Cyber threats

Cyber threat overview

Who is active against Asia-Pacific, where the activity concentrates, what is being exploited and what the regional and specialist press reports. Actor profiles from MISP Galaxy and MITRE ATT&CK, vulnerabilities from CISA KEV and FIRST EPSS, activity measured in the news.

346+75Cyber articles · 7 daysagainst the week before 14Threat actors in the news · 30 days12 this week 264Incidents on the register · 12 monthslatest Nov 12, 2026 11Newly exploited vulnerabilities · 7 days1779 in CISA KEV 56CVEs named in regional news · 30 days 67National CERT advisories · 7 days5 CERT feeds 20/ 21Countries with cyber news · 30 days

Threat actors in the news 30 days

All actors →
ActorSuspected sponsorAsia-Pacific targets7 days30 daysLast named
TraderTraitor KP North Korea none on record 4 29 Nov 11
Lazarus Group EU high KP North Korea AUCNHKINJPKRTH +8 elsewhere 2 5 Nov 9
Storm-0940 CN China none on record 2 3 Nov 11
UTA0178 CN China none on record +1 elsewhere 1 3 Nov 12
GhostEmperor CN China none on record 1 2 Nov 10
APT17 EU high CN China CNIDJP +8 elsewhere 1 1 Nov 11
APT29 EU high RU Russia CNINJPKR +12 elsewhere 1 1 Nov 9
MUSTANG PANDA CN China none on record +2 elsewhere 1 1 Nov 10
SAMURAI PANDA CN China HK +2 elsewhere 1 1 Nov 12
UAT-9244 CN China none on record 1 1 Nov 10
An actor counts when an article that mentions an Asia-Pacific country, or comes from a regional outlet, names it or one of its aliases. Targets: the Asia-Pacific countries among the suspected victims of the profile (MISP Galaxy); “elsewhere” counts its victims outside the region.

Latest cyber headlines 7 days

All cyber news →

Vulnerabilities to prioritise

All exploited vulnerabilities →
CVEVendor · productWhy nowEPSS
CVE-2024-21887 Ransomware Ivanti · Connect Secure and Policy Secure Exploited; named in 1 Asia-Pacific article 100.0%
CVE-2026-109618 PHP Group · PHP Exploited; named in 4 Asia-Pacific articles 100.0%
CVE-2026-109619 PHP Group · PHP Exploited; named in 4 Asia-Pacific articles 100.0%
CVE-2023-46805 Ransomware Ivanti · Connect Secure and Policy Secure Exploited; named in 1 Asia-Pacific article 100.0%
CVE-2025-25257 Fortinet · FortiWeb Exploited; named in 1 Asia-Pacific article 99.9%
CVE-2026-0257 Ransomware Palo Alto Networks · PAN-OS Exploited; named in 1 Asia-Pacific article 95.6%
CVE-2026-123158 OpenBSD · OpenSSH Added to CISA KEV on Nov 9 16.5%
CVE-2026-116779 SignalWire · FreeSwitch Added to CISA KEV on Nov 9 2.2%

National CERT advisories 14 days

All advisories →
Bulletins of HKCERT security bulletins, JPCERT/CC, JVN (JPCERT/CC and IPA), KrCERT/CC (KISA, Korean), ThaiCERT (Thai). Shown apart and never counted as news. Other national CERTs of the region publish no feed this server can read.

Cyber activity by country articles, 30 days

JP Japan167 KR South Korea150 TW Taiwan82 TH Thailand79 SG Singapore66 KP North Korea57 MY Malaysia53 KH Cambodia48 CN China33 PH Philippines33 IN India29 ID Indonesia28 VN Vietnam28 AU Australia23 HK Hong Kong18 MM Myanmar14 LA Laos4 MO Macau2 TL Timor-Leste2 BN Brunei1 MN Mongolia0
Articles with an unmistakably cyber headline, counted for the countries they are about. Countries with few outlets or no local-language coverage show less than happens there: see the sources by country.

Who targets the region suspected sponsors

Actors →
CN China45 RU Russia8 IR Iran5 KP North Korea4 US United States3 KR South Korea2
80 profiled actors have a suspected victim in Asia-Pacific; 9 of them have no attributed sponsor. Attribution as given by MISP Galaxy and MITRE ATT&CK.

Incident register

All incidents →
Detected in the news by rules after every fetch; Detected entries have not been reviewed. How

Most used techniques ATT&CK

Matrix →
Phishing34 User Execution32 Command and Scripting Interpreter30 Masquerading25 Obfuscated Files or Information24 Ingress Tool Transfer24 Boot or Logon Autostart Execution22 OS Credential Dumping21
Number of actors targeting the region whose ATT&CK profile includes the technique.