โพสต์ถูกสร้างโดย NCSA_THAICERT

Financial Sector

• Criminal Networks Industrialize Payment Fraud Operations
  "Fraud operations are expanding faster than payment defenses can adjust. Criminal groups function like coordinated businesses that develop tools, automate tasks, and scale attacks. New data from a Visa report shows how these shifts are reshaping risk across the financial sector."
  https://www.helpnetsecurity.com/2025/11/27/visa-payment-fraud-trends-report/

Malware

• Shai-Hulud 2.0 Campaign Targets Cloud And Developer Ecosystems
  "This blog continues our investigation on the Node Package Manager (NPM) supply chain attack that took place on September 15, where attackers executed a highly targeted phishing campaign to compromise the account of an NPM package maintainer. Our previous blog detailed how the malicious code injected onto JavaScript packages diverted cryptocurrency assets by hijacking web APIs and manipulating network traffic, and how the Shai-hulud worm in the attack payload steals cloud service tokens, deploys secret-scanning tools, and spreads to additional accounts. An incident this November 24 reported hundreds of NPM repositories compromised by what appears to be a new Shai-hulud campaign with the repository description, "Sha1-Hulud: The Second Coming.""
  https://www.trendmicro.com/en_us/research/25/k/shai-hulud-2-0-targets-cloud-and-developer-systems.html
• • Is Zendesk Scattered Lapsus$ Hunters’ Latest Campaign Target?
    "ReliaQuest has uncovered indications of a potential new campaign from the notorious threat collective “Scattered Lapsus$ Hunters,” this time targeting users of the customer support software Zendesk. ReliaQuest’s Threat Research team identified Zendesk-related domains, including more than 40 typosquatted domains and impersonating URLs, created within the past six months. These domains, such as znedesk[.]com or vpn-zendesk[.]com, are clearly designed to mimic legitimate Zendesk environments. Some host phishing pages, like fake single sign-on (SSO) portals that appear before Zendesk authentication. It’s a classic tactic probably aimed at stealing credentials from unsuspecting users. We also identified Zendesk-related impersonating domains that contained multiple different organizations’ names or brands within the URL, making it even more likely that unsuspecting users would trust and click on these links."
    https://reliaquest.com/blog/zendesk-scattered-lapsus-hunters-latest-target/
    https://www.infosecurity-magazine.com/news/scattered-lapsus-hunters-zendesk/
    https://www.theregister.com/2025/11/27/scattered_lapsus_hunters_zendesk/
• Meet Rey, The Admin Of ‘Scattered Lapsus$ Hunters’
  "A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father."
  https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/
  https://hackread.com/report-names-teen-scattered-lapsus-hunters-group/

Breaches/Hacks/Leaks

• OpenAI Discloses API Customer Data Breach Via Mixpanel Vendor Hack
  "OpenAI is notifying some ChatGPT API customers that limited identifying information was exposed following a breach at its third-party analytics provider Mixpanel. Mixpanel offers event analytics that OpenAI uses to track user interactions on the frontend interface for the API product. According to the AI company, the cyber incident affected “limited analytics data related to some users of the API” and did not impact users of ChatGPT or other products."
  https://www.bleepingcomputer.com/news/security/openai-discloses-api-customer-data-breach-via-mixpanel-vendor-hack/
  https://openai.com/index/mixpanel-incident/
  https://www.infosecurity-magazine.com/news/openai-warns-mixpanel-data-breach/
  https://www.securityweek.com/openai-user-data-exposed-in-mixpanel-hack/
  https://hackread.com/openai-api-mixpanel-data-breach-chatgpt/
  https://securityaffairs.com/185121/data-breach/openai-data-may-have-been-exposed-after-a-cyberattack-on-analytics-firm-mixpanel.html
  https://www.theregister.com/2025/11/27/openai_mixpanel_api/
• Asahi Admits Ransomware Gang May Have Spilled Almost 2M People's Data
  "Asahi has finally done the sums on September's ransomware attack in Japan, conceding the crooks may have helped themselves to personal data tied to almost 2 million people. Back on September 29, Asahi disclosed a "system failure caused by a cyberattack" that knocked out ordering, shipping, and call center systems across its Japanese operations. Days later, the attack was claimed by the Qilin ransomware crew, which reckons it stole some 27 GB of internal files – including employee records, contracts, financial documents, and other sensitive assets."
  https://www.theregister.com/2025/11/27/asahi_ransomware_numbers/
  https://www.infosecurity-magazine.com/news/asahi-15-million-customers/
  https://www.securityweek.com/asahi-data-breach-impacts-2-million-individuals/
  https://securityaffairs.com/185126/data-breach/asahi-says-crooks-stole-data-of-approximately-2m-customers-and-employees.html

General News

• Your Critical Infrastructure Is Running Out Of Time
  "Cyber attackers often succeed not because they are inventive, but because the systems they target are old. A new report by Cisco shows how unsupported technology inside national infrastructure creates openings that attackers can exploit repeatedly. The findings show how widespread this problem has become and how much it influences national resilience."
  https://www.helpnetsecurity.com/2025/11/27/cisco-legacy-system-vulnerabilities-report/
• The Identity Mess Your Customers Feel Before You Do
  "Customer identity has become one of the most brittle parts of the enterprise security stack. Teams know authentication matters, but organizations keep using methods that frustrate users and increase risk. New research from Descope shows how companies manage customer identity and the issues that have been building in the background."
  https://www.helpnetsecurity.com/2025/11/27/descope-customer-identity-issues-report/
• Fraud Fears But No Breach Spike Expected This Festive Season
  "Security experts have dismissed fears that threat actors could step up cyber-attacks on distracted retailers this Black Friday and in the run up to Christmas, although concerns persist. Huntsman Security analyzed data security incidents reported to the UK's Information Commissioner's Office (ICO) between Q3 2024 and Q2 2025. It found that the 1381 incidents reported by the retail and manufacturing sector had only minor seasonal peaks, with none outside a margin of error. Some 355 incidents were reported to the regulator in the busiest time of the year for retailers (Q4), versus 323 in Q3 2024, 317 in Q2 2025 and 386 in Q2 2025. The latter period included the massive ransomware breaches at M&S and the Co-Op Group."
  https://www.infosecurity-magazine.com/news/fraud-fears-no-breach-spike/
• Ransomware Reshaping Cyber As National Security Priority
  "Non-stop, high-profile ransomware attacks against Britain and the United States have transformed cybersecurity into a national security priority, Anne Neuberger, the former White House deputy national security adviser for cyber, said at a Wednesday event in London. "For too long, it's been a tech thing, 'go get your CIO to fix it,'" Neuberger told attendees at an event hosted by think tank Royal United Services Institute, where she serves as a distinguished fellow."
  https://www.bankinfosecurity.com/ransomware-reshaping-cyber-as-national-security-priority-a-30160
• As Space Becomes Warfare Domain, Cyber Is On The Frontlines
  "Space is becoming a domain of warfare, with private sector companies on the front lines - and the first shots will likely be fired in cyberspace, a senior U.S. intelligence official warned this month. "Cybersecurity for space systems is very likely to be on the front lines of conflict involving space," said Johnathon Martin, acting deputy director of the Office of the Chief Architect at the National Reconnaissance Office, which builds, launches and operates U.S. spy satellites."
  https://www.bankinfosecurity.com/as-space-becomes-warfare-domain-cyber-on-frontlines-a-30148
• FCC Warns Of Hackers Hijacking Radio Equipment For False Alerts
  "Hackers have been hijacking US radio transmission equipment to air bogus emergency tones and offensive material, according to a notice issued Wednesday by the US Federal Communications Commission (FCC). The wave of intrusions triggered unauthorized uses of the Emergency Alert System’s distinctive Attention Signal, which is normally reserved for tornadoes, hurricanes, earthquakes and other urgent threats. In particular, threat actors appeared to target Barix network audio devices and reconfigure them to capture attacker-controlled streams instead of regular programming."
  https://www.infosecurity-magazine.com/news/fcc-hackers-hijacking-radio/
  https://docs.fcc.gov/public/attachments/DA-25-996A1.pdf
  https://www.theregister.com/2025/11/27/fcc_radio_hijack/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Telecom Sector

• Mobile Industry Warns Patchwork Cyber Regs Are Driving Up Costs
  "Mobile operators' core cybersecurity spending is projected to more than double by 2030 as threats evolve, while poorly designed and fragmented policy frameworks add extra compliance costs, according to industry group the GSMA. The lobbying organization has pushed out a report calling for national policymakers to simplify compliance and incident reporting to make the job of the network operators easier. It also wants to see greater international coordination between governments and regulators to build those frameworks around common standards."
  https://www.theregister.com/2025/11/26/gsma_global_standards_mobile_industry/
  https://www.gsma.com/solutions-and-impact/connectivity-for-good/public-policy/wp-content/uploads/2025/11/Impact-of-Cybersecurity-Regulation-on-Mobile-Operators.pdf

New Tooling

• DeepTeam: Open-Source LLM Red Teaming Framework
  "Security teams are pushing large language models into products faster than they can test them, which makes any new red teaming method worth paying attention to. DeepTeam is an open-source framework built to probe these systems before they reach users, and it takes a direct approach to exposing weaknesses. The tool runs on a local machine and uses language models to simulate attacks as well as evaluate the results. It applies techniques drawn from recent research on jailbreaking and prompt injection, which gives teams a way to uncover issues such as bias or exposure of personal data. Once DeepTeam finds a problem, it offers guardrails that can be added to production systems to block similar issues."
  https://www.helpnetsecurity.com/2025/11/26/deepteam-open-source-llm-red-teaming-framework/
  https://github.com/confident-ai/deepteam

Vulnerabilities

• Old Tech, New Vulnerabilities: NTLM Abuse, Ongoing Exploitation In 2025
  "Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits."
  https://securelist.com/ntlm-abuse-in-2025/118132/
• ASUS Warns Of New Critical Auth Bypass Flaw In AiCloud Routers
  "ASUS has released new firmware to patch nine security vulnerabilities, including a critical authentication bypass flaw in routers with AiCloud enabled. AiCloud is a cloud-based remote access feature that comes with many ASUS routers, turning them into private cloud servers for remote media streaming and cloud storage. As the Taiwanese electronics manufacturer explained, the CVE-2025-59366 vulnerability "can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.""
  https://www.bleepingcomputer.com/news/security/asus-warns-of-new-critical-auth-bypass-flaw-in-aicloud-routers/
• Popular Forge Library Gets Fix For Signature Verification Bypass Flaw
  "A vulnerability in the ‘node-forge’ package, a popular JavaScript cryptography library, could be exploited to bypass signature verifications by crafting data that appears valid. The flaw is tracked as CVE-2025-12816 and received a high severity rating. It arises from the library’s ASN.1 validation mechanism, which allows malformed data to pass checks even when it is cryptographically invalid."
  https://www.bleepingcomputer.com/news/security/popular-forge-library-gets-fix-for-signature-verification-bypass-flaw/
  Dell ControlVault, Lasso, GL.iNet Vulnerabilities
  "Cisco Talos’ Vulnerability Discovery & Research team recently disclosed five vulnerabilities in Dell ControlVault 3 firmware and its associated Windows software, four vulnerabilities in Entr'ouvert Lasso, and one vulnerability in GL.iNet Slate AX. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy. For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website."
  https://blog.talosintelligence.com/dell-controlvault-lasso-gl-inet-vulnerabilities/
• B2B Guest Access Creates An Unprotected Attack Vector
  "Microsoft Teams is a core collaboration platform for Ontinue and for the organisations we protect. Our ability to engage directly with customers inside their own Teams environments is one of our most valued differentiators, and one they consistently highlight as a strength of our service. However, like all powerful collaboration tools, Teams depends on proper configuration and governance to ensure its security boundaries function as intended. Effective protection is not inherent to the platform; it emerges from how each tenant chooses to manage external access, identity boundaries, and integrated security controls."
  https://www.ontinue.com/resource/blog-microsoft-chat-with-anyone-understanding-phishing-risk/
  https://hackread.com/microsoft-teams-guest-chat-flaw-malware/

Malware

• Bloody Wolf: A Blunt Crowbar Threat To Justice
  "Bloody Wolf is an advanced persistent threat (APT) group active since late 2023. The group initially used commercial STRRAT malware. Later, the group switched to deploying the legitimate NetSupport remote administration tool (RAT) in campaigns targeting Kazakhstan and Russia previously described by BI.ZONE analysts. A joint investigation between Group-IB and UKUK has revealed that Bloody Wolf had been conducting a campaign in Kyrgyzstan since at least June 2025. Those threat actors would impersonate the country’s Ministry of Justice through official looking PDF documents and domain names, which in turn hosted malicious Java Archive (JAR) files designed to deploy the NetSupport RAT."
  https://www.group-ib.com/blog/bloody-wolf/
• Dissecting a New Malspam Chain Delivering Purelogs Infostealer
  "The AISI Research Center’s Cybersecurity Observatory publishes the report “Dissecting a new malspam chain delivering Purelogs infostealer” – November 25, 2025. Organizational and personal security remains under constant threat from increasingly sophisticated attack vectors, with malspam continuing to represent one of the most widespread and effective initial infection vectors for distributing malware on a large scale. Despite advances in endpoint protection technologies, malicious campaigns effectively exploit human urgency, curiosity, and trust, often masquerading as legitimate communications, security alerts, or financial documents."
  https://securityaffairs.com/185066/cyber-crime/dissecting-a-new-malspam-chain-delivering-purelogs-infostealer.html
  https://dimanec.unipegaso.it/wp-content/uploads/sites/5/2025/11/Dissecting-a-new-malspam-chain-delivering-Purelogs-infostealer.pdf
• Russian RomCom Utilizing SocGholish To Deliver Mythic Agent To U.S. Companies Supporting Ukraine
  "In September 2025, Arctic Wolf Labs identified a U.S.-based company that was targeted by RomCom threat actors via SocGholish, operated by TA569. While the typical initial SocGholish infection chain was followed, roughly 10 minutes post-exploitation, RomCom’s targeted Mythic Agent loader was delivered to the system. This is the first time that a RomCom payload has been observed being distributed by SocGholish."
  https://arcticwolf.com/resources/blog/romcom-utilizing-socgholish-to-deliver-mythic-agent-to-usa-companies-supporting-ukraine/
  https://thehackernews.com/2025/11/romcom-uses-socgholish-fake-update.html
  https://securityaffairs.com/185084/security/for-the-first-time-a-romcom-payload-has-been-observed-being-distributed-via-socgholish.html
• Fake Battlefield 6 Pirated Versions And Game Trainers Used To Deploy Stealers And C2 Agents
  "Bitdefender Labs has identified malware campaigns exploiting the popularity of EA's Battlefield 6 first-person shooter, distributed via supposedly pirated versions, game installers, and fake game trainers across torrent websites and other easily found domains. Electronic Arts' Battlefield 6, developed by DICE and published by Electronic Arts (EA), was released in October, and it's likely one of the most significant game launches of the year."
  https://www.bitdefender.com/en-us/blog/labs/fake-battlefield-6-pirated-games-trainers
  https://hackread.com/fake-battlefield-6-downloads-malware-data/
• Malicious Chrome Extension Injects Hidden SOL Fees Into Solana Swaps
  "Socket’s Threat Research Team discovered a malicious Chrome extension Crypto Copilot, published on June 18, 2024, which markets itself as a tool to “execute trades instantly from your X feed.” Behind the interface, the extension injects an extra transfer into every Solana swap, siphoning a minimum of 0.0013 SOL or 0.05% of the trade amount to a hardcoded attacker-controlled wallet. The fee behavior is never disclosed on the Chrome Web Store listing, and the logic implementing it is buried inside heavily obfuscated code."
  https://socket.dev/blog/malicious-chrome-extension-injects-hidden-sol-fees-into-solana-swaps
  https://thehackernews.com/2025/11/chrome-extension-caught-injecting.html
• ShadowV2 Casts a Shadow Over IoT Devices
  "At the end of October, during a global disruption of AWS connections, FortiGuard Labs observed malware named “ShadowV2” spreading via IoT vulnerabilities. These incidents affected multiple countries worldwide and spanned seven different industries. So far, the malware appears to have only been active during the time of the large-scale AWS outage. We believe this activity was likely a test run conducted in preparation for future attacks. The following sections provide a detailed analysis of these incidents and the ShadowV2 malware."
  https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices
  https://www.bleepingcomputer.com/news/security/new-shadowv2-botnet-malware-used-aws-outage-as-a-test-opportunity/
  https://www.theregister.com/2025/11/26/miraibased_botnet_shadowv2/
• Shai Hulud Strikes Again (v2)
  "PostHog has published a detailed post mortem describing how one of its GitHub Actions workflows was abused as an initial access vector for Shai Hulud v2. An attacker briefly opened a pull request that modified a script executed via pull_request_target, exfiltrated a bot personal access token from CI, then used that access to steal additional GitHub secrets including an npm publish token and ship malicious versions of several PostHog SDKs. PostHog has since revoked credentials, tightened workflow reviews, moved to trusted publishing, and reworked its secrets management. Their write up highlights how subtle CI workflow choices can create a path from untrusted contributions to package release credentials."
  https://socket.dev/blog/shai-hulud-strikes-again-v2
  https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.html
• The Korean Leaks – Analyzing The Hybrid Geopolitical Campaign Targeting South Korean Financial Services With Qilin RaaS
  "The "Korean Leaks" campaign showcases a sophisticated supply chain attack against South Korea's financial sector. This operation combined the capabilities of a major Ransomware-as-a-Service (RaaS) group, Qilin, with potential involvement from North Korean state-affiliated actors (Moonstone Sleet) leveraging Managed Service Provider (MSP) compromise as the initial access vector."
  https://www.bitdefender.com/en-us/blog/businessinsights/korean-leaks-campaign-targets-south-korean-financial-services-qilin-ransomware
  https://thehackernews.com/2025/11/qilin-ransomware-turns-south-korean-msp.html

Breaches/Hacks/Leaks

• London Councils Hit By Serious Cyber “Incidents”
  "Multiple local authorities in London appear to be dealing with a serious cybersecurity incident, it has emerged. The Royal Borough of Kensington and Chelsea (RBKC) issued a statement on Tuesday revealing that it and Westminster City Council (WCC) were responding to an incident identified on Monday morning. The two have notified the UK Information Commissioner’s Office (ICO) and are working with the National Cyber Security Centre (NCSC) on incident response."
  https://www.infosecurity-magazine.com/news/london-councils-hit-by-serious/
  https://www.theregister.com/2025/11/26/cyberattack_london_councils/
  https://therecord.media/cyber-issue-london-councils-attack
  https://www.bleepingcomputer.com/news/security/multiple-london-councils-it-systems-disrupted-by-cyberattack/
  https://www.bankinfosecurity.com/multiple-london-councils-responding-to-cyberattack-a-30146
  https://securityaffairs.com/185086/security/multiple-london-councils-faced-a-cyberattack.html
• Gainsight Cyber-Attack Affect More Salesforce Customers
  "The cyber-attack targeting Gainsight has affected more Salesforce customers than initially expected. In a customer FAQ, first posted on November 20 and regularly updated since, the customer support platform provider said Salesforce initially provided a list of three customers impacted by the breach. Gainsight later found that the number “has been expanded to a larger list.”"
  https://www.infosecurity-magazine.com/news/gainsight-cyberattack-more/
  https://www.theregister.com/2025/11/26/gainsight_ceos_handful_customers_data_stolen/
  https://www.helpnetsecurity.com/2025/11/26/gainsight-breach-salesforce-details-attack-window/

General News

• Heineken CISO Champions a New Risk Mindset To Unlock Innovation
  "In this Help Net Security interview, Marina Marceta, CISO at Heineken, discusses what it takes for CISOs to be seen as business-aligned leaders rather than technical overseers. She shares how connecting security to business impact can shift perceptions and strengthen partnerships across the company. Marceta focuses on the value of a security culture that supports innovation while keeping risk in check."
  https://www.helpnetsecurity.com/2025/11/26/marina-marceta-heineken-business-aligned-security/
• Small Language Models Step Into The Fight Against Phishing Sites
  "Phishing sites keep rising, and security teams are searching for ways to sort suspicious pages at speed. A recent study explores whether small language models (SLMs) can scan raw HTML to catch these threats. The work reviews a range of model sizes and tests how they handle detection tasks while keeping compute demands in check."
  https://www.helpnetsecurity.com/2025/11/26/research-slms-website-phishing-detection/
  https://arxiv.org/pdf/2511.15434
• Cybersecurity Is Now a Core Business Discipline
  "Cyber risk has become the background noise of modern business. We’re seeing nearly two thousand attacks per organization per week in the first quarter of 2025—a 47% rise year-on-year. That surge reflects two realities moving at once: attacks are genuinely increasing because it’s easier and cheaper than ever to mount them, and defenders are getting better at spotting what previously slipped under the radar. In other words, the problem is growing and we’re measuring it more honestly."
  https://www.securityweek.com/cybersecurity-is-now-a-core-business-discipline/
• The Golden Scale: 'Tis The Season For Unwanted Gifts
  "In October 2025, we published two Insights blogs on threat activity affiliated with the cybercriminal alliance known as Scattered LAPSUS$ Hunters (SLSH). After a few weeks of apparent inactivity, the threat actors have returned with a vengeance based on open-source reporting and conversations obtained from a new Telegram channel (scattered LAPSUS$ hunters part 7). This latest Insights threat blog will detail several notable observations made by Unit 42 since mid-November, and prepares organizations as we head into the holiday season."
  https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/
• Behind The Bargains: Why Phishing Peaks On Black Friday
  "Black Friday has evolved into one of the most active shopping periods of the year. No longer is it just one day of shopping after Thanksgiving; the sales have now turned into a full week of high-volume promotions, beginning before Thanksgiving and stretching through Black Friday and Cyber Monday, with many retailers extending deals even longer. Unsurprisingly, this surge in digital activity is very attractive for threat actors."
  https://cofense.com/blog/behind-the-bargains-why-phishing-peaks-on-black-friday
• Sumsub’s Annual Report: Fraud Shifts To Complex Multi-Step Schemes In 2025, Agentic AI Scams Poised To Surge In 2026
  "Sumsub today released its Identity Fraud Report 2025–2026, analyzing millions of verification checks and 4,000,000+ fraud attempts between 2024–2025*. The study blends global and regional dynamics from internal data with findings from Sumsub’s Fraud Exposure Survey 2025, featuring responses from 300+ risk professionals and 1,200+ end users. In 2024, the rise of fraud-as-a-service platforms and ready-made toolkits “democratized” identity crime, making it widely accessible to non-tech-savvy fraudsters. In 2025, that trend matured into the Sophistication Shift: fewer but more professionalized operations designed for higher-impact damage."
  https://sumsub.com/newsroom/sumsubs-annual-report-fraud-shifts-to-complex-multi-step-schemes-in-2025-agentic-ai-scams-poised-to-surge-in-2026/
  https://sumsub.com/fraud-report-2025/
  https://www.darkreading.com/cyberattacks-data-breaches/digital-fraud-industrial-scale-2025
• Prompt Injections Loom Large Over ChatGPT's Atlas Browser
  "As a new AI-powered Web browser brings agentics closer to the masses, questions remain regarding whether prompt injections, the signature LLM attack type, could get even worse. ChatGPT Atlas is OpenAI's large language model (LLM)-powered Web browser launched Oct. 21 and based on Chromium. Currently available for macOS (with other platforms to come), Atlas comes with native ChatGPT functionality including text generation, Web page summarization, and agent capabilities."
  https://www.darkreading.com/application-security/prompt-injections-loom-large-over-chatgpt-atlas-launch
• Enterprises Aren't Confident They Can Secure Non-Human Identities (NHIs)
  "Non-human identities (NHIs) are poised to experience exponential growth and adoption throughout the coming year, fundamentally transforming how organizations approach cybersecurity. These digital entities, which include service accounts, system identities, machine identities, and other forms of automated identities, serve as the backbone of modern digital infrastructure by enabling communication and interaction between applications, services, and automated systems."
  https://www.darkreading.com/identity-access-management-security/enterprise-not-confident-secure-non-human-identities

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 7 รายการ เมื่อวันที่ 25 พฤศจิกายน 2025 พื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-25-329-01 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
• ICSA-25-329-02 Rockwell Automation Arena Simulation
• ICSA-25-329-03 Zenitel TCIV-3+
• ICSA-25-329-04 Opto 22 groov View
• ICSA-25-329-05 Festo Compact Vision System, Control Block, Controller, and Operator Unit products
• ICSA-25-329-06 SiRcom SMART Alert (SiSA)
• ICSA-22-333-05 Mitsubishi Electric FA Engineering Software (Update C)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/alerts/2025/11/25/cisa-releases-seven-industrial-control-systems-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Zenitel TCIV-3+
  "Successful exploitation of these vulnerabilities could result in arbitrary code execution or cause a denial-of-service condition."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-03
• Festo Compact Vision System, Control Block, Controller, And Operator Unit Products
  "Successful exploitation of these vulnerabilities could result in an attacker accessing devices without authentication or modifying configuration files."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-05
• SiRcom SMART Alert (SiSA)
  "Successful exploitation of this vulnerability could enable an attacker to remotely activate or manipulate emergency sirens."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-06
• Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
  "Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01
• Rockwell Automation Arena Simulation
  "Successful exploitation of this vulnerability could allow local attackers to execute arbitrary code on affected installations of Arena."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-02
• Opto 22 Groov View
  "Successful exploitation of this vulnerability could result in credential exposure, key exposure, and privilege escalation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-04

Vulnerabilities

• Update Firefox To Patch CVE-2025-13016 Vulnerability Affecting 180 Million Users
  "AI security firm AISLE recently discovered a serious vulnerability in the Firefox web browser that went unnoticed for six months. This flaw could have let attackers run their own instructions on a user’s computer, potentially putting over 180 million users at risk."
  https://hackread.com/update-firefox-patch-cve-2025-13016-vulnerability/

Malware

• RelayNFC: The New NFC Relay Malware Targeting Brazil
  "Cyble Research and Intelligence Labs (CRIL) has uncovered an active and evolving phishing campaign targeting users in Brazil. Dubbed RelayNFC, this Android malware family is designed specifically to perform NFC relay attacks for fraudulent contactless payments. RelayNFC is a lightweight yet highly evasive malware because of its Hermes-compiled payload. This makes detection significantly harder, enabling it to stealthily capture victims’ card data and relay it in real time to an attacker-controlled server."
  https://cyble.com/blog/relaynfc-nfc-relay-malware-targeting-brazil/
• Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)
  "Welcome to watchTowr vs the Internet, part 68. That feeling you’re experiencing? Dread. You should be used to it by now. As is fast becoming an unofficial and, apparently, frowned upon tradition - we identified incredible amounts of publicly exposed passwords, secrets, keys and more for very sensitive environments - and then spent a number of months working out if we could travel back in time to a period in which we just hadn't. Remember, kids - a problem shared is a problem that isn't just your problem anymore. It's the Shared Responsibility model(tm)."
  https://labs.watchtowr.com/stop-putting-your-passwords-into-random-websites-yes-seriously-you-are-the-problem/
  https://www.bleepingcomputer.com/news/security/code-beautifiers-expose-credentials-from-banks-govt-tech-orgs/
  https://thehackernews.com/2025/11/years-of-jsonformatter-and-codebeautify.html
  https://www.bankinfosecurity.com/blogs/data-leaks-are-we-so-stupid-about-free-online-services-p-3982
  https://www.helpnetsecurity.com/2025/11/25/code-formatting-sites-exposing-secrets/
• Fake Adult Websites Pop Realistic Windows Update Screen To Deliver Stealers Via ClickFix
  "Novel "JackFix" attack: Acronis TRU researchers discover an ongoing campaign that leverages a novel combination of screen hijacking techniques with ClickFix, displaying a realistic, full-screen Windows Update of “Critical Windows Security Updates” to trick victims into executing malicious commands. Adult content bait strategy: Campaign leverages fake adult websites (xHamster, PornHub clones) as its phishing mechanism, likely distributed via malvertising. The adult theme, and possible connection to shady websites, add to victim’s psychological pressure, making victims more likely to comply with sudden “security update” installation instructions."
  https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/
  https://thehackernews.com/2025/11/jackfix-uses-fake-windows-update-pop.html
  https://www.darkreading.com/threat-intelligence/jackfix-attack-clickfix-mitigations
• The Dual-Use Dilemma Of AI: Malicious LLMs
  "A fundamental challenge with large language models (LLMs) in a security context is that their greatest strengths as defensive tools are precisely what enable their offensive power. This issue is known as the dual-use dilemma, a concept typically applied to technologies like nuclear physics or biotechnology, but now also central to AI. Any tool powerful enough to build a complex system can also be repurposed to break one. This dilemma manifests in several critical ways related to cybersecurity. While defenders can employ LLMs to speed up and improve responses, attackers can also take advantage of them for their workflows."
  https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/
  https://www.securityweek.com/wormgpt-4-and-kawaiigpt-new-dark-llms-boost-cybercrime-automation/
  https://www.theregister.com/2025/11/25/wormgpt_4_evil_ai_lifetime_cost_220_dollars/
• FlexibleFerret Malware Continues To Strike
  "Early in 2025, a SentinelOne blog post brought to light a malware family known as FlexibleFerret. This malware family is attributed to DPRK-aligned operators and tied to fake recruitment lures associated with the Contagious Interview operation. In this operation, individuals are led through staged hiring tasks that result in the execution of malicious instructions. Earlier this month, Validin released a blog highlighting the details of an attack that they identified as a new variant of the Contagious Interview campaign. Jamf Threat Labs has been tracking similar activity stemming from in-the-wild detections that began with the execution of a script called /var/tmp/macpatch.sh."
  https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/
  https://www.darkreading.com/cyberattacks-data-breaches/dprks-flexibleferret-tightens-macos-grip
  https://www.infosecurity-magazine.com/news/flexibleferret-malware-macos-go/
• FBI: Cybercriminals Stole $262M By Impersonating Bank Support Teams
  "The FBI warned today of a massive surge in account takeover (ATO) fraud schemes and said that cybercriminals impersonating financial institutions have stolen over $262 million in ATO attacks since the start of the year. Since January 2025, the FBI's Internet Crime Complaint Center (IC3) has received over 5,100 complaints, with the attacks impacting individuals, as well as businesses and organizations across all industry sectors. In these schemes, criminals gain unauthorized access to online bank, payroll, or health savings accounts using various social engineering techniques or fraudulent websites, the FBI said."
  https://www.bleepingcomputer.com/news/security/fbi-cybercriminals-stole-262-million-by-impersonating-bank-support-teams-since-january/
  https://www.ic3.gov/PSA/2025/PSA251125
  https://therecord.media/millions-in-account-takeover-fbi-warns-ahead-of-holidays
  https://securityaffairs.com/185060/cyber-crime/fbi-bank-impersonators-fuel-262m-surge-in-account-takeover-fraud.html
• Zscaler Threat Hunting Discovers And Reconstructs a Sophisticated Water Gamayun APT Group Attack
  "This blog is intended to share an in-depth analysis of a recent multi-stage attack attributed to the Water Gamayun advanced persistent threat group (APT). Drawing on telemetry, forensic reconstruction, and known threat intelligence, the Zscaler Threat Hunting team reconstructed how a seemingly innocuous web search led to a sophisticated exploitation of a Windows MMC vulnerability, ultimately delivering hidden PowerShell payloads and final malware loaders."
  https://www.zscaler.com/blogs/security-research/water-gamayun-apt-attack
• Smishing Triad Targets Egypt’s Financial Sector And Postal Services
  "Recently, during one of our threat hunting operations, our squad identified multiple malicious domains impersonating major Egyptian service providers, including Fawry, the Egypt Post, and Careem. These domains were likely established to support fraud, phishing campaigns, and other malicious activities targeting users and organizations. Before we begin our analysis, we will provide an overview of the Smishing Triad, the cybercriminal group relevant to this report."
  https://darkatlas.io/blog/smishing-triad-targets-egypts-financial-sector-and-postal-services
  https://www.infosecurity-magazine.com/news/smishing-triad-campaigns-expand/
• Threat Spotlight: Akira Ransomware’s SonicWall Campaign Creates Enterprise M&A Risk
  "The “Akira” ransomware group has been weaponizing vulnerabilities in SonicWall SSL VPN devices, revealing an overlooked threat for larger enterprises navigating mergers and acquisitions (M&A). These devices, widely used by small- and medium-sized businesses due to their affordability and ease of use, have become launchpads for Akira’s fast-spreading attacks. ReliaQuest analyzed a series of Akira attacks between June and October 2025 that targeted SonicWall SSL VPN devices to uncover a troubling trend. In every incident, Akira operators gained a foothold in larger, acquiring enterprises by compromising SonicWall devices inherited from smaller, acquired business during M&A. In these cases, the acquiring enterprises were unaware that these devices existed in their new environments, leaving critical vulnerabilities exposed."
  https://reliaquest.com/blog/threat-spotlight-akira-ransomwares-sonicwall-campaign-creates-enterprise-m&a-risk
  https://www.theregister.com/2025/11/25/akira_ransomware_acquisitions/
• Influencers In The Crosshairs: How Cybercriminals Are Targeting Content Creators
  "It’s not an easy time to be an influencer. Brands are spending less, ad revenue is declining and competition is fierce – including from AI-generated influencers and impersonators. According to one study, around half of the industry makes just $15,000 or less per year, while just one in 10 pull in over $100,000. As if that wasn’t enough, there’s another challenge: influencers are an increasingly popular target for cybercriminals. A recent spear-phishing campaign abusing brands such as Tesla and Red Bull highlights the potential risks."
  https://www.welivesecurity.com/en/social-media/influencers-crosshairs-cybercriminals-targeting-content-creators/
• Russian Hackers Target US Engineering Firm Because Of Work Done For Ukrainian Sister City
  "Hackers working for Russian intelligence attacked an American engineering company this fall, investigators at a U.S. cybersecurity company said Tuesday — seemingly because that firm had worked for a U.S. municipality with a sister city in Ukraine. The findings reflect the evolving tools and tactics of Russia’s cyber war and demonstrate Moscow’s willingness to attack a growing list of targets, including governments, organizations and private companies that have supported Ukraine, even in a tenuous way."
  https://www.securityweek.com/russian-hackers-target-us-engineering-firm-because-of-work-done-for-ukrainian-sister-city/

Breaches/Hacks/Leaks

• Dartmouth College Confirms Data Breach After Clop Extortion Attack
  "​Dartmouth College has disclosed a data breach after the Clop extortion gang leaked data allegedly stolen from the school's Oracle E-Business Suite servers on its dark web leak site. The private Ivy League research university, founded in 1769, has an endowment of $9 billion as of June 30, 2025, over 40 academic departments and programs, and more than 4,000 undergraduate students, with a 7:1 undergraduate-to-faculty ratio. In a breach notification letter filed with the office of Maine's Attorney General, Dartmouth says the attackers exploited an Oracle E-Business Suite (EBS) zero-day vulnerability to steal personal information belonging to 1,494 individuals."
  https://www.bleepingcomputer.com/news/security/dartmouth-college-confirms-data-breach-after-clop-extortion-attack/
  https://www.theregister.com/2025/11/25/clop_dartmouth_college/
• Canon Says Subsidiary Impacted By Oracle EBS Hack
  "Imaging and optical technology giant Canon has confirmed being targeted in the recent Oracle E-Business Suite (EBS) hacking campaign. However, its investigation has shown that the incident is limited to a subsidiary of Canon U.S.A., Inc., the company told SecurityWeek in an emailed statement. “We have confirmed that the incident only affected the web server, and we have already taken security measures and resumed service,” Canon said. “In addition, we are continuing to investigate further to ensure that there is no other impact.”"
  https://www.securityweek.com/canon-says-subsidiary-impacted-by-oracle-ebs-hack/
• OnSolve CodeRED Cyberattack Disrupts Emergency Alert Systems Nationwide
  "Risk management company Crisis24 has confirmed its OnSolve CodeRED platform suffered a cyberattack that disrupted emergency notification systems used by state and local governments, police departments, and fire agencies across the United States. The CodeRED platform enables these agencies to send alerts to residents during emergencies. The cyberattack forced Crisis24 to decommission the legacy CodeRED environment, causing widespread disruption for organizations that use the platform for emergency notifications, weather alerts, and other sensitive warnings."
  https://www.bleepingcomputer.com/news/security/onsolve-codered-cyberattack-disrupts-emergency-alert-systems-nationwide/
• Georgia Court Filing Organization Warns Of Outages After Ransomware Allegations
  "The organization responsible for managing real estate and civil court filings in Georgia has been knocked offline by a cyberattack that began on Friday. The Georgia Superior Court Clerks' Cooperative Authority (GSCCCA) said it is experiencing a “credible and ongoing cybersecurity threat” that forced the organization to temporarily restrict access to its website and services."
  https://therecord.media/georgia-court-filing-org-ransomware-warning

General News

• Supply Chain Sprawl Is Rewriting Security Priorities
  "Organizations depend on long chains of vendors, but many cybersecurity professionals say these relationships create gaps they cannot see or control. A new ISC2 survey of more than 1,000 cybersecurity professionals shows that supply chain risk sits near the top of their concerns. 70% of respondents said their organizations are concerned about cybersecurity risks linked to third party suppliers. Concern is highest in enterprise environments and in sectors that handle financial or government data."
  https://www.helpnetsecurity.com/2025/11/25/isc2-vendor-security-gaps-report/
• The 2026 Tech Tsunami: AI, Quantum, And Web 4.0 Collide
  "The year 2026 will not be defined by incremental upgrades. It will be shaped by an unprecedented collision of forces: next-generation computing, hyper-automation, and a global cyber security reckoning. Technological convergence and the rise of autonomous systems will redefine global resilience. Artificial intelligence is no longer a single discipline. It has become the connective tissue linking cloud, networks, and physical systems. Quantum research is challenging the fundamental mathematics of digital trust, while Web 4.0 is transforming the internet into an immersive, always-on layer of reality."
  https://blog.checkpoint.com/executive-insights/the-2026-tech-tsunami-ai-quantum-and-web-4-0-collide/
• How An AI Meltdown Could Reset Enterprise Expectations
  "In this Help Net Security interview, Graham McMillan, CTO at Redgate Software, discusses AI, security, and the future of enterprise oversight. He explains why past incidents haven’t pushed the industry to mature. McMillan also outlines the structural shifts he expects once failures start to have business impact."
  https://www.helpnetsecurity.com/2025/11/25/graham-mcmillan-redgate-software-ai-security-future/
• Aircraft Cabin IoT Leaves Vendor And Passenger Data Exposed
  "The expansion of IoT devices in shared, multi-vendor environments, such as aircraft cabins, has created tension between the benefits of data collaboration and the risks to passenger privacy, vendor intellectual property, and regulatory compliance. A new study finds that even with protections that scramble data while it moves between devices, sensitive information often remains exposed once it reaches its destination."
  https://www.helpnetsecurity.com/2025/11/25/aircraft-cabin-iot-privacy-exposure/
  https://arxiv.org/pdf/2511.15278
• AI And Deepfake-Powered Fraud Skyrockets Amid Identity Fraud Stagnation
  "AI is reshaping the identity fraud landscape, helping cybercriminals deploy more sophisticated fraud schemes than ever, despite a global stagnation in fraud attempts. The latest of Sumsub’s Identity Fraud Report, published on November 25, 2025, showed that while identity fraud has slightly decreased in 2025, with identity fraud attempts at 2.2% of all analyzed verifications worldwide – compared to 2.6% in 2024 – the most sophisticated of these attempts have jumped 180%."
  https://www.infosecurity-magazine.com/news/ai-deepfake-fraud-skyrockets/
• Mounting Cyber-Threats Prompt Calls For Economic Security Bill
  "UK lawmakers have called on the government to enshrine in law a new approach to economic security, citing a growing menace to the country from cyber and other threats. The House of Commons Business and Trade Committee issued the call as it published a new report yesterday: Toward a new doctrine for economic security. “Britain is now hugely exposed to the risks of economic warfare and bluntly, our current defenses are not fit for the future,” argued committee chair, Liam Byrne."
  https://www.infosecurity-magazine.com/news/mounting-cyber-threats-economic/
• CISOs Get Real About Hiring In The Age Of AI
  "Becky Bracken: Hello, and welcome to Dark Reading Confidential. It's a podcast from the editors of Dark Reading, focused on bringing you real world stories straight from the cyber trenches. Today we are talking about the cybersecurity job market, talent pipeline, and the disruption of both as automation and AI start in earnest to take over those traditional entry level tier one analyst roles."
  https://www.darkreading.com/cybersecurity-operations/ciscos-get-real-about-hiring-age-ai
• Advanced Security Isn't Stopping Ancient Phishing Tactics
  "Phishing is nothing new when it comes to cybersecurity threats, constantly putting users and organizations at risk of compromising sensitive information. But a new study has uncovered alarming insights about the persistent nature of phishing attacks against enterprises in particular, revealing how even some of the most mature companies with the most advanced security systems continue to remain vulnerable — and why phishing attacks aren't going away anytime soon."
  https://www.darkreading.com/cyberattacks-data-breaches/advanced-security-phishing-tactics
• Cyberthreats Targeting The 2025 Holiday Season: What CISOs Need To Know
  "Every year, the holiday season brings a predictable spike in online activity. But in 2025, the volume of newly created malicious infrastructure, account compromise activity, and targeted exploitation of e-commerce systems is markedly higher. Attackers began preparing months in advance, leveraging industrialized tools and services that enable them to scale attacks across multiple platforms, geographies, and merchant categories."
  https://www.fortinet.com/blog/threat-research/cyberthreats-targeting-2025-holiday-season-what-cisos-need-to-know
• Cato CTRL Threat Research: HashJack – Novel Indirect Prompt Injection Against AI Browser Assistants
  "HashJack is a newly discovered indirect prompt injection technique that conceals malicious instructions after the # in legitimate URLs. When AI browsers send the full URL (including the fragment) to their AI assistants, those hidden prompts get executed. This enables threat actors to conduct a variety of malicious activities. Cato CTRL’s findings outline six scenarios including callback phishing, data exfiltration (in agentic modes), misinformation, malware guidance, medical harm, and credential theft. Trusted URL. Clean webpage. Compromised AI browser assistant."
  https://www.catonetworks.com/blog/cato-ctrl-hashjack-first-known-indirect-prompt-injection/
  https://www.theregister.com/2025/11/25/hashjack_attack_ai_browser_hashtag/
• The AI-Fication Of Cyberthreats: Trend Micro Security Predictions For 2026
  "Our annual security predictions report is designed to help organizations navigate an ever-changing threat landscape with confidence so they can face the challenges and seize the opportunities that the coming year has in store. Drawing on insights from Trend Micro’s global team of researchers and security experts, this year’s edition highlights the trends we believe will shape 2026 and beyond. The cybersecurity landscape is entering a new era, one shaped by automation and constant connection. Businesses are embracing AI tools to boost efficiency, sharpen decision-making, and unlock new opportunities. However, cybercriminals are also using these tools to automate reconnaissance, launch phishing campaigns, and carry out attacks at scale. What once required deep expertise can now be done with minimal effort, as AI-driven automation levels the playing field between skilled attackers and opportunistic threat actors."
  https://www.trendmicro.com/vinfo/gb/security/research-and-analysis/predictions/the-ai-fication-of-cyberthreats-trend-micro-security-predictions-for-2026
  https://documents.trendmicro.com/assets/research-reports/the-ai-fication-of-cyberthreats-trend-micro-security-predictions-for-2026.pdf
  https://www.theregister.com/2025/11/25/trend_micro_agentic_ai_assisted_ransomware/
• Is Your Android TV Streaming Box Part Of a Botnet?
  "On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers."
  https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 24 พฤศจิกายน 2568 Cybersecurity and Infrastructure Security Agency (CISA) ทราบว่ามีผู้ก่อภัยคุกคามทางไซเบอร์หลายกลุ่มกำลังใช้สปายแวร์เชิงพาณิชย์เพื่อโจมตีผู้ใช้แอปพลิเคชันส่งข้อความ (mobile messaging applications) บนมือถืออย่างต่อเนื่อง ผู้ก่อภัยคุกคามเหล่านี้ใช้เทคนิคการเจาะเป้าหมายที่ซับซ้อนร่วมกับการหลอกลวงทางสังคม (social engineering) เพื่อส่งสปายแวร์และเข้าถึงแอปส่งข้อความของเหยื่อโดยไม่ได้รับอนุญาต ซึ่งช่วยให้พวกเขาสามารถติดตั้งเพย์โหลดที่เป็นอันตรายเพิ่มเติมเพื่อลุกลามการโจมตีและยึดครองอุปกรณ์มือถือของเหยื่อได้มากขึ้น

ผู้โจมตีมีวิธีการในการก่อเหตุ ดังนี้

• การฟิชชิ่งและใช้ QR Code สำหรับเชื่อมอุปกรณ์ ที่เป็นอันตราย เพื่อเจาะบัญชีของเหยื่อและเชื่อมต่อบัญชีนั้นเข้ากับอุปกรณ์ที่ผู้ก่อเหตุควบคุม

• การใช้ช่องโหว่แบบ zero-click ซึ่งไม่ต้องการการกระทำใด ๆ จากผู้ใช้

• การปลอมแปลงตัวตน เป็นแพลตฟอร์มแอปส่งข้อความ เช่น Signal และ WhatsApp

แม้ว่าการโจมตีในปัจจุบันจะเป็นลักษณะเหมือนสุ่มมองหาเป้าหมาย (opportunistic) แต่หลักฐานบ่งชี้ว่าผู้ก่อภัยคุกคามเหล่านี้มุ่งเน้นไปยังบุคคลที่มีมูลค่าสูง เช่น เจ้าหน้าที่ระดับสูงทั้งปัจจุบันและอดีตของภาครัฐ ทหาร และผู้ดำรงตำแหน่งทางการเมือง รวมถึงองค์กรภาคประชาสังคม (CSOs) และบุคคลต่าง ๆ ในสหรัฐอเมริกา ตะวันออกกลาง และยุโรป

CISA ขอเน้นย้ำให้ผู้ใช้แอปส่งข้อความตรวจสอบเอกสารคำแนะนำล่าสุด ได้แก่ Mobile Communications Best Practice Guidance และ Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society เพื่อเรียนรู้แนวทางปฏิบัติในการปกป้องการสื่อสารบนมือถือ การใช้งานแอปส่งข้อความ และวิธีลดความเสี่ยงจากสปายแวร์

อ้างอิง
https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-threat-actors-target-users-messaging-applications?utm_source=https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-threat-actors-target-users-messaging-applications&utm_medium=GovDelivery

Healthcare Sector

• The Privacy Tension Driving The Medical Data Shift Nobody Wants To Talk About
  "Most people assume their medical data sits in quiet storage, protected by familiar rules. That belief gives a sense of safety, but new research argues that the world around healthcare data has changed faster than the policies meant to guide it. As a result, the system is stuck, and the cost of that stagnation is rising for patients, researchers, and innovators. The paper, written by experts from major U.S. medical institutions, examines how healthcare’s privacy-centric approach limits progress at a moment when data could unlock better tools, lower costs, and broader access to care. The authors argue that privacy remains important, but current frameworks fall behind the ways data is produced, used, and misused in digital environments."
  https://www.helpnetsecurity.com/2025/11/24/medical-data-stewardship-privacy/
  https://arxiv.org/pdf/2511.15829

New Tooling

• Cnspec: Open-Source, Cloud-Native Security And Policy Project
  "cnspec is an open source tool that helps when you are trying to keep a sprawling setup of clouds, containers, APIs and endpoints under control. It checks security and compliance across all of it, which makes it easier to see what needs attention. At its core, cnspec looks for vulnerabilities and misconfigurations across public and private cloud environments, Kubernetes clusters, containers, container registries, servers, endpoints, SaaS products, infrastructure as code and APIs. It uses a policy-as-code engine built on a security data fabric, which allows you to codify checks and run them at scale."
  https://www.helpnetsecurity.com/2025/11/24/cnspec-open-source-cloud-native-security-policy-project/
  https://github.com/mondoohq/cnspec

Vulnerabilities

• Critical Vulnerabilities In FluentBit Expose Cloud Environments To Remote Takeover
  "A new chain of 5 critical vulnerabilities within Fluent Bit allows attackers to compromise cloud infrastructure. Fluent Bit, an open-source tool for collecting, processing, and forwarding logs is the quiet messenger of modern computing. It is embedded in billions of containers and deployed more than 15 billion times, with over 4 million pulls in the past week alone. It runs everywhere: AI labs, banks, car manufactures, all the major cloud providers such as AWS, Google Cloud, and Microsoft Azure, and more."
  https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover
  https://thehackernews.com/2025/11/new-fluent-bit-flaws-expose-cloud-to.html
  https://www.infosecurity-magazine.com/news/flaws-expose-risks-fluent-bit/
  https://www.theregister.com/2025/11/24/fluent_bit_cves/

Malware

• RadzaRat: New Android Trojan Disguised As File Manager Emerges With Zero Detection Rate
  "The Android malware-as-a-service (MaaS) ecosystem continues to evolve with increasingly sophisticated threats designed to evade security measures while maintaining operational simplicity for would-be attackers. The emergence of RadzaRat, an Android remote access trojan (RAT) recently discovered by Certo’s researchers, exemplifies this troubling trend. What makes this threat particularly concerning is not just its capabilities, but its complete absence from security vendor detection lists and its brazen distribution through legitimate code hosting platforms."
  https://www.certosoftware.com/insights/radzarat-new-android-trojan-disguised-as-file-manager-emerges-with-zero-detection-rate/
  https://hackread.com/radzarat-spyware-hijack-android-devices/
• Malicious Blender Model Files Deliver StealC Infostealing Malware
  "A Russian-linked campaign delivers the StealC V2 information stealer malware through malicious Blender files uploaded to 3D model marketplaces like CGTrader. Blender is a powerful open-source 3D creation suite that can execute Python scripts for automation, custom user interface panels, add-ons, rendering processes, rigging tools, and pipeline integration. If the Auto Run feature is enabled, when a user opens a character rig, a Python script can automatically load the facial controls and custom UI panels with the required buttons and sliders."
  https://www.bleepingcomputer.com/news/security/malicious-blender-model-files-deliver-stealc-infostealing-malware/
  https://www.infosecurity-magazine.com/news/russian-malware-blender-3d-files/
• ClickFix Gets Creative: Malware Buried In Images
  "This analysis details a multi-stage malware execution chain, originating from a ClickFix lure, that leads to the delivery of infostealing malware, including LummaC2 and Rhadamanthys. A notable discovery during analysis was the campaign's use of steganography to conceal the final malware stages within an image. Rather than simply appending malicious data to a file, the malicious code is encoded directly within the pixel data of PNG images, relying on specific colour channels to reconstruct and decrypt the payload in memory."
  https://www.huntress.com/blog/clickfix-malware-buried-in-images
  https://www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-update-screen-to-push-malware/
  https://www.theregister.com/2025/11/24/clickfix_attack_infostealers_images/
• Shai Hulud Launches Second Supply-Chain Attack: Zapier, ENS, AsyncAPI, PostHog, Postman Compromised
  "It's another Monday morning, sitting down at the computer. And I see a stack of alerts from the last hour of packages showing signs of malware in our triage queue. Having not yet finished my first cup of coffee, I see Shai Hulud indicators. Yikes, surely that's a false positive? Nope, welcome to Monday, Shai Hulud struck again. Strap in. The timing is notable, given npm’s recent announcement that it will revoke classic tokens on December 9 after the wave of supply-chain attacks. With many users still not migrated to trusted publishing, the attacker seized the moment for one more hit before npm’s deadline."
  https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html
  https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/
  https://www.darkreading.com/application-security/infamous-shai-hulud-worm-resurfaces-from-depths
  https://hackread.com/shai-hulud-npm-worm-supply-chain-attack/
  https://www.theregister.com/2025/11/24/shai_hulud_npm_worm/
  https://cyberscoop.com/supply-chain-attack-shai-hulud-npm/
• GhostAd: Hidden Google Play Adware Drains Devices And Disrupts Millions Of Users
  "Check Point researchers uncover a large-scale Android adware campaign that silently drains resources and disrupts normal phone use through persistent background activity. During an internal threat-hunting investigation, Check Point Harmony Mobile Detection Team identified a network of Android applications on Google Play masquerading as harmless utility and emoji-editing tools. Behind their cheerful icons, these apps created a persistent background advertising engine – one that kept running even after users closed or rebooted their devices, quietly consuming battery and mobile data."
  https://blog.checkpoint.com/research/ghostad-hidden-google-play-adware-drains-devices-and-disrupts-millions-of-users/
• Checkmarx Zero Takes Down Malicious “Prettier” Alternative Found In VSCode Marketplace
  "Checkmarx Zero’s ongoing monitoring of the Visual Studio Code Marketplace has identified a critical Brandjacking style attack in the form of a malicious VSCode extension. Name: prettier-vscode-plus (full identifier: publishingsofficial.prettier-vscode-plus) Publisher Account: publishingsofficial Release Date: 2025-11-21 11:34:12 UTC We identified and reported this extension quickly, and it was removed within 4 hours after its publication, thanks to the efforts of Daniel Miranda and Raphael Silva on the Checkmarx Zero team and coordination with the VSCode Marketplace security team. We detected only 6 downloads and 3 installs before removal."
  https://checkmarx.com/zero-post/checkmarx-zero-takes-down-malicious-prettier-alternative-found-in-vscode-marketplace/
  https://hackread.com/prettier-extension-vscode-marketplace-anivia-stealer/

Breaches/Hacks/Leaks

• 146,000 Impacted By Delta Dental Of Virginia Data Breach
  "Dental services provider Delta Dental of Virginia (DDVA) is notifying roughly 146,000 people that their personal and health information was compromised in a data breach this year. In the notification letter to the impacted individuals, a copy of which was submitted to the Maine Attorney General’s Office, the organization describes the incident as the compromise of an email account. Between March 21 and April 23, it says, a threat actor accessed and may have exfiltrated emails and attachments containing patient data from the impacted email account."
  https://www.securityweek.com/146000-impacted-by-delta-dental-of-virginia-data-breach/
  https://securityaffairs.com/185019/data-breach/delta-dental-of-virginia-data-breach-impacts-145918-customers.html
  https://www.bankinfosecurity.com/email-hacks-continue-to-plague-healthcare-sector-a-30116
• Real-Estate Finance Services Giant SitusAMC Breach Exposes Client Data
  "SitusAMC, a company that provides back-end services for top banks and lenders, disclosed on Saturday a data breach it had discovered earlier this month that impacted customer data. As a real-estate (commercial and residential) financing firm, SitusAMC handles back-office operations in areas like mortgage origination, servicing, and compliance for banks and investors. The company generates around $1 billion in annual revenue from 1,500 clients, some of whom are banking giants like Citi, Morgan Stanley, and JPMorgan Chase."
  https://www.bleepingcomputer.com/news/security/real-estate-finance-services-giant-situsamc-breach-exposes-client-data/
  https://www.bankinfosecurity.com/major-us-banks-gauge-their-exposure-to-situsamc-breach-a-30114
  https://www.theregister.com/2025/11/24/situsamc_breach/
• Harvard University Discloses Data Breach Affecting Alumni, Donors
  "Harvard University disclosed over the weekend that its Alumni Affairs and Development systems were compromised in a voice phishing attack, exposing the personal information of students, alumni, donors, staff, and faculty members. The exposed data includes email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities.""
  https://www.bleepingcomputer.com/news/security/harvard-university-discloses-data-breach-affecting-alumni-donors/
  https://securityaffairs.com/185034/security/harvard-reports-vishing-breach-exposing-alumni-and-donor-contact-data.html
• Mazda Says No Data Leakage Or Operational Impact From Oracle Hack
  "Mazda has confirmed being targeted in the recent Oracle E-Business Suite (EBS) hacking campaign. However, the carmaker told SecurityWeek that the incident did not impact system operations or production. In addition, the company said “no data leakage has been confirmed”. A Mazda Motor Europe representative clarified that “traces of an attack” were detected, but its “defensive measures were effective, preventing any system impact or data leakage”. The company said it continues to monitor its systems."
  https://www.securityweek.com/mazda-says-no-data-leakage-or-operational-impact-from-oracle-hack/
• Hackers Knock Out Systems At Moscow-Run Postal Operator In Occupied Ukraine
  "A Russian state-owned postal operator in occupied eastern Ukraine said Monday its systems were disrupted by “external interference” after a pro-Ukraine hacktivist group claimed it had wiped thousands of the company’s devices. Donbas Post, which operates in the Russian-controlled parts of Donetsk and Luhansk, said the incident affected its corporate network, web platform and email systems. The company had restricted access to several services to contain the breach and was working to restore operations."
  https://therecord.media/hackers-knock-out-systems-russia-operated-post-ukraine

General News

• What Happens When Vulnerability Scores Fall Apart?
  "Security leaders depend on vulnerability data to guide decisions, but the system supplying that data is struggling. An analysis from Sonatype shows that core vulnerability indexes no longer deliver the consistency or speed needed for the current software environment. The CVE program still serves as the industry’s naming backbone, and the NVD remains a primary source for severity ratings. These tools were built for an era of slower release cycles. They have not kept up with continuous deployment, heavy dependency use, and automated development workflows."
  https://www.helpnetsecurity.com/2025/11/24/sonatype-vulnerability-scoring-gaps-report/
• Email Blind Spots Are Back To Bite Security Teams
  "The threat landscape is forcing CISOs to rethink what they consider normal. The latest Cybersecurity Report 2026 by Hornetsecurity, based on analysis of more than 70 billion emails and broad threat telemetry, shows attackers adopting automation, AI driven social engineering, and new evasion techniques at scale. Email remains the primary entry point for compromise. Malware in email increased by more than 130% year over year. Scams rose by more than 30% and phishing increased by more than 20%. These categories continue to drive most of the operational impact that organizations experience, including account compromise and business disruption."
  https://www.helpnetsecurity.com/2025/11/24/hornetsecurity-email-attack-tactics-report/
• The Slow Rise Of SBOMs Meets The Rapid Advance Of AI
  "Open-source components power nearly all modern software, but they’re often buried deep in massive codebases—hiding severe vulnerabilities. For years, software bills of materials (SBOMs) have been the security community’s key tool to shine a light on these hidden risks. Yet, despite government advancements in the US and Europe, SBOM adoption in the private sector remains sluggish. Now, some experts warn that the rapid rise of AI-assisted coding could soon eclipse the push to make software supply chains more transparent."
  https://cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/
• Quantum Encryption Is Pushing Satellite Hardware To Its Limits
  "In this Help Net Security interview, Colonel Ludovic Monnerat, Commander Space Command, Swiss Armed Forces, discusses how securing space assets is advancing in response to emerging quantum threats. He explains why satellite systems must move beyond traditional cryptography to remain protected. Monnerat also describes how future communication architectures will need to integrate quantum-safe methods without disrupting operations."
  https://www.helpnetsecurity.com/2025/11/24/ludovic-monnerat-swiss-armed-forces-securing-satellite-architecture/
• AI Attack Agents Are Accelerators, Not Autonomous Weapons: The Anthropic Attack
  "Anthropic recently published a report that sparked a lively debate about what AI agents can actually do during a cyberattack. The study shows an AI system, trained specifically for offensive tasks, handling 80–90% of the tactical workload in simulated operations. At first glance, this sounds like a giant leap toward autonomous cyber weapons, but the real story is more nuanced, and far less dramatic. Anthropic’s agent excelled at one thing: speed. It generated scripts in seconds, tested known exploits with no fatigue, scanned configurations at scale, and built basic infrastructure faster than any analyst could. These tasks normally take hours or days, and the AI completed them almost instantly. It automated the “grunt work” that fills so much of an attacker’s time."
  https://securityaffairs.com/184943/security/ai-attack-agents-are-accelerators-not-autonomous-weapons-the-anthropic-attack.html
• Spyware Allows Cyber Threat Actors To Target Users Of Messaging Applications​
  "CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications (apps).1 These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim’s messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim’s mobile device."
  https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-threat-actors-target-users-messaging-applications
  https://cyberscoop.com/cisa-alert-draws-attention-to-spywares-targeting-of-messaging-apps/
• New Research Finds That Claude Breaks Bad If You Teach It To Cheat
  "According to Anthropic, its large language model Claude is designed to be a “harmless” and helpful assistant. But new research released by the company Nov. 21 shows that when Claude is taught to cheat in one area, it becomes broadly malicious and untrustworthy in other areas. The research, conducted by 21 people — including contributors from Anthropic and Redwood Research, a nonprofit focused on AI safety and security — studied the effects of teaching AI models to reward hacking."
  https://cyberscoop.com/anthropic-claude-breaks-bad-jailbreak-reward-hacking-study/
  https://assets.anthropic.com/m/74342f2c96095771/original/Natural-emergent-misalignment-from-reward-hacking-paper.pdf
• To Buy Or Not To Buy: How Cybercriminals Capitalize On Black Friday
  "The global e‑commerce market is accelerating faster than ever before, driven by expanding online retail, and rising consumer adoption worldwide. According to McKinsey Global Institute, global e‑commerce is projected to grow by 7–9% annually through 2040. At Kaspersky, we track how this surge in online shopping activity is mirrored by cyber threats. In 2025, we observed attacks which targeted not only e‑commerce platform users but online shoppers in general, including those using digital marketplaces, payment services and apps for everyday purchases."
  https://securelist.com/black-friday-threat-report-2025/118083/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Vulnerabilities

• Grafana Enterprise Security Update: Critical Severity Security Fix For CVE-2025-41115
  "Along with the release of Grafana Enterprise 12.3, we are releasing updated versions of Grafana Enterprise 12.2.1, 12.1.3 and 12.0.6, all of which contain a fix for a critical severity vulnerability (CVE-2025-41115) discovered in the SCIM (System for Cross-domain Identity Management). This issue could allow privilege escalation or user impersonation under certain configurations."
  https://grafana.com/blog/2025/11/19/grafana-enterprise-security-update-critical-severity-security-fix-for-cve-2025-41115/
  https://www.bleepingcomputer.com/news/security/grafana-warns-of-max-severity-admin-spoofing-vulnerability/
  https://thehackernews.com/2025/11/grafana-patches-cvss-100-scim-flaw.html
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability"
  https://www.cisa.gov/news-events/alerts/2025/11/21/cisa-adds-one-known-exploited-vulnerability-catalog
  https://www.bleepingcomputer.com/news/security/cisa-warns-oracle-identity-manager-rce-flaw-is-being-actively-exploited/
  https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html
  https://www.securityweek.com/critical-oracle-identity-manager-flaw-possibly-exploited-as-zero-day/
  https://securityaffairs.com/184935/security/u-s-cisa-adds-an-oracle-fusion-middleware-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• LINE Messaging Bugs Open Asian Users To Cyber Espionage
  "LINE, a popular encrypted messaging platform used daily by millions of users in East Asia — most notably in Japan, Taiwan, Thailand, and Indonesia — is offering up a veritable buffet of attack vectors for threat actors, potentially exposing billions of messages to data leakage and misuse. That’s according to researchers Thomas Mogensen and Diego De Freitas Aranha from Aarhus University, who conducted a comprehensive security analysis of LINE's end-to-end, custom encryption protocol (E2EE), dubbed Letter Sealing v2. Among the findings, which the two will be presenting at Black Hat Europe in early December, are critical vulnerabilities that open the door to three main buckets of compromise: message replay attacks, plaintext and sticker leakage, and, most concerningly, impersonation attacks."
  https://www.darkreading.com/application-security/line-messaging-bugs-asian-cyber-espionage
• CrowdStrike Research: Security Flaws In DeepSeek-Generated Code Linked To Political Triggers
  "In January 2025, China-based AI startup DeepSeek (深度求索) released DeepSeek-R1, a high-quality large language model (LLM) that allegedly cost much less to develop and operate than Western competitors’ alternatives. CrowdStrike Counter Adversary Operations conducted independent tests on DeepSeek-R1 and confirmed that in many cases, it could provide coding output of quality comparable to other market-leading LLMs of the time. However, we found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%."
  https://www.crowdstrike.com/en-us/blog/crowdstrike-researchers-identify-hidden-vulnerabilities-ai-coded-software/

Malware

• Analysis Report On Malicious Apps Using Advanced Detection And Evasion Techniques
  "Malware developers are using increasingly diverse techniques to evade anti-virus (AV) products. In the past, it was common for a single malicious app to implement all malicious behaviors. However, recently, apps have been discovered in which features are separated and need to be downloaded additionally, or encrypted files need to be decrypted and loaded. There are also a number of apps that set triggers to execute only when certain conditions are met, and remain in a waiting state otherwise."
  https://asec.ahnlab.com/en/91180/
  Inside Europe’s AI-Fuelled GLP-1 Scam Epidemic: How Criminal Networks Are Hijacking The Identities Of The NHS, * AEMPS, ANSM, BfArM And AIFA To Sell Fake Weight-Loss Products
  "The global appetite for GLP-1 medications like Ozempic, Wegovy and Mounjaro have created something far more dangerous than a cultural trend. It has created the perfect opening for cyber criminals who understand how desperation, scarcity and online misinformation intersect. As clinics struggle with shortages and manufacturers warn of supply limits extending well into 2025 and 2026, the demand for “easier,” faster or cheaper alternatives has exploded. Into this void, criminal groups have moved with extraordinary speed."
  https://blog.checkpoint.com/research/inside-europes-ai-fuelled-glp-1-scam-epidemic-how-criminal-networks-are-hijacking-the-identities-of-the-nhs-aemps-ansm-bfarm-and-aifa-to-sell-fake-weight-loss-products/
• New Matrix Push C2 Abuses Push Notifications To Deliver Malware
  "At BlackFog, we recently uncovered a new command-and-control platform called Matrix Push C2 which cybercriminals are using to deliver malware and phishing attacks via web browser features. This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems. It turns web browsers into an attack delivery vehicle: tricking users with fake system notifications, redirecting them to malicious sites, monitoring infected clients in real time, and even scanning for cryptocurrency wallets."
  https://www.blackfog.com/new-matrix-push-c2-deliver-malware/
  https://thehackernews.com/2025/11/matrix-push-c2-uses-browser.html
  https://www.infosecurity-magazine.com/news/browser-push-notifications-deliver/
• ToddyCat: Your Hidden Email Assistant. Part 1
  "Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure (for example, by deploying Microsoft Exchange Server) or through cloud mail services such as Microsoft 365 or Gmail. At first glance, it might seem that using cloud services offers a higher level of confidentiality for corporate correspondence: mail data remains external, even if the organization’s internal infrastructure is compromised. However, this does not stop highly organized espionage groups like the ToddyCat APT group."
  https://securelist.com/toddycat-apt-steals-email-data-from-outlook/118044/
• China’s APT31 Linked To Hacks On Russian Tech Firms
  "The China-linked hacking group known as APT31 infiltrated Russia’s technology sector for years and quietly exfiltrated data from companies involved in government contracting and systems integration, according to a new report. The campaign, which ran into this year, was “well-planned” and allowed intruders to remain undetected, Russian cybersecurity firm Positive Technologies said in research published on Thursday. Public reports of Chinese cyber operations against Russia are rare, given the countries are widely seen as strategic partners. In October, U.S.-based cybersecurity firm Symantec attributed an espionage attack on an unnamed Russian IT service provider to Jewelbug, another China-linked group."
  https://therecord.media/russia-report-apt31-china-linked-hacks
  https://thehackernews.com/2025/11/china-linked-apt31-launches-stealthy.html
• Piecing Together The Puzzle: A Qilin Ransomware Investigation
  "A big part of a security analyst’s everyday role is figuring out what actually happened during an incident. We can do that by piecing together breadcrumbs–whether that’s through logs, antivirus detections, and other clues–that help us understand how the attacker achieved initial access and what they did after. However, it’s not always cut and dry: sometimes there are external factors that limit our visibility. The Huntress agent might not be deployed across all endpoints, for example, or the targeted organization might install the Huntress agent after a compromise has already occurred."
  https://www.bleepingcomputer.com/news/security/piecing-together-the-puzzle-a-qilin-ransomware-investigation/

Breaches/Hacks/Leaks

• Local Law Enforcement Agencies In Oklahoma, Massachusetts Responding To Cyber Incidents
  "Local law enforcement agencies in Oklahoma, Massachusetts responding to cyber incidents. Hackers have successfully targeted local law enforcement agencies in two states this week, launching cyberattacks that impacted IT systems. The Cleveland County Sheriff’s Office in Oklahoma published a message on Thursday saying it was facing a ransomware attack that affected parts of its internal computer system."
  https://therecord.media/cleveland-county-okla-attleboro-mass-law-enforcement-cyberattacks
• Cox Enterprises Discloses Oracle E-Business Suite Data Breach
  "Cox Enterprises is notifying impacted individuals of a data breach that exposed their personal data to hackers who breached the company network after exploiting a zero-day flaw in Oracle E-Business Suite. The compromise occurred in August, but the company didn’t detect the intrusion until late September, when it launched its internal investigation. “On September 29, 2025, we became aware of suspicious activity involving Oracle’s E-Business Suite, which is a platform we use for some of our back-office business operations,” reads the notice."
  https://www.bleepingcomputer.com/news/security/cox-enterprises-discloses-oracle-e-business-suite-data-breach/
• Iberia Discloses Customer Data Leak After Vendor Security Breach
  "Spanish flag carrier Iberia has begun notifying customers of a data security incident stemming from a compromise at one of its suppliers. The disclosure comes days after a threat actor claimed on hacker forums to have access to 77 GB of data allegedly stolen from the airline."
  https://www.bleepingcomputer.com/news/security/iberia-discloses-customer-data-leak-after-vendor-security-breach/
  https://securityaffairs.com/184985/data-breach/iberia-discloses-security-incident-tied-to-supplier-breach.html

General News

• Hardware Hackers Urge Vendor Engagement For Security Success
  "If hardware once had a reputation as an immutable root of trust, more than a decade of worries about compromised supply chains, side channel attacks and insecure enclaves have sanded that standing down to a stump. Vulnerabilities are a fact of life - but how they end up in devices involves numerous factors. "I see hardware security vulnerabilities as a business problem with a business choice," said Alex Guzman, CISO for Cisco Network Devices, speaking this week at the Hardware.io conference in Amsterdam. Information Security Media Group has invested in the conference."
  https://www.bankinfosecurity.com/hardware-hackers-urge-vendor-engagement-for-security-success-a-30102
• CrowdStrike Catches Insider Feeding Information To Hackers
  "American cybersecurity firm CrowdStrike has confirmed that an insider shared screenshots taken on internal systems with hackers after they were leaked on Telegram by the Scattered Lapsus$ Hunters threat actors. However, the company noted that its systems were not breached as a result of this incident and that customers' data was not compromised."
  https://www.bleepingcomputer.com/news/security/crowdstrike-catches-insider-feeding-information-to-hackers/
  https://securityaffairs.com/184926/security/crowdstrike-denies-breach-after-insider-sent-internal-screenshots-to-hackers.html
  https://hackread.com/crowdstrike-fires-worker-insider-leak-scattered-lapsus-hunters/
• 'Scattered Spider' Teens Plead Not Guilty To UK Transport Hack
  "Two British teenagers have denied charges related to an investigation into the breach of Transport for London (TfL) in August 2024, which caused millions of pounds in damage and exposed customer data. Believed to be members of the Scattered Spider hacking collective, 19-year-old Thalha Jubair from east London and 18-year-old Owen Flowers from Walsall were arrested at their homes in September 2024 by officers from the UK National Crime Agency (NCA) and the City of London Police. Flowers was also arrested for his alleged involvement in the TfL attack in September 2024, but was released on bail after being questioned by NCA officers."
  https://www.bleepingcomputer.com/news/security/scattered-spider-teens-plead-not-guilty-to-uk-transport-hack/
  https://news.sky.com/story/teenagers-plead-not-guilty-to-london-transport-cyber-attack-13473518
  https://therecord.media/transport-for-london-hack-scattered-spider-suspects-plead-not-guilty
• Legacy Web Forms Are The Weakest Link In Government Data Security
  "Federal, state, and local government agencies face a critical vulnerability hiding in plain sight: outdated web forms collecting citizen data through insecure channels. While agencies invest in perimeter security and threat detection, many continue using legacy forms built years ago without modern encryption, authentication, or compliance capabilities. These aging systems collect Social Security numbers, financial records, health information, and security clearance data through technology that cannot meet current federal security standards."
  https://cyberscoop.com/government-legacy-web-forms-security-risks/
• Inside The Industrialization Of Cybercrime: What To Expect In 2026
  "Each year, FortiGuard Labs analyzes how technology, economics, and human behavior shape global cyber risk. The Fortinet Cyberthreat Predictions for 2026 report outlines a turning point in that evolution. Cybercrime will continue to evolve into an organized industry, built on automation, specialization, and artificial intelligence (AI). But in 2026, success in both offense and defense will be determined less by innovation than by throughput: how quickly intelligence can be turned into action."
  https://www.fortinet.com/blog/industry-trends/inside-industrialization-of-cybercrime-what-to-expect-in-2026
  https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/report-threat-predictions-2026.pdf
• Research Shows Identity Document Checks Are Missing Key Signals
  "Most CISOs spend their time thinking about account takeover and phishing, but identity document fraud is becoming a tougher challenge. A new systematic review shows how attackers are pushing past old defenses and how detection models are struggling to keep up. The study analyzes work published from 2020 to 2025, giving security leaders a view of where these systems stand and what is holding them back."
  https://www.helpnetsecurity.com/2025/11/21/identity-document-fraud-detection-research/
  https://arxiv.org/pdf/2511.06056
• Convenience Culture Is Breaking Personal Security
  "AI is changing how scams are built, shared, and trusted. A new global survey from Bitdefender shows how far the problem has spread. Over seven in ten consumers encountered some form of scam in the past year. One in seven fell for one. Worry about AI driven fraud is now mainstream, with 37% listing deepfake audio and video as their top concern."
  https://www.helpnetsecurity.com/2025/11/21/bitdefender-ai-powered-scams-report/
• How To Align Security Requirements And Controls To Express System Threats
  "Threats and how we counter them have become key considerations in a system’s cybersecurity architecture and design. This applies whether we are designing a new system, addressing regulatory requirements to operate in a particular mission environment, or just working to meet organizational needs. Adoption of zero trust strategies, security by design guidance, and DevSecOps are core to a system's cybersecurity architecture and design in both the public and private sector."
  https://www.sei.cmu.edu/blog/how-to-align-security-requirements-and-controls-to-express-system-threats/
• Operation Destabilise: NCA Exposes Billion-Dollar Money Laundering Network That Purchased Bank To Fund Russian War Effort
  "The NCA have identified that a billion-dollar money laundering network active in the UK purchased a bank in Kyrgyzstan to facilitate sanctions evasion and payments in support of Russian military efforts. Through Operation Destabilise, the NCA and its partners are targeting money launderers who work for this network and are known to operate in at least 28 UK cities and towns."
  https://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-exposes-billion-dollar-money-laundering-network-that-purchased-bank-to-fund-russian-war-effort
  https://www.theregister.com/2025/11/21/russia_cybercrime_bank_purchase/
• The OSINT Playbook: Find Your Weak Spots Before Attackers Do
  "Whatever the reason, we spend vast amounts of time online, tapping into the untold expanse of information, communication and resources. Sometimes, the challenge isn’t finding some data, but knowing what’s relevant, real and worth trusting. Anyone working with information needs to be able to cut through the noise and discern the authenticity of the data, which requires being methodical and deliberate when choosing and using our sources – and having the right tools to expedite the process."
  https://www.welivesecurity.com/en/privacy/osint-playbook-find-weak-spots-attackers-do/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Financial Sector

• October 2025 Security Issues In Korean And Global Financial Sector
  "This report comprehensively covers actual cyber threats and security issues relevant to the finance industry in Korea and around the world. The article includes an analysis of the malware and phishing cases distributed to the financial sector. It also provides a list of the top 10 malware targeting the financial sector and statistics on the industries of the leaked Korean accounts on Telegram. A case of phishing emails distributed to the financial sector is also covered in detail."
  https://asec.ahnlab.com/en/91174/

Industrial Sector

• Automated Logic WebCTRL Premium Server
  "Successful exploitation of these vulnerabilities could allow a remote attacker to deceive a legitimate user into running malicious scripts or redirecting them to malicious websites."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-01
• Festo MSE6-C2M/D2M/E2M
  "Successful exploitation of this vulnerability could lead to a complete loss of confidentiality, integrity, and availability."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-04
• Emerson Appleton UPSMON-PRO
  "Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected installations of Appleton UPSMON-PRO."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-06
• ICAM365 CCTV Camera Multiple Models
  "Successful exploitation of these vulnerabilities could result in unauthorized exposure of camera video streams and camera configuration data."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02
• Opto 22 GRV-EPIC And Groov RIO
  "Successful exploitation of this vulnerability could result in the execution of arbitrary shell commands with root privileges."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-03
• Festo Didactic Products
  "Successful exploitation of this vulnerability could allow the creation or overwriting of arbitrary files in the engineering system."
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-05

Vulnerabilities

• SolarWinds Patches Three Critical Serv-U Vulnerabilities
  "SolarWinds this week announced patches for three critical vulnerabilities found in its Serv-U enterprise file transfer solution. One of the flaws, tracked as CVE-2025-40549, has been described as a path restriction bypass issue that can be exploited by a threat actor with administrator privileges to execute arbitrary code on a directory. The vendor pointed out that on Windows systems the vulnerability has a ‘medium severity’ rating due to “differences in how paths and home directories are handled”."
  https://www.securityweek.com/solarwinds-patches-three-critical-serv-u-vulnerabilities/
• New SonicWall SonicOS Flaw Allows Hackers To Crash Firewalls
  "American cybersecurity company SonicWall urged customers today to patch a high-severity SonicOS SSLVPN security flaw that can allow attackers to crash vulnerable firewalls. Tracked as CVE-2025-40601, this denial-of-service vulnerability is caused by a stack-based buffer overflow impacting Gen8 and Gen7 (hardware and virtual) firewalls. "A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash," SonicWall said."
  https://www.bleepingcomputer.com/news/security/new-sonicwall-sonicos-flaw-allows-hackers-to-crash-firewalls/
  https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0016
• D-Link Warns Of New RCE Flaws In End-Of-Life DIR-878 Routers
  "D-Link is warning of three remotely exploitable command execution vulnerabilities that affect all models and hardware revisions of its DIR-878 router, which has reached end-of-service but is still available in several markets. Technical details and proof-of-concept (PoC) exploit code demonstrating the vulnerabilities have been published by a researcher using the name Yangyifan. Typically used in homes and small offices, the DIR-878 was hailed as a high-performance dual-band wireless router when it launched in 2017."
  https://www.bleepingcomputer.com/news/security/d-link-warns-of-new-rce-flaws-in-end-of-life-dir-878-routers/
  https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475
• CVE-2025-50165: Critical Flaw In Windows Graphics Component
  "In May 2025, Zscaler ThreatLabz discovered CVE-2025-50165, a critical remote code execution (RCE) vulnerability with a CVSS score of 9.8 that impacts the Windows Graphics Component. The vulnerability lies within windowscodecs.dll, and any application that uses this library as a dependency is vulnerable to compromise, such as a Microsoft Office document. For example, attackers can exploit the vulnerability by creating a malicious JPEG image and inserting it into any file that leverages windowscodecs.dll. If a user opens that file, their system can be compromised by an attacker who can go on to perform RCE and take over the victim’s system."
  https://www.zscaler.com/blogs/security-research/cve-2025-50165-critical-flaw-windows-graphics-component

Malware

• Analysis Of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287)
  "AhnLab SEcurity intelligence Center (ASEC) has identified an attack where the remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, was exploited to distribute the ShadowPad malware. ShadowPad is a backdoor malware used by numerous Chinese APT groups. First discovered in 2017, its developers have continuously updated its modules. According to a report by SentinelOne, ShadowPad is privately sold to Chinese state-backed APT groups. This report analyzes the initial intrusion process exploiting the vulnerability, the operational mechanism of ShadowPad, and recommended countermeasures."
  https://asec.ahnlab.com/en/91166/
• NKNShell Malware Distributed Via VPN Website
  "AhnLab SEcurity intelligence Center (ASEC) has confirmed that malware has been uploaded to the website of a South Korean VPN provider. Based on the distribution method and characteristics of the malware used, this attack appears to be the work of the same threat actor who has been targeting South Korean VPN providers since 2023. In previous cases, the attacker ultimately installed backdoors such as SparkRAT, MeshAgent, and Sliver to control the infected systems. In the latest incident, MeshAgent with similar PDB paths was again observed, along with a newly identified backdoor named NKNShell. NKNShell is notable for using NKN and MQTT protocols for communication with its C&C server."
  https://asec.ahnlab.com/en/91139/
• Phishing Emails Impersonating a Popular OTT Service
  "AhnLab Security Intelligence Center (ASEC) has recently discovered a phishing campaign distributing emails that impersonate a well-known OTT streaming service. The emails claim there is an issue with the user’s subscription payment and urge recipients to verify the problem. To make the message appear legitimate, the email includes a hyperlink labeled “Update Now” designed to trick users into clicking."
  https://asec.ahnlab.com/en/91127/
• Sturnus: Mobile Banking Malware Bypassing WhatsApp, Telegram And Signal Encryption
  "MTI Security researchers have identified Sturnus, a privately operated Android banking trojan. This malware supports a broad range of fraud-related capabilities, including full device takeover. A key differentiator is its ability to bypass encrypted messaging. By capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal."
  https://www.threatfabric.com/blogs/sturnus-banking-trojan-bypassing-whatsapp-telegram-and-signal
  https://www.bleepingcomputer.com/news/security/multi-threat-android-malware-sturnus-steals-signal-whatsapp-messages/
  https://thehackernews.com/2025/11/new-sturnus-android-trojan-quietly.html
  https://therecord.media/new-android-malware-captures-private-messages
  https://www.securityweek.com/new-sturnus-banking-trojan-targets-whatsapp-telegram-signal-messages/
  https://securityaffairs.com/184878/cyber-crime/sturnus-new-android-banking-trojan-targets-whatsapp-telegram-and-signal.html
• Blockchain And Node.js Abused By Tsundere: An Emerging Botnet
  "Tsundere is a new botnet, discovered by our Kaspersky GReAT around mid-2025. We have correlated this threat with previous reports from October 2024 that reveal code similarities, as well as the use of the same C2 retrieval method and wallet. In that instance, the threat actor created malicious Node.js packages and used the Node Package Manager (npm) to deliver the payload. The packages were named similarly to popular packages, employing a technique known as typosquatting. The threat actor targeted libraries such as Puppeteer, Bignum.js, and various cryptocurrency packages, resulting in 287 identified malware packages. This supply chain attack affected Windows, Linux, and macOS users, but it was short-lived, as the packages were removed and the threat actor abandoned this infection method after being detected."
  https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/
  https://thehackernews.com/2025/11/tsundere-botnet-expands-using-game.html
• CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat
  "CTM360 has identified a rapidly expanding WhatsApp account-hacking campaign targeting users worldwide via a network of deceptive authentication portals and impersonation pages. The campaign, internally dubbed HackOnChat, abuses WhatsApp's familiar web interface, using social engineering tactics to trick users into compromising their accounts."
  https://thehackernews.com/2025/11/ctm360-exposes-global-whatsapp.html
  https://www.ctm360.com/reports/hackonchat-unmasking-the-whatsapp-hacking-scam
• Cooking Up Trouble: How TamperedChef Uses Signed Apps To Deliver Stealthy Payloads
  "Recently, TRU observed a global campaign targeting organizations across various sectors. The attackers distribute seemingly legitimate software featuring full functionality and valid code signing to trick end users into executing them. These fake applications imitate commonly used software such as browsers, PDF editors, manual readers and even games, adding another layer of authenticity that makes it harder for users to detect their malicious intent. Additionally, trojans disguised as these familiar programs are more likely to earn users’ trust, since they mimic tools widely used for everyday tasks."
  https://www.acronis.com/en/tru/posts/cooking-up-trouble-how-tamperedchef-uses-signed-apps-to-deliver-stealthy-payloads/
  https://thehackernews.com/2025/11/tamperedchef-malware-spreads-via-fake.html
• Palo Alto Scanning Surges 40X In 24 Hours, Marking 90-Day High
  "GreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in a 40x surge within 24 hours, marking a new 90-day high. GreyNoise has also identified strong connections between this spike and prior related campaigns. We assess with high confidence that these campaigns are at least partially driven by the same threat actor(s), supported by:"
  https://www.greynoise.io/blog/palo-alto-scanning-surges-90-day-high
  https://www.bleepingcomputer.com/news/security/globalprotect-vpn-portals-probed-with-23-million-scan-sessions/
  https://www.theregister.com/2025/11/20/palo_alto_traffic_flood/
• Analysis Report On AI-Based Obfuscated Malicious Apps Using Compromised Legitimate Websites As C2 Servers
  "Malware impersonating a famous Korean delivery service has been continuously distributed, and the threat actor behind it is utilizing various techniques to evade anti-virus (AV) detection. In particular, obfuscation and packing techniques are being used, and many malware strains leveraging these techniques have been discovered."
  https://asec.ahnlab.com/en/91176/
• 'Matrix Push' C2 Tool Hijacks Browser Notifications
  "Cybercriminals have a new, user-friendly tool for turning your browser alerts into a vector for phishing attacks. "Matrix Push" is slick, it's pretty, and it's about as easy to use as any commercial software you can think of. Unfortunately, it's a command-and-control (C2) framework for infecting people with malware through their browsers. A new report from BlackFog describes how, from an interface colored like a retro terminal, hackers can design notifications that get pushed to victims from their legitimate browsers, but in fact point to malicious websites."
  https://www.darkreading.com/threat-intelligence/matrix-push-c2-tool-hijacks-browser-notifications-phishing
• UNC2891: ATM Threats Never Die
  "Group-IB’s latest research reveals how UNC2891 is rewriting the playbook of financial cybercrime.This secretive cybercrime group has been targeting banks in Southeast Asia for years, blurring the line between digital theft and physical intrusion."
  https://www.group-ib.com/landing/unc2891/
  https://www.infosecurity-magazine.com/news/unc2891-money-mule-network-atm/
• Beyond The Watering Hole: APT24's Pivot To Multi-Vector Attacks
  "Google Threat Intelligence Group (GTIG) is tracking a long-running and adaptive cyber espionage campaign by APT24, a People's Republic of China (PRC)-nexus threat actor. Spanning three years, APT24 has been deploying BADAUDIO, a highly obfuscated first-stage downloader used to establish persistent access to victim networks. While earlier operations relied on broad strategic web compromises to compromise legitimate websites, APT24 has recently pivoted to using more sophisticated vectors targeting organizations in Taiwan. This includes the repeated compromise of a regional digital marketing firm to execute supply chain attacks and the use of targeted phishing campaigns."
  https://cloud.google.com/blog/topics/threat-intelligence/apt24-pivot-to-multi-vector-attacks
  https://www.bleepingcomputer.com/news/security/google-exposes-badaudio-malware-used-in-apt24-espionage-campaigns/
• Unwanted Gifts: Major Campaign Lures Targets With Fake Party Invites
  "A highly active threat actor that specializes in using the ScreenConnect remote management and monitoring (RMM) software in its attacks has changed tactics and is now infecting its victims with multiple RMM tools, including LogMeIn Resolve and Naverisk. In many cases, the attackers install additional RMM tools on infected computers long after the initial compromise occurs. The motivation behind this new tactic remains unclear, although it appears that the attackers are attempting to increase their dwell time on networks in order to maximise their return on successful attacks."
  https://www.security.com/threat-intelligence/rmm-logmein-attacks
• Nation-State Actor’s Arsenal: An In-Depth Look At Lazarus’ ScoringMathTea
  "In October 2025, the ESET Research Team published an excellent article about the identification of a new instance of the Operation DreamJob cyberespionage campaign, conducted by the Lazarus APT Group, aligned with the North Korean government. This instance was identified by ESET as Gotta Fly, as it was determined that Lazarus was directing cyberattacks with an espionage focus to steal know-how related to the production of Unmanned Aerial Vehicles from companies that are providing such technology to Ukraine. In the same article, the ESET Research Team provided information on the identification of two kill chains, both of which implement ScoringMathTea. Below, you can see an image taken from the ESET post, showing the identified execution chains."
  https://0x0d4y.blog/arsenal-analysis-of-a-nation-state-actor-an-in-depth-look-at-lazarus-scoringmathtea/

Breaches/Hacks/Leaks

• Hacker Claims To Steal 2.3TB Data From Italian Rail Group, Almavia
  "Data from Italy's national railway operator, the FS Italiane Group, has been exposed after a threat actor breached the organization's IT services provider, Almaviva. The hacker claims to have stolen 2.3 terabytes of data and leaked it on a dark web forum. According to the threat actor's description, the leak includes confidential documents and sensitive company information."
  https://www.bleepingcomputer.com/news/security/hacker-claims-to-steal-23tb-data-from-italian-rail-group-almavia/
• Salesforce Investigates Customer Data Theft Via Gainsight Breach
  "Salesforce says it revoked refresh tokens linked to Gainsight-published applications while investigating a new wave of data theft attacks targeting customers. The cloud-based software company noted that this doesn't stem from a vulnerability in its customer relationship management (CRM) platform since all evidence points to the malicious activity being related to the app's external connection to Salesforce."
  https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/
  https://therecord.media/salesforce-cuts-off-access-to-third-party-unusual-activity
  https://www.bankinfosecurity.com/shinyhunters-hack-salesforce-instances-via-gainsight-apps-a-30087
  https://cyberscoop.com/salesforce-gainsight-customers-breach/
  https://www.theregister.com/2025/11/20/salesforce_gainsight_breach/
  https://www.helpnetsecurity.com/2025/11/20/salesforce-investigates-new-incident-echoing-salesloft-drift-compromise/
• Everest Ransomware Says It Breached Brazilian Energy Giant Petrobras
  "Everest ransomware group has listed two separate entries on its dark web leak site, both targeting Petrobras, a Brazilian majority state-owned multinational corporation giant in the petroleum industry headquartered in Rio de Janeiro. Both listings were published on November 14, 2025. The first listing points to an alleged data breach involving both Petrobras and a partner firm, SAExploration. According to the group, it managed to steal a database that contains over 176 gigabytes of seismic navigation data. More than half of that, over 90 gigabytes, is said to belong directly to Petrobras."
  https://hackread.com/everest-ransomware-brazil-petrobras-breach/

General News

• Crypto Mixer Founders Sent To Prison For Laundering Over $237 Million
  "The founders of the Samourai Wallet (Samourai) cryptocurrency mixing service have been sent to prison for helping criminals launder over $237 million. Samourai CEO Keonne Rodriguez was sentenced to five years in prison on November 6th, while the cryptomixer's Chief Technology Officer William Lonergan Hill received a four-year sentence on November 19th. Both men were also sentenced to three years of supervised release and must pay $250,000 fines. The two defendants were arrested in April 2024 and charged by the prosecutors with conspiracy to operate an unlicensed money-transmitting business (with a maximum sentence of 5 years) and money laundering (which carries a maximum sentence of 20 years)."
  https://www.bleepingcomputer.com/news/security/samourai-cryptomixer-founders-sent-to-prison-for-laundering-over-237-million/
  https://therecord.media/samourai-wallet-crypto-mixer-founders-sentenced
• The Confidence Trap Holding Security Back
  "Security leaders often feel prepared for a major cyber incident, but performance data shows a different reality. Teams continue to miss key steps during practice scenarios, and the gap between confidence and capability keeps growing. Findings from Immersive’s Cyber Workforce Benchmark Report show the habits that hold readiness back and the areas security leaders must address to make progress."
  https://www.helpnetsecurity.com/2025/11/20/immersive-cyber-readiness-gap-report/
• Gartner: 40% Of Firms To Be Hit By Shadow AI Security Incidents
  "By 2030, more than 40% of global organizations will suffer security and compliance incidents due to the use of unauthorized AI tools, Gartner has predicted. The analyst said a survey of cybersecurity leaders earlier this year revealed that 69% have evidence or suspect that employees are using public generative AI (GenAI) at work. It warned that such tools can increase the risk of IP loss, data exposure and other security and compliance issues. These should be well understood by now. As far back as 2023, Samsung was forced to ban the use of GenAI internally after staff shared source code and meeting notes with ChatGPT."
  https://www.infosecurity-magazine.com/news/gartner-40-firms-hit-shadow-ai/
• Inside The Dark Web Job Market
  "In 2022, we published our research examining how IT specialists look for work on the dark web. Since then, the job market has shifted, along with the expectations and requirements placed on professionals. However, recruitment and headhunting on the dark web remain active. So, what does this job market look like today? This report examines how employment and recruitment function on the dark web, drawing on 2,225 job-related posts collected from shadow forums between January 2023 and June 2025. Our analysis shows that the dark web continues to serve as a parallel labor market with its own norms, recruitment practices and salary expectations, while also reflecting broader global economic shifts."
  https://securelist.com/dark-web-job-market-2023-2025/118057/
• October 2025 Threat Trend Report On Ransomware
  "This report provides the number of affected systems identified and statistics related to DLS-based ransomware, as well as major ransomware issues in and out of Korea in October 2025. The following is a summary of the report. The statistics on the number of ransomware samples and affected systems use the detection names set by AhnLab. The statistics on the number of affected companies by ransomware group are based on the information published on DLS (Dedicated Leak Sites, which are PR sites or pages for ransomware) and collected by ATIP at the time."
  https://asec.ahnlab.com/en/91178/
• October 2025 APT Attack Trends Report (South Korea)
  "AhnLab is monitoring Advanced Persistent Threat (APT) attacks in South Korea by utilizing their own infrastructure. This report covers the classification, statistics, and features of APT attacks in South Korea that were identified in October 2025."
  https://asec.ahnlab.com/en/91177/
• Stepping Up Our Role In Vulnerability Management: ENISA Becomes CVE Root
  "The European Union Agency for Cybersecurity (ENISA) is now a Common Vulnerabilities and Exposures (CVE) Program-Root, thus becoming a central point of contact within the CVE program for national/EU authorities, EU CSIRTs network members, and cooperative partners falling under ENISA’s mandate. As a Common Vulnerability and Exposure (CVE) Numbering Authority (CNA), ENISA is authorised to assign CVE Identifiers (CVE IDs) and to publish CVE Records for vulnerabilities discovered by or reported to EU CSIRTs, in line with their dedicated coordinator roles since January 2024. As Root CNA, ENISA is now expanding its role within the CVE program."
  https://www.enisa.europa.eu/news/stepping-up-our-role-in-vulnerability-management-enisa-becomes-cve-root
  https://www.bankinfosecurity.com/enisa-now-cve-program-root-a-30086
• The Black Friday Cyber Crime Economy: Surge In Fraudulent Domains And eCommerce Scams
  "Seasonal shopping periods regularly trigger domain registration spikes, and criminal actors capitalize on the opportunity to camouflage fraudulent infrastructure. October saw 158 new Black Friday related domains, a staggering 93 percent increase over the 2025 monthly average. Early November intensified that growth, with more than 330 new related domains appearing in only the first 10 days. This pace aligns with historical behavior. In 2024, Black Friday domain registration grew 188 percent between October and November. Based on current trends, hundreds of additional domains are likely to appear before month’s end."
  https://blog.checkpoint.com/research/the-black-friday-cyber-crime-economy-surge-in-fraudulent-domains-and-ecommerce-scams/
• Same Old Security Problems: Cyber Training Still Fails Miserably
  "It's a story we've all heard before, yet somehow, we keep living it. Despite years of cybersecurity awareness campaigns, training sessions, and technological advances, the same fundamental security challenges continue to plague organizations worldwide. This past October, during Cybersecurity Awareness Month 2025, three seasoned cybersecurity journalists, from Dark Reading, Tech Target Search Security, and Cybersecurity Dive, came together to examine a frustrating reality: We're still fighting the same battles we were fighting decades ago. Their candid discussion in this month's "Reporters Notebook" reveals why password hygiene remains poor and phishing attacks keep working, even as we pour resources into awareness programs that seem to miss the mark."
  https://www.darkreading.com/cybersecurity-operations/security-problems-cyber-training-fails-miserably
• Supply Chain Breaches Impact Almost All Firms Globally, BlueVoyant Reveals
  "An overwhelming majority of organizations (97%) have been negatively impacted by a supply chain breach, according to a new survey by BlueVoyant. This is a significant increase from 2024, when 81% of respondents to the same annual survey from the third-party risk management (TPRM) provider said they suffered from such an incident."
  https://www.infosecurity-magazine.com/news/supply-chain-breaches-impact/
• The Future Of Malware Is LLM-Powered
  "Large language models (LLMs) have rapidly transformed industries, becoming invaluable tools for automation, coding assistance, and research. However, their widespread adoption raises several critical cybersecurity questions. Is it feasible to create agentic malware composed solely of LLM prompts and minimal code, thereby eliminating the need to hardcode detectable instructions? How effective are LLMs at generating polymorphic threats that can autonomously analyze and execute evasive actions on a victim’s machine in real time? How close are we to seeing this next generation of truly autonomous, LLM-driven malware emerge?"
  https://www.netskope.com/blog/the-future-of-malware-is-llm-powered
  https://www.theregister.com/2025/11/20/llmgenerated_malware_improving/
• UK Drug Funds Flowed Into Bank Tied To Russian Spy Services, Military
  "Investigators at the U.K.’s National Crime Agency say cash generated by Britain’s local drug trade was funnelled through a bank connected to the Kremlin’s intelligence services and sanctioned defense sector, expanding the known scope of a vast Russian money laundering network uncovered last year. The agency said on Friday that ‘Operation Destabilise’ investigators identified a growing number of entities linked to the two major laundering networks — SMART and TGR — including a spy ring imprisoned in Britain back in May."
  https://therecord.media/uk-drug-funds-flowed-into-bank-tied-to-russia

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand