Financial Sector

• August 2025 Security Issues In Korean & Global Financial Sector
  "This report comprehensively covers actual cyber threats and security issues related to financial companies in South Korea and abroad. This article includes an analysis of malware and phishing cases distributed to the financial sector, the top 10 malware strains targeting the financial sector, and the industry statistics of leaked Korean accounts on Telegram. A detailed look into the phishing email distribution case targeting the financial sector is also covered."
  https://asec.ahnlab.com/en/90110/

Healthcare Sector

• Attackers Are Coming For Drug Formulas And Patient Data
  "In the pharmaceutical industry, clinical trial data, patient records, and proprietary drug formulas are prime targets for cybercriminals. These high-value assets make the sector a constant focus for attacks. Disruptions to research or medicine distribution can have life-threatening consequences. “During global health crises, cyber attackers swiftly exploit vulnerabilities. The COVID-19 pandemic saw a fivefold increase in phishing attempts targeting WHO, with attackers impersonating leadership to distribute malware,” said Flavio Aggio, CISO at the World Health Organization."
  https://www.helpnetsecurity.com/2025/09/12/ciso-pharma-cybersecurity-risks/

Vulnerabilities

• Samsung Patches Actively Exploited Zero-Day Reported By WhatsApp
  "Samsung has patched a remote code execution vulnerability that was exploited in zero-day attacks targeting its Android devices. Tracked as CVE-2025-21043, this critical security flaw affects Samsung devices running Android 13 or later and was reported by the security teams of Meta and WhatsApp on August 13. As Samsung explains in a recently updated advisory, this vulnerability was discovered in libimagecodec.quram.so (a closed-source image parsing library developed by Quramsoft that implements support for various image formats) and is caused by an out-of-bounds write weakness that allows attackers to execute malicious code on vulnerable devices remotely."
  https://www.bleepingcomputer.com/news/security/samsung-patches-actively-exploited-zero-day-reported-by-whatsapp/
  https://thehackernews.com/2025/09/samsung-fixes-critical-zero-day-cve.html
  https://securityaffairs.com/182135/hacking/samsung-fixed-actively-exploited-zero-day.html
  https://www.theregister.com/2025/09/12/samsung_fixes_android_0day/
  https://hackread.com/samsung-android-image-parsing-vulnerability-attacks/
• NFC Card Vulnerability Exploitation Leading To Free Top-Up In KioSoft "Stored Value" Unattended Payment Solution (Mifare)
  "Some KioSoft customers currently use outdated MiFare Classic cards in "Stored Value" Unattended Payment Solutions from KioSoft. A new detection algorithm has been rolled out through firmware according to KioSoft. As a long-term fix, hardware changes with a new reader and secure cards are planned as well. KioSoft understands that its customers continually take steps to track suspicious activity as routine. Mifare Classic cards have been found to be vulnerable to attacks in the past, allowing these cards to be modified or copied. A short-term solution may be to transition away from the Stored Value Payment System to the Online Payment System of KioSoft, which does not have this vulnerability according to the vendor."
  https://sec-consult.com/vulnerability-lab/advisory/nfc-card-vulnerability-exploitation-leading-to-free-top-up-kiosoft-payment-solution/
  https://www.securityweek.com/payment-system-vendor-took-year-to-patch-infinite-card-top-up-hack-security-firm/

Malware

• Introducing HybridPetya: Petya/NotPetya Copycat With UEFI Secure Boot Bypass
  "ESET Research has discovered HybridPetya, on the VirusTotal sample sharing platform. It is a copycat of the infamous Petya/NotPetya malware, adding the capability of compromising UEFI-based systems and weaponizing CVE‑2024‑7344 to bypass UEFI Secure Boot on outdated systems."
  https://www.welivesecurity.com/en/eset-research/introducing-hybridpetya-petya-notpetya-copycat-uefi-secure-boot-bypass/
  https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
  https://thehackernews.com/2025/09/new-hybridpetya-ransomware-bypasses.html
  https://www.bankinfosecurity.com/hybridpetya-crypto-locker-outsmarts-uefi-secure-boot-a-29437
  https://www.helpnetsecurity.com/2025/09/12/hybridpetya-ransomware-secure-boot-bypass/
  https://www.theregister.com/2025/09/12/hopefully_just_a_poc_hybridpetya/
  https://securityaffairs.com/182149/malware/hybridpetya-ransomware-bypasses-uefi-secure-boot-echoing-petya-notpetya.html
• Meet Yurei: The New Ransomware Group Rising From Open-Source Code
  "A new ransomware group calling itself Yurei has appeared on the cyber crime scene, and it wasted no time in making headlines. First observed on September 5 by Check Point Research, the group listed its first victim, a food manufacturing company in Sri Lanka, on its darknet site. Within just a few days, two more victims, one in India and one in Nigeria, were added. Yurei’s quick rise illustrates a growing challenge: how easily cyber criminals can turn open-source malware into real-world ransomware operations, even with limited skills and effort."
  https://blog.checkpoint.com/research/meet-yurei-the-new-ransomware-group-rising-from-open-source-code/
• SEO Poisoning Attack Targets Chinese-Speaking Users With Fake Software Sites
  "In August 2025, FortiGuard Labs identified an SEO poisoning campaign aimed at Chinese-speaking users. The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites. By using convincing language and small character substitutions, they tricked victims into visiting spoofed pages and downloading malware"
  https://www.fortinet.com/blog/threat-research/seo-poisoning-attack-targets-chinese-speaking-users-with-fake-software-sites
  https://hackread.com/seo-poisoning-attack-windows-hiddengh0st-winos-malware/
• Massive L7 DDoS Botnet Expands To 5.76M Devices, Qrator Labs Reports
  "On September 1, 2025, Qrator.AntiDDoS detected and mitigated another large-scale attack carried out by the largest L7 DDoS botnet observed to date. The target was an organization in the government sector. In total, 5.76 million IP addresses were blocked during the incident. Qrator Labs has been monitoring this botnet for several months. The first attack, recorded on March 26, targeted an organization in the online betting sector. It involved about 1.33 million IP addresses, mostly from Brazil, Argentina, Russia, Iraq, and Mexico. A second incident followed on May 16, this time hitting an organization in the government sector, with the botnet already grown to 4.6 million devices. Most of the traffic originated from IP addresses in Brazil, the United States, Vietnam, India, and Argentina."
  https://qrator.net/blog/details/massive-l7-ddos-botnet-expands-to-576m-devices-qra
  https://hackread.com/qrator-labs-mitigate-l7-ddos-attack-5-76m-botnet/
• FBI Warns Of UNC6040 And UNC6395 Targeting Salesforce Platforms In Data Theft Attacks
  "The U.S. Federal Bureau of Investigation (FBI) has issued a flash alert to release indicators of compromise (IoCs) associated with two cybercriminal groups tracked as UNC6040 and UNC6395 for a string of data theft and extortion attacks. "Both groups have recently been observed targeting organizations' Salesforce platforms via different initial access mechanisms," the FBI said."
  https://thehackernews.com/2025/09/fbi-warns-of-unc6040-and-unc6395.html
  https://www.ic3.gov/CSA/2025/250912.pdf
  https://www.bleepingcomputer.com/news/security/fbi-warns-of-unc6040-unc6395-hackers-stealing-salesforce-data/
  https://securityaffairs.com/182159/cyber-crime/fbi-warns-of-salesforce-attacks-by-unc6040-and-unc6395-groups.html
• WhiteCobra's Playbook Exposed: Critical Mistake Reveals 24-Extension Campaign Targeting VS Code And Cursor
  "A new wave 24 of malicious extensions targeting VSCode, Cursor and Windsurf users have infiltrated the VSCode and OpenVSX marketplaces over the past month, and now we now know exactly how they did it. Today we unveil a coordinated campaign by a threat actor group nicknamed WhiteCobra, that we’ve been tracking for over a year. This is the same group behind the $500K crypto theft revealed two months ago, a slew of malicious extensions published on the VSCode and OpenVSX marketplaces in 2024 and 2025, and now they're back with evolved tactics."
  https://www.koi.security/blog/whitecobra-vscode-cursor-extensions-malware
  https://www.bleepingcomputer.com/news/security/whitecobra-floods-vscode-market-with-crypto-stealing-extensions/

Breaches/Hacks/Leaks

• Vietnam, Panama Governments Suffer Incidents Leaking Citizen Data
  "Data from the government organizations in Vietnam and Panama was stolen by hackers in multiple cyber incidents that came to light this week. Vietnam’s state news outlet said the country’s Cyber Emergency Response Team (VNCERT) confirmed that it received a report of an incident impacting the National Credit Information Center (CIC), which is run by the State Bank of Vietnam and manages credit information for the country’s citizens and businesses. VNCERT said initial reports show that personal data was leaked as a result of the attack. The organization is now coordinating with multiple agencies and state-owned telecom Viettel on the investigation."
  https://therecord.media/vietnam-cic-panama-finance-ministry-cyberattacks
  https://securityaffairs.com/182189/cyber-crime/shinyhunters-attack-national-credit-information-center-of-vietnam.html
• China’s Great Firewall Suffers Its Biggest Leak Ever As 500GB Of Source Code And Docs Spill Online — Censorship Tool Has Been Sold To Three Different Countries
  "Chinese censorship sprang a major leak on September 11, when researchers confirmed that more than 500GB of internal documents, source code, work logs, and internal communications from the so-called Great Firewall were dumped online, including packaging repos and operational runbooks used to build and maintain China’s national traffic filtering system. The files appear to originate from Geedge Networks, a company that has long been linked to Fang Binxing — widely described as the “father” of the Great Firewall — and from the MESA lab at the Institute of Information Engineering, a research arm of the Chinese Academy of Sciences."
  https://www.tomshardware.com/tech-industry/chinas-great-firewall-springs-huge-leak
  https://gfw.report/blog/geedge_and_mesa_leak/en/
  https://hackread.com/great-firewall-of-china-data-published-largest-leak/

General News

• August 2025 APT Group Trends
  "North Korea-linked APT groups have been intensively launching advanced cyber attacks targeting the areas of diplomacy, finance, technology, media, and policy research in South Korea. They have been highly active in their sophisticated spear-phishing campaigns employing various malware strains, social engineering techniques, and cloud-based C2 infrastructures. They have been combining various infiltration techniques such as LNK and PowerShell-based loaders, steganography (JPEG image concealment), and fileless techniques to distribute RATs and data exfiltration malware."
  https://asec.ahnlab.com/en/90104/
• Exclusive: US Warns Hidden Radios May Be Embedded In Solar-Powered Highway Infrastructure
  "U.S. officials say solar-powered highway infrastructure including chargers, roadside weather stations, and traffic cameras should be scanned for the presence of rogue devices – such as hidden radios – secreted inside batteries and inverters. The advisory, disseminated late last month by the U.S. Department of Transportation’s Federal Highway Administration, comes amid escalating government action over the presence of Chinese technology in America's transportation infrastructure."
  https://www.reuters.com/legal/government/us-warns-hidden-radios-may-be-embedded-solar-powered-highway-infrastructure-2025-09-10/
  https://www.darkreading.com/ics-ot-security/undocumented-radios-found-solar-powered-devices
• Your Heartbeat Could Reveal Your Identity, Even In Anonymized Datasets
  "A new study has found that electrocardiogram (ECG) signals, often shared publicly for medical research, can be linked back to individuals. Researchers were able to re-identify people in anonymous datasets with surprising accuracy, raising questions about how health data is protected and shared."
  https://www.helpnetsecurity.com/2025/09/12/heartbeat-ecg-data-privacy-risk/
• CISOs Brace For a New Kind Of AI Chaos
  "AI is being added to business processes faster than it is being secured, creating a wide gap that attackers are already exploiting, according to the SANS Institute. Attackers are using AI to work at speeds that humans cannot match. Phishing messages are more convincing, privilege escalation happens faster, and automated scripts can adjust mid-attack to avoid detection. The report highlights research showing that AI-driven attacks can move more than 40 times faster than traditional methods. This means a breach can happen before a defender even sees the first alert."
  https://www.helpnetsecurity.com/2025/09/12/sans-ai-security-blueprint/
• HP Wolf Security Threat Insights Report: September 2025
  "Welcome to the September 2025 edition of the HP Wolf Security Threat Insights Report. In the report, we review notable malware campaigns, trends and techniques identified from HP Wolf Security’s customer telemetry in calendar Q2 2025. In Q2 2025, the HP Threat Research team identified attackers refining their use of living-off-the-land (LOTL) tools to evade detection. In one campaign that targeted businesses, threat actors chained together multiple LOTL tools, including lesser-known ones, to deliver XWorm malware. The final payload was hidden in the pixels of an image (T1027.003) downloaded from a trusted website, decoded via PowerShell (T1059.001), and executed through MSBuild (T1127.001), enabling remote access and data theft."
  https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2025/
  https://threatresearch.ext.hp.com/wp-content/uploads/2025/09/HP_Wolf_Security_Threat_Insights_Report_September_2025.pdf
  https://www.infosecurity-magazine.com/news/attackers-novel-lotl-detection/
• Trusted Connections, Hidden Risks: Token Management In The Third-Party Supply Chain
  "You are about to log off for the weekend when a high-severity alert flashes on your cloud security tool’s dashboard. A single, unfamiliar OAuth token is making hundreds of connections from three different IP addresses, two of which are flagged as belonging to an unknown VPN service. The token belongs to a third-party application integrated with the company's Salesforce instance, one of those forgotten dormant integrations. A threat actor has stolen an OAuth token to bypass traditional defenses and is enumerating CRM accounts and exfiltrating sensitive data. A pit forms in your stomach; you are experiencing a supply chain attack."
  https://unit42.paloaltonetworks.com/third-party-supply-chain-token-management/
• Are Cybercriminals Hacking Your Systems – Or Just Logging In?
  "Why break a door down and set the house alarm off when you have a key and a code to walk in silently? This is the rationale behind a trend in cybersecurity where adversaries are increasingly looking to steal passwords, and even authentication tokens and session cookies to bypass MFA codes so they can access networks by masquerading as legitimate users. According to Verizon, “use of stolen credentials” has been one of the most popular methods for gaining initial access over recent years. The use of stolen credentials appeared in a third (32%) of data breaches last year, its report notes. However, while there are several ways threat actors can get hold of credentials, there are also plenty of opportunities to stop them."
  https://www.welivesecurity.com/en/business-security/cybercriminals-hacking-systems-logging-in/

อ้างอิง
Electronic Transactions Development Agency(ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Siemens SIMATIC Virtualization As a Service (SIVaaS)
  "Successful exploitation of this vulnerability could allow an attacker to access or alter sensitive data without proper authorization."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-02
• Siemens Industrial Edge Management OS (IEM-OS)
  "Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-06
• Siemens User Management Component (UMC)
  "Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial-of-service condition."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-07
• Daikin Security Gateway
  "Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the system."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-10
• Siemens SIMOTION Tools
  "Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with SYSTEM privileges when a legitimate user installs an application that uses the affected setup component."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
• Siemens SINAMICS Drives
  "Successful exploitation of this vulnerability could allow users to escalate their privileges."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-03
• Siemens SINEC OS
  "Successful exploitation of these vulnerabilities could allow an attacker to access non-sensitive information without authentication or potentially cause a temporary denial of service."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-04
• Siemens Apogee PXC And Talon TC Devices
  "Successful exploitation of this vulnerability could allow an attacker to download the device's encrypted database file via BACnet."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-05
• Schneider Electric EcoStruxure
  "Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or disclose sensitive credential data."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-08
• Schneider Electric Modicon M340, BMXNOE0100, And BMXNOE0110
  "Successful exploitation of this vulnerability could allow attackers to prevent firmware updates and disrupt the webserver's proper behavior by removing specific files or directories from the filesystem."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-09
• Threat Landscape For Industrial Automation Systems. Q2 2025
  "In Q2 2025, the percentage of ICS computers on which malicious objects were blocked decreased by 1.4 pp from the previous quarter to 20.5%. Compared to Q2 2024, the rate decreased by 3.0 pp."
  https://ics-cert.kaspersky.com/publications/reports/2025/09/11/threat-landscape-for-industrial-automation-systems-q2-2025/

Vulnerabilities

• Critical Chrome Vulnerability Earns Researcher $43,000
  "Researchers have earned significant rewards from Google for reporting two potentially serious vulnerabilities found in the Chrome web browser. Google this week rolled out a Chrome update that fixes two security defects reported by external researchers, including a critical-severity bug in the browser’s Serviceworker component, for which a $43,000 bug bounty reward was paid. Tracked as CVE-2025-10200 and reported by Looben Yang, the critical flaw is described as a use-after-free issue. These types of memory corruption vulnerabilities appear when the program attempts to access memory that has been freed."
  https://www.securityweek.com/critical-chrome-vulnerability-earns-researcher-43000/
  https://securityaffairs.com/182107/security/google-fixes-critical-chrome-flaw-researcher-earns-43k.html
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2025-5086 Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability"
  https://www.cisa.gov/news-events/alerts/2025/09/11/cisa-adds-one-known-exploited-vulnerability-catalog
• VMScape: Exposing And Exploiting Incomplete Branch Predictor Isolation In Cloud Environments
  "VMScape (CVE-2025-40300) brings Spectre branch target injection (Spectre-BTI) to the cloud, revealing a critical gap in how branch predictor states are isolated in virtualized environments. Our systematic analysis of protection-domain isolation shows that current mechanisms are too coarse-grained: on all AMD Zen CPUs, including the latest Zen 5, the branch predictor cannot distinguish between host and guest execution, enabling practical cross-virtualization BTI (vBTI) attack primitives. Although Intel’s recent CPUs offer better isolation, gaps still exist."
  https://comsec.ethz.ch/research/microarch/vmscape-exposing-and-exploiting-incomplete-branch-predictor-isolation-in-cloud-environments/
  https://www.bleepingcomputer.com/news/security/new-vmscape-attack-breaks-guest-host-isolation-on-amd-intel-cpus/
  https://www.theregister.com/2025/09/11/vmscape_spectre_vulnerability/
• Pwn My Ride: Exploring The CarPlay Attack Surface
  "At the recent DefCon conference, we had the opportunity to present Pwn My Ride, a comprehensive exploration of the Apple CarPlay attack surface. With vehicles becoming increasingly connected, the security of in-car systems like CarPlay is critical. Our talk focused on dissecting the protocols that enable CarPlay’s functionality and revealing multiple attack vectors that could be exploited against various CarPlay multimedia systems. A key focus was CVE-2025-24132, a stack buffer overflow vulnerability within the AirPlay protocol that is exposed when a device connects to the car’s multimedia system."
  https://www.oligo.security/blog/pwn-my-ride-exploring-the-carplay-attack-surface
  https://www.darkreading.com/vulnerabilities-threats/apple-carplay-rce-exploit
  https://www.securityweek.com/remote-carplay-hack-puts-drivers-at-risk-of-distraction-and-surveillance/
• When Typing Becomes Tracking: Study Reveals Widespread Silent Keystroke Interception
  "You type your email address into a website form but never hit submit. Hours later, a marketing email shows up in your inbox. According to new research, that is not a coincidence. A team of researchers from UC Davis, Maastricht University, and other institutions has found that many websites collect keystrokes as users type, sometimes before a form is ever submitted. The study explores how third-party scripts capture and share this information in ways that may fit the legal definition of wiretapping under California law."
  https://www.helpnetsecurity.com/2025/09/11/website-keystroke-tracking-privacy/
  https://arxiv.org/pdf/2508.19825
• Cisco Patches High-Severity IOS XR Vulnerabilities
  "Cisco on Wednesday released patches for three vulnerabilities in IOS XR software, as part of its September 2025 security advisory bundled publication. Tracked as CVE-2025-20248 (CVSS score of 6), the first of the bugs is a high-severity issue in the IOS XR installation process that could allow attackers to bypass image signature verification. Successful exploitation of the flaw, Cisco explains, could lead to unsigned files being added to an ISO image, which could then be installed and activated on a device."
  https://www.securityweek.com/cisco-patches-high-severity-ios-xr-vulnerabilities/
• UAE’s K2 Think AI Jailbroken Through Its Own Transparency Features
  "K2 Think, the recently launched AI system from the United Arab Emirates built for advanced reasoning, has been jailbroken by exploiting the quality of its own transparency. Transparency in AI is a quality urged, if not explicitly required, by numerous international regulations and guidelines. The EU AI Act, for example, has specific transparency requirements, including explainability – users must be able to understand how the model has arrived at its conclusion."
  https://www.securityweek.com/uaes-k2-think-ai-jailbroken-through-its-own-transparency-features/

Malware

• Trigona Rebranding Suspicions And Global Threats, And BlackNevas Ransomware Analysis
  "BlackNevas has been continuously launching ransomware attacks against companies in various industries and countries, including South Korea. This post provides a technical analysis on the characteristics, encryption methods, and reasons why BlackNevas encrypts files in a way that makes them impossible to decrypt. It is hoped that this post will provide insights for defending against similar threats in the future."
  https://asec.ahnlab.com/en/90080/
• EvilAI Operators Use AI-Generated Code And Fake Apps For Far-Reaching Attacks
  "In recent weeks, Trend Research has observed a new wave of malware campaigns that infiltrate systems by posing as legitimate AI tools and software – complete with realistic interfaces, code signing, and convincing utility features – making them appear legitimate to end users. Rather than relying on obviously malicious files, these trojans mimic the appearance of real software to go unnoticed into both corporate and personal environments, often gaining persistent access before raising any suspicion."
  https://www.trendmicro.com/en_us/research/25/i/evilai.html
  https://www.darkreading.com/cyberattacks-data-breaches/ai-backed-malware-hits-companies-worldwide
• Vidar Infostealer Back With a Vengeance
  "The long-running Vidar infostealer has evolved with new obfuscation techniques. That is according to researchers at cybersecurity vendor Aryaka, which published research last week dedicated to a fresh campaign involving the malware-as-a-service Vidar that has emerged in recent weeks. First tracked in late 2018, Vidar is an infostealer that enables affiliates to grab credentials, operating system details, cookies, sensitive financial data, various authentication tokens, and more from compromised environments."
  https://www.darkreading.com/endpoint-security/vidar-infostealer-back-with-vengeance
  https://www.aryaka.com/docs/reports/vidar-infostealer-in-action.pdf
• PoisonGPT: Weaponizing AI For Disinformation
  "Not all malicious AI tools are designed for immediate profit or hacking — some are crafted to twist the truth at scale. PoisonGPT is a prime example of this darker application of generative AI. Unlike the other tools we’ve explored in this series, PoisonGPT was not sold on forums but instead was developed as a proof-of-concept by security researchers in July 2023 to highlight the risks associated with AI-driven misinformation."
  https://blog.barracuda.com/2025/09/11/poisongpt-weaponizing-ai-disinformation
• Malicious Facebook Ads Push Fake ‘Meta Verified’ Browser Extensions To Steal Accounts
  "Threat actors are at it again, targeting content creators and businesses with a new malvertising campaign on Meta. This time, the malicious ads are bundled with a video tutorial that guides viewers through the process of downloading and installing a so-called browser extension, which claims to unlock the blue verification tick on Facebook or other special features. At a glance, it looks legitimate, and maybe even helpful. After all, why would scammers go through the trouble of recording tutorials unless the tool really worked? But as the saying goes, “there's no such thing as a free lunch.” This software is nothing more than a malicious browser extension designed to steal your data."
  https://www.bitdefender.com/en-us/blog/hotforsecurity/malicious-facebook-ads-push-fake-meta-verified-browser-extensions-to-steal-accounts
  https://thehackernews.com/2025/09/fake-madgicx-plus-and-socialmetrics.html
• Uncloaking VoidProxy: a Novel And Evasive Phishing-As-a-Service Framework
  "Okta Threat Intelligence has published a detailed analysis on a previously unreported Phishing-as-a-Service (PhaaS) operation, which its authors name VoidProxy. VoidProxy is a novel and highly evasive service used by attackers to target Microsoft and Google accounts. The service is also capable of redirecting accounts protected by third-party single sign-on (SSO) providers like Okta to second-stage phishing pages. VoidProxy represents a mature, scalable and evasive threat to traditional email security and authentication controls."
  https://sec.okta.com/articles/uncloakingvoidproxy/
  https://www.theregister.com/2025/09/11/voidproxy_phishing_service/
• Cyberspike Villager – Cobalt Strike’s AI-Native Successor
  "Straiker’s AI Research (STAR) team recently uncovered Villager, an AI-native penetration testing framework in the wild by the Chinese-based group Cyberspike. Originally positioned as a red-team offering, Cyberspike has released an AI-enabled, MCP-supported automation tool called "Villager" that combines Kali Linux toolsets with DeepSeek AI models to fully automate testing workflows. The package is published in PyPI.org and has recorded ~10,000 downloads in two months. The rapid, public availability and automation capabilities create a realistic risk that Villager will follow the Cobalt Strike trajectory: commercially or legitimately developed tooling becoming widely adopted by threat actors for malicious campaigns."
  https://www.straiker.ai/blog/cyberspike-villager-cobalt-strike-ai-native-successor
  https://www.theregister.com/2025/09/11/cobalt_strikes_ai_successor_downloaded/

Breaches/Hacks/Leaks

• Panama Ministry Of Economy Discloses Breach Claimed By INC Ransomware
  "Panama's Ministry of Economy and Finance (MEF) has disclosed that one of its computers may have been compromised in a cyberattack.. The government noted that it activated the security procedures for these situations, stating that the incident has been contained and didn't impact core systems that are vital to its operations. "The Ministry of Economy and Finance informs the public that today an incident involving possible malicious software was detected on one of the Ministry's workstations," MEF says in an official statement."
  https://www.bleepingcomputer.com/news/security/panama-ministry-of-economy-discloses-breach-claimed-by-inc-ransomware/
• Exclusive: High-End Fashion Retailers Gucci, Balenciaga, Brioni, And Alexander McQueen Hit By Salesforce Attacks
  "Those readers who aren’t A-listers (including yours truly) may never have heard of Kering, but you may have heard of their high-end fashion brands: Gucci. Yves Saint Laurent. Bottega Veneta. Balenciaga. Alexander McQueen. Brioni. It is some of those fashion brands that are the subject of this post as they fell prey to attacks by ShinyHunters. As far as DataBreaches.net can determine, Kering has yet to publicly acknowledge either of two attacks or to notify customers."
  https://databreaches.net/2025/09/11/exclusive-high-end-fashion-retailers-gucci-balenciaga-brion-and-alexander-mcqueen-hit-by-salesforce-attacks/
• LNER Reveals Supply Chain Attack Compromised Customer Information
  "The operator of one of the UK’s busiest rail lines has admitted that an unauthorized third party has accessed customer details via a supplier. LNER, the government-owned company that runs east coast services between London and Scotland, revealed the incident in an online update yesterday. “We have been made aware of unauthorised access to files managed by a third-party supplier, which involves customer contact details and some information about previous journeys,” it said."
  https://www.infosecurity-magazine.com/news/lner-supply-chain-attack-customer/
  https://www.theregister.com/2025/09/11/lner_says_customer_data_stolen/
  https://hackread.com/uk-rail-operator-lner-cyber-attack-passenger-data/
  https://www.securityweek.com/uk-train-operator-lner-warns-customers-of-data-breach/
• France: Three Regional Healthcare Agencies Targeted By Cyber-Attacks
  "French regional healthcare agencies have been targeted by cyber-attacks compromising the personal data of patients across the country. On September 8, the regional healthcare agencies (ARS) for three regions, Hauts-de-France (Upper France), Normandy and Pays de la Loire (Lower Loire), issued security alerts warning about recent cyber-attacks carried out against the servers hosting the identity data of patients from public hospitals in the regions. All three agencies described a very similar incident with the same impact."
  https://www.infosecurity-magazine.com/news/france-regional-healthcare/
• 100,000 Impacted By Cornwell Quality Tools Data Breach
  "American mobile tools manufacturer Cornwell Quality Tools has informed authorities that a data breach discovered late last year impacts more than 100,000 people. According to notification letters sent out to the affected individuals, Cornwell Quality Tools discovered unusual activity on its network on December 20, 2024. An investigation completed recently showed that hackers had gained access to its systems and files a week earlier. The company is telling impacted people that information such as their name, Social Security number, medical information, and financial account number may have been compromised."
  https://www.securityweek.com/100000-impacted-by-cornwell-quality-tools-data-breach/

General News

• Apple Warns Customers Targeted In Recent Spyware Attacks
  "Apple warned customers last week that their devices were targeted in a new series of spyware attacks, according to the French national Computer Emergency Response Team (CERT-FR). CERT-FR is operated by ANSSI, the National Cybersecurity Agency, and is responsible for preventing and mitigating cybersecurity-related incidents impacting public and critical organizations. According to a Thursday advisory, CERT-FR is aware of at least four instances of Apple threat notifications alerting the company's users about mercenary spyware attacks that have occurred since the beginning of the year."
  https://www.bleepingcomputer.com/news/security/apple-warns-customers-targeted-in-recent-spyware-attacks/
  https://cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-010/
• Global Cyber Threats August 2025: Agriculture In The Crosshairs
  "In August 2025, the global cyber threat landscape presented a complex interplay of stability and alarming new challenges. Organizations around the world confronted an average of nearly 2,000 cyber attacks each week—a slight 1% decrease from July but a stark 10% rise compared to the same month last year. Particularly concerning is the agricultural sector, which has seen a staggering 101% increase in cyber incidents since August 2024. Although the overall volume of attacks has somewhat stabilized, the evolving distribution of threats across industries, regions, and types of attacks suggests a troubling trend that demands our attention. As businesses navigate this new reality, understanding the nuances of the current cyber threat landscape is more critical than ever."
  https://blog.checkpoint.com/research/global-cyber-threats-august-2025-agriculture-hit-hard/
• How Attackers Weaponize Communications Networks
  "In this Help Net Security interview, Gregory Richardson, Vice President, Advisory CISO Worldwide, at BlackBerry, talks about the growing risks to communications networks. He explains why attackers focus on these networks and how their motivations range from corporate espionage to geopolitical influence. The discussion also covers practical ways to secure networks and maintain reliable communication."
  https://www.helpnetsecurity.com/2025/09/11/gregory-richardson-blackberry-securing-communication-networks/
• AI Is Everywhere, But Scaling It Is Another Story
  "AI is being adopted across industries, but many organizations are hitting the same obstacles, according to Tines. IT leaders say orchestration is the key to scaling AI. They point to governance, visibility, and collaboration as the critical areas executives need to watch. Organizations are pouring resources into AI, yet many initiatives remain isolated or slow-moving. Without a coordinated approach, AI deployments can become fragmented and harder to secure. Research shows that IT teams see orchestration (coordinating processes, systems, and workflows) as the missing link to scaling AI in a safe and compliant way."
  https://www.helpnetsecurity.com/2025/09/11/ai-enterprise-orchestration-scaling/
• Why Organizations Need a New Approach To Risk Management
  "To succeed in the risk environment, risk, audit, and compliance leaders need to focus on what Gartner calls “reflexive risk ownership.” This is a future state where business leaders don’t just identify and manage risks after they occur, but instinctively recognize and respond to them as part of their daily decision-making. At the opening keynote of the Gartner Enterprise Risk, Audit & Compliance Conference, Gartner experts highlighted how risks are now emerging faster, overlapping, and becoming harder to classify. This makes it essential for organizations to rethink how they approach risk management."
  https://www.helpnetsecurity.com/2025/09/11/gartner-organizational-risk-management-strategy/
• AI Emerges As The Hope—and Risk—for Overloaded SOCs
  "The problems faced by SOCs are well known, understood, and quantified – but not yet solved. SMEs get around 500 security alerts every day; larger enterprises receive nearer 3,000. Forty percent of these are never investigated, while 57% of companies suppress their detection rules to lessen the load. Most SOCs cannot cope with the existing alert load, while others seek to reduce it by consciously accepting unknown risk (often in the cloud and identity spheres). These figures come from a Prophet Security analysis (PDF) that canvassed 282 security leaders (CISOs, security directors, managers, and analysts) from companies with more than 1,000 employees, primarily in the United States."
  https://www.securityweek.com/ai-emerges-as-the-hope-and-risk-for-overloaded-socs/
• Cyberattacks Against Schools Driven By a Rise In Student Hackers, ICO Warns
  "The U.K.’s Information Commissioner's Office (ICO) warned on Thursday that student hackers motivated by dares are driving an increasing number of cyberattacks and data breaches affecting schools. It advised parents to “to have regular conversations with their children about what they get up to online” and warned that children hacking into their school’s computer systems may be setting themselves up for lives of cybercrime."
  https://therecord.media/cyberattacks-against-schools-driven-by-student-hackers
• Going Dark: ShinyHunters/ScatteredSpider/LAPSUS$ Say Goodbye
  "On September 8, the “scattered LAPSUS$ hunters 4.0” Telegram channel posted: FBI and French LE, great job for the third time arresting the wrong person in France once again. DOJ please stop wasting your budget by flying your agents to France every time to make the WRONG arrest, as it’s almost the end of the fiscal year, please save your money, and please do a better job at investigating us instead of arresting innocent individuals and stop falling for our (most obvious) each and all of our schemes and disinformation campaigns. That person who law enforcement allegedly arrested has been MIA for 6 hours and more. We have always been aware since the beginning. You can make as many arrests as you want and we’ll still be active with the same amount of efficiency as we always were."
  https://databreaches.net/2025/09/11/going-dark-shinyhunters-scatteredspider-lapsus-say-goodbye/

อ้างอิง
Electronic Transactions Development Agency(ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand