytes of data, which is over 700 files."
  https://www.bankinfosecurity.com/new-zealand-probes-ransomware-hack-health-portal-a-30444
  https://www.infosecurity-magazine.com/news/new-zealand-orders-review-manage/
  https://www.theregister.com/2026/01/05/nz_managemyhealth_breach_review/
• Researcher Wipes White Supremacist Dating Sites, Leaks Data On Okstupid[.]lol
  "A self-described security researcher operating under the pseudonym Martha Root has breached and exposed thousands of user profiles from a WordPress hosted white supremacist dating website, WhiteDate and two associated platforms, WhiteChild and WhiteDeal. The incident was discussed during the 39th Chaos Communication Congress (CCC) in Hamburg in late December 2025, and has since drawn both praise and controversy across cybersecurity and political circles."
  https://hackread.com/white-supremacist-dating-sites-wiped-okstupid-lol/
• Cyberattack Forces British High School To Close
  "A cyberattack has forced a British high school to remain closed following the Christmas holidays. Higham Lane School in Nuneaton, a town in central England, has told its roughly 1,500 students they won’t be able to attend classes until at least Wednesday due to the incident. In an email to parents and carers, the school said the cyberattack “has taken down the school IT system,” leaving staff without access “to any digital services including telephones / emails / servers and the school’s management system.”"
  https://therecord.media/cyberattack-british-high-school-closes

General News

• The Enduring Attack Surface Of VPNs
  "One way to look at the novel coronavirus pandemic: A societal experiment in how an oft-overlooked yet essential element of secure networking would stand up to an exploding user base. Unsurprisingly, the rapid uptake of virtual private networks by companies suddenly managing a remote workforce came with significant security costs. Researchers from the Blekinge Institute of Technology in Sweden in a 2025 paper counted a 238% surge in VPN targeted attacks between 2020 and 2022, peak years of coronavirus lockdowns. The study is a meta-analysis of 81 reports from sources including Google and BrightTALK."
  https://www.bankinfosecurity.com/enduring-attack-surface-vpns-a-30446
• AI Security Risks Are Also Cultural And Developmental
  "Security teams spend much of their time tracking vulnerabilities, abuse patterns, and system failures. A new study argues that many AI risks sit deeper than technical flaws. Cultural assumptions, uneven development, and data gaps shape how AI systems behave, where they fail, and who absorbs the harm. The research was produced by a large international group of scholars from universities, ethics institutes, and policy bodies, including Ludwig Maximilian University of Munich, the Technical University of Munich, and the African Union. It examines AI through international human rights law, with direct relevance to security leaders responsible for AI deployment across regions and populations."
  https://www.helpnetsecurity.com/2026/01/05/ai-security-governance-risks-research/
  https://arxiv.org/pdf/2512.15786
• 8 Cybersecurity Predictions For 2026: Barracuda Leaders Share Their Insights
  "As we head into 2026, cybersecurity is changing faster than ever — thanks to big leaps in artificial intelligence, increasingly complex regulatory requirements and mounting pressure on critical infrastructure. To help organizations navigate these changes, three Barracuda executives share their top predictions for the coming year, offering valuable insights on the operational challenges, compliance risks and strategic priorities shaping the future of security."
  https://blog.barracuda.com/2026/01/05/cybersecurity-predictions-2026-barracuda-leaders
• Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act
  "Ilya Lichtenstein, who was sentenced to prison last year for money laundering charges in connection with his role in the massive hack of cryptocurrency exchange Bitfinex in 2016, said he has been released early. In a post shared on X last week, the 38-year-old announced his release, crediting U.S. President Donald Trump's First Step Act. According to the Federal Bureau of Prisons' inmate locator, Lichtenstein is scheduled for release on February 9, 2026. "I remain committed to making a positive impact in cybersecurity as soon as I can," Lichtenstein added. "To the supporters, thank you for everything. To the haters, I look forward to proving you wrong.""
  https://thehackernews.com/2026/01/bitfinex-hack-convict-ilya-lichtenstein.html
  https://www.infosecurity-magazine.com/news/lichtenstein-released-bitfinex/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Vulnerabilities

• Over 10K Fortinet Firewalls Exposed To Actively Exploited 2FA Bypass
  "Over 10,000 Fortinet firewalls are still exposed online and vulnerable to ongoing attacks exploiting a five-year-old critical two-factor authentication (2FA) bypass vulnerability. Fortinet released FortiOS versions 6.4.1, 6.2.4, and 6.0.10 in July 2020 to address this flaw (tracked as CVE-2020-12812) and advised admins who couldn't immediately patch to turn off username-case-sensitivity to block 2FA bypass attempts targeting their devices. This improper authentication security flaw (rated 9.8/10 in severity) was found in FortiGate SSL VPN and allows attackers to log in to unpatched firewalls without being prompted for the second factor of authentication (FortiToken) when the username's case is changed."
  https://www.bleepingcomputer.com/news/security/over-10-000-fortinet-firewalls-exposed-to-ongoing-2fa-bypass-attacks/

Malware

• ColdFusion++ Christmas Campaign: Catching a Coordinated Callback Calamity
  "GreyNoise observed a coordinated exploitation campaign targeting Adobe ColdFusion servers over the Christmas 2025 holiday period. The attack appears to be a single threat actor operating from Japan-based infrastructure (CTG Server Limited). This source was responsible for ~98% of attack traffic, systematically exploiting 10+ ColdFusion CVEs from 2023-2024. The campaign leveraged ProjectDiscovery Interactsh for out-of-band callback verification, with JNDI/LDAP injection as the primary attack vector. The deliberate timing during Christmas Day (68% of traffic) suggests intentional targeting during reduced security monitoring periods."
  https://www.labs.greynoise.io/grimoire/2025-12-26-coldfusion/
  https://www.securityweek.com/adobe-coldfusion-servers-targeted-in-coordinated-campaign/
  https://securityaffairs.com/186450/uncategorized/thousands-of-coldfusion-exploit-attempts-spotted-during-christmas-holiday.html
• APT36 : Multi-Stage LNK Malware Campaign Targeting Indian Government Entities
  "CYFIRMA has identified a targeted malware campaign attributed to APT36 (Transparent Tribe), a Pakistan aligned threat actor actively engaged in cyber espionage operations against Indian governmental, academic, and strategic entities. The campaign employs deceptive delivery techniques, including a weaponized Windows shortcut (LNK) file masquerading as a legitimate PDF document and embedded with full PDF content to evade user suspicion."
  https://www.cyfirma.com/research/apt36-multi-stage-lnk-malware-campaign-targeting-indian-government-entities/
  https://thehackernews.com/2026/01/transparent-tribe-launches-new-rat.html
  https://therecord.media/pakistan-linked-hacking-group-targets-indian-orgs
• VVS Discord Stealer Using Pyarmor For Obfuscation And Detection Evasion
  "This article details our technical analysis of VVS stealer, also styled VVS $tealer, including its distributors’ use of obfuscation and detection evasion. The stealer is written in Python and targets Discord users, exfiltrating sensitive information like credentials and tokens stored in Discord accounts. This stealer was once in active development and marketed for sale on Telegram as early as April 2025. VVS stealer's code is obfuscated by Pyarmor. This tool is used to obfuscate Python scripts to hinder static analysis and signature-based detection. Pyarmor can be used for legitimate purposes and also leveraged to build stealthy malware."
  https://unit42.paloaltonetworks.com/vvs-stealer/

Breaches/Hacks/Leaks

• Hackers Claim To Hack Resecurity, Firm Says It Was a Honeypot
  "Threat actors associated with the "Scattered Lapsus$ Hunters" (SLH) claim to have breached the systems of cybersecurity firm Resecurity and stolen internal data, while Resecurity says the attackers only accessed a deliberately deployed honeypot containing fake information used to monitor their activity. Today, threat actors published screenshots on Telegram of the alleged breach, claiming they stole employee data, internal communications, threat intelligence reports, and client information. "We would like to announce that we have gained full access to REsecurity systems," the group wrote on Telegram, claiming to have stolen "all internal chats and logs", "full employee data", "threat intel related reports", and a "complete client list with details.""
  https://www.bleepingcomputer.com/news/security/hackers-claim-resecurity-hack-firm-says-it-was-a-honeypot/
  https://databreaches.net/2026/01/03/shinyhunters-claims-to-have-compromised-resecurity-but-it-looks-like-they-fell-for-a-honeypot/
  https://hackread.com/resecurity-shinyhunters-honeypot-breach/
  https://securityaffairs.com/186528/security/resecurity-caught-shinyhunters-in-honeypot.html
• Covenant Health Says May Data Breach Impacted Nearly 478,000 Patients
  "The Covenant Health organization has revised to nearly 500,000 the number of individuals affected by a data breach discovered last May. The healthcare entity initially reported in July that the data of 7,864 people had been exposed, but further analysis has revealed a larger impact. After completing “the bulk of its data analysis,” Covenant Health now says that 478,188 individuals were affected. Covenant Health is a Catholic healthcare provider based in Andover, Massachusetts, operating hospitals, nursing and rehabilitation centers, assisted living residences, and elder care organizations across New England and parts of Pennsylvania."
  https://www.bleepingcomputer.com/news/security/covenant-health-says-may-data-breach-impacted-nearly-478-000-patients/
  https://therecord.media/covenant-health-breach-qilin
  https://www.securityweek.com/covenant-health-data-breach-impacts-478000-individuals/
  https://securityaffairs.com/186439/data-breach/covenant-health-data-breach-after-ransomware-attack-impacted-over-478000-people.html
• Tokyo FM Data Breach: Hacker Claims Over 3 Million Records Stolen
  "A major cyber incident has surfaced involving Tokyo FM Broadcasting Co., LTD., one of the most prominent radio stations in Japan. On January 1st, 2026, a time when most people were busy celebrating the New Year holiday, a person or group using the alias “victim” announced that they had broken into the company’s private computer systems. Radio stations, as we know it, hold a lot of listener and employee information, making them prime targets for cybercriminals. While the station is a big name in the news and multimedia world, this situation is currently being treated as a standard case of cybercrime."
  https://hackread.com/tokyo-fm-data-breach-hacker-3-million-records-stolen/
• Sedgwick Confirms Cyber Incident Affecting Its Major Federal Contractor Subsidiary
  "Claims administration company Sedgwick confirmed that its government-focused subsidiary is dealing with a cybersecurity incident. On New Year’s Eve, the TridentLocker ransomware gang claimed it attacked Sedgwick Government Solutions and stole 3.4 gigabytes of data. A Sedgwick spokesperson confirmed the company is currently addressing a security incident at the subsidiary, which provides claims and risk management services to federal agencies like the Department of Homeland Security (DHS), Immigration and Customs Enforcement, Customs and Border Protection, Citizenship and Immigration Services, the Department of Labor, and the Cybersecurity and Infrastructure Security Agency (CISA)."
  https://therecord.media/sedgwick-cyber-incident-ransomware
• Cybercrook Claims To Be Selling Infrastructure Info About Three Major US Utilities
  "A cybercrook claims to have breached Pickett and Associates, a Florida-based engineering firm whose clients include major US utilities, and is selling what they claim to be about 139 GB of engineering data about Tampa Electric Company, Duke Energy Florida, and American Electric Power. The price is 6.5 bitcoin, which amounts to about $585,000. Based in Tampa, Florida, Pickett USA provides transmission and distribution design, project management, surveying, aerial mapping, and LiDAR (Light Detection and Ranging) services to utilities and mining operations across the US and Caribbean."
  https://www.theregister.com/2026/01/02/critical_utility_files_for_sale/

General News

• Why 47-Day TLS And SSL Certificate Renewal Cycles Alarm CIOs
  "The era of short-lived Transport Layer Security and Secure Sockets Layer certificates is redefining enterprise resilience. By 2029, certificate lifespans are expected to drop to 47 days - a shift that transforms certificate renewal from a periodic task into a continuous operational function. For many CIOs, this raises critical questions around outage exposure, automation readiness and oversight accountability."
  https://www.bankinfosecurity.com/47-day-tls-ssl-certificate-renewal-cycles-alarm-cios-a-30427
• CISA Known Exploited Vulnerabilities Surged 20% In 2025
  "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 245 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in 2025, as the database grew to 1,484 software and hardware flaws at high risk of cyberattacks. The agency removed at least one vulnerability from the catalog in 2025 – CVE-2025-6264, a Velociraptor Incorrect Default Permissions vulnerability that CISA determined had insufficient evidence of exploitation – but the database has generally grown steadily since its launch in November 2021."
  https://cyble.com/blog/cisa-kev-2025-exploited-vulnerabilities-growth/
• Cybersecurity Predictions For 2026: Navigating The Future Of Digital Threats
  "As the digital landscape continues to evolve, so too do the threats that organizations must contend with. In this year's final Reporter's Notebook conversation, cybersecurity experts Rob Wright from Dark Reading, David Jones from Cybersecurity Dive, and Alissa Irei from Tech Target Search Security share their insights on what the future holds for cybersecurity in 2026. Drawing from AI-summarized industry reports and expert opinions, the conversation highlights key trends, challenges, and opportunities that will shape the way businesses approach security in the coming years. From the rise of AI-driven threats to the growing importance of resilience, the panelists paint a vivid picture of the road ahead."
  https://www.darkreading.com/threat-intelligence/cybersecurity-predictions-for-2026-navigating-the-future-of-digital-threats
• CTO New Year Resolutions For a More Secure 2026
  "As CTOs endeavor to take a breath after a breakneck year of keeping up with continual upheaval in engineering patterns due to AI, the flipping of calendar pages is a perfect time to evaluate what's working and what's not from a security perspective. Dark Reading recently caught up with a panel of software engineering, product security, and cybersecurity experts to discuss the top resolutions that security-minded CTOs should make in the coming year. Here are their top five picks."
  https://www.darkreading.com/cyber-risk/cto-new-year-resolutions-for-a-more-secure-2026
• From Experiment To Production, AI Settles Into Embedded Software Development
  "AI-generated code is already running inside devices that control power grids, medical equipment, vehicles, and industrial plants. AI tools have become standard in embedded development workflows. More than 80% of respondents to a new RunSafe Security survey say they currently use AI to assist with tasks such as code generation, testing, or documentation. Another 20% say they are actively evaluating AI. No respondents report avoiding AI entirely."
  https://www.helpnetsecurity.com/2026/01/02/ai-embedded-systems-development/
• How AI Made Scams More Convincing In 2025
  "Most cybercriminals stick with what works. But once a new method proves effective, it spreads quickly—and new trends and types of campaigns follow. In 2025, the rapid development of Artificial Intelligence (AI) and its use in cybercrime went hand in hand. In general, AI allows criminals to improve the scale, speed, and personalization of social engineering through realistic text, voice, and video. Victims face not only financial loss, but erosion of trust in digital communication and institutions."
  https://www.malwarebytes.com/blog/news/2026/01/how-ai-made-scams-more-convincing-in-2025
• Cybercrime In 2026: Faster, Smarter And Fully Industrialized
  "Cybercrime is no longer a loose collection of hackers, tools and opportunistic attacks. As we move into 2026, it has matured into a highly industrialized ecosystem—complete with specialization, automation, affiliate networks, and even cartel-like business models. The result is a threat landscape defined by speed, scale and sophistication, where attackers adapt faster than traditional defenses can respond."
  https://blog.barracuda.com/2026/01/02/cybercrime-in-2026--faster--smarter-and-fully-industrialized

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 2 รายการ เมื่อวันที่ 30 ธันวาคม 2025 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-25-364-01: WHILL C2 Wheelchairs
• ICSA-25-345-03: AzeoTech DAQFactory (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/alerts/2025/12/30/cisa-releases-two-industrial-control-systems-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand