โพสต์ถูกสร้างโดย NCSA_THAICERT

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Trio Of Critical Bugs Spotted In Delta Industrial PLCs
  "Researchers have identified one high- and three critical-severity vulnerabilities in a brand of programmable logic controller (PLC) popular at industrial sites in Asia. The DVP-12SE11T, by Taiwan's Delta Electronics, is a cut-rate PLC popular in a variety of sensitive sectors in Asia, such as water treatment and food and beverage processing. In August 2025, researchers from OPSWAT's Unit 515 decided to crack into it, and in doing so discovered four serious vulnerabilities, three of which ranked above a 9 out of 10 in the Common Vulnerability Scoring System (CVSS)."
  https://www.darkreading.com/ics-ot-security/critical-bugs-delta-industrial-plcs
• ICS Patch Tuesday: Vulnerabilities Fixed By Siemens, Schneider, Aveva, Phoenix Contact
  "Industrial giants Siemens, Schneider Electric, Phoenix Contact, and Aveva have published a dozen Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS/OT products. Siemens has released five new advisories. Two of them describe the same critical authorization bypass flaw in Industrial Edge Devices that can be leveraged by an unauthenticated, remote attacker to bypass authentication and impersonate a user. One advisory covers Industrial Edge Devices, while the other is for the Industrial Edge Device Kit. The remaining advisories inform customers about the availability of fixes for high-severity vulnerabilities in Ruggedcom, ET 200SP, and TeleControl Server Basic products."
  https://www.securityweek.com/ics-patch-tuesday-vulnerabilities-fixed-by-siemens-schneider-aveva-phoenix-contact/
• Cyber Threat Actors Ramp Up Attacks On Industrial Environments
  "Both cybercriminals and hacktivists have increased cyber-attacks against industrial technology environments, with vulnerability exploits in these systems almost doubling in 2025, according to Cyble. This according the Cyble Research & Intelligence Labs’ (CRIL) Annual Threat Landscape Report 2025, published on January 15, 2026."
  https://www.infosecurity-magazine.com/news/cyber-threat-actors-ramp-up-ics/

Vulnerabilities

• Critical Privilege Escalation Vulnerability In Modular DS Plugin Affecting 40k+ Sites Exploited In The Wild
  "This blog post is about an Unauthenticated Privilege Escalation vulnerability in the Modular DS plugin. Patchstack has issued a mitigation rule to protect against exploitation of this vulnerability. If you're a Modular DS user, please update to at least version 2.5.2. This vulnerability was discovered and reported to Patchstack by Teemu Saarentaus from group.one."
  https://patchstack.com/articles/critical-privilege-escalation-vulnerability-in-modular-ds-plugin-affecting-40k-sites-exploited-in-the-wild/
  https://thehackernews.com/2026/01/critical-wordpress-modular-ds-plugin.html
  https://www.bleepingcomputer.com/news/security/hackers-exploit-modular-ds-wordpress-plugin-flaw-for-admin-access/
• Cisco Finally Fixes Max-Severity Bug Under Active Attack For Weeks
  "Cisco finally delivered a fix for a maximum-severity bug in AsyncOS that has been under attack for at least a month. The networking giant disclosed the vulnerability, tracked as CVE-2025-20393, on December 17. It affects some Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. Cisco first became aware of attackers targeting the appliances on December 10."
  https://www.theregister.com/2026/01/15/cisco_fixes_cve_2025_20393/
  Palo Alto Networks Warns Of DoS Bug Letting Hackers Disable Firewalls
  "Palo Alto Networks patched a high-severity vulnerability that could allow unauthenticated attackers to disable firewall protections in denial-of-service (DoS) attacks. Tracked as CVE-2026-0227, this security flaw affects next-generation firewalls (running PAN-OS 10.1 or later) and Palo Alto Networks' Prisma Access configurations when the GlobalProtect gateway or portal is enabled. The cybersecurity company says that most cloud-based Prisma Access instances have already been patched, with those left to be secured already scheduled for an upgrade."
  https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-dos-bug-letting-hackers-disable-firewalls/
  https://security.paloaltonetworks.com/CVE-2026-0227
  https://thehackernews.com/2026/01/palo-alto-fixes-globalprotect-dos-flaw.html
  https://securityaffairs.com/186948/hacking/palo-alto-networks-addressed-a-globalprotect-flaw-poc-exists.html
• WhisperPair: Hijacking Bluetooth Accessories Using Google Fast Pair
  "Google Fast Pair enables one-tap pairing and account synchronisation across supported Bluetooth accessories. While Fast Pair has been adopted by many popular consumer brands, we discovered that many flagship products have not implemented Fast Pair correctly, introducing a flaw that allows an attacker to hijack devices and track victims using Google's Find Hub network. We introduce WhisperPair, a family of practical attacks that leverages a flaw in the Fast Pair implementation on flagship audio accessories. Our findings show how a small usability 'add-on' can introduce large-scale security and privacy risks for hundreds of millions of users."
  https://whisperpair.eu/
  https://www.bleepingcomputer.com/news/security/critical-flaw-lets-hackers-track-eavesdrop-via-bluetooth-audio-devices/
• CodeBreach: Infiltrating The AWS Console Supply Chain And Hijacking AWS GitHub Repositories Via CodeBuild
  "Wiz Research uncovered CodeBreach, a critical vulnerability that placed the AWS Console supply chain at risk. The issue allowed a complete takeover of key AWS GitHub repositories - most notably the AWS JavaScript SDK, a core library that powers the AWS Console. By exploiting CodeBreach, attackers could have injected malicious code to launch a platform-wide compromise, potentially affecting not just the countless applications depending on the SDK, but the Console itself, threatening every AWS account."
  https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild
  https://thehackernews.com/2026/01/aws-codebuild-misconfiguration-exposed.html
  https://www.infosecurity-magazine.com/news/codebuild-flaw-aws-console-risk/
  https://www.theregister.com/2026/01/15/codebuild_flaw_aws/
• New ‘StackWarp’ Attack Threatens Confidential VMs On AMD Processors
  "A team of researchers from the CISPA Helmholtz Center for Information Security in Germany has disclosed the details of a new hardware vulnerability affecting AMD processors. Dubbed StackWarp, the issue has been found to impact AMD Zen 1 through Zen 5 processors, enabling an attacker to hack confidential virtual machines (CVMs). The researchers described StackWarp as a software-based architectural attack that “exploits a synchronization failure in the stack engine that manages stack pointer updates in the CPU frontend”."
  https://www.securityweek.com/new-stackwarp-attack-threatens-confidential-vms-on-amd-processors/
  https://www.theregister.com/2026/01/15/stackwarp_bug_amd_cpus/
• Claude Cowork Exfiltrates Files
  "Two days ago, Anthropic released the Claude Cowork research preview (a general-purpose AI agent to help anyone with their day-to-day work). In this article, we demonstrate how attackers can exfiltrate user files from Cowork by exploiting an unremediated vulnerability in Claude’s coding environment, which now extends to Cowork. The vulnerability was first identified in Claude.ai chat before Cowork existed by Johann Rehberger, who disclosed the vulnerability — it was acknowledged but not remediated by Anthropic."
  https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files
  https://www.theregister.com/2026/01/15/anthropics_claude_bug_cowork/

Malware

• Planned Failure: Gootloader’s Malformed ZIP Actually Works Perfectly
  "The Gootloader developer has been involved in ransomware for a long time. Their role within ransomware has been initial access: getting the foot in the door. Once the malware runs on a system, they hand their access to someone else. In being responsible for this job, the Gootloader developer has incentive to ensure that their malware receives a low detection score and can bypass most security tools. They’ve been very successful with this over the years. In years past, Gootloader malware made up 11% of all malware we saw bypassing other security tools."
  https://expel.com/blog/gootloaders-malformed-zip/
  https://www.bleepingcomputer.com/news/security/gootloader-now-uses-1-000-part-zip-archives-for-stealthy-delivery/
• UAT-8837 Targets Critical Infrastructure Sectors In North America
  "Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor based on overlaps in tactics, techniques, and procedures (TTPs) with those of other known China-nexus threat actors. Based on UAT-8837's TTPs and post-compromise activity Talos has observed across multiple intrusions, we assess with medium confidence that this actor is primarily tasked with obtaining initial access to high-value organizations. Although UAT-8837's targeting may appear sporadic, since at least 2025, the group has clearly focused on targets within critical Infrastructure sectors in North America."
  https://blog.talosintelligence.com/uat-8837/
  https://therecord.media/china-hackers-apt-cisco-talos
• New Remcos Campaign Distributed Through Fake Shipping Document
  "FortiGuard Labs discovered a new phishing campaign in the wild. The campaign delivers a new variant of Remcos, a commercial lightweight remote access tool (RAT) with a wide range of capabilities, including system resource management, remote surveillance, network management, and Remcos agent management. I conducted an in-depth investigation into this malicious campaign. This analysis covers how the phishing email initializes the attack, how the attached Word document downloads an RTF file, the vulnerability the attack leverages within the RTF file, the VBScript and PowerShell code, how a fileless .NET module is loaded and executed in a PowerShell process, and how the fileless Remcos agent is downloaded and loaded using process hollowing."
  https://www.fortinet.com/blog/threat-research/new-remcos-campaign-distributed-through-fake-shipping-document
• New PayPal Scam Sends Verified Invoices With Fake Support Numbers
  "A new phishing scam is leveraging PayPal’s legitimate invoice system to trick unsuspecting users, even appearing with the coveted “blue tick” verification mark in their inboxes. This sophisticated attack is bypassing traditional email security filters and leaving even tech-savvy individuals confused. Hackread.com has obtained direct evidence of this escalating threat, confirming that attackers are exploiting PayPal’s own services to send fraudulent money requests, making them appear entirely authentic."
  https://hackread.com/paypal-scam-verified-invoices-fake-support-numbers/
• Browser Extensions Gone Rogue: The Full Scope Of The GhostPoster Campaign
  "Last month, researchers at Koi Security published a detailed analysis of a malicious Firefox extension they dubbed GhostPoster – a browser-based malware leveraging an uncommon and stealthy payload delivery method: steganography within a PNG icon file. This innovative approach allowed the malware to evade traditional extension security reviews and static analysis tools. Following their publication, our investigation identified 17 additional extensions associated with the same infrastructure and tactics, techniques, and procedures (TTPs). Collectively, these extensions were downloaded over 840,000 times, with some remaining active in the wild for up to five years."
  https://layerxsecurity.com/blog/browser-extensions-gone-rogue-the-full-scope-of-the-ghostposter-campaign/
  https://hackread.com/ghostposter-browser-malware-840000-installs/
• New CastleLoader Variant Linked To 469 Infections Across Critical Sectors
  "A new name is surfacing in cyber intelligence reports that has security teams on edge. Known as CastleLoader, it has become a go-to tool for attackers targeting high-security environments since early 2025. As Hackread.com reported in December 2025, earlier versions of CastleLoader were analysed in July and August 2025. Cybersecurity analysis firm ANY.RUN has now detected a newer and more stealthy version."
  https://hackread.com/castleloader-variant-infections-critical-sectors/
• Ransomware: Tactical Evolution Fuels Extortion Epidemic
  "The cyber-extortion epidemic reached new heights in 2025, with a record number of attacks recorded. As outlined in our new whitepaper, this increase is being powered by a new breed of attackers who eschew encryption and rely solely on data theft as leverage for extortion. By using zero-day vulnerabilities or exploiting weaknesses in the software supply chain, attackers can steal data from even the best-defended organizations before they become aware of the issue."
  https://www.security.com/threat-intelligence/ransomware-extortion-epidemic
  https://sed-cms.broadcom.com/sites/default/files/2026-01/RWN-2026-WP100_1.pdf
  https://www.infosecurity-magazine.com/news/hackers-shun-encryption-in-favour/
• LOTUSLITE: Targeted Espionage Leveraging Geopolitical Themes
  "Acronis Threat Research Unit (TRU) has been actively monitoring malware campaigns and threat activity leveraging recent geopolitical developments between the United States and Venezuela as thematic lures. During this tracking, TRU identified a targeted campaign delivering a previously undocumented DLL-based backdoor, tracked as LOTUSLITE, aimed at U.S. government–related entities."
  https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/
  https://www.theregister.com/2026/01/15/chinese_spies_used_maduros_capture/
• Sicarii Ransomware: Truth Vs Myth
  "In December 2025, a previously unknown Ransomware-as-a-Service (RaaS) operation calling itself Sicarii began advertising its services across multiple underground platforms. The group’s name references the Sicarii, a 1st-century Jewish assassins group that opposed Roman rule in Judea. From its initial appearance, the Sicarii ransomware group distinguished itself through unusually explicit and persistent use of Israeli and Jewish symbolism in its branding, communications, and malware logic."
  https://research.checkpoint.com/2026/sicarii-ransomware-truth-vs-myth/
• Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs
  "Threat hunting often begins with a single indicator, such as a suspicious IP address, a beaconing domain, or a known malware family. Looking at those indicators individually makes the underlying infrastructure easy to miss. While analyzing malicious activity across Chinese hosting environments, we repeatedly observed the same networks and providers appearing across unrelated campaigns. Commodity malware, phishing operations, and state-linked tooling were often hosted side by side within the same infrastructure, even as individual IPs and domains changed."
  https://hunt.io/blog/china-hosting-malware-c2-infrastructure

Breaches/Hacks/Leaks

• Grubhub Confirms Hackers Stole Data In Recent Security Breach
  "Food delivery platform Grubhub has confirmed a recent data breach after hackers accessed its systems, with sources telling BleepingComputer the company is now facing extortion demands. "We're aware of unauthorized individuals who recently downloaded data from certain Grubhub systems," Grubhub told BleepingComputer. "We quickly investigated, stopped the activity, and are taking steps to further increase our security posture. Sensitive information, such as financial information or order history, was not affected.""
  https://www.bleepingcomputer.com/news/security/grubhub-confirms-hackers-stole-data-in-recent-security-breach/
• ICE Agent Doxxing Site DDoS-Ed Via Russian Servers
  "A controversial website launched following an apparent insider breach at the Department of Homeland Security (DHS) has been taken offline by a sustained DDoS attack, its founder has revealed. Dominick Skinner told The Daily Beast that his ICE List site is being hit with a “prolonged and sophisticated” cyber-attack which began on Tuesday evening. At the time of writing, it was still down, making it impossible for interested parties to uncover the identities of agents working for US Immigration and Customs Enforcement (ICE) and Border Patrol."
  https://www.infosecurity-magazine.com/news/ice-agent-doxxing-site-ddosed/

General News

• CISOs Flag Gaps In Third-Party Risk Management
  "Third-party cyber risk continues to concern security leaders as vendor ecosystems grow, supply chains stretch, and AI plays a larger role in business operations. A recent Panorays survey of U.S. CISOs shows rising third-party incidents and growing regulatory attention, while visibility beyond direct vendors and the resources to manage that risk continue to fall short."
  https://www.helpnetsecurity.com/2026/01/15/panorays-cisos-ai-vendor-risk/
• Cybersecurity Spending Keeps Rising, So Why Is Business Impact Still Hard To Explain?
  "Cybersecurity budgets keep climbing, but many security leaders still struggle to explain what that spending delivers to the business. A new study by Expel examines that disconnect through a survey of security and finance executives at large enterprises. The research looks at how the two groups view risk, investment decisions, and their working relationship."
  https://www.helpnetsecurity.com/2026/01/15/expel-cybersecurity-investment-decisions/
• The NSA Lays Out The First Steps For Zero Trust Adoption
  "Security pros often say that zero trust sounds straightforward until they try to apply it across real systems, real users, and real data. Many organizations are still sorting out what they own, how access works, and where authority sits. That day-to-day reality is the context for a new set of implementation documents released by the National Security Agency."
  https://www.helpnetsecurity.com/2026/01/15/nsa-zero-trust-implementation-guidelines/
  https://media.defense.gov/2026/Jan/08/2003852320/-1/-1/0/CTR_ZERO_TRUST_IMPLEMENTATION_GUIDELINE_PRIMER.PDF
• Microsoft Remains The Most Imitated Brand In Phishing Attacks In Q4 2025
  "In Q4 2025, Microsoft once again ranked as the most impersonated brand in phishing attacks, accounting for 22% of all brand phishing attempts, according to data from Check Point Research. This continues a multi-quarter trend in which attackers increasingly abuse trusted enterprise and consumer brands to harvest credentials and gain initial access. Google followed in second place with 13%, while Amazon climbed into third position at 9%, fueled by Black Friday and holiday sales, overtaking Apple. After a prolonged absence, Facebook (Meta) re-entered the top 10, landing in fifth place, highlighting renewed interest among attackers in social media account takeover."
  https://blog.checkpoint.com/research/microsoft-remains-the-most-imitated-brand-in-phishing-attacks-in-q4-2025/
• Winter Olympics Could Share Podium With Cyberattackers
  "When the Milano Cortina Winter Games begin Feb. 6, it won't be just the athletes hunting for gold, but cybercriminals as well. Everything is on the table, experts warn — from Wi-Fi and digital infrastructure disruptions like those seen at the 2018 Winter Olympics in PyeongChang, to distributed denial-of-service (DDoS) and ransomware attacks of the sort French authorities faced during the 2024 Olympics. State-linked cyber espionage could be part of the mix too."
  https://www.darkreading.com/remote-workforce/winter-olympics-podium-cyberattackers
• Vulnerabilities Surge, But Messy Reporting Blurs Picture
  "Another year, another record for vulnerability reports. For the ninth year in a row, the number of reported vulnerabilities set a new record, with 48,177 issues assigned a 2025 Common Vulnerabilities and Exposures (CVE) identifier, according to data analyzed from the National Vulnerability Database (NVD). While the deluge of security issues complicates companies' efforts to prioritize their patching processes, ongoing changes in the CVE-reporting ecosystem have more to do with the surge than an increase in cybersecurity risk."
  https://www.darkreading.com/cybersecurity-analytics/vulnerabilities-surge-messy-reporting-blurs-picture
  https://jerrygamblin.com/2026/01/01/2025-cve-data-review/
• Years-Old Apache Struts2 Vulnerability Downloaded 387K+ Times In The Past Week
  "Apache Struts has a newly disclosed vulnerability, CVE-2025-68493, affecting Struts' XWork component and raising renewed concern about unsafe XML handling and XXE-style risk in certain deployments. According to NVD, affected versions span Struts 2.0.0 up to 6.1.0, with 6.1.1 identified as the fixed release. What makes this disclosure especially urgent is what we're seeing in Maven Central download telemetry: in just the past 7 days, we observed 387,549 downloads of org.apache.struts:*, and ~98% of that activity was concentrated on end-of-life (EOL) Struts 2.x lines with only ~1.8% on Struts 6.0.0 – 6.1.0."
  https://www.sonatype.com/blog/years-old-apache-struts2-vulnerability-downloaded-325k-times-in-the-past-week
  https://hackread.com/years-old-vulnerable-apache-struts-2-downloads/
• LinkedIn Wants To Make Verification a Portable Trust Signal
  "In this Help Net Security interview, Oscar Rodriguez, VP Trust Product at LinkedIn, discusses how verification is becoming a portable trust signal across the internet. He explains how LinkedIn is extending professional identity beyond its platform to address rising AI-driven fraud, impersonation, and online scams. Rodriguez also outlines how LinkedIn views its role in digital trust alongside platforms, partners, and existing identity systems."
  https://www.helpnetsecurity.com/2026/01/15/oscar-rodriguez-linkedin-identity-verification/
• QR Codes Are Getting Colorful, Fancy, And Dangerous
  "QR codes have become a routine part of daily life, showing up on emails, posters, menus, invoices, and login screens. Security-savvy users have learned to treat links with caution, but QR codes still carry an assumption of safety. Researchers from Deakin University have examined how visually stylized QR codes are being used in quishing attacks. Their study introduces a detection method that evaluates QR codes based on their structure rather than the link they contain, with a focus on visually stylized designs that use colors, shapes, logos, and background images."
  https://www.helpnetsecurity.com/2026/01/15/fancy-qr-codes-phishing-risk/
  https://arxiv.org/pdf/2601.06768
• CISO Role Reaches “Inflexion Point” With Executive-Level Titles
  "The role of chief information security officer (CISO) is now more likely to be regarded as an executive-level position than VP or director, signifying its growing importance to the business, according to IANS. The research and advisory firm put together its 2026 State of the CISO Report based on interviews with 662 North American CISOs. It revealed that 46% of respondents now hold executive titles (e.g., EVP, SVP), while 27% are VPs and 27% are directors. This indicates a “structural shift” in the security leadership landscape, IANS claimed."
  https://www.infosecurity-magazine.com/news/ciso-role-inflexion-point/
• Forget Predictions: True 2026 Cybersecurity Priorities From Leaders
  "Every December and January we see multiple public relations-driven “next year predictions” and these predictions are, unsurprisingly, self-serving to their clients. Why not go straight to the source? For this article, I spoke with several security leaders and asked them all the same question: “What people, process, or technology shift will help you most to do your job more efficiently in 2026?”"
  https://www.securityweek.com/forget-predictions-true-2026-cybersecurity-priorities-from-leaders/
• Insider Threats: Turning 2025 Intelligence Into a 2026 Defense Strategy
  "Every organization houses sensitive assets that threat actors actively seek. Whether it is proprietary trade secrets, intellectual property, or the personally identifiable information (PII) of employees and customers, these datasets are the lifeblood of the modern enterprise—and highly lucrative commodities within the illicit underground. In 2025, Flashpoint observed 91,321 instances of insider recruiting, advertising, and threat actor discussions involving insider-related illicit activity. This underscores a critical reality—it is far more efficient for threat actors to recruit an “insider” to circumvent multi-million dollar security stacks than it is to develop a complex exploit from the outside."
  https://flashpoint.io/blog/insider-threats-2025-intelligence-2026-strategy/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Industrial Sector

• Western Cyber Agencies Warn About Threats To Industrial Operational Technology
  "A group of Western cyber agencies warned on Wednesday about the growing digital threats facing the operational technology at the heart of industrial systems. New guidance issued by Britain’s National Cyber Secure Centre (NCSC), a part of signals and cyber intelligence agency GCHQ, sets out how organizations should securely connect equipment such as industrial control systems, sensors and other critical services. These types of technology are often at the heart of critical infrastructure, from energy generation plants through to water treatment facilities, manufacturing lines and transportation networks."
  https://therecord.media/cyber-agencies-warn-of-industrial-system-threats
  https://www.ncsc.gov.uk/files/ncsc-secure-connectivity-for-operational-technology.pdf

New Tooling

• CISO Assistant: Open-Source Cybersecurity Management And GRC
  "CISO Assistant is an open-source governance, risk, and compliance (GRC) platform designed to help security teams document risks, controls, and framework alignment in a structured system. The community edition is maintained as a self-hosted tool for organizations that want direct access to the code and data. The community edition focuses on foundational GRC functions. It allows teams to define assets, document risks, create controls, and map those controls to security and compliance frameworks. All of these elements are connected through a shared data model that emphasizes traceability."
  https://www.helpnetsecurity.com/2026/01/14/ciso-assistant-open-source-cybersecurity-management-grc/
  https://github.com/intuitem/ciso-assistant-community

Vulnerabilities

• Fortinet Patches Critical Vulnerabilities In FortiFone, FortiSIEM
  "Fortinet on Tuesday announced patches for six vulnerabilities across its products, including two critical-severity bugs in FortiFone and FortiSIEM. The most severe of these flaws is CVE-2025-64155 (CVSS score of 9.4), an OS command injection issue in FortiSIEM that could be exploited by unauthenticated attackers for code and command execution. Exploitable via crafted TCP requests, the security defect was resolved in FortiSIEM versions 7.1.9, 7.2.7, 7.3.5, and 7.4.1."
  https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortifone-fortisiem/
  https://thehackernews.com/2026/01/fortinet-fixes-critical-fortisiem-flaw.html
  https://securityaffairs.com/186902/security/fortinet-fixed-two-critical-flaws-in-fortifone-and-fortisiem.html
• Chrome 144, Firefox 147 Patch High-Severity Vulnerabilities
  "Google and Mozilla on Tuesday announced the release of Chrome 144 and Firefox 147 with patches for a total of 26 vulnerabilities. Chrome 144 was rolled out to the stable channel with fixes for 10 security defects, including three high-severity bugs. Two of the high-severity flaws affect V8, the browser’s JavaScript and WebAssembly engine: CVE-2026-0899 is an out-of-bounds memory access issue, while CVE-2026-0900 is an inappropriate implementation weakness."
  https://www.securityweek.com/chrome-144-firefox-147-patch-high-severity-vulnerabilities/
• CVE-2025-64155: Three Years Of Remotely Rooting The Fortinet FortiSIEM
  "In August of 2025, Fortinet released an advisory for CVE-2025-25256, a command injection vulnerability which affected the FortiSIEM appliance. After the August advisory, we decided to dive in and assess the situation, ultimately leading to the discovery of:

• An unauthenticated argument injection vulnerability resulting in arbitrary file write allowing for remote code execution as the admin user
• A file overwrite privilege escalation vulnerability leading to root access
  These vulnerabilities were reported and assigned CVE-2025-64155. Our proof of concept exploit can be found on our GitHub."
  https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/
  https://www.bleepingcomputer.com/news/security/exploit-code-public-for-critical-fortisiem-command-injection-flaw/

• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-20805 Microsoft Windows Information Disclosure Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/01/13/cisa-adds-one-known-exploited-vulnerability-catalog
  https://therecord.media/desktop-windows-manager-vulnerability-added-to-cisa-list
  https://securityaffairs.com/186898/security/u-s-cisa-adds-a-flaw-in-microsoft-windows-to-its-known-exploited-vulnerabilities-catalog.html
• Mitigating Denial-Of-Service Vulnerability From Unrecoverable Stack Space Exhaustion For React, Next.js, And APM Users
  "Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion with a catchable error, which frameworks have come to rely on for service availability. A bug that only reproduces when async_hooks are used would break this attempt, causing Node.js to exit with 7 directly without throwing a catchable error when recursions in user code exhaust the stack space. This makes applications whose recursion depth is controlled b
  https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
  https://thehackernews.com/2026/01/critical-nodejs-vulnerability-can-cause.html

Malware

• ConsentFix Debrief: Insights From The New OAuth Phishing Attack
  "In December, the Push Security research team discovered and blocked a brand new attack technique that we coined ConsentFix. This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. We saw this attack running across a large network of compromised websites that attackers were injecting the malicious payload into, forming a large-scale campaign that was detected across multiple customer estates."
  https://www.bleepingcomputer.com/news/security/consentfix-debrief-insights-from-the-new-oauth-phishing-attack/
• Predator's Kill Switch: Undocumented Anti-Analysis Techniques In iOS Spyware
  "n December 2024, Google's Threat Intelligence Group (GTIG) published extensive research on Intellexa's Predator spyware, documenting its zero-day exploit chains and the PREYHUNTER stager component. Their research identified that the "watcher" module detects developer mode, jailbreak tools, security applications and network interception configurations. However, while conducting independent reverse engineering of a Predator sample, Jamf Threat Labs discovered several undocumented mechanisms that reveal how sophisticated this spyware's anti-analysis capabilities truly are."
  https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/
  https://cyberscoop.com/predator-spyware-demonstrates-troubleshooting-researcher-dodging-capabilities/
  https://www.securityweek.com/predator-spywares-granular-anti-analysis-features-exposed/
• Microsoft Disrupts Global Cybercrime Subscription Service Responsible For Millions In Fraud Losses
  "Today, Microsoft is announcing a coordinated legal action in the United States and, for the first time, the United Kingdom to disrupt RedVDS, a global cybercrime subscription service fueling millions in fraud losses. These efforts are part of a broader joint operation with international law enforcement, including German authorities and Europol, which has allowed Microsoft and its partners to seize key malicious infrastructure and take the RedVDS marketplace offline, a major step toward dismantling the networks behind AI-enabled fraud, such as real estate scams."
  https://blogs.microsoft.com/on-the-issues/2026/01/14/microsoft-disrupts-cybercrime/
  https://www.darkreading.com/threat-intelligence/microsoft-disrupts-cybercrime-service-redvds
  https://therecord.media/microsoft-redvds-cybercrime-scam
  https://cyberscoop.com/microsoft-seizes-disrupts-redvds-cybercrime-marketplace/
  https://www.infosecurity-magazine.com/news/criminal-subscription-service/
  https://www.securityweek.com/redvds-cybercrime-service-disrupted-by-microsoft-and-law-enforcement/
• Inside The Latest PayPal Scam: RMM Abuse And Credential Theft
  "Over the past two months, cybercriminals have increasingly abused Remote Monitoring and Management (RMM) tools in multi-stage attack campaigns. These attacks often begin with phishing emails disguised as holiday party invitations, overdue invoices, tax notices, Zoom meeting requests, or document signing notifications. While these lures appear harmless, their true intent is credential theft and unauthorized access. Recent public research released on November 19, 2025, highlighted this trend, noting that attackers frequently use seasonal lures such as “Party Invitation” or “December Holiday Party” to trick victims into engaging with malicious content."
  https://www.cyberproof.com/blog/inside-the-latest-paypal-scam-rmm-abuse-and-credential-theft/
  https://www.infosecurity-magazine.com/news/hackers-fake-paypal-notices-deploy/
• DeadLock Ransomware Group Utilizes Polygon Smart Contracts
  "A newly emerged digital extortion group is using blockchain smart contracts to store proxy server addresses for facilitating ransomware negotiations with victim organizations. The DeadLock ransomware group - it dates to July 2025 - has been using smart contracts on Polygon, a cryptocurrency blockchain platform designed to run alongside the ethereum blockchain. Known as "EtherHiding," the technique embeds malicious instructions in blockchain smart contracts. In many cases, such activities leave no trace. Devotees have included a North Korean nation-state group targeting developers and cryptocurrency firms and a financially motivated cybercrime group (see: Hackers Use Blockchain to Hide Malware in Plain Sight)."
  https://www.bankinfosecurity.com/deadlock-ransomware-group-utilizes-polygon-smart-contracts-a-30518
  https://www.infosecurity-magazine.com/news/deadlock-polygon-smart-contracts/
  https://www.theregister.com/2026/01/14/deadlock_ransomware_smart_contracts/
• How Real Software Downloads Can Hide Remote Backdoors
  "It starts with a simple search. You need to set up remote access to a colleague’s computer. You do a Google search for “RustDesk download,” click one of the top results, and land on a polished website with documentation, downloads, and familiar branding. You install the software, launch it, and everything works exactly as expected. What you don’t see is the second program that installs alongside it—one that quietly gives attackers persistent access to your computer."
  https://www.malwarebytes.com/blog/threat-intel/2026/01/how-real-software-downloads-can-hide-remote-backdoors
• Researchers Null-Route Over 550 Kimwolf And Aisuru Botnet Command Servers
  "The Black Lotus Labs team at Lumen Technologies said it null-routed traffic to more than 550 command-and-control (C2) nodes associated with the AISURU/Kimwolf botnet since early October 2025. AISURU and its Android counterpart, Kimwolf, have emerged as some of the biggest botnets in recent times, capable of directing enslaved devices to participate in distributed denial-of-service (DDoS) attacks and relay malicious traffic for residential proxy services."
  https://thehackernews.com/2026/01/kimwolf-botnet-infected-over-2-million.html
  https://cyberscoop.com/kimwolf-aisuru-botnet-lumen-technologies/
• Hiding In Plain Sight: Deconstructing The Multi-Actor DLL Sideloading Campaign Abusing Ahost.exe
  "The Trellix Advanced Research Center has uncovered an active malware campaign that exploits a DLL sideloading vulnerability within the legitimate ahost.exe utility. This utility is a component of the open-source c-ares library (used for asynchronous DNS lookups) and is commonly bundled within Git for Windows installations, including those embedded in developer tools like GitKraken or GitHub Desktop. Attackers achieve evasion by pairing a malicious libcares-2.dll with any signed version of the legitimate ahost.exe (which they often rename) to execute their code. This DLL sideloading technique allows the malware to bypass traditional signature-based security defenses."
  https://www.trellix.com/en-au/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/
  https://thehackernews.com/2026/01/hackers-exploit-c-ares-dll-side-loading.html
• Reprompt: The Single-Click Microsoft Copilot Attack That Silently Steals Your Personal Data
  "Varonis Threat Labs uncovered a new attack flow, dubbed Reprompt, that gives threat actors an invisible entry point to perform a data‑exfiltration chain that bypasses enterprise security controls entirely and accesses sensitive data without detection — all from one click. First discovered in Microsoft Copilot Personal, Reprompt is important for multiple reasons:"
  https://www.varonis.com/blog/reprompt
  https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/
• NFC Skimming Attacks
  "Thanks to the convenience of NFC and smartphone payments, many people no longer carry wallets or remember their bank card PINs. All their cards reside in a payment app, and using that is quicker than fumbling for a physical card. Mobile payments are also secure — the technology was developed relatively recently and includes numerous anti-fraud protections. Still, criminals have invented several ways to abuse NFC and steal your money. Fortunately, protecting your funds is straightforward: just know about these tricks and avoid risky NFC usage scenarios."
  https://www.kaspersky.com/blog/nfc-gate-relay-attacks-2026/55116/

Breaches/Hacks/Leaks

• Victorian Department Of Education Says Hackers Stole Students’ Data
  "The Department of Education in Victoria, Australia, notified parents that attackers accessed a database containing the personal information and email addresses of current and former students, prompting password resets. The department disclosed the breach in letters sent to parents, stating that an unauthorized third party accessed students' names, school names, year levels, and school-issued email addresses, as well as encrypted passwords for accounts that use them."
  https://www.bleepingcomputer.com/news/security/victorian-department-of-education-notifies-parents-of-data-breach/
• Monroe University Says 2024 Data Breach Affects 320,000 People
  "Monroe University revealed that threat actors stole the personal, financial, and health information of over 320,000 people after breaching its systems in a December 2024 cyberattack. Founded in 1933 as a Bronx secretarial school, Monroe University is now a private institution with over 9,000 students each year across campuses in New York (Bronx and New Rochelle), and in the Caribbean nation of Saint Lucia. As the school explained in data breach notifications filed with the Office of the Maine Attorney General this week, the attackers had access to its network for 2 weeks, from December 9 to December 23."
  https://www.bleepingcomputer.com/news/security/monroe-university-says-2024-data-breach-affects-320-000-people/
• Hacker Claims Full Breach Of Russia’s Max Messenger, Threatens Public Leak
  "A hacker using the alias CamelliaBtw has claimed responsibility for a major data breach involving Max Messenger, according to a post published yesterday on the DarkForums cybercrime marketplace and hacker forum. The forum thread, titled “ Max Messenger – Full User Infrastructure & SQL Dump,” alleges that the attacker gained complete access to the messaging platform’s production systems exactly one year after its public launch. The post describes what would amount to a total compromise of user data, backend infrastructure, and proprietary source code."
  https://hackread.com/hacker-russia-max-messenger-breach-data-leak/
• Eurail Passengers Taken For a Ride As Data Breach Spills Passports, Bank Details
  "Eurail has confirmed customer information was stolen in a data breach, according to notification emails sent out this week. The European travel company, also known as Interrail to EU residents, initially posted the news on January 10, but affected customers, the number of whom was not disclosed, began receiving emails on January 13."
  https://www.theregister.com/2026/01/14/eurail_breach/

General News

• International Threats: How Malware Campaigns Vary Across Non-English Languages
  "Cofense Intelligence relies on over 35 million trained employees from around the world. As a result, a considerable number of analyzed campaigns are written in languages other than English. This report covers from May 2023 to May 2025, providing a historical perspective that demonstrates long-term patterns and trends seen over the last several years. It focuses on the malware families delivered by campaigns bypassing secure email gateways (SEGs) in the top five languages, excluding English, most commonly seen delivering malware by Cofense Intelligence."
  https://cofense.com/blog/international-threats-how-malware-campaigns-vary-across-non-english-languages
• Retail, Services Industries Under Fire In Oceania
  "New data suggests that in Australia and New Zealand, hackers are increasingly targeting companies in non-critical sectors like retail and construction. Cyble's "Threat Landscape Report 2024" for Australia and New Zealand focused on the threat to industries critical to the functioning of modern society: government, healthcare, and finance, for example. These are the kinds of sectors that tend to top most cybersecurity year-in-review lists — they carry the most significance to state-level attackers, and have the most money floating around for cybercriminals."
  https://www.darkreading.com/cybersecurity-analytics/retail-services-industries-oceania
• Survey: Rapid AI Adoption Causes Major Cyber Risk Visibility Gaps
  "As software supply chains become longer and more interconnected, enterprises have become well aware of the need to protect themselves against third-party vulnerabilities. However, the rampant adoption of artificial intelligence chatbots and AI agents means they’re struggling to do this. On the contrary, the majority of organizations are exposing themselves to unknown risks by allowing employees to access AI services and software packages that include AI integrations, with little oversight. This revelation is one of the main findings of Panorays’ latest CISO Survey for Third-Party Cyber Risk Management, which revealed that 60% of CISOs rate AI vendors as “uniquely risky,” primarily due to their opaque nature."
  https://hackread.com/survey-rapid-ai-adoption-cyber-risk-visibility-gaps/
  https://panorays.com/resources/reports-whitepapers/2026-ciso-survey/
• How Cybercrime Markets Launder Breach Proceeds And What Security Teams Miss
  "A corporate customer database is breached on a quiet Sunday night. Millions of credentials and card numbers are quietly exfiltrated, sorted, and listed on a well‑known fraud shop on a cybercrime forum. Over the next few days, small crews buy slices of that data and start testing logins, draining loyalty points, taking over e‑commerce accounts, and running carding scripts against online merchants. The successful hits are funnelled into mule accounts and digital wallets. From there, the proceeds converge. Balances spread across multiple services are swept into a single exchange and converted into liquid, dollar‑pegged assets for rapid movement across chains and borders."
  https://hackread.com/cybercrime-markets-stablecoins-launder-breach-proceeds/
• Firmware Scanning Time, Cost, And Where Teams Run EMBA
  "Security teams that deal with connected devices often end up running long firmware scans overnight, checking progress in the morning, and trying to explain to colleagues why a single image consumed a workday of compute time. That routine sets the context for a new research paper that examines how the EMBA firmware analysis tool behaves when it runs in different environments."
  https://www.helpnetsecurity.com/2026/01/14/emba-iot-firmware-security/
  https://www.preprints.org/frontend/manuscript/46bc80aec11f8fa7c0eb1e55f5634d27/download_pub
• How AI Image Tools Can Be Tricked Into Making Political Propaganda
  "A single image can shift public opinion faster than a long post. Text to image systems can be pushed to create misleading political visuals, even when safety filters are in place, according to a new study. The researchers examined whether commercial text to image tools can be tricked into producing politically sensitive images of actual public figures. They focused on scenes that could be used for propaganda or disinformation, such as elected leaders holding extremist symbols or performing gestures tied to hate movements. Tests were carried out on GPT-4o, GPT-5, and GPT-5.1, using the gpt-image-1 image generator through standard web interfaces."
  https://www.helpnetsecurity.com/2026/01/14/ai-generated-political-propaganda-study/
  https://arxiv.org/pdf/2601.05150
• G7 Sets 2034 Deadline For Finance To Adopt Quantum-Safe Systems
  "Financial businesses and public entities should have fully transitioned to post-quantum cryptography (PQC) by 2034 at the latest, according to the G7. In a new document published on January 13, the G7 Cyber Expert Group (CEG) set a recommended roadmap for financial entities to test, migrate and fully transition to quantum-resistant cryptographic systems in order to anticipate the risk of potential quantum-enabled cyber-attacks in the future that would break current cryptographic systems."
  https://www.infosecurity-magazine.com/news/g7-2034-deadline-finance-pqc/
  https://home.treasury.gov/system/files/136/G7-CEG-Quantum-Roadmap.pdf

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

New Tooling

• AuraInspector: Auditing Salesforce Aura For Data Exposure
  "Mandiant is releasing AuraInspector, a new open-source tool designed to help defenders identify and audit access control misconfigurations within the Salesforce Aura framework. Salesforce Experience Cloud is a foundational platform for many businesses, but Mandiant Offensive Security Services (OSS) frequently identifies misconfigurations that allow unauthorized users to access sensitive data including credit card numbers, identity documents, and health information. These access control gaps often go unnoticed until it is too late."
  https://cloud.google.com/blog/topics/threat-intelligence/auditing-salesforce-aura-data-exposure
  https://github.com/google/aura-inspector
  https://www.theregister.com/2026/01/13/mandiant_salesforce_tool/
  https://www.helpnetsecurity.com/2026/01/13/aurainspector-open-source-tool-salesforce-aura/

Vulnerabilities

• Adobe Patches Critical Apache Tika Bug In ColdFusion
  "Adobe has released security updates for 11 products on January 2026 Patch Tuesday, addressing a total of 25 vulnerabilities, including a critical code execution flaw. The critical-severity issue, tracked as CVE-2025-66516 (CVSS score of 10/10), is an XML External Entity (XXE) injection bug in Apache Tika modules that could be exploited via XFA files placed inside PDF documents. The security defect was patched in early December, when Apache warned that successful exploitation could lead to information leaks, SSRF attacks, denial-of-service (DoS), or remote code execution (RCE)."
  https://www.securityweek.com/adobe-patches-critical-apache-tika-bug-in-coldfusion/
• SAP’s January 2026 Security Updates Patch Critical Vulnerabilities
  "Enterprise software maker SAP on Tuesday announced the release of 17 new security notes as part of its January 2026 Security Patch Day. Four of the notes address critical-severity vulnerabilities. The first note in SAP’s January 2026 advisory resolves CVE-2026-0501 (CVSS score of 9.9), a critical SQL injection bug in S/4HANA. The issue impacts a Remote Function Call-enabled module relying on the ABAP Database Connectivity (ADBC) framework for the execution of a native SQL statement, explains Onapsis, which discovered and reported the bug."
  https://www.securityweek.com/saps-january-2026-security-updates-patch-critical-vulnerabilities/
• Microsoft January 2026 Patch Tuesday Fixes 3 Zero-Days, 114 Flaws
  "Today is Microsoft's January 2026 Patch Tuesday with security updates for 114 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday also addresses eight "Critical" vulnerabilities, 6 of which are remote code execution flaws and 2 are elevation-of-privilege flaws."
  https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2026-patch-tuesday-fixes-3-zero-days-114-flaws/
  https://www.darkreading.com/application-security/microsofts-starts-2026-bang-zero-day
  https://blog.talosintelligence.com/microsoft-patch-tuesday-january-2026/
  https://cyberscoop.com/microsoft-patch-tuesday-january-2026/
  https://www.securityweek.com/microsoft-patches-exploited-windows-zero-day-111-other-vulnerabilities/
  https://www.theregister.com/2026/01/14/patch_tuesday_january_2026/
• 'Most Severe AI Vulnerability To Date' Hits ServiceNow
  "Authentication issues in ServiceNow potentially opened the door for arbitrary attackers to gain full control over the entire platform and access to the various systems connected to it. ServiceNow is a Fortune 500 company that, according to its promotional materials, acts as an IT services management platform for 85% of the companies that comprise the rest of the Fortune 500. That alone makes it a critical supply chain risk to the US business sector. Beyond that, ServiceNow is deeply integrated into its customers' broader IT infrastructure, more so than most vendors: ServiceNow's tentacles spread through HR, customer service, security, and the various other systems that keep a company running. To an attacker, it's both an ideal launchpad for lateral movement and a treasure trove of sensitive operational and customer data in its own right."
  https://www.darkreading.com/remote-workforce/ai-vulnerability-servicenow
  https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.html
  https://cyberscoop.com/servicenow-fixes-critical-ai-vulnerability-cve-2025-12420/
• CyRC Advisory: Vulnerability In Broadcom Chipset Causes Network Disruption And Client Disconnection On Wireless Routers
  "The Black Duck Cybersecurity Research Center (CyRC) discovered an issue while testing the interoperability of the Defensics Fuzzing with 802.11 protocol test suites against ASUS routers. During testing, the CyRC team found Defensics anomaly test cases that caused the network to stop working until the router was manually reset. This vulnerability allows an attacker to make the access point unresponsive to all clients and terminate any ongoing client connections. If data transmission to subsequent systems is ongoing, the data may become corrupted or, at minimum, the transmission will be interrupted."
  https://www.blackduck.com/blog/cyrc-discovers-asus-tplink-wlan-vulnerabilities.html
  https://www.securityweek.com/broadcom-wi-fi-chipset-flaw-allows-hackers-to-disrupt-networks/
  https://www.bankinfosecurity.com/one-simple-trick-to-knock-out-wi-fi-network-a-30502
• Remote Code Execution With Modern AI/ML Formats And Libraries
  "We identified vulnerabilities in three open-source artificial intelligence/machine learning (AI/ML) Python libraries published by Apple, Salesforce and NVIDIA on their GitHub repositories. Vulnerable versions of these libraries allow for remote code execution (RCE) when a model file with malicious metadata is loaded."
  https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/
  https://www.theregister.com/2026/01/13/ai_python_library_bugs_allow/

Malware

• Ukraine's Army Targeted In New Charity-Themed Malware Campaign
  "Officials of Ukraine's Defense Forces were targeted in a charity-themed campaign between October and December 2025 that delivered backdoor malware called PluggyApe. Ukraine's CERT says in a report that the attacks were likely launched by the Russian threat group known as 'Void Blizzard' and 'Laundry Bear', although there is medium confidence in attribution. Laundry Bear is the same threat group responsible for breaching the Dutch police's internal systems in 2024 and stealing sensitive information about officers."
  https://www.bleepingcomputer.com/news/security/ukraines-army-targeted-in-new-charity-themed-malware-campaign/
  https://therecord.media/kremlin-linked-hackers-pose-as-charities-spy-ukraine
• Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework
  "In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, widely deployed tool. The speed and variety of changes across the samples indicate a framework that is being iterated upon quickly to achieve broader, real-world use."
  https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/
  https://thehackernews.com/2026/01/new-advanced-linux-voidlink-malware.html
  https://www.bleepingcomputer.com/news/security/new-voidlink-malware-framework-targets-linux-cloud-servers/
  https://www.infosecurity-magazine.com/news/chinese-malware-framework-linux/
• Convincing LinkedIn Comment-Reply Tactic Used In New Phishing
  "Scammers are flooding LinkedIn posts this week with fake "reply" comments that appear to come from the platform itself, warning users of bogus policy violations and urging them to visit an external link. The messages convincingly impersonate LinkedIn branding and in some cases even use the company’s official lnkd.in URL shortener, making the phishing links harder to distinguish from legitimate ones."
  https://www.bleepingcomputer.com/news/security/convincing-linkedin-comment-reply-tactic-used-in-new-phishing/
• Silent Push Uncovers New Magecart Network: Disrupting Online Shoppers Worldwide
  "While investigating intelligence shared with us, a set of indicators that were also found on our Bulletproof Host Indicators Of Future Attack (IOFA) feeds, our team discovered a vast network of domains related to a long-term and ongoing credit card skimming campaign. Current findings suggest this campaign has been active for several years, dating back to the beginning of 2022. This campaign utilizes scripts targeting at least six major payment network providers: American Express, Diners Club, Discover (a subsidiary of Capital One), JCB Co., Ltd., Mastercard, and UnionPay. Enterprise organizations that are clients of these payment providers are the most likely to be impacted."
  https://www.silentpush.com/blog/magecart/
  https://thehackernews.com/2026/01/long-running-web-skimming-campaign.html
  https://www.bankinfosecurity.com/magecart-hits-continue-stripe-spoofing-supply-chain-risks-a-30507
  https://hackread.com/magecart-targets-all-credit-cards-users/
  https://www.infosecurity-magazine.com/news/global-magecart-campaign-six-card/
• DeVixor: An Evolving Android Banking RAT With Ransomware Capabilities Targeting Iran
  "deVixor is an actively developed Android banking malware campaign operating at scale, targeting Iranian users through phishing websites that masquerade as legitimate automotive businesses. Distributed as malicious APK files, deVixor has evolved from a basic SMS-harvesting threat into a fully featured Remote Access Trojan (RAT) that combines banking fraud, credential theft, ransomware, and persistent device surveillance within a single platform."
  https://cyble.com/blog/devixor-an-evolving-android-banking-rat-with-ransomware-capabilities-targeting-iran/
• SHADOW#REACTOR – Text-Only Staging, .NET Reactor, And In-Memory Remcos RAT Deployment
  "The Securonix Threat Research team has analyzed a multi-stage Windows malware campaign tracked as SHADOW#REACTOR. The infection chain follows a tightly orchestrated execution path: an obfuscated VBS launcher executed via wscript.exe invokes a PowerShell downloader, which retrieves fragmented, text-based payloads from a remote host. These fragments are reconstructed into encoded loaders, decoded in memory by a .NET Reactor–protected assembly, and used to fetch and apply a remote Remcos configuration. The final stage leverages MSBuild.exe as a living-off-the-land binary (LOLBin) to complete execution, after which the Remcos RAT backdoor is fully deployed and takes control of the compromised system."
  https://www.securonix.com/blog/shadowreactor-text-only-staging-net-reactor-and-in-memory-remcos-rat-deployment/
  https://thehackernews.com/2026/01/new-malware-campaign-delivers-remcos.html
  https://www.darkreading.com/endpoint-security/shadow-reactor-uses-text-files-to-deliver-remcos-rat
  https://www.infosecurity-magazine.com/news/shadowreactor-text-staging-remcos/
• Malicious Chrome Extension Steals MEXC API Keys By Masquerading As Trading Tool
  "Cybersecurity researchers have disclosed details of a malicious Google Chrome extension that's capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange (CEX) available in over 170 countries, while masquerading as a tool to automate trading on the platform. The extension, named MEXC API Automator (ID: pppdfgkfdemgfknfnhpkibbkabhghhfh), has 29 downloads and is still available on the Chrome Web Store as of writing. It was first published on September 1, 2025, by a developer named "jorjortan142.""
  https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.html
• Key Insights On SHADOW-AETHER-015 And Earth Preta From The 2025 MITRE ATT&CK Evaluation With Trend Vision One
  "This blog examines notable modern techniques, tactics, and procedures (TTPs) that Trend Research has observed in the two emulations during the MITRE ATT&CK Evaluation Round 7 (ER7 2025) that featured Earth Preta (also known as Mustang Panda), and SHADOW-AETHER-015 (Trend Research’s intrusion name for a particular group of activities with modern TTPs characterized by AI-generated attacks, sophisticated phishing attacks, and/or social engineering). These observed, analyzed, and reported TTPs support the performance of Trend Vision One in ER7, reinforcing the position of TrendAI as a trusted leader in detection and response innovation."
  https://www.trendmicro.com/en_us/research/26/a/shadow-aether-015-earth-preta-mitre.html
• Stealthy Malware Masking Its Activity, Deploying Infostealer
  "Our experts have detected a new wave of malicious emails targeting Russian private-sector organizations. The goal of the attack is to infect victims’ computers with an infostealer. This campaign is particularly noteworthy because the attackers tried to disguise their activity as the operations of legitimate software and traffic to the ubiquitously-used state and municipal services website."
  https://www.kaspersky.com/blog/malicious-mailing-masking-activity/55104/

Breaches/Hacks/Leaks

• Belgian Hospital AZ Monica Shuts Down Servers After Cyberattack
  "Belgian hospital AZ Monica was forced to shut down all servers, cancel scheduled procedures, and transfer critical patients earlier today due to a cyberattack. The hospital, which operates campuses in Antwerp and Deurne, disconnected all servers at 6:32 AM after its systems were hit. The cyberattack also forced the hospital to suspend all scheduled procedures on Tuesday, as the emergency department continues to operate at reduced capacity, even though emergency medical services and intensive care transport units remain offline."
  https://www.bleepingcomputer.com/news/security/belgian-hospital-az-monica-shuts-down-servers-after-cyberattack/
  https://securityaffairs.com/186882/cyber-crime/az-monica-hospital-in-belgium-shuts-down-servers-after-cyberattack.html
• Central Maine Healthcare Breach Exposed Data Of Over 145,000 People
  "A data breach last year at Central Maine Healthcare (CMH) exposed sensitive information of more than 145,000 individuals. The hackers persisted on the organization's systems for more than two months last year, between March 19 and June 1, when CMH discovered the intrusion. The CMH integrated healthcare delivery system serves at least 400,000 people and manages hospitals like Central Maine Medical Center (CMMC), Bridgton Hospital, and Rumford Hospital."
  https://www.bleepingcomputer.com/news/security/central-maine-healthcare-breach-exposed-data-of-over-145-000-people/
• Betterment Confirms Data Breach After Wave Of Crypto Scam Emails
  "U.S. digital investment advisor Betterment confirmed that hackers breached its systems and sent fake crypto-related messages to some customers. The threat actor last week delivered fraudulent emails from Betterment infrastructure, luring recipients into a reward scam disguised as a company promotion that claimed to triple the amount of cryptocurrency sent to a specific address."
  https://www.bleepingcomputer.com/news/security/betterment-confirms-data-breach-after-wave-of-crypto-scam-emails/
• After Goldman, JPMorgan Discloses Law Firm Data Breach
  "JPMorgan Chase is informing some investors about a data breach stemming from a recent cybersecurity incident at an outside law firm. The same incident triggered a similar data breach notice from Goldman Sachs in December 2025. The Maine Attorney General’s Office requires companies that have suffered a data breach impacting the state’s residents to submit a report and a copy of the notification letter sent to affected individuals."
  https://www.securityweek.com/after-goldman-jpmorgan-discloses-law-firm-data-breach/
• Suspected Ransomware Attack Threatens One Of South Korea’s Largest Companies
  "Kyowon Group, one of South Korea’s largest education and lifestyle companies, announced shutting down key parts of its internal computer network this weekend following what it described as a suspected ransomware attack. In a company statement, Kyowon said it identified abnormal activity on Saturday morning, triggering an emergency response plan to isolate the affected servers and prevent hackers compromising more of its systems."
  https://therecord.media/kyowon-group-south-korea-suspected-ransomware-attack

General News

• AI Supply Chain Risk: Will CIOs Be Held Accountable?
  "When reports of Korean Air losing sensitive data on tens of thousands of employees surfaced, the incident was initially seen as a routine data breach. But reports soon indicated the exposure stemmed from a supply chain attack on a catering vendor responsible for in-flight meals and duty-free retail operations. But the vendor was running Oracle E-Business Suite, which contained a critical-severity vulnerability tracked as CVE-2025-61882. The flaw was discovered in early October 2025, after several enterprises reportedly received emails from attackers claiming to have already exploited the flaw to gain access and steal data."
  https://www.bankinfosecurity.com/blogs/ai-supply-chain-risk-will-cios-be-held-accountable-p-4024
• Building a Solid IT Strategy In An Unstable World
  "It's not surprising in today's world to wake up to news of dramatic changes in the geopolitical climate, of protests erupting overnight that could destabilize governments, or of nation-state actors launching cyberattacks. Geopolitical instability is a part of reality in 2026, and the stakes are high for CIOs who must rely on global supply chains to develop IT, artificial intelligence, cloud and cybersecurity strategies."
  https://www.bankinfosecurity.com/building-solid-strategy-in-unstable-world-a-30512
• Latin America Sees Sharpest Rise In Cyber Attacks In December 2025 As Ransomware Activity Accelerates
  "In December 2025, organizations experienced an average of 2,027 cyber attacks per organization per week. This represents a 1% month-over-month increase and a 9% year-over-year increase. While overall growth remained moderate, Latin America recorded the sharpest regional increase, with organizations experiencing an average of 3,065 attacks per week, a 26% increase year over year. The data points to sharper regional and sector-level spikes in activity, driven primarily by ransomware operations and expanding exposure linked to enterprise adoption of generative AI (GenAI)."
  https://blog.checkpoint.com/research/latin-america-sees-sharpest-rise-in-cyber-attacks-in-december-2025-as-ransomware-activity-accelerates/
• Doctor Web’s Q4 2025 Review Of Virus Activity On Mobile Devices
  "According to detection statistics collected by Dr.Web Security Space for mobile devices, the trojans Android.MobiDash and Android.HiddenAds, which display intrusive ads, were again the most widespread Android threats. At the same time, their activity decreased, and they were detected less frequently on protected devices by 43.24% and 18.06%, respectively. These malicious programs were followed by trojans from the Android.Siggen family, which includes malware whose functionality varies. They were also detected less often—by 27.47%."
  https://news.drweb.com/show/review/?lng=en&i=15101
  https://hackread.com/q4-2025-malware-telegram-backdoor-joker-google-play/
• Rakuten Viber CISO/CTO On Balancing Encryption, Abuse Prevention, And Platform Resilience
  "In this Help Net Security interview, Liad Shnell, CISO and CTO at Rakuten Viber, discusses how messaging platforms have become critical infrastructure during crises and conflicts. He explains how it influences cybersecurity priorities, from encryption and abuse prevention to incident response and user protection. Shnell also outlines how Viber assesses and mitigates risks that blend technical threats with human behavior."
  https://www.helpnetsecurity.com/2026/01/13/liad-shnell-rakuten-viber-messaging-cybersecurity-risks/
• Teaching Cybersecurity By Letting Students Break Things
  "Cybersecurity students show higher engagement when the work feels tangible. A new study from Airbus Cybersecurity and Dauphine University describes what happens when courses move beyond lectures and place students inside structured hacking scenarios, social engineering exercises, and competitive games."
  https://www.helpnetsecurity.com/2026/01/13/gamified-cybersecurity-training-study/
  https://www.mdpi.com/2624-800X/6/1/16
• What Insurers Expect From Cyber Risk In 2026
  "Technology shifts, policy decisions, and attacker behavior are changing at the same time, and their effects increasingly overlap. Insurers, brokers, and security teams are feeling that pressure across underwriting, claims, and risk management. A new global study by CyberCube examines how these changes are expected to influence cyber risk through 2026. AI remains a top priority across the insurance sector, though adoption still trails ambition. 82% of insurance leaders say AI ranks as a top business imperative. Deployment at scale remains limited."
  https://www.helpnetsecurity.com/2026/01/13/cybercube-insurance-cyber-risk-2026/
• Cyber Insights 2026: External Attack Surface Management
  "Shadows are dark and dangerous places where bad guys attack anything or anyone they find. In 2026, AI will increase the number and size of shadows, together with the entire external attack surface. External Attack Surface Management (EASM) is the process of finding and managing every asset an organization exposes to the internet. Those assets may be known (and therefore documented and may be secured) or unknown (and therefore invisible and almost certainly insecure). While EASM covers both categories, we are primarily concerned with the invisible assets."
  https://www.securityweek.com/cyber-insights-2026-external-attack-surface-management/
• More Than 40 Countries Impacted By North Korea IT Worker Scams, Crypto Thefts
  "The U.S. on Monday urged United Nation member states to take a tougher stance against North Korean efforts to skirt sanctions through its IT worker scheme and cryptocurrency heists. Eleven countries led a session at the UN headquarters in New York centered around a 140-page report released last fall that covered North Korea’s extensive cyber-focused efforts to fund its nuclear and ballistic weapons program. The report links the North Korean IT worker scheme — where citizens of the country steal identities and secure employment at western companies — with Pyongyang’s billion-dollar crypto thefts."
  https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations
• Dutch Cops Cuff Alleged AVCheck Malware Kingpin In Amsterdam
  "Dutch police believe they have arrested a man behind the AVCheck online platform - a service used by cybercrims that Operation Endgame shuttered in May. The country's public prosecutor's office (LP) issued a statement on Monday, confirming the arrest of a 33-year-old Dutchman in connection with its investigation into the malware service, without specifying it or the man by name."
  https://www.theregister.com/2026/01/13/avcheck_arrest/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Vulnerabilities

• Max Severity Ni8mare Flaw Impacts Nearly 60,000 n8n Instances
  "Nearly 60,000 n8n instances exposed online remain unpatched against a maximum-severity vulnerability dubbed "Ni8mare." n8n is an open-source workflow automation platform that allows users to connect different applications and services via pre-built connectors and a visual, node-based interface to automate repetitive tasks without writing code. The automation platform is widely used in AI development to automate data ingestion and build AI agents and RAG pipelines. It has over 100 million pulls on Docker Hub and over 50,000 weekly downloads on npm."
  https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-impacts-nearly-60-000-n8n-instances/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2025-8110 Gogs Path Traversal Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/01/12/cisa-adds-one-known-exploited-vulnerability-catalog
  https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-gogs-rce-flaw-exploited-in-zero-day-attacks/
  https://securityaffairs.com/186837/hacking/u-s-cisa-adds-a-flaw-in-gogs-to-its-known-exploited-vulnerabilities-catalog.html

Malware

• RMM Tools (Syncro, SuperOps, NinjaOne, Etc.) Being Distributed Disguised As Video Files
  "AhnLab SEcurity intelligence Center (ASEC) recently discovered cases of attacks using RMM tools such as Syncro, SuperOps, NinjaOne, and ScreenConnect. Threat actors distributed a PDF file that prompted users to download and run the RMM tool from a disguised distribution page such as Google Drive. The certificate used to sign the malware shows that the threat actor has been performing similar attacks since at least October 2025."
  https://asec.ahnlab.com/en/91995/
• The Unfriending Truth: How To Spot a Facebook Phishing Scam Before It's Too Late
  "As one of the world's largest social media platforms, with over 3 billion active users, Facebook is a frequent target for phishing scams. Hackers aim to hijack user accounts to exploit people in their network. The goal is to steal the victim's credentials so the attackers can take over the account, spread scams, steal personal data, or commit identity fraud. In the second half of 2025, Trellix observed a surge in Facebook phishing scams employing a variety of tactics and techniques, most notably the "Browser in the Browser" (BitB) technique. This advanced method tricks users by simulating a legitimate third-party login pop-up window (like a Facebook authentication screen) within the browser tab, effectively masking a credential-harvesting page."
  https://www.trellix.com/en-au/blogs/research/the-unfriending-truth-how-to-spot-a-facebook-phishing-scam/
  https://www.bleepingcomputer.com/news/security/facebook-login-thieves-now-using-browser-in-browser-trick/
• 'Bad Actor' Hijacks Apex Legends Characters In Live Matches
  "Apex Legends players over the weekend experienced disruptions during live matches as threat actors hijacked their characters, disconnected them, and changed their nicknames. Respawn, the publisher of the still popular battle royale-hero shooter, issued a public statement about the security incident, assuring players that it hadn't been caused by an exploit or malware infection. The title continues to have a large user base, with an estimated half a million daily concurrent players across all platforms as of mid-2025."
  https://www.bleepingcomputer.com/news/security/bad-actor-hijacks-apex-legends-characters-in-live-matches/
• Hidden Telegram Proxy Links Can Reveal Your IP Address In One Click
  "A single click on what may appear to be a Telegram username or harmless link is all it takes to expose your real IP address to attackers due to how proxy links are handled. Telegram tells BleepingComputer it will now add warnings to proxy links after researchers demonstrated that specially crafted links could be used to reveal a Telegram user's real IP address without any further confirmation."
  https://www.bleepingcomputer.com/news/security/hidden-telegram-proxy-links-can-reveal-your-ip-address-in-one-click/
• n8mare On Auth Street: Supply Chain Attack Targets n8n Ecosystem
  "Attackers infiltrated n8n's community node ecosystem this week with a malicious npm package that masqueraded as a Google Ads integration. The package, n8n-nodes-hfgjf-irtuinvcm-lasdqewriit, tricked developers into entering OAuth credentials through what appeared to be a legitimate credential form, then silently exfiltrated them during workflow execution to an attacker-controlled server. This novel supply chain attack—targeting users beyond n8n's recently disclosed remote code execution (RCE) flaws—demonstrates how threat actors are exploiting trust in community-maintained integrations."
  https://www.endorlabs.com/learn/n8mare-on-auth-street-supply-chain-attack-targets-n8n-ecosystem
  https://thehackernews.com/2026/01/n8n-supply-chain-attack-abuses.html
• Scaling The Fraud Economy: Pig Butchering As a Service
  "The scam industry has undergone massive transformations over the last decade. The cliché image of the once-iconic Nigerian prince duping Westerners from a local cybercafé is now passé. Western Africa is still a hotbed for digital fraud operations, but it has been superseded in both scale and efficiency by hundreds of industrial-scale scam centres now scattered throughout Southeast Asia. Over the past decade major Chinese-speaking criminal groups have managed to infiltrate a growing number of countries in Southeast Asia, securing vast amounts of land to build cities and special economic zones dedicated to crime operations."
  https://www.infoblox.com/blog/threat-intelligence/scaling-the-fraud-economy-pig-butchering-as-a-service/
  https://thehackernews.com/2026/01/researchers-uncover-service-providers.html
• Analyzing a Multi-Stage AsyncRAT Campaign Via Managed Detection And Response
  "AsyncRAT has emerged as a notable Remote Access Trojan (RAT) used by threat actors for its robust capabilities and ease of deployment. It gained favor for its extensive feature set, which includes keylogging, screen capturing, and remote command execution capabilities. Its modular architecture, typically implemented in Python, provides flexibility and ease of customization, making it a preferred tool of choice for cybercriminals. During our investigation of AsyncRAT infections, we observed Python scripts playing a central role in the infection chain, automating various stages of the attack."
  https://www.trendmicro.com/en_us/research/26/a/analyzing-a-a-multi-stage-asyncrat-campaign-via-mdr.html
• Malicious Crystal PDF Converter Detected On SLTT Networks
  "In late October 2025, the Center for Internet Security (CIS) Cyber Threat Intelligence (CTI) team observed an increase in CIS Managed Detection and Response (CIS MDR) alerts associated with a malicious fake PDF converter called Crystal PDF on U.S. State, Local, Tribal, and Territorial (SLTT) government entity endpoints. The CIS CTI team’s analysis confirmed that Crystal PDF is a managed .NET (F#) staged loader, but the second-stage payload was unavailable for analysis."
  https://www.cisecurity.org/insights/blog/malicious-crystal-pdf-converter-detected-on-sltt-networks
• THE KNOWNSEC LEAK: Yet Another Leak Of China’s Contractor-Driven Cyber-Espionage Ecosystem
  "In November of 2025, an allegedly massive leak of data from Chinese company “KnownSec” was posted to a github account. The initial leak was covered by Wired Magazine, and a few other outlets. The leak has since been pulled off of Github and downloaded by very few, and of those few who gained access, only one uploaded 65 documents as a primer to the leak elsewhere for others to see. DTI was able to get the 65 document images and this report is derived from this slice of a much larger leak that is out there but not available."
  https://dti.domaintools.com/the-knownsec-leak-yet-another-leak-of-chinas-contractor-driven-cyber-espionage-ecosystem/

Breaches/Hacks/Leaks

• University Of Hawaii Cancer Center Hit By Ransomware Attack
  "University of Hawaii says a ransomware gang breached its Cancer Center in August 2025, stealing data of study participants, including documents from the 1990s containing Social Security numbers. Founded in 1907, the University of Hawaii (UH) System now includes 3 universities and 7 community colleges, as well as 10 campuses and training and research centers across the Hawaiian Islands. Its Cancer Center is located in the Kakaʻako district of Honolulu and has over 300 faculty and staff, as well as an additional 200 affiliate members."
  https://www.bleepingcomputer.com/news/security/university-of-hawaii-cancer-center-hit-by-ransomware-attack/
  https://www.securityweek.com/hackers-accessed-university-of-hawaii-cancer-center-patient-data-they-werent-immediately-notified/
• Target's Dev Server Offline After Hackers Claim To Steal Source Code
  "Hackers are claiming to be selling internal source code belonging to Target Corporation, after publishing what appears to be a sample of stolen code repositories on a public software development platform. Last week, an unknown threat actor created multiple repositories on Gitea that appeared to contain portions of Target's internal code and developer documentation. The repositories were presented as a preview of a much larger dataset allegedly being offered for sale to buyers on an underground forum or private channel."
  https://www.bleepingcomputer.com/news/security/targets-dev-server-offline-after-hackers-claim-to-steal-source-code/
• Spanish Energy Giant Endesa Discloses Data Breach Affecting Customers
  "Spanish energy provider Endesa and its Energía XXI operator are notifying customers that hackers accessed the company's systems and accessed contract-related information, which includes personal details. Endesa is the largest electric utility company in Spain, now owned by Enel Group, that distributes gas and electricity to more than 10 million customers in Spain and Portugal. In total, the company says it has about 22 million clients."
  https://www.bleepingcomputer.com/news/security/spanish-energy-giant-endesa-discloses-data-breach-affecting-customers/
• Everest Ransomware Claims Breach At Nissan, Says 900GB Of Data Stolen
  "The notorious Everest ransomware group claims to have breached Nissan Motor Corporation (Nissan Motor Co., Ltd.), the Japanese multinational automobile manufacturer. The group published its claims on its dark web leak site on January 10, 2026, sharing six screenshots allegedly taken from the stolen data. They also revealed a directory structure showing ZIP archives, text files, Excel sheets, and CSV documents."
  https://hackread.com/everest-ransomware-nissan-data-breach/
• Armenia Probes Alleged Sale Of 8 Million Government Records On Hacker Forum
  "Hackers are offering for sale what they claim is a large trove of Armenian government-related data, prompting officials in Yerevan to open an investigation into a potential breach. The alleged seller, using the alias dk0m, said it gained access to a government notification system used to distribute official communications, including legal and administrative notices."
  https://therecord.media/armenia-probes-alleged-sale-government-records

General News

• What Security Teams Can Learn From Torrent Metadata
  "Security teams often spend time sorting through logs and alerts that point to activity happening outside corporate networks. Torrent traffic shows up in investigations tied to policy violations, insider risk, and criminal activity. A new research paper looks at that same torrent activity through an open source intelligence lens and asks how much signal security teams can extract from data that is already public."
  https://www.helpnetsecurity.com/2026/01/12/torrent-metadata-osint-research/
• Downtime Pushes Resilience Planning Into Security Operations
  "CISOs describe a shift in how they define success. New research from Absolute Security shows broad agreement that resilience outweighs security goals centered on prevention alone. Security leaders increasingly define their role around keeping the business operating through disruption. CISOs see themselves as responsible for recovery when incidents interrupt operations. Business continuity, endpoint restoration, and coordination with IT teams fall within their scope. Formal resilience strategies have become common, indicating that this shift is built into planning instead of treated as an add on."
  https://www.helpnetsecurity.com/2026/01/12/absolute-ciso-resilience-planning/
• Statistics Report On Malware Targeting Windows Web Servers In Q4 2025
  "AhnLab SEcurity intelligence Center (ASEC) is using the AhnLab Smart Defense (ASD) infrastructure to respond to and categorize attacks targeting poorly managed Windows web servers. This post will cover the damage status of Windows web servers that have become attack targets and the statistics of attacks that occurred against these servers in the fourth quarter of 2025. Additionally, it will categorize the malware strains used in each attack and provide detailed statistics."
  https://asec.ahnlab.com/en/92002/
• Statistics Report On Malware Targeting Windows Database Servers In Q4 2025
  "AhnLab SEcurity intelligence Center (ASEC) utilizes the AhnLab Smart Defense (ASD) infrastructure to respond to and categorize attacks targeting MS-SQL and MySQL servers installed on Windows operating systems. This post covers the damage status of MS-SQL and MySQL servers that have become attack targets and statistics on attacks against these servers, based on the logs identified in the fourth quarter of 2025. It also categorizes the malware strains used in each attack and provides detailed statistics."
  https://asec.ahnlab.com/en/92003/
• Statistics Report On Malware Targeting Linux SSH Servers In Q4 2025
  "AhnLab SEcurity intelligence Center (ASEC) utilizes a honeypot to respond to and classify brute-force and dictionary attacks targeting poorly managed Linux SSH servers. This post covers the status of the attack sources identified in the logs from the fourth quarter of 2025 and the statistics of attacks launched by these sources. It also classifies the malware strains used in each attack and provides detailed statistics."
  https://asec.ahnlab.com/en/92004/
• Hacker Gets Seven Years For Breaching Rotterdam And Antwerp Ports
  "The Amsterdam Court of Appeal sentenced a 44-year-old Dutch national to seven years in prison for multiple crimes, including computer hacking and attempted extortion. The man was arrested in 2021 and convicted in 2022 by the Amsterdam District Court, but he appealed the sentence because authorities had unlawfully intercepted his communications, deriving incriminating evidence. These communications occurred on the end-to-end encrypted chat service Sky ECC. Europol 'cracked' the service in 2021, which led to the arrest of the CEO and multiple users. The actions deriving from the operation extended into last year."
  https://www.bleepingcomputer.com/news/security/hacker-gets-seven-years-for-breaching-rotterdam-and-antwerp-ports/
  https://therecord.media/dutch-court-sentences-hacker-who-smuggled-cocaine-ports
• Cybersecurity In The Public Sector: Challenges, Strategies And Best Practices
  "Once upon a time, computer crimes were associated with the image of a hacker in a black hoodie working in a dark room by the glow of a monitor. But times have changed, and so have the threats. From simple penetration attempts, cyber attacks have evolved into complex, coordinated operations specifically targeting state systems, rather than pursued merely for entertainment or recognition."
  https://hackread.com/cybersecurity-public-sector-challenges-strategies-practices/
• Rethinking OT Security For Project Heavy Shipyards
  "In this Help Net Security interview, Hans Quivooij, CISO at Damen Shipyards Group, discusses securing OT and ICS in the shipyard. He outlines how project-based operations, rotating contractors, and temporary systems expand the threat surface and complicate access control. Quivooij also covers visibility in legacy environments and the risks introduced by IT and OT integration."
  https://www.helpnetsecurity.com/2026/01/12/hans-quivooij-damen-shipyards-group-securing-shipyard-ot-ics/
• Global Cybersecurity Outlook 2026
  "The World Economic Forum's Global Cybersecurity Outlook 2026, written in collaboration with Accenture, examines the cybersecurity trends that will affect economies and societies in the year to come. The report explores how accelerating AI adoption, geopolitical fragmentation and widening cyber inequity are reshaping the global risk landscape. As attacks grow faster, more complex and more unevenly distributed, organizations and governments face rising pressure to adapt amid persistent sovereignty challenges and widening capability gaps. Drawing on leaders’ perspectives, the report provides actionable insights to inform strategy, investment and policy."
  https://www.weforum.org/publications/global-cybersecurity-outlook-2026/
  https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2026.pdf
  https://www.infosecurity-magazine.com/news/fraud-overtakes-ransomware-as-top/
• Cyber Insights 2026: What CISOs Can Expect In 2026 And Beyond
  "The responsibility of the CISO is ever increasing, and this won’t slow down in the coming years. Paul Kivikink, VP of product management and technology partnerships, at DataBee, explains the starting point: “Traditionally, CISOs came up through the technical ranks, deeply rooted in cybersecurity operations. But as cyber risk has become a board-level concern, the CISO is now expected to speak the language of business, connecting security investments to revenue protection, regulatory compliance, and enterprise resilience.”"
  https://www.securityweek.com/cyber-insights-2026-what-cisos-can-expect-in-2026-and-beyond/
• Block CISO: We Red-Teamed Our Own AI Agent To Run An Infostealer On An Employee Laptop
  "When it comes to security, AI agents are like self-driving cars, according to Block Chief Information Security Officer James Nettesheim. "It's not enough for self-driving cars to be just as good as humans," Nettesheim said in an exclusive interview with The Register. "They have to be safer and better than humans - and provably so. We need that with our agentic use, too." The parent company of Square, Cash App, and Afterpay is pushing hard to position itself as an AI leader, co-designing the Model Context Protocol (MCP) with Anthropic and using MCP to build Goose, its open source AI agent that's used by almost all Block's 12,000 employees and connects to all of the company's systems including Google accounts and Square payments."
  https://www.theregister.com/2026/01/12/block_ai_agent_goose/
• 2026 Crypto Crime Report Key Insights: TRM Identifies Record USD 158 Billion In Illicit Crypto Flows In 2025, Reversing a Multi-Year Decline
  "This blog features key highlights from TRM’s upcoming 2026 Crypto Crime Report. Be sure to check back in the coming weeks to get your complete copy. Illicit crypto volume reached an all-time high of USD 158 billion in 2025, up nearly 145% from 2024. Despite the increase in absolute illicit volume, illicit volume as a proportion of overall crypto volume fell in 2025, from 1.3% in 2024 to 1.2% in 2025. While illicit activity represented a small share of overall on-chain volume, illicit entities captured 2.7% of available crypto liquidity in 2025, using a new metric that frames risk relative to deployable capital rather than raw transaction volume."
  https://www.trmlabs.com/resources/blog/2026-crypto-crime-report-key-insights-trm-identifies-record-usd-158-billion-in-illicit-crypto-flows-in-2025-reversing-a-multi-year-decline
  https://www.infosecurity-magazine.com/news/illicit-crypto-activity-record/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

รายละเอียดช่องโหว่
• CVE-2025-52694 เป็นช่องโหว่ที่มีระดับความรุนแรง วิกฤต (คะแนน CVSS Score 10.0) จัดอยู่ในประเภท SQL Injection ซึ่งเกิดจากความบกพร่องในการตรวจสอบและกรองข้อมูลนำเข้าที่ไม่เหมาะสมในผลิตภัณฑ์ Advantech IoTSuite / IoT Edge
• ระบบ Advantech IoTSuite / IoT Edge ที่เปิดให้เข้าถึงผ่านเครือข่ายภายนอก มีความเสี่ยงที่ผู้โจมตีจะส่งคำสั่งจากระยะไกลเพื่อโจมตีระบบได้ โดยไม่จำเป็นต้องผ่านการยืนยันตัวตน ผ่านการส่งคำสั่ง SQL ที่ถูกออกแบบมาเป็นพิเศษไปยังระบบฐานข้อมูล ซึ่งอาจนำไปสู่การเข้าถึงข้อมูลสำคัญ การแก้ไขหรือทำลายข้อมูล หรือการทำให้ระบบไม่สามารถให้บริการได้ตามปกติ

ผลิตภัณฑ์ที่ได้รับผลกระทบ
• Advantech IoTSuite SaaSComposer ก่อนเวอร์ชัน 3.4.15
• Advantech IoTSuite Growth Linux docker ก่อนเวอร์ชัน V2.0.2
• Advantech IoTSuite Starter Linux docker ก่อนเวอร์ชัน V2.0.2
• Advantech IoT Edge Linux docker ก่อนเวอร์ชัน V2.0.2
• Advantech IoT Edge Windows ก่อนเวอร์ชัน V2.0.2

1. แนวทางการตรวจสอบ
   • ตรวจสอบว่าหน่วยงานมีการใช้งานผลิตภัณฑ์ Advantech IoTSuite หรือ IoT Edge ในเวอร์ชันที่ได้รับผลกระทบหรือไม่
   • ตรวจสอบการเปิดให้บริการของระบบดังกล่าวว่ามีการเข้าถึงจากเครือข่ายภายนอกหรืออินเทอร์เน็ตสาธารณะหรือไม่
   • ตรวจสอบบันทึกเหตุการณ์ (Logs) ของระบบและฐานข้อมูล เพื่อค้นหาพฤติกรรมผิดปกติหรือความพยายามในการส่งคำสั่ง SQL ที่ผิดปกติ

2. แนวทางการป้องกัน
   • ดำเนินการ อัปเดตซอฟต์แวร์เป็นเวอร์ชันล่าสุด ที่ผู้พัฒนาได้แก้ไขช่องโหว่แล้ว
   • สำหรับ IoTSuite SaaSComposer, IoTSuite Growth (Linux Docker) และ IoT Edge (Windows) ขอแนะนำให้ ติดต่อบริษัท Advantech เพื่อขอรับข้อมูลและเวอร์ชันที่มีการแก้ไขช่องโหว่อย่างเป็นทางการ ตามรายละเอียดที่ระบุไว้ด้านล่าง

   • https://dg.th/v6ju5r8wxz
     • สำหรับ IoTSuite Starter (Linux Docker) ขอแนะนำให้ ดาวน์โหลดและติดตั้งแพตช์จาก Advantech ตามรายละเอียดที่ระบุไว้ด้านล่าง

• https://dg.th/cyof2tbkl3
  • สำหรับ IoT Edge (Linux Docker) ขอแนะนำให้ ดาวน์โหลดและติดตั้งแพตช์จาก Advantech ตามรายละเอียดที่ระบุไว้ด้านล่าง
• https://dg.th/wqx1o0y6r9

3. มาตรการชั่วคราว (กรณียังไม่สามารถอัปเดตได้ทันที)
   • ปิดหรือจำกัดการเข้าถึงบริการที่ได้รับผลกระทบจากเครือข่ายสาธารณะ
   • ใช้มาตรการ Firewall หรือ Web Application Firewall (WAF) เพื่อกรองคำร้องขอที่มีลักษณะผิดปกติ
   • เฝ้าระวังและติดตามเหตุการณ์ด้านความมั่นคงปลอดภัยไซเบอร์อย่างใกล้ชิด
   อ้างอิง
   https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/
   https://nvd.nist.gov/vuln/detail/CVE-2025-52694

ThaiCERT ขอแนะนำให้ผู้ใช้งานและผู้ดูแลระบบที่ใช้งานผลิตภัณฑ์ดังกล่าว รีบดำเนินการตรวจสอบและอัปเดตเป็นเวอร์ชันล่าสุดทันที เพื่อลดความเสี่ยงจากการโจมตีและป้องกันความเสียหายที่อาจเกิดขึ้น

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand