Region: apac
59 entries covering the apac region, latest activity first.
- Falcon: Unit 42 describes a browser-resident command-and-control framework planted in government webmail and web applications, with a script tag in Roundcube at a Middle Eastern foreign ministry and a sideloaded 'PDF Viewer' extension elsewhere; it shares its core with PeckBirdy
- Acronis TRU on BOSSAI: one operator's mesh of 12 AI agents took patient-care records and dispatch case data from Taiwanese emergency services through a legacy open port, a public API and default root credentials, and failed wherever authentication was enforced
- IDC Frontier: ransomware stops four zones of IDCF Cloud for 495 companies and local governments; the provider's seventh report traces it to an open-source flaw in the customer portal's authentication system and says no server data left
- Japan's wave of personal-data theft from web systems: JPCERT/CC and NICT describe attackers who decompile the published Android app to find internal APIs, drop JSP web shells as .war files on application servers, and run AI penetration-testing platforms against exposed web applications and WSUS servers
- UAT-11587: a China-nexus cluster spear-phishes Asian government and policy bodies with Antino, a Rust backdoor whose only command channel is Microsoft 365 through Microsoft Graph
- BlueMoon: six separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain
- An internal OpenAI agent reached non-public files on an Australian government Medicare statistics portal that Canberra called hacked; archived portal code suggests the portal served them to any visitor
- Gyazo (Helpfeel): an image-upload-server vulnerability reaches arbitrary command execution, exposing 23.62 million user records and 490 million image-metadata records
- BambooToken, a previously undocumented MQTT-based malware framework sideloads via a signed Chinese hardware-token utility to control Windows and Linux hosts
- GTG-20006: a Russian espionage cluster runs AI-orchestrated intrusions and autonomously rebuilds detected malware across 20+ government, military and drone-supply-chain targets
- Japan's Digital Agency: a VPN vulnerability exploited since May went undetected for a month, surfaced only by an anomalous mass file-access alert on a maintenance account, exposing ~246,000 government-personnel records
- "ted backdoor" and curlRAT, a DPRK-nexus actor recompiles a victim's own HAProxy source tree to hide C2 inside the load balancer's self-reported connection statistics
- Kimsuky's seafood-invoice LNK campaign abuses Backblaze B2 cloud storage as C2 and exfiltration infrastructure, keyed by victim BIOS serial number
- MoiClient: an invoice-themed backdoor chains an RPC-based UAC bypass with a vulnerable Lenovo PC Manager driver to kill security products and steal browser credentials
- ValleyRAT (Winos 4.0) hides inside a re-signed Chinese wallpaper app: DLL sideloading, a self-restoring svchost injection, and a Windows Defender kill switch
- TA4922 adds PackClient, a Telegram-sold modular RAT/C2 framework, to its toolkit, dual-channel C2, registry-resident configuration, and tax-themed lures against mainland China and India
- A near-autonomous, multi-agent AI framework compromised Taiwanese government infrastructure over four days, cracking 85 accounts, exfiltrating 2,564+ personnel records, and bypassing its own safety guardrails by reframing itself as 'authorized penetration testing'
- A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations
- SilkParasite runs seven RAT families behind six signed-application side-loading pairs, and the reusable detection is the pairing itself, not any DLL name: a signed binary loading a library placed beside it from an unusual location
- Mustang Panda's CoolClient backdoor gains a kernel driver signed with a 2013 certificate that expired in 2014, and it hides the malware's own C2 traffic by hooking the driver Windows uses to report network state
- Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent
- PATCHCORD, SHEETCORD and HACKERAI; one espionage cluster runs three different command-and-control channels, two of them inside Google Sheets and GitHub, and persists by rewriting the victim's browser shortcuts
- Jewelbug: one script tag in a shared government webmail template put a watering hole on 15+ ministry tenants at once, and the browser extension it drops escapes the sandbox through a native-messaging host named after Microsoft Edge
- JWR: a phishing kit that puts a live operator on an encrypted WebSocket into the victim's session, reading card and code digits as they are typed and choosing which one-time-code channel to demand
- CVE-2026-34486, Apache Tomcat: the fix for an earlier EncryptInterceptor flaw reintroduced a bypass, and CISA's KEV listing lands months after a China-nexus campaign was already exploiting it
- XCSSET v40 turns the macOS `defaults` preference system into a fileless re-infection store and holds an exclusive lock on the XProtect signature database
- OctLurk and SilkLurk, sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies
- Unattended AI agent in 'YOLO mode' automated post-exploitation against Thailand's Finance Ministry, a transferable government-network TTP
- South Korea's Foreign Ministry: a ~10-month zero-day intrusion into the Diplomatic Academy's e-learning platform exposed records on nearly all diplomats
- GoSerpent evolves: staged collect-then-return espionage against Southeast Asian government and diplomatic targets
- World Leaks posts ~858,000 files tied to India's Kudankulam nuclear-plant contractor; Reliance confirms a third-party-hosting breach
- Espionage actors weaponise a citizen-facing e-government complaint portal as a watering hole, serving a fake 'portal update' that reflectively loads a RAT
- KDDI third-party email platform breach exposes up to 14.22 million credentials across six Japanese ISPs
- RedHook Android RAT abuses ADB Wireless Debugging to self-grant shell (uid 2000) privileges without an exploit
- Cisco Talos: China-nexus UAT-7810 expands its ORB network with LONGLEASH/DOGLEASH/JARLEASH via unpatched Ruckus and ASUS routers
- Blackfield ransomware demands $2M from Nidec's Taiwanese subsidiary after a 22 June server compromise
- Aflac discloses a Japan-subsidiary breach, 4.38 million policyholders and agents, ~10-day dwell before detection
- Mustang Panda abuses Zoho WorkDrive as a dead-drop C2 channel (ZOHOMURK) against government and energy targets
- Unit 42: Chinese-speaking cluster CL-STA-1062 deploys the new TinyRCT .NET backdoor against SE-Asian government and energy targets via AppDomainManager injection
- Microsoft: "Photo ZIP" phishing laundered through Calendly drops Node.js TonRAT against European hospitality front desks
- WhatsApp-borne VBScript silently installs a ManageEngine RMM agent for living-off-the-land remote control
- China arrests 67 members of the Silver Fox (Winos/ValleyRAT) cybercrime network
- ScarCruft (APT37) delivers NarwhalRAT behind fake Microsoft OTP "security alert" lures
- Sekoia: ErrTraffic, a ClickFix Malware-as-a-Service framework resolving C2 through the Polygon blockchain
- FishMonger (I-SOON) ports its SprySOCKS backdoor to Windows with a kernel-driver rootkit
- Kyushu Electric subsidiary loses an unencrypted SSD with 10.9 million customer records, reportedly Japan's largest personal-data breach
- South Korea fines Coupang a record ₩624.7 bn over an unrevoked signing key held by a former employee
- ESET: OceanLotus (APT32) compromises a stock-trading platform's update server, selective SPECTRALVIPER delivery, no integrity checks to defeat
- The hijacked Polyfill CDN domain came back online answering HTTP 401, so leftover script tags raised browser sign-in prompts on Toshiba, Muji and other sites
- Operation XENOFISCAL: SideCopy (APT36) hits provincial treasury officials with XenoRAT via an mshta/HTA chain
- Operation Dragon Weave: China-nexus espionage against Czech government with Azure Blob Storage dead-drop C2
- Kimsuky (Velvet Chollima) deploys HTTPSpy RAT and Rust-based HelloDoor via VS Code Remote Tunnel and Cloudflare Quick Tunnel C2
- MuddyWater / Seedworm, Symantec and Carbon Black document new DLL-side-loading pair via signed Fortemedia and SentinelOne binaries, ChromElevator for Chromium App-Bound Encryption bypass, Node.js orchestration
- CVE-2026-5426, Digital Knowledge KnowledgeDeliver LMS: pre-shared ASP.NET machineKey enables ViewState deserialization RCE, exploited as a zero-day
- Red Lamassu (Calypso/Bronze Medley): Showboat + JFMBackdoor telco espionage implant pair
- Showboat Linux post-exploitation framework and JFMBackdoor for Windows used against telecom providers; PwC attributes the operation to Red Lamassu (Calypso)
- B1ack's Stash carding marketplace releases about 4.6 million stolen payment card records for free
- Cisco Talos: the "demo.pdb" BadIIS variant is commodity IIS-module malware for SEO fraud, likely sold among Chinese-speaking crime groups and built by the author "lwxat"
- Kaspersky: Kimsuky adds Rust-based HelloDoor and httpMalice to its PebbleDash toolkit and takes over hosts through VSCode tunnels and DWAgent