โพสต์ถูกสร้างโดย NCSA_THAICERT

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Vulnerabilities

• Seven FatFs Bugs, One Very Large Blast Radius
  "Heads up! If you ship firmware that touches FAT media (think any removable storage, like USB drives and SDCards), you'll want to pay attention to this post. This work was part of runZero's research into long-tail supply chain bug hunting using LLMs. We live in the future! Today, we're publishing seven CVEs documenting several vulnerabilities in FatFs project, ranging from CVSS Medium to High (no Criticals, phew!). The affected ecosystem includes some major non-hobby platforms like Espressif ESP-IDF, STMicroelectronics STM32Cube middleware, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate, with downstream reach into consumer IoT, industrial controllers, drones, crypto wallets, and more."
  https://www.runzero.com/blog/fatfs-bugs/
  https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html
• New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
  "A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Android, and a fix is out. Bad Epoll sits in the same small stretch of kernel code where Anthropic's most powerful AI model, Mythos, recently found a different bug. The AI caught one flaw and missed this one. A researcher, Jaeyoung Chung, found it and built a working attack."
  https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html
  https://github.com/J-jaeyoung/bad-epoll
• New ClamAV Security Patch Closes Seven Scanner Bugs Dating Back Two Decades
  "Open source antivirus scanning sits inside mail gateways, file upload checks, and endpoint tooling at organizations of every size. Much of that work runs through ClamAV, the scanning engine maintained by Cisco’s Talos group. The project released two patch versions, 1.5.3 and 1.4.5, carrying fixes for seven security flaws along with smaller hardening changes."
  https://www.helpnetsecurity.com/2026/07/06/clamav-security-patch-versions/

Malware

• Espionage Against The European Parliament: Member Of Committee Investigating Spyware Hacked With Pegasus
  "We found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations."
  https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/
  https://thehackernews.com/2026/07/european-parliament-member.html
  https://therecord.media/pegasus-spyware-european-parliament-pega-committee-member
  https://www.bankinfosecurity.com/lawmaker-probing-pegasus-spyware-infected-using-same-malware-a-32153
  https://cyberscoop.com/pegasus-spyware-pega-committee-member-targeted/
  https://securityaffairs.com/194728/malware/pegasus-used-against-mep-investigating-pegasus-citizen-lab-finds.html
• Verified X Ad Spreads Mac Malware, While ConsentFix Steals Microsoft Accounts
  "Cybercriminals are finding new ways to trick people into compromising their own devices and accounts. One campaign used a sponsored ad on X to target Mac users, while another technique, dubbed ConsentFix, steals Microsoft 365 accounts without installing malware. Researchers have discovered a ClickFix-style attack running as a sponsored advertisement on X. The ad was posted from a verified account, adding an extra layer of credibility to the scam."
  https://www.malwarebytes.com/blog/news/2026/07/verified-x-ad-spreads-mac-malware-while-consentfix-steals-microsoft-accounts
• Armored Likho Digging a Snake Pit: Inside The Covert BusySnake Stealer Campaign
  "During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on government agencies and the electric power sector. The geographical footprint of these attacks spans Russia, Brazil, and Kazakhstan, establishing the group as a global threat actor."
  https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/
  https://thehackernews.com/2026/07/armored-likho-targets-government.html
• The Anatomy Of a Shadow AI Supply-Chain Breach: Lessons From The 2026 Vercel Incident
  "The Vercel breach of April 2026 did not begin with a classic zero-day exploit, a misconfigured cloud bucket, or a sophisticated nation-state infrastructure implant. Instead, it unfolded when an unreviewed Artificial Intelligence (AI) tool became a trusted corporate connection without a standard enterprise security review. At first glance, the incident resembled a typical third-party software supply chain compromise. An AI tooling vendor, Context.ai, was breached via an employee account, allowing attackers to move downstream into a much larger technology provider: Vercel. However, the deeper architectural lesson lies in the relationship between the two entities. The breached tool was not part of an enterprise deployment; it was a consumer-grade browser extension self-adopted by an employee using a corporate identity."
  https://securityaffairs.com/194709/hacking/the-anatomy-of-a-shadow-ai-supply-chain-breach-lessons-from-the-2026-vercel-incident.html
• Vibe Coded Extortion: Avalon’s Path From Legal Lure To CrownX Ransom Capabilities
  "Blackpoint’s Adversary Pursuit Group (APG) identified and analyzed a previously undocumented malware framework, now tracked as Avalon, delivered through a multi-stage phishing chain designed to evade conventional security controls. The attack began with a spoofed legal document email directing recipients to a password protected archive on Proton Drive. Malicious content was embedded inside an ISO image rather than attached directly, reducing the likelihood of detection at the email layer."
  https://blackpointcyber.com/blog/avalons-path-from-legal-lure-to-crownx-ransom-capabilities/
  https://thehackernews.com/2026/07/new-avalon-malware-framework-packs.html
• Lazarus-Linked Npm Malware Masquerades As Rollup Polyfills
  "The JFrog Security research team identified a malicious npm package cluster masquerading as Rollup polyfill tooling. The two entry packages, rollup-packages-polyfill-core and rollup-runtime-polyfill-core, imitate the naming, README content, repository metadata, and package shape of the legitimate rollup-plugin-polyfill-node project."
  https://research.jfrog.com/post/rollup-polyfill-masquerading/
  https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html
• PamStealer: a Rust-Based MacOS Infostealer That Validates Credentials Through PAM
  "While reviewing results from our sample pipeline, Jamf Threat Labs identified a macOS infostealer distributed as a compiled AppleScript (.scpt) file impersonating “Maccy,” a legitimate open-source clipboard manager. We are tracking this malware under the name PamStealer after one of its core behaviors: validating the victim’s login password through the macOS Pluggable Authentication Modules (PAM) before harvesting it. PamStealer is delivered in two stages. The first is a compiled AppleScript distributed inside a disk image that downloads and stages a second-stage payload. The second is a Rust-based Mach-O infostealer responsible for credential theft, browser data collection, persistence and exfiltration. The dropper is hosted on the fake domain maccyapp[.]com, which impersonates the legitimate Maccy project."
  https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/
  https://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.html
  https://hackread.com/pamstealer-malware-macos-fake-maccy-clipboard-app/
• PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems
  "PolinRider is a supply chain campaign linked to North Korean threat actors associated with the broader Contagious Interview / Famous Chollima activity cluster. Our latest findings show that the campaign has expanded beyond npm into additional open source ecosystems, with 162 malicious release artifacts identified across 108 unique packages, including compromise traces in 80 Go modules, 10 Packagist packages, and one Chrome extension. The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts, modify legitimate repositories, and publish infected package versions where they retain or obtain registry access."
  https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands
  https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html
• FBI: TeamPCP Compromised Dev Tools To Steal Cloud Credentials
  "On July 2, 2026, the FBI published a FLASH alert identifying the criminal group called TeamPCP and detailing how it compromised widely used developer and security tools to steal credentials from victim environments at scale. The targets weren’t end users. They were the tools developers trust every day inside their build pipelines. TeamPCP is behind multiple supply chain attacks, in the past, they targeted PyPI packages and NPM repositories, and most recently the “Mini Shai-Hulud” campaign also caught two OpenAI employees. The pattern is consistent: go after the tools developers trust, poison the supply chain, and let the downstream damage multiply."
  https://securityaffairs.com/194741/cyber-crime/fbi-teampcp-compromised-dev-tools-to-steal-cloud-credentials.html
  https://www.ic3.gov/CSA/2026/260702.pdf

Breaches/Hacks/Leaks

• AdaptHealth Says Attackers Sweet-Talked Their Way Into Cloud Systems And Stole Patient Data
  "AdaptHealth says attackers used social engineering to breach its systems and steal sensitive patient data, including passwords associated with insurance billing. The medical equipment company disclosed the attack to the Securities and Exchange Commission (SEC) on Thursday, noting that attackers accessed internal patient management systems, document storage platforms, and external electronic health record system portals. The attack targeted an unwitting third-party contractor, through which the cybercriminals gained entry to the company's cloud environment, where they accessed business applications holding sensitive data."
  https://www.theregister.com/security/2026/07/03/adapthealth-crooks-stole-our-passwords-patient-health-data/5266512
• Kairos Ransomware: Data-Extortion Case Study Involving a U.S. Government Entity
  "A leaked negotiation transcript and payment-flow analysis of a successful $1 million ransom payment by a U.S. government body to Kairos — a data-extortion actor whose "ransomware group" status remains unverified — including fund tracing to ByBit, OKX, and BELQI exchange touchpoints."
  https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/
  https://thehackernews.com/2026/07/us-government-entity-paid-kairos-group.html
  https://securityaffairs.com/194750/security/u-s-government-agency-paid-1m-to-data-extortion-group-kairos.html

General News

• Q2 2026 Attack Techniques Trend Report
  "The second quarter of 2026 was marked by a notable increase in actual exploits that targeted public assets, identities, and AI stacks. The number of CISA KEV listings reached 75, an increase of approximately 27% compared to the same period in 2025. Primary targets included web and server applications, endpoints, network perimeter devices, and remote management tools, and also included vulnerabilities related to AI and the supply chain. The percentage of listings associated with ransomware rose from 8.5% In the same period of 2025 to 16.0%."
  https://asec.ahnlab.com/en/94320/
• Chinese LLMs Broaden The Gap Between Attackers & Defenders
  "Chinese companies released two new AI models in the past month that have pushed the boundaries of the nation's capabilities for vulnerabilities discovery and caused concerns among some cybersecurity experts. On June 13, Chinese firm Zhipu AI released an open-weight model, GLM 5.2, that subsequent testing found outperforms Anthropic's Opus and Open AI's GPT-5.5 on some bug-finding benchmarks and costs only $0.17 per vulnerability found. Two weeks later, another firm, 360 Security Technology, released a frontier-model-based security tool, Tulongfeng (aka "Dragon Saber"), that its founder touted as China's version of Mythos, claiming it had already found more than 3,400 vulnerabilities, according to a Reuters report."
  https://www.darkreading.com/cyber-risk/chinese-llms-broaden-gap-between-attackers-and-defenders
• Non-Interactive SSH Attacks Dominate After Login
  "Anyone who runs a server with SSH exposed to the internet sees the same pattern in the logs. A steady stream of automated scanners tries to log in, hour after hour, from addresses all over the world. The common picture of what comes next has an attacker landing a shell, looking around the system, and typing commands. The reality recorded across eleven research honeypots looks almost nothing like that. Eleven SSH honeypots ran on cloud servers in Frankfurt, Germany, for fifteen days in late May and early June, in a study by researchers at the Czech Technical University in Prague. Together they logged 177,622 authenticated sessions, every one an attacker who got past the login."
  https://www.helpnetsecurity.com/2026/07/03/research-non-interactive-ssh-attacks/
  https://arxiv.org/pdf/2606.28006
• Organizations Struggle To Prioritize Known Cyber Risks
  "Organizations collect more cyber risk data than ever, with many still struggling to build a unified view of their exposure. The latest State of Threat Management report from Filigran found that security teams continue to work across disconnected tools, leaving important context spread across multiple systems. Cloud infrastructure, on-premises environments, third-party services, vulnerability scanners, threat intelligence feeds, and attack surface management platforms all generate information about potential risk."
  https://www.helpnetsecurity.com/2026/07/03/cyber-risk-exposure-report/
• Qilin Dominates Ransomware Market Amid Growing Cybercrime Consolidation
  "The ransomware ecosystem is moving from fragmentation back to consolidation, with Qilin emerging as the dominant ransomware-as-a-service (RaaS) operation after the disruption of major groups including LockBit and RansomHub. Yet despite Qilin's strong position, the rapid emergence of other groups, such as The Gentlemen, demonstrates how quickly the cybercrime landscape continues to evolve. Lotem Finkelstein, VP research at Check Point, highlighted that based on the cybersecurity firm’s research in their 2026 Cyber Security Report, Qilin now holds around 16% of the cybercriminal market share."
  https://www.infosecurity-magazine.com/news/qilin-dominates-ransomware-market/
• Which Industry & Country Has The Worst Email Security? An Analysis Of 5,800+ Domains For SPF, DMARC, DKIM & MTA-STS Protocols
  "Every day, cybercriminals send around 3.4 billion phishing emails. 90 percent of successful cyber attacks originate from one of these emails. We analyzed the live DNS records for 5,849 domains across 13 sectors, scoring each domain on eight points based on its Sender Policy Framework (SPF), Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM), and Mail Transfer Agent Strict Transport Security (MTA-STS)."
  https://www.comparitech.com/news/which-industry-country-has-the-worst-email-security-an-analysis-of-5800-domains-for-spf-dmarc-dkim-mta-sts-protocols/
  https://securityaffairs.com/194677/security/government-and-healthcare-are-the-weakest-links-in-global-email-security.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Building More Resilient CNI: What Industry Pen Testers Told Us
  "For those of us working in operational technology here at the NCSC, part of our job is to engage with penetration testers. Also known as ‘pen testers’, it’s their job to try to break into systems, poke holes in your infrastructure and find any weak spots. These can then be patched to improve the system’s resilience against attackers who have the same skills, but bad intentions. In this blog, we’ll explain what pen testers told us when we asked: ‘What can organisations do to make your job harder?’"
  https://www.ncsc.gov.uk/blogs/building-more-resilient-cni-what-industry-pen-testers-told-us
  https://www.infosecurity-magazine.com/news/ncsc-tips-make-pen-testers-job/

Vulnerabilities

• New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure
  "Threat actors began exploiting the latest CitrixBleed-like vulnerability in NetScaler ADC and NetScaler Gateways less than 24 hours after public disclosure, Scottish cybersecurity firm Lupovis reports. Tracked as CVE-2026-8451 (CVSS score of 8.8), the security defect was disclosed on June 30, when Citrix rolled out patches, and attack surface management company watchTowr published technical details on it. The bug is described as an out-of-bounds read issue affecting NetScaler appliances configured as SAML IDP and leading to memory disclosure."
  https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog
  https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
  https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited/
  https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/
  https://securityaffairs.com/194654/security/u-s-cisa-adds-a-microsoft-sharepoint-server-flaw-to-its-known-exploited-vulnerabilities-catalog.html
  https://www.theregister.com/security/2026/07/02/microsoft-said-exploitation-was-less-likely-but-cisa-just-added-sharepoint-rce-to-kev-list/5265886
• Apple’s Hide My Email Doesn’t Hide It Very Well
  "404 Media reports that a researcher has found a vulnerability in Apple’s Hide My Email feature that could allow someone to discover a person’s real email address. That’s especially concerning because protecting your real email address is exactly what the feature is designed to do. 404 Media did not publish technical details of the vulnerability to avoid helping attackers exploit it, but said it independently verified that the issue works."
  https://www.malwarebytes.com/blog/news/2026/07/apples-hide-my-email-doesnt-hide-it-very-well
• WinRAR Flaw Could Allow Attackers To Take Control Of Your Computer
  "Rarlab has released a new version of the popular WinRAR tool to patch a vulnerability that can be abused in remote code execution attacks. The issue is fixed in WinRAR 7.23, but users must install the new version manually because WinRAR still does not offer automatic updates. They also need to make sure they download the version that matches their system and language preference. There are five operating system to choose from (Windows, macOS, Android, Linux, and FreeBSD), which shouldn’t be too hard. More people will struggle with choosing 64 bits, 32 bits, or ARM, which requires checking their system specifications."
  https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-attackers-to-take-control-of-your-computer

Malware

• JADEPUFFER: Agentic Ransomware For Automated Database Extortion
  "Ransomware has had a human at the keyboard, or at least a human writing its script, since it was first established as a category of threat. The Sysdig Threat Research Team (TRT) has captured what we assess to be the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM). This operator, which we have dubbed JADEPUFFER, gained initial access to an internet-facing Langflow instance through CVE-2025-3248 and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim's production database server. JADEPUFFER is considered an agentic threat actor (ATA), or an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit."
  https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
  https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html
  https://hackread.com/sysdig-jadepuffer-first-agentic-ransomware-operation/
  https://www.theregister.com/security/2026/07/02/smooth-ai-criminal-drives-first-end-to-end-agentic-ransomware-attack/5266073
• Fake Google And Cloudflare Verification Pages Spread Multiple Malware Families
  "ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware that can take full control of your system. We uncovered multiple campaigns using the same infrastructure to deliver malware including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer."
  https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families
• Indirect Prompt Injection In Web Content Targets AI Agents
  "AI agents are increasingly changing how users interact with web content, making the content itself a growing attack surface for threat actors. Just as a human user can be socially engineered through phishing, AI agents are also susceptible to similar attacks. Indirect prompt injection (IPI) is an example of these types of attacks that embed malicious instructions in the content retrieved by an AI agent (websites, documents, email, etc.) to influence the agent’s reasoning during task execution. Zscaler ThreatLabz has observed malicious websites that impersonate legitimate services and use IPI to manipulate AI-driven workflows."
  https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents
• From CitrixBleed 2 To Cloudflared: The Tools And Techniques Behind Anubis Ransomware Attacks
  "Throughout 2026, Arctic Wolf has investigated multiple Anubis ransomware intrusions. Although threat actor tradecraft differs between intrusions, key themes have emerged: abuse of VPN infrastructure, blending in with legitimate activity through the use of Remote Monitoring and Management (RMM) solutions, and using other legitimate binaries on victim devices. Public reporting has focused largely on the group’s ransomware-as-a-service (RaaS) model, affiliate program, and encryptor payloads. In this research publication, we provide new insight into initial access techniques in Anubis ransomware cases, including exploitation of CitrixBleed 2 (CVE-2025-5777). We also report on the stealthy use of RMM tooling to blend in with legitimate activity, as well as various other techniques used to evade safeguards in victim environments. An understanding of these behaviors provides defenders with opportunities for early detection and containment."
  https://arcticwolf.com/resources/blog/citrixbleed-2-to-cloudflared-the-tools-and-techniques-behind-anubis-ransomware-attacks/
  https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html
• Remus Stealer: A New, Not-So-New Infostealer
  "The underground marketplace rarely stays quiet for long. A new information-stealing malware dubbed Remus Stealer has surfaced in the cybercrime underground, exhibiting significant similarities to the notorious Lumma malware family across its administration panel, stolen log files, and core code structure. Despite parallels in its code and functionality, threat actors are eagerly buying into the platform. In addition to its familiar features, it provides attackers with a distinct, modern command and control (C2) and networking infrastructure designed to slip past current security perimeters."
  https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/
• Vect And TeamPCP Partner For Ransomware Campaigns
  "Counter Threat Unit (CTU) researchers investigated two interconnected threat groups known as Vect and TeamPCP. The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks and the extortion of multiple organizations."
  https://www.sophos.com/en-us/blog/vect-and-teampcp-partner-for-ransomware-campaigns
• Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
  "Insikt Group has identified new infrastructure associated with the TAG-182 threat cluster, used to disseminate MarkiRAT malware in support of Iranian government surveillance operations. It is highly likely that TAG-182 is targeting Iranians living inside and outside the country using different lures, including free download tools and fake VPN applications. The group’s operations are highly likely active across social media platforms like Instagram. As the kinetic conflict with the United States and Israel has subsided since April 2026, Iran's security apparatus is likely redirecting its focus toward intensified cyber surveillance and digital enforcement operations targeting perceived dissidents and alleged foreign collaborators."
  https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat
  https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-ir-2026-0701.pdf
• The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers To Kill Security
  "Defense evasion has quietly become one of the most consequential stages of an advanced cyber intrusion. As security products have grown harder to beat, attackers have changed their tactics. Rather than attempting to fly under the radar, they are opting to switch off security altogether. With ransomware attacks, in particular, attempting to disable security software is now a standard part of the attack chain. One technique has come to dominate the area of defense evasion and, over the past three years, it has become something close to an epidemic. The Bring Your Own Vulnerable Driver (BYOVD) technique lets attackers abuse flaws in legitimate, validly signed kernel drivers to seize control of the Windows kernel itself and operate at the highest level of privilege on a machine."
  https://www.security.com/threat-intelligence/byovd-vulnerable-drivers

Breaches/Hacks/Leaks

• Medtronic Notifies Customers Impacted By ShinyHunters Data Breach
  "Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party. The company previously confirmed that its IT systems were compromised by hackers, and the infamous data extortion group ‘ShinyHunters’ claimed the attack. The threat actor said that they were holding 9 million Medtronic records with personally identifiable information (PII) and internal corporate data."
  https://www.bleepingcomputer.com/news/security/medtronic-notifies-customers-impacted-by-shinyhunters-data-breach/
  https://www.theregister.com/security/2026/07/02/pacemaker-manufacturer-medtronic-warns-patients-cybercrooks-may-have-swiped-health-data/5265768

General News

• Under Pressure: Insights From The 2026 Exposure Gap Report
  "Risk is concentrating. The 2026 Exposure Gap Report shows vulnerabilities claiming a larger share of critical exposure, and that shift has real implications for how security teams prioritize their response. Two findings are central to this change. Vulnerabilities now represent a much larger share of critical exposure, and only a small percentage of vulnerability alerts are validated as exploitable. Together, these findings show why prioritization depends on context, validation, and a clear understanding of which exposures require action."
  https://blog.checkpoint.com/exposure-management/under-pressure-insights-from-the-2026-exposure-gap-report/
• The Endpoint Recovery Gap Many Teams Discover During An Incident
  "In this interview with Help Net Security, IGEL CTO Matthias Haas explains why backups alone do not equal recovery. He makes the case that endpoint recovery is often overlooked, leaving organizations exposed when thousands of devices go down at once. Haas walks through what a well-planned recovery looks like, where the bottlenecks appear, and why restoring trusted user access matters more than counting blocked threats. He also shares how security leaders can convince a CFO to fund recovery capability before an incident proves it was worth the spend."
  https://www.helpnetsecurity.com/2026/07/02/matthias-haas-igel-endpoint-recovery-gap/
• Catching Ransomware On The Wire Before It Locks The File Server
  "Corporate networks keep sensitive files off individual workstations and store them on shared servers that staff reach through mapped network drives. That arrangement hands ransomware operators a target worth chasing. A single compromised laptop can begin encrypting files that live on a server across the building, and the encryption travels over the network as ordinary file-sharing traffic. Endpoint detection tools watch the machine they run on. When the encryption lands on a remote file server, the server does little of the visible work. It accepts read and write commands from a client and carries them out, the same way it serves any legitimate user. The agent on the server records normal operation. The agent on the client sees an application touching mapped files. Damage settles in the gap between the two machines, where each agent has a poor view."
  https://www.helpnetsecurity.com/2026/07/02/shared-storage-ransomware-detection-research/
  https://arxiv.org/pdf/2606.30586
• What The AI Patch Gap Means For Enterprise Security
  "Open-source maintainers are receiving more vulnerability reports than they can act on, and a rising share now comes from an AI system working at machine speed. Over roughly two months this spring, Anthropic’s Claude Mythos Preview combed through more than 23,000 open-source code paths and routed verified findings to the projects that own them. Tuskira studied what happens to those findings once they reach human hands. The program reported 1,596 verified vulnerabilities, spread across hundreds of projects over a window of about nine weeks. Six external security research firms triaged the findings before they reached maintainers."
  https://www.helpnetsecurity.com/2026/07/02/open-source-ai-patch-gap/
• Cybercrime In Australia 2025
  "In 2025, 10,593 online Australians participated in the Australian Cybercrime Survey. Nearly half of all respondents reported having been a victim of some form of cybercrime in the 12 months prior to the survey. This included online abuse and harassment (24.9% of respondents), followed by malware (21.5%), identity crime and misuse (20.6%) and fraud and scams (11.4%). One in five respondents experienced multiple types of cybercrime. Between 2024 and 2025, the proportion of respondents who had been a victim of online fraud and scams increased."
  https://www.aic.gov.au/publications/sr/sr59
  https://www.darkreading.com/cybersecurity-analytics/aussies-face-reduced-cybercrime-risk-pressure-shifts-smbs
• Apple Reverses Age-Old Patch Policy To Keep Up With AI
  "Apple is changing its approach to security patching, in response to the growing threat of accelerated artificial intelligence (AI) attacks. The company has historically saved big, bundled sets of bug fixes for new versions of its operating system (OS). That's set to change. The company released a variety of security updates June 29 for iPhones, iPads, Macbooks, and the Safari browser, untethered to any major version releases. It's hardly the first time it's released security updates out-of-band, but the motivation was different this time. According to Reuters, the company said "it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it ⁠needed to reduce the time between when updates were first made public and when they were put into customers' hands.""
  https://www.darkreading.com/cybersecurity-operations/apple-patch-policy-ai
• When Too Much Security Data Became The Risk
  "For years, conventional wisdom in security operations was simple: collect everything. Logs were cheap. Storage was plentiful. And the more data a team had, the more confident it could feel about detection and forensics. That assumption quietly broke as organizations scaled. At Vensure Employer Solutions, a privately held HR services and payroll provider supporting more than 95,000 businesses, telemetry volume did not just grow; it exploded. Rapid acquisitions, expanding infrastructure, and a growing customer base turned routine firewall traffic into a relentless stream of raw data flowing into the company's security information and event management (SIEM) environment."
  https://www.darkreading.com/cyber-risk/too-much-security-data-risk
• Researcher Behind 'Exploitarium' Explains Release Of Undisclosed Zero-Day Exploits
  "A pseudonymous security researcher has released over 30 proof-of-concept exploits for zero-day vulnerabilities in open-source projects without disclosing them to the maintainers first. The dump, called ‘Exploitarium,’ was shared publicly on GitHub by an individual going by name ‘bikini’ and ‘ashdfrkl’ on Discord. First published on June 27, the repository initially included around 15 exploits, before the researcher updated it over the next few days with new entries."
  https://www.infosecurity-magazine.com/news/researcher-exploitarium-exploits/
• Missed Incidents, Persistent Threats, And Response Gaps: Insights From Compromise Assessment Projects
  "The following analysis presents the key findings from Kaspersky Compromise Assessment engagements performed in 2025. A compromise assessment is an independent, expert-driven service that examines whether a target network has been compromised. The service combines threat intelligence analysis (including darknet sources), tool-aided endpoint scanning, a systematic review of security event logs and network traffic, and, when necessary, an initial incident response and digital forensic investigation. This report focuses on missed incidents – threats that remained undetected for weeks, months, or even years."
  https://securelist.com/compromise-assessment-findings-2025/120542/
• How To Conduct a Successful Audit Of AI-Driven Software Development
  "Traditionally, an audit independently examines records, processes and controls to verify compliance and assess financial and operational integrity. In the modern world, such an approach should extend to the software development lifecycle (SDLC) – especially in the age of artificial intelligence (AI) or large language model (LLM)-assisted code. Chief Information Security Officers (CISOs) and their teams need proof that developers are producing protected products, because one in five organizations has experienced a serious security incident directly tied to AI-generated code. Getting to the root of the problems requires visibility into who is leveraging AI, what tools they are using and where AI-generated code is introduced into the SDLC. This is considered the ADLC: the agentic development lifecycle."
  https://www.securityweek.com/how-to-conduct-a-successful-audit-of-ai-driven-software-development/
• Google’s Continued Disruption Of Malicious Residential Proxy Networks
  "Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks."
  https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks
  https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html

อ้างอิง

Electronic Transactions Development Agency (ETDA)

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 6 รายการ เมื่อวันที่ 2 กรกฏาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

ICSA-26-183-01 ST Engineering iDirect iQ-Series Terminals
ICSA-26-183-02 CubeSpace CW0057 Reaction Wheel
ICSA-26-183-03 Gardyn IoT Hub
ICSA-24-291-03 Mitsubishi Electric CNC Series (Update D)
ICSA-26-055-03 Gardyn Home Kit (Update B)
ICSMA-25-364-01 WHILL Model C2 Electric Wheelchairs and Model F Power Chairs (Update B)

อ้างอิง

https://www.cisa.gov/news-events/ics-advisories

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 1 กรกฏาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 1 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง

https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

New Tooling

• Nika: Open-Source Code Analysis Tool
  "Many serious security bugs in web applications sit across several files at once. Request data enters through a controller, moves through data objects and service layers, and turns dangerous only when it reaches a sensitive operation such as a database query or a file action. A scanner that reads one file at a time can miss that path entirely. Nika, an open-source tool from the payments company PhonePe, works on that problem for Java microservices. It performs cross-file taint analysis, tracing attacker-controlled input across application layers to find out whether that input reaches a security-sensitive sink."
  https://www.helpnetsecurity.com/2026/07/01/nika-open-source-code-analysis-tool/
  https://github.com/PhonePe/nika

Vulnerabilities

• DuneSlide: Two Critical RCE Vulnerabilities Via Zero-Click Prompt Injection In Cursor IDE
  "Cato AI Labs has discovered two critical remote code execution (RCE) vulnerabilities in Cursor IDE, the popular development environment which, according to Cursor, is used by over half of the Fortune 500. Both RCE vulnerabilities, which we refer to as “DuneSlide,” achieved a 9.8 CVSS score, and involve breaking out of the IDE’s sandbox environment and were assigned CVE IDs CVE-2026-50548 and CVE-2026-50549. Together, these vulnerabilities show how prompt injection can reach beyond the LLM layer and expose classical vulnerabilities in code paths that were not traditionally considered part of the attack surface."
  https://www.catonetworks.com/blog/duneslide-two-critical-rce-vulnerabilities/
  https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html
• Google Patches 382 Chrome Vulnerabilities
  "Google on Tuesday announced the release of Chrome 151 with patches for 382 vulnerabilities, the vast majority of which were discovered by the tech giant itself. Of the 382 vulnerabilities, 358 were found by Google. The company has discovered and patched hundreds of Chrome flaws in recent months, a surge likely driven by AI. However, it has shared no details on which specific AI tools are driving the surge. Fifteen of the newly patched vulnerabilities have been assigned a ‘critical’ severity rating, and 67 have been rated ‘high severity’. Of the remaining flaws, 169 have a ‘medium’ and 131 have a ‘low’ severity rating."
  https://www.securityweek.com/google-patches-382-chrome-vulnerabilities/
  https://www.malwarebytes.com/blog/bugs/2026/07/chrome-needs-another-whopper-update-to-fix-382-security-fixes
  Caught In The Octopus Trap: Unauthenticated RCE In Argo CD With CodeQL
  "Synacktiv has discovered an unauthenticated arbitrary code execution vulnerability in ArgoCD's repo-server component, potentially allowing full cluster compromise. This article explains how the vulnerability was identified using CodeQL, details the exploitation process to gain control over the underlying Kubernetes cluster, and introduces a tool for automating the attack."
  https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql
  https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html
• Over 900 Oracle E-Business Instances Exposed To Ongoing Attacks
  "Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw. The vulnerability (tracked as CVE-2026-46817) was found in the File Transmission component of EBS's Oracle Payments product and allows malicious actors without privileges and with HTTP network access to take over vulnerable systems through low-complexity attacks. Oracle has patched this flaw with security updates released as part of its May 2026 Critical Security Patch Update and urged customers to patch their systems immediately."
  https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/
  https://cyberscoop.com/oracle-ebs-critical-vulnerability-exploited/
  https://securityaffairs.com/194599/security/oracle-e-business-suite-flaw-under-active-attack-950-systems-exposed.html
• Progress Kemp LoadMaster Vulnerability Targeted (CVE-2026-8037)
  "Beginning on June 29th, 2026, eSentire’s Threat Response Unit (TRU) identified exploitation attempts targeting the critical Progress Kemp LoadMaster vulnerability CVE-2026-8037. The vulnerability was initially disclosed on June 4th and functional Proof-of-Concept (PoC) exploit code was released on June 29th. CVE-2026-8037 (CVSS: 9.8), is an OS Command Injection Remote Code Execution (RCE) vulnerability which allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance. As active exploitation attempts have been identified, it is critical that organizations apply the relevant security patches immediately."
  https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037
  https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html

Malware

• No (Bad) CAP: Inside An Ongoing LSHIY Password Spray Attack
  "Huntress is observing a massive, ongoing, automated password spray attack against Microsoft's Azure command-line interface (CLI), originating from an IPv6 address range controlled by internet infrastructure provider LSHIY LLC, AS32167. Between June 12 through June 26, the threat actor made more than 81 million login attempts against Huntress customer accounts and successfully compromised at least 78 Microsoft accounts. Last week, the number and effectiveness of the compromises surged, continuing a concerning trend in the rapid expansion of these types of attacks. Notably, many of these organizations had Conditional Access policies, but the way they were configured didn't cover the techniques used by the threat actors in this campaign."
  https://www.huntress.com/blog/lshiy-password-spray-attack
  https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html
  https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-365-accounts-with-81-million-login-attempts/
  https://www.securityweek.com/massive-password-spray-campaign-targeting-azure-cli/
  https://www.bankinfosecurity.com/azure-password-spraying-attack-bypasses-mfa-defenses-a-32128
  https://securityaffairs.com/194588/uncategorized/azure-cli-targeted-in-lshiy-password-spray-campaign-across-64-orgs.html
• Phantom Squatting: AI-Hallucinated Domains As a Software Supply Chain Vector
  "Unit 42 researchers found that large language models (LLMs) consistently hallucinate web domains for legitimate brands. Adversaries are actively weaponizing this vector by registering these nonexistent domains to intercept traffic generated by AI systems. We call this phenomenon phantom squatting, and it poses a significant risk to the software supply chain. Our proactive monitoring of registration for high-priority hallucinated domains yielded real-world detections across multiple sectors. We were able to predict use of these domains from 18–51 days ahead of adversary registration."
  https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/
  https://thehackernews.com/2026/07/phantom-squatting-uses-ai-hallucinated.html
  https://www.darkreading.com/endpoint-security/phantom-squatting-ai-driven-supply-chain-threat
• ClickFix: The Gift That Keeps On Giving
  "In the beginning of June I presented the session ClickFix: The Gift That Keeps On Giving at OrangeCon. ClickFix emerged around 2024 and saw a 517% increase in 2025 as described by SANS, the effectiveness of this technique is something we will have to deal with for the upcoming years. Before diving into technical details, it’s important to understand why ClickFix is so effective. The attack exploits fundamental user behaviors and training:"
  https://kqlquery.com/posts/clickfix-gift-that-keeps-on-giving/
  https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html
• SOCRadar Links FortiBleed Campaign To INC And Lynx Ransomware Operations
  "SOCRadar’s Threat Research Unit (STRU) has linked the FortiBleed credential-harvesting campaign to two active ransomware-as-a-service operations, INC Ransom and Lynx. An operator tied to FortiBleed’s infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly to ransomware deployment for the first time."
  https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/
  https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/
• Don’t Eat The ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits
  "This blogpost is a collaboration between YesWeHack and Sekoia TDR, analysing an undocumented supply chain attack that targets vulnerability researchers and pentesters via lure CVE PoC repositories. Our analysis shows that this vector has already been used in malicious PoCs, seeking to compromise pentesting tools, since late 2025. Because the malware and its C2 infrastructure are still active, we strongly advise against running any of the PoCs code or installing the malicious packages."
  https://www.sekoia.com/blog/dont-eat-the-chocopocs-how-vulnerability-researchers-were-repeatedly-targeted-by-trojanised-exploits
  https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/
• When AI Invents The Attack: Browser-Native Ransomware
  "Check Point Research recently uncovered something that changes how we think about AI-assisted threats: a malware sample in which an AI model independently connected a theoretical browser risk to a working ransomware technique, with no exploit, no app installation, and no technical expertise required from the attacker."
  https://blog.checkpoint.com/research/when-ai-invents-the-attack-browser-native-ransomware/
  https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/
  https://thehackernews.com/2026/07/ai-generated-browser-ransomware-abuses.html
  https://www.theregister.com/security/2026/07/01/somebody-told-deepseek-to-build-in-browser-ransomware-and-it-gleefully-complied/5265311
• ARToken: Inside An EvilTokens Affiliate Panel Targeting Microsoft 365
  "Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration — all accessible to operators through a React-based dashboard."
  https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
  https://cyberscoop.com/artoken-bec-platform-cisco-talos/
  https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409
  https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/
• Analysis Of Ongoing Ousaban Attacks Targeting The Iberian Peninsula
  "In May 2026, FortiGuard Labs identified an attack targeting users in Spain and Portugal involving the banking Trojan Ousaban. This malware has been active in Brazil and is spread through an MSI downloader. The malicious payload involves a DLL file that is run via DLL side-loading or process injection. In this campaign, the threat actor primarily targets users in Spain and Portugal. Figure 1 shows how the attack unfolds. The phishing PDF tricks victims into visiting a malicious webpage that scans the user's environment. If they are in Spain or Portugal, the webpage downloads a VBS file to kickstart the next part of the attack. The final payload is an EXE file that is dropped onto the victim’s computer and executed by the VBS script."
  https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula
  https://thehackernews.com/2026/07/ousaban-banking-trojan-targets-iberian.html
  https://www.infosecurity-magazine.com/news/ousaban-banking-trojan-spain/
• Phishing In The Balkans: Fake Traffic Fines, Real Losses
  "Government services are increasingly relying on SMS as a channel to send notifications such as fines, toll reminders and payment alerts. It is fast, convenient, and the general public tends to trust a text from an official sender. This trust is what scammers are looking to take advantage of. Group-IB researchers have been tracking a smishing campaign that is impersonating the identity of Putevi Srbije, Serbia’s state road authority. Victims get a text claiming they have an unpaid traffic fine. They click a link. They land on a fake government website that looks real enough to fool most people. They enter their card details. And then the money is gone."
  https://www.group-ib.com/blog/balkans-fake-traffic-fines-phishing/
• Fake Interpol Investigation Emails Target Small Businesses With Ransomware
  "Think your small business is too small to be targeted by ransomware? That's precisely the assumption cybercriminals hope you'll make. Bitdefender Antispam researchers have uncovered a phishing campaign targeting small businesses across Europe, Asia, the Middle East, and the United States with fake investigation emails impersonating law enforcement officials. The messages claim to contain evidence of suspicious company activity, but there’s a catch: The attached ‘evidence’ is actually ransomware."
  https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-interpol-emails-serve-ransomware
  https://hackread.com/fake-interpol-investigation-emails-ransomware-small-businesses/
• The SOC Files: ScreenConnect Masked As Freeware. An Inside Look At a Large-Scale Campaign
  "To access compromised systems, threat actors frequently abuse legitimate remote monitoring tools. At first glance, these utilities rarely raise red flags: they are signed with valid digital certificates, often allowlisted under corporate IT policies, and fully supported by OS vendors. However, they grant attackers the ability to harvest data from target devices, drop malware, and move laterally across the network."
  https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/
  https://thehackernews.com/2026/07/seo-poisoned-software-sites-abuse.html
• Veil#Drop: Blogspot-Hosted PowerShell Loader Delivers PureLog Stealer Through XOR-Encoded In-Memory .NET Payloads
  "Veil#Drop is a sophisticated multi-stage malware delivery framework that combines social engineering, compromised websites, malicious JavaScript launchers, PowerShell download cradles, and trusted cloud-hosted infrastructure to deploy PureLog Stealer entirely in memory. The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host and launches PowerShell with execution policy bypasses enabled. PowerShell then retrieves additional stages from attacker-controlled Blogspot pages, abusing Google’s trusted infrastructure to blend malicious traffic with legitimate web activity and evade reputation-based security controls."
  https://www.securonix.com/blog/veildrop-blogspot-hosted-powershell-loader/
  https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html
  https://www.infosecurity-magazine.com/news/veil-drop-blogspot-purelog-stealer/
• UNC1151 Phishing Email Targeting Belarusian Politician Points To Multi-National Campaign
  "UNC1151, also referred to as Ghostwriter and various other names, is a threat actor whose interests align with those of the government of Belarus (and, by extension, Russia, due to Russia and Belarus’s frequently aligned interests). The group first rose to prominence in 2020 when it hacked into legitimate media sites to publish fake stories (which earned it the name ‘Ghostwriter’). Since then it has remained very active, mostly in spear-phishing campaigns targeting individuals in Poland and Ukraine."
  https://censys.com/blog/unc1151-phishing-email-campaign/

Breaches/Hacks/Leaks

• Kubota Says Hackers Had Month-Long Access To Network Systems
  "Kubota North America Corporation disclosed that hackers had access to some of its network systems for more than a month earlier this year. Following an investigation into the incident, the company determined that between March 16 and April 20 the threat actor accessed files with personal information for employees and their dependents. Kubota is a Japanese industrial manufacturer known for its agricultural and construction equipment. It operates in 120 countries, employs more than 52,000 people, and has a reported annual revenue of $20 billion."
  https://www.bleepingcomputer.com/news/security/kubota-says-hackers-had-month-long-access-to-network-systems/
• Hackers Breached DHS Information-Sharing Network, People Familiar Say
  "A key Department of Homeland Security information-sharing database was accessed by an unknown threat actor in recent weeks, potentially exposing sensitive data exchanged between federal, state, local and industry partners, according to two people familiar with the matter. DHS investigators are probing the intrusion of the Homeland Security Information Network, said both people, who spoke on the condition of anonymity because the incident is sensitive. The hackers’ affiliation and whether any documentation was pilfered from the system are both unclear."
  https://www.nextgov.com/cybersecurity/2026/06/hackers-breached-dhs-information-sharing-network-people-familiar-say/414534/
  https://www.bleepingcomputer.com/news/security/dhs-confirms-hackers-breached-hsin-info-sharing-platform/

General News

• What a Financial Planner Taught Me About Cybersecurity
  "When I spoke at a recent cybersecurity awareness event for financial planners and tax advisors, the audience really engaged with the subject. As happens at conferences the world over, people often come up to speakers to ask follow-up questions, or just give their feedback about points made during the presentation. This time, it struck me how many of them said they had been scared by what they heard during my talk."
  https://www.helpnetsecurity.com/2026/07/01/raising-cybersecurity-awareness-for-non-experts/
• This Supercomputer Encrypts Your Data Even While It’s Running It
  "Most people who handle sensitive data already encrypt it in two places. They lock it down when it sits on a hard drive, and they lock it down when it moves across a network. There has always been a third moment that stayed open. The instant a computer pulls that data into memory to work on it, the protection drops away. For a few seconds or a few hours, the information sits in the open, readable by anyone with deep enough access to the machine. A research team at the University of Cologne built a supercomputer that closes that gap. The system is called RAMSES, and it keeps data scrambled even during the moment of processing."
  https://www.helpnetsecurity.com/2026/07/01/confidential-computing-hpc-research/
  https://arxiv.org/pdf/2606.27919
• AI-Generated Code Risks Reach Security, Legal, And Compliance Teams
  "Most engineering organizations write code with AI, and a good number of them keep that code away from customers. A Flux survey of engineering leaders and practitioners found that nearly half run AI-generated code in production. Almost every company in the sample uses AI somewhere in development, with under 5% reporting no plans to adopt it within a year. Teams reach for AI on repetitive work first. It writes documentation, fills out unit tests, and handles simple functions, the kind of tasks where a mistake stays small and easy to catch. Adoption thins out as the stakes rise."
  https://www.helpnetsecurity.com/2026/07/01/ai-generated-code-risks-security/
• The Near Real-Time Patching Era Has Arrived
  "Cybersecurity teams need to prepare now for a forthcoming onslaught of vulnerabilities that will need to be remediated much faster than ever before. The number of vulnerabilities being discovered and reported has already been steadily increasing over the last few months. However, with further advances in artificial intelligence (AI), most notably in the form of Mythos and ChatGPT 5.6 models from Anthropic and OpenAI, the overall number of vulnerabilities is only going to increase. Right now, however, not all the vulnerabilities being remediated lately have actually been formally reported, so limited access to the latest AI models might be working in favor of cybersecurity teams."
  https://blog.barracuda.com/2026/06/30/near-real-time-patching-ai-application-security
• The Platform You Trust Is The Platform They Target
  "Cofense Intelligence is observing a clear shift in phishing operations: threat actors are moving beyond broad, one-size-fits-all campaigns and adopting platform-aware delivery that adapts to the victim’s device, browser, and environment. What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android. This trend reflects a broader strategic change in the threat landscape, one that is designed to increase the likelihood of compromise, expand target coverage, and improve threat actor return on investment."
  https://cofense.com/blog/the-platform-you-trust-is-the-platform-they-target
  https://www.darkreading.com/application-security/phishing-campaigns-auto-adapt-victims-device-os
• OpenClaw: Risks For The Users And How To Mitigate Them
  "OpenClaw, which was previously known as Clawdbot and Moltbot, is today one of the most successful and fast‑growing ecosystems for AI agents, recognized worldwide. The project quickly became popular with users because of its flexibility and ability to solve fairly complex tasks that previously required a lot of time for automation and execution. A dedicated marketplace appeared quickly after the project started gaining traction, where developers and users began publishing tools that integrate with OpenClaw. Currently, employees all over the world use OpenClaw to automate their tasks, often unaware of risks this practice introduces to them and their employers."
  https://securelist.com/openclaw-security/120484/
• Alleged Member Of Criminal Cyber Hacking Group “Scattered Spider” Arrested In Finland And Extradited To The United States
  "An alleged member of the criminal cyber hacking group Scattered Spider has been arrested in Finland and extradited to the United States to face federal criminal conspiracy charges in the Northern District of Illinois. A criminal complaint unsealed Tuesday charges Peter Stokes, 19, a dual citizen of the United States and Estonia, with conspiracy, computer intrusion, and fraud. Stokes was arrested by Finnish authorities in April pursuant to an Interpol Red Notice and extradited to the United States last week. He made an initial appearance on Tuesday in federal court in Chicago and was ordered to remain in law enforcement custody."
  https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited
  https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html
  https://therecord.media/teen-suspect-in-scattered-spider-hacks-extradited-to-us
• Huntress CEO Says Threat Hunter Used 'poor Judgment' In Alerting Ransomware Crim About Law Enforcement Probe
  "Huntress CEO Kyle Hanslovan said he is aware of “questionable, long-term threat actor communications” between a threat hunter who is still employed with the security firm and a cybercriminal, and called this “poor judgment.” “In one particular exchange, our current teammate disclosed to a threat actor that law enforcement had reached out to them about the threat actor,” Hanslovan said in a blog post, addressing a former employee’s accusations that the current Huntress analyst is an insider threat to the company. “While this disclosure was not illegal, it reflected poor judgment,” he wrote."
  https://www.theregister.com/security/2026/06/30/huntress-ceo-says-threat-hunter-used-poor-judgment-in-alerting-ransomware-crim-about-law-enforcement-probe/5264532

อ้างอิง

Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Healthcare Sector

• OFFIS DCMTK Toolkit
  "Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01
  https://www.bankinfosecurity.com/dicom-toolkit-bugs-raise-medical-imaging-security-risks-a-32114

Industrial Sector

• StoneFly Storage Concentrator
  "Successful exploitation of these vulnerabilities could allow attackers to gain broad unauthorized access, execute arbitrary commands with root privileges, steal sensitive data, and perform actions on behalf of legitimate users across interconnected systems."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06
• Delta Electronics DVP12SE PLC
  "Successful exploitation of these vulnerabilities could allow an attacker to remotely issue commands, modify operational values, interfere with control logic, and alter device behavior without authentication or privilege enforcement."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-07
• Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M
  "Successful exploitation of these vulnerabilities could allow a local attacker to tamper with or destroy information in the affected product, cause a denial-of-service condition in the affected product, or execute arbitrary code when a specially crafted archive file is decompressed by the 7-Zip component included in MELSOFT Update Manager."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01
• Frangoteam FUXA SCADA/HMI
  "Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to enumerate all user accounts and role assignments on a FUXA SCADA/HMI instance."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02
• Schneider Electric EcoStruxure IT Data Center Expert
  "Schneider Electric is aware of a vulnerability in its EcoStruxure IT Data Center Expert. The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-03
• Schneider Electric EasyLogic T150 And Saitel DP RTU
  "Successful exploitation of these vulnerabilities can allow an attacker to cause unauthorized access and exposure of sensitive information when the unauthenticated attacker accesses credentials stored within firmware or system files."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-04
• XZ Utils Vulnerability Impacting B&R Products
  "An update is available that resolves vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the product to stop or corrupt memory data."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-05

Vulnerabilities

• Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap To Pre-Auth RCE CVE-2026-8037)
  "Welcome back to another watchTowr Labs blog post. This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and CVE-2026-8037 keeps that streak alive: a pre-authentication Remote Code Execution vulnerability accessible to anyone who can access the API. So, in probably a predictable turn of events, we're back doing what we do best."
  https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
  https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html
• Adobe Security Bulletin
  "Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
  https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
• Citrix Patches a New NetScaler Flaw With Echoes Of CitrixBleed
  "Citrix published a security bulletin Tuesday disclosing six vulnerabilities in NetScaler ADC and NetScaler Gateway appliances, including a high-severity memory disclosure flaw that researchers say belongs to a vulnerability class first identified in the 2023 incident known as CitrixBleed. The company rated the overall bulletin severity as high and assigned CVSS scores ranging from 6.9 to 8.8 across the six CVEs. Citrix said customers should install the updated builds and, in one case, manually adjust a configuration parameter even after patching."
  https://cyberscoop.com/citrix-netscaler-flaw-cve-2026-8451-citrixbleed/
  https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
• CISA: Windows BlueHammer Flaw Now Exploited By Ransomware Gangs
  "CISA confirmed on Monday that ransomware gangs have begun exploiting a high-severity Microsoft Defender privilege escalation vulnerability that has previously been abused in zero-day attacks. Dubbed BlueHammer, the security flaw (CVE-2026-33825) was leaked by a security researcher known as "Nightmare Eclipse" in early April, together with proof-of-concept exploit code, in protest at how the Microsoft Security Response Center (MSRC) handles the disclosure process. "Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally," Microsoft explains in a security advisory."
  https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/
  https://www.securityweek.com/bluehammer-vulnerability-exploited-in-ransomware-attacks/
• AirDrop And Quick Share Flaws Let Nearby Attackers Trigger Crashes And Bypass Checks
  "Two researchers have found six security flaws in AirDrop and Quick Share, the wireless features that beam files between nearby devices with no cables or shared network. An attacker within wireless range, with just a laptop and no prior connection, can crash the sharing service on a Mac or iPhone set to receive from anyone, with no tap or prompt. The same research found Quick Share flaws that bypass Samsung's session checks and trigger a potentially exploitable crash in Google's Windows app."
  https://thehackernews.com/2026/06/airdrop-and-quick-share-flaws-let.html
  https://www.helpnetsecurity.com/2026/06/30/apple-airdrop-google-samsung-quick-share-vulnerabilities/
• Apple Patches 30+ iOS, MacOS, Safari Flaws, Including AI-Discovered WebKit Bugs
  "Apple on Monday released security updates for iOS, macOS, and the Safari web browser to address over three dozen flaws, including four vulnerabilities in WebKit that were discovered using artificial intelligence (AI) tools like Anthropic Claude and OpenAI Codex Security."
  https://thehackernews.com/2026/06/apple-patches-30-ios-macos-safari-flaws.html
  https://support.apple.com/en-us/100100
  https://securityaffairs.com/194476/security/apple-fixes-webkit-flaws-in-ios-and-macos-with-help-from-ai-tools.html
  https://www.malwarebytes.com/blog/news/2026/06/update-time-apple-releases-security-patches-for-ios-macos-tahoe-safari
• GuardFall: a Universal Shell Injection Vulnerability In Open-Source AI Agents
  "AI coding agents and computer use agents run shell commands with your full account authority: your SSH keys, your cloud credentials, everything in $HOME. Most of them gate that power behind a guard that matches the command string against a list of dangerous patterns. But the string being inspected is different from the command executed. A guard inspects raw text, while system shell (bash) expands, unquotes, and rewrites text before running it. So, when an agent processes untrusted content (for example, an npm package with a poisoned README), the prompt injection can make it run a command that passes all the execution filters. This tactic is not new. It’s a decades-old shell quoting bypass, well known in the security literature. It succeeds against today’s most-used open-source agents. We first met this in the open-source NousResearch/hermes-agent project and surveyed ten others against the same bypass class."
  https://adversa.ai/blog/opensource-ai-coding-agents-shell-injection-vulnerability/
  https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html
  https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/

Malware

• How Ransomware Syndicates Weaponize Corporate-Style Organization
  "Similar to the events that unfolded with the Conti ransomware group’s demise in 2022, leaked internal chat logs of the Black Basta cybercrime group last year gave us a peek behind the curtain of modern ransomware operations. We found that these groups have continued to evolve into highly sophisticated and organized syndicates, taking a corporate-style approach to extortion. According to our analysis, Black Basta members carefully studied victims to launch advanced phishing and malware campaigns, exploit vulnerabilities and intimidate victims into paying via panic-triggering tactics."
  https://cyberscoop.com/ransomware-syndicates-corporate-organization-op-ed/
  Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake * Pyrogram Packages On PyPI
  "A threat actor targeted Telegram bot developers adopting the popular ‘pyrogram’ package on PyPI over the course of six months starting November 2025, in Operation Navy Ghost. This malware is a complete backdoor on servers where infected bots are operated, and uses Telegram itself for C2 and data exfiltration. Learn how it works, how it sneaks by most scanners, and how to detect infections."
  https://checkmarx.com/zero-post/operation-navy-ghost-pyrogram-telegram-supplychain-attack/
  https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-give-hackers-control-of-telegram-bot-servers/
• The Bear Necessities: A Look At The Drivers, Dynamics, And Applications Of The Pro-Russia Influence Ecosystem
  "Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. Since the mobilization of this ecosystem to support frontline objectives, we have witnessed the expedited development of new influence assets linked to multiple, expansive, covert information operations (IO) campaigns and a revitalization of pro-Russia hacktivism at an unprecedented scale. While this threat activity initially adapted to encompass Ukraine-related priorities, it is gradually pivoting back to established Russian influence objectives for which the ecosystem was originally honed."
  https://cloud.google.com/blog/topics/threat-intelligence/pro-russia-influence-ecosystem
  https://www.bankinfosecurity.com/google-kremlin-expands-ai-backed-campaigns-across-europe-us-a-32120
• Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App
  "Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Based on the Polish-language lure and rental-themed distribution website, the activity appears to be Poland-focused, targeting users in Poland or Polish expats."
  https://cyble.com/blog/glitch-spy-rat-distributed-via-fake-polish-app/
• Bring Your Own Agent: Hijacking Exposed AI Backends To Power Offensive Operations
  "Some abuse of an internet-exposed AI server can be mundane: someone finds free inference and runs a chatbot on your bill. The cases below are different. Between March and May 2026, our honeypot sensors caught three separate operators hijacking our exposed Ollama and LiteLLM endpoints as the model backend for offensive tooling. Two were autonomous penetration-testing frameworks ("Strix" and "HexStrike AI"), and the third was an OpenAI Codex agent carrying a persona built to suppress safety refusals and assisting in web reverse-engineering work."
  https://labs.zenity.io/p/bring-your-own-agent-hijacking-exposed-ai-backends-to-power-offensive-operations
  https://www.darkreading.com/cloud-security/attackers-hijack-exposed-ai-endpoints-power-offensive-ops
• New EvilTokens Attack Exposes Browser Visibility Gap In Enterprise SOCs
  "A new EvilTokens attack shows how modern phishing can hide critical evidence from enterprise SOCs until the page runs inside the browser. The case highlights a growing visibility gap in phishing triage: suspicious URLs may appear incomplete at first, while the real account takeover flow is revealed only after execution. For security leaders, that gap can mean slower investigations, delayed response, and higher business risk."
  https://hackread.com/eviltokens-attack-browser-visibility-gap-enterprise-socs/
• ToddyCat: Your Hidden Email Assistant. Part 2
  "We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. In the first part of this report, we examined the group’s attacks aimed at stealing data from browsers, as well as from local and cloud email services. The methods used in that campaign indicated that ToddyCat was attempting to access corporate correspondence while evading monitoring tools. However, all of the group’s methods we described previously are effectively detected by EPP and EDR solutions."
  https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/
• RustDuck: An In-Depth Analysis Of a Two-Stage Botnet
  "Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities."
  https://blog.xlab.qianxin.com/rustduck-en/
  https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html
• Silent Swap: A Crypto Clipper Extension Campaign
  "McAfee Advanced Threat Research has identified an active browser-extension campaign designed to steal cryptocurrency by silently substituting wallet addresses the moment a user initiates a transaction. The campaign is delivered through unsigned installers — observed in both .NET and Golang variants — that deploy a malicious Chromium extension masquerading as a benign “Google Notes” utility."
  https://www.mcafee.com/blogs/other-blogs/mcafee-labs/crypto-clipper-wallet-swapping-browser-extension-malware/
  https://thehackernews.com/2026/06/silent-swap-crypto-clipper-uses-fake.html
• INC Ransomware Targets Mainframes: Exposed Servers Reveal Cross-Platform Payloads And APAC Campaign
  "A recent infrastructure exposure provided a rare look into an active INC ransomware affiliate targeting the Asia-Pacific region. In mid-June 2026, a pair of open directories were identified on AEZA Group LLC, a known bulletproof hosting environment, revealing an operational staging server. The exposed directories contained Windows and Linux encryptors, Group Policy Object (GPO) deployment scripts for a Japanese food and beverage company, and 675 MB of operator tooling, and exfiltrated victim data. Together, these findings offered a unique view into an active ransomware campaign in near real-time."
  https://cyberandramen.net/2026/06/24/inc-ransomware-targets-mainframes-exposed-servers-reveal-cross-platform-payloads-and-apac-campaign/

Breaches/Hacks/Leaks

• Insurance Giant Aflac Discloses Data Breach After Subsidiary Hack
  "American insurance giant Aflac has disclosed a new data breach after attackers breached its Japan subsidiary's systems and stole personal and bank account information. Aflac (short for American Family Life Assurance Company) is a Fortune 500 company and the largest supplemental insurance provider in the United States, serving millions of customers in the U.S. and Japan. In a filing with the U.S. Securities and Exchange Commission (SEC) on Monday, the company revealed that threat actors gained access to Aflac Japan's systems earlier this month."
  https://www.bleepingcomputer.com/news/security/insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack/
  https://www.securityweek.com/aflac-japan-data-breach-impacts-4-38-million/
  https://securityaffairs.com/194488/data-breach/hackers-steal-data-of-4-38-million-aflac-japan-customers.html

General News

• Shadow AI Is Not a Tool Problem. It’s a Timing Problem.
  "Most AI policies are written in the future tense. Employees use AI in the present tense. That gap explains a lot about shadow AI. A governance committee may still be defining good AI use. Meanwhile, AI has already become part of how work moves: in the browser, inside SaaS platforms, and across everyday applications. The mismatch is not only organizational. It is temporal."
  https://blog.checkpoint.com/ai-security/shadow-ai-is-not-a-tool-problem-its-a-timing-problem/
• Vulnerability Reports Are Arriving Faster Than GitHub Can Review Them
  "Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, has reached a point where some new advisories take weeks to publish. In May 2026, the database published 1,560 reviewed advisories, the most in its history and several times its usual monthly output. The volume still fell short of what arrived."
  https://www.helpnetsecurity.com/2026/06/30/github-advisory-database-review/
• Half The Defense Base Still Builds Security Around Compliance
  "CMMC requirements are appearing in defense contracts and moving down through supplier networks to thousands of companies new to this kind of compliance work. Many run on limited budgets with lean security teams. The picture comes from nearly 900 defense contractors, C3PAOs, federal suppliers, and cybersecurity professionals who attended the 2026 Secureframe National Cybersecurity Summit."
  https://www.helpnetsecurity.com/2026/06/30/federal-cybersecurity-compliance-report/
• Over 300 UK Firms Hit By Ransomware In a Year
  "UK organizations suffered more than 26 successful ransomware attacks each month last year, with SMEs hit hardest, according to new data from Report Fraud. The UK’s cybercrime and fraud reporting service was contacted by 323 corporate ransomware victims between April 2025 and March 2026, according to City of London Police. Over 50% of reports were from small and mid-sized companies. Financial losses associated with these incidents increased 50% annually to around £270,000 ($357,000), although the police force admitted this was likely an underestimate given many businesses do not fully disclose the figure."
  https://www.infosecurity-magazine.com/news/over-300-uk-firms-hit-ransomware/
• What’s The Difference Between Credential Theft And Session Hijacking?
  "Credential theft targets login details: Attackers steal usernames and passwords to access accounts, often through phishing or social engineering. Session hijacking targets active access: Attackers steal or manipulate session tokens to impersonate users who have already logged in. Multifactor authentication (MFA) helps, but it isn’t foolproof: Session hijacking can bypass MFA because the attacker is exploiting an already-authenticated session. Stopping these attacks requires layered defenses: Strong authentication, encryption, session monitoring, device checks, and user training all play a role."
  https://blog.barracuda.com/2026/06/29/credential-theft-vs-session-hijacking
• UK Healthcare Sector Records Tenfold Increase In Cyber-Attacks
  "The UK’s healthcare sector is being “stress-tested to breaking point," with a tenfold increase in attacks during January-May 2026 compared to the whole of 2025, according to SonicWall. The security vendor’s data comes from its intrusion prevention system (IPS) sensors dispersed across UK healthcare clients. They recorded 264,000 individual events in the first five months of the year compared to just 27,000 for 2025."
  https://www.infosecurity-magazine.com/news/uk-healthcare-tenfold-increase/
• Accelerating The Quantum-Safe Timeline
  "For years, planning for post-quantum cryptography (PQC) was framed as a future problem: important, inevitable, but distant. That perspective is evolving as technology advances and organizations prepare for the scale and complexity of the transition ahead. At Microsoft, we are acting on this shift by bringing our quantum-safe timeline forward so organizations can begin the transition earlier and with greater confidence."
  https://www.microsoft.com/en-us/security/blog/2026/06/30/microsoft-advances-quantum-safe-security-as-the-risk-timeline-shifts/
  https://www.bleepingcomputer.com/news/microsoft/microsoft-accelerates-quantum-safe-roadmap-as-risks-grow/
• Communications Security Establishment Canada Annual Report 2025-2026
  "For 80 years, the Communications Security Establishment Canada (CSE) has used its expertise in signals intelligence to keep Canada and Canadians safe. As technology has evolved, so has CSE’s role. Through our Canadian Centre for Cyber Security (Cyber Centre), we now provide authoritative, practical advice and technical guidance to help Canadian individuals, businesses, various levels of government and critical infrastructure stay safe from cyber threats. Together, we are Canada’s digital frontline of defence."
  https://www.cse-cst.gc.ca/en/accountability/transparency/reports/communications-security-establishment-canada-annual-report-2025-2026
  https://www.bankinfosecurity.com/russian-water-system-hack-attempted-to-turn-canada-dry-a-32122
• AI-Generated Workflows Are a Silent Security Disaster
  "A security analyst at a large enterprise recently found sensitive HR documents being copied into a Microsoft Teams channel that hundreds of employees could access. It was not caused by a malicious insider, a compromised admin account, or a sophisticated attacker. It was caused by a Power Automate workflow. The workflow had been created by a developer who wanted to automate document approvals between SharePoint and Teams. To move faster, the developer used an AI assistant to generate the automation logic. Functionally, the workflow worked. Documents moved from one location to another. Notifications were sent. The approval process became faster."
  https://www.darkreading.com/cyber-risk/ai-generated-workflows-silent-security-disaster
• Two Months In: Assessing The Impact Of NIST's Enrichment Cutbacks
  "On April 15, NIST announced that it would no longer attempt enrichment for every CVE. Vulnerabilities are still ingested by the National Vulnerability Database, but enrichment is now reserved for a selected subset. Everything else will be marked as Not Scheduled. That may sound strategic, but is actually problematic. For years, NIST established itself as an authoritative source of vulnerability data. Teams have come to rely on their assessment of CVSS, CWE, and CPE for vulnerability management and automation."
  https://blog.volerion.com/posts/two-months-in-nist-cuts-back-on-enrichment-efforts/
  https://www.darkreading.com/vulnerabilities-threats/nist-enrichment-reductions-cve-coverage-accuracy
• Singapore Cyber Landscape 2025/2026
  "The cybersecurity landscape over the past year was defined by several prominent trends, underpinned by a threat environment of growing complexity, speed, scale, and sophistication. Key among the drivers of these trends were the proliferation and accessibility of artificial intelligence, as well as the interdependencies inherent in modern supply chains. In line with global trends, Singapore’s cyber landscape saw an increase in ransomware attacks. Locally, there was also a notable rise in the number of infected systems, driven primarily by an expanded attack surface stemming from the increasing adoption of Malware-as-a-Service (MaaS) operations, and the proliferation of consumer-grade Internet-of-Things (IoT) devices with unpatched firmware or default passwords."
  https://www.csa.gov.sg/resources/publications/singapore-cyber-landscape-2025-2026/
• What's Trending: Top Cyber Attacker Techniques, March - May 2026
  "Between March 1 and May 31, 2026 (“the reporting period”), attackers achieved their objectives by exploiting trusted identities, devices, and tools rather than malicious code. Because their activity resembled normal behavior, traditional perimeter and file-scanning defenses often failed to catch it. Adversaries leaned on two strategies: social engineering at scale and attacks on unpatched, internet-facing infrastructure. The leading technique “ClickFix” drove the first, shifting delivery from compromised websites to emailed links, while “Qilin,” the period’s most active ransomware operator, continued exploiting unpatched edge devices for mass extortion. What’s more, AI is making social engineering faster, cheaper, and more convincing, accelerating familiar techniques rather than creating new ones."
  https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-march-may-2026
  https://www.infosecurity-magazine.com/news/clickfix-cybercriminals-favorite/
• Securing AI Agents: When AI Tools Move From Reading To Acting
  "As enterprise deployments mature, some enterprise AI agents are shifting from reading content to taking action. In this post, Microsoft Incident Response walks through an attack pattern that targets the fastest growing part of the agentic AI supply chain: Model Context Protocol (MCP) tools. The post provides a practical playbook for detecting, containing, and preventing this class of attack using Microsoft security controls."
  https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/
  https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html
• What The Numbers Say About FIFA 2026 Cyber Risk
  "The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages. Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering financial services, transportation, hospitality, and gambling. Here are three findings worth reading carefully."
  https://thehackernews.com/2026/06/what-numbers-say-about-fifa-2026-cyber.html
  https://checkpoint.cyberint.com/fifa-report-2026
• Hacker Conversations: Chris Thompson, Former Head Of IBM X-Force Red, Co-Founder Of RemoteThreat
  "From bad game hacker to an elite good red team hacker. Chris Thompson is a hacker. His journey took him from hacking game controls as a teenager to become the founder of IBM’s first dedicated red team and then global head of X-Force Red. In 2024 he founded and remains the organizer of Offensive AI Con, and in 2025 moved from IBM to be co-founder and CEO at RemoteThreat."
  https://www.securityweek.com/hacker-conversations-chris-thompson-former-head-of-ibm-x-force-red-co-founder-of-remotethreat/
• The AI Token Costs That Can Break Cybersecurity
  "Imagine this scenario. It’s Tuesday night at 11:47 PM. Your senior SOC analyst is pulled into a critical, high-severity alert. A primary Domain Controller has flagged a deeply anomalous administrative command sequence originating from a mid-level employee’s standard workstation. The analyst triggers “agents” on the organization’s cybersecurity platform to assist with her investigation: mapping the account’s full authentication timeline, cross-referencing internal network logs, scanning active threat intelligence feeds, constructing secondary lookup queries to hunt for lateral movement. The investigation is moving at machine speed."
  https://www.securityweek.com/the-ai-token-costs-that-can-break-cybersecurity/
• XSS Forum: From DaMaGeLaB To The 2025 Takedown
  "XSS[.]is, the most influential Russian-language cybercrime forum of the past decade and the direct heir to the legacy board DaMaGeLaB, lost its administrator on 22 July 2025 when French and Ukrainian police arrested a 38-year-old man in Kyiv. Europol, which coordinated Operation Ratatouille, said the forum had more than 50,000 members and that the suspect earned over EUR 7 million arbitrating deals between criminals. The Ransomnews Research Team analysed a leaked copy of the forum database, 123,241 messages across 51 trading sections, to show exactly how the marketplace worked and where it sat in the ransomware kill chain."
  https://ransomnews.com/xss-forum-damagelab-takedown-2025/
  https://securityaffairs.com/194524/security/xss-is-the-forum-that-ran-the-ransomware-supply-chain-is-down-the-market-isnt.html

อ้างอิง

Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 30 มิถุนายน 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 1 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

CVE-2026-48558 SimpleHelp Authentication Bypass Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง

https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 8 รายการ เมื่อวันที่ 30 มิถุนายน 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

ICSMA-26-181-01 OFFIS DCMTK Toolkit
ICSA-26-181-01 Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M
ICSA-26-181-02 Frangoteam FUXA SCADA/HMIM
ICSA-26-181-03 Schneider Electric EcoStruxure IT Data Center Expert
ICSA-26-181-04 Schneider Electric EasyLogic T150 and Saitel DP RTU
ICSA-26-181-05 XZ Utils vulnerability impacting B&R Products
ICSA-26-181-06 StoneFly Storage Concentrator
ICSA-26-181-07 Delta Electronics DVP12SE PLC

อ้างอิง

https://www.cisa.gov/news-events/ics-advisories