{
 "response": [
  {
   "Event": {
    "uuid": "0db8cf87-a221-57a1-9cb2-ee3a259ab206",
    "info": "Ministry of Digital Affairs: AI helps hackers launch cyberattacks, over a dozen companies have 8 million personal data records leaked",
    "date": "2026-11-12",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"data_breach\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/ministry-of-digital-affairs-ai-helps-hackers-launch-cyberattacks-over-20261112/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://newtalk.tw/news/view/2026-11-12/1070779",
      "comment": "New Talk",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 1 article in 1 outlet (New Talk), Nov 12, 2026. Title machine-translated from Chinese. Type: data breach; sectors: government. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 8,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "7a33e88b-9d5a-5a8b-a999-6ada6710b702",
    "info": "No evidence of customer data leak in unauthorized transactions: SinoPac",
    "date": "2026-11-04",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"data_breach\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Financial Services\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/no-evidence-of-customer-data-leak-in-unauthorized-transactions-sinopac-20261104/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://newtalk.tw/news/view/2026-11-04/1069275",
      "comment": "New Talk",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.taipeitimes.com/News/biz/archives/2026/11/05/2003867168",
      "comment": "Taipei Times",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://ec.ltn.com.tw/article/breakingnews/5638871",
      "comment": "Liberty Times",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 3 articles in 3 outlets (Liberty Times, New Talk, Taipei Times), Nov 4 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 40,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "9ab54f53-548b-590a-b93b-0064a006f43b",
    "info": "First-time voter lottery target Yakira hit by cyberattack; Chiang office and KMT councilors show support: Do not create a chilling effect",
    "date": "2026-10-27",
    "threat_level_id": "1",
    "analysis": "0",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"detected-unreviewed\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/yakira-20261027/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://newtalk.tw/news/view/2026-10-27/1067745",
      "comment": "New Talk",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Detected automatically from 1 article in 1 outlet (New Talk), Oct 27, 2026. Title machine-translated from Chinese. Type: espionage campaign; sectors: government. Asia-Pacific countries affected: Taiwan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "4993de8b-1eda-598c-b85b-f897f4c292c8",
    "info": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
    "date": "2026-09-04",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:country=\"china\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"afghanistan\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Education\""
     },
     {
      "name": "misp-galaxy:sector=\"Manufacturing\""
     },
     {
      "name": "misp-galaxy:sector=\"Healthcare\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "74657fff-2b96-5e87-8bba-660969e4162e",
    "info": "China-linked SecFlow campaign uses AI agents against Asian government and industrial targets",
    "date": "2026-08-20",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"china\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Education\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense\""
     },
     {
      "name": "misp-galaxy:sector=\"Industrial\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/china-linked-secflow-campaign-uses-ai-agents-against-asian-government-and-industrial-targets/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Hunt.io documented a Chinese-speaking operation tracked as SecFlow, linked to a username 'Nie' recurring across its infrastructure, which routed Claude, Qwen and DeepSeek through private proxies at niestools.com to automate reconnaissance and exploitation. The toolkit included the GLUTTON webshell framework delivering steganographic payloads inside PNG files, a fake MySQL deserialization service, a Java and CAS exploitation workspace, and Shellshock and credential-testing nodes. Confirmed targeting spanned Kuomintang Party archives in Taiwan, the Indonesian Ministry of Foreign Affairs, and Chinese and Vietnamese government, education and industrial hosts. A confirmed breach of the Fengtai District government office-automation environment yielded 822 OA user records and 1.28GB of data including patient health information.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "34bf598f-5d27-57d9-85dd-3bbb1606d62a",
    "info": "AI-Driven Autonomous Cyberattack Hits Taiwan Government Systems",
    "date": "2026-08-12",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"apt\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:sector=\"government\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/ai-driven-autonomous-cyberattack-hits-taiwan-government-systems/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.cnn.com/2026/08/13/tech/china-taiwan-ai-agent-cyberattack-intl-hnk",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Taiwan's Ministry of Digital Affairs confirmed that government agencies were targeted in July by what researchers at Israeli firm Dream described as the first end-to-end autonomous AI cyberattack, using AI agents including the open-source-built OpenClaw tool. Over four days the AI agents mapped 21 government systems, cracked 85 government user accounts and extracted roughly 2,500 personnel records, with experts suspecting China-linked operators.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "91156f08-77d1-56e9-a07f-3cdbff47a209",
    "info": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
    "date": "2024-09-15",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"GhostEmperor\""
     },
     {
      "name": "misp-galaxy:country=\"united states\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"australia\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"japan\""
     },
     {
      "name": "misp-galaxy:sector=\"Telecommunications\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "CISA Advisory AA24-340A",
       "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "Microsoft Threat Intelligence",
       "url": "https://www.microsoft.com/en-us/security/blog/"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  }
 ]
}