{ "type": "bundle", "id": "bundle--693e0c79-4604-4819-96b6-1623438b1de5", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "SecurityStudies.info", "identity_class": "organization", "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--33f88102-5701-57d5-ae19-61490a213398", "created": "2026-11-13T06:07:08.894Z", "modified": "2026-11-13T06:07:08.894Z", "name": "Safeguarding India's Banking from AI-Powered Cyberattacks", "description": "Detected automatically from 1 article in 1 outlet (ETCISO (Economic Times)), Nov 13, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "other", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/safeguarding-indias-banking-from-ai-powered-cyberattacks-20261113/" }, { "source_name": "ETCISO (Economic Times)", "url": "https://ciso.economictimes.indiatimes.com/news/cybercrime-fraud/safeguarding-indias-banking-from-ai-powered-cyberattacks/135787484", "description": "Safeguarding India's Banking from AI-Powered Cyberattacks" } ], "x_securitystudies_occurred_on": "2026-11-13", "x_securitystudies_severity": 3, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--095279bc-69f1-5155-a576-8cfad052b57e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "India", "country": "IN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--808239de-fbbd-56a4-95fc-d30f009ddeaa", "created": "2026-11-13T06:07:08.894Z", "modified": "2026-11-13T06:07:08.894Z", "relationship_type": "related-to", "source_ref": "incident--33f88102-5701-57d5-ae19-61490a213398", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--6eb20c15-2e94-5172-8c2c-bb1d822f59b8", "created": "2026-11-10T16:32:08.678Z", "modified": "2026-11-13T06:07:08.594Z", "name": "Mirae Asset says data breaches exposed customer, employee information", "description": "Detected automatically from 4 articles in 3 outlets (ETCISO (Economic Times), The Korea Herald, Yonhap), Nov 6 to Nov 9, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea, India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/mirae-asset-says-data-breaches-exposed-customer-employee-information-20261106/" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261107000400315", "description": "Mirae Asset says data breaches exposed customer, employee information" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261107000451315", "description": "(LEAD) Personal info of some 39,000 leaked from Mirae Asset Securities" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10929242", "description": "Personal info of some 39,000 leaked from Mirae Asset Securities" }, { "source_name": "ETCISO (Economic Times)", "url": "https://ciso.economictimes.indiatimes.com/news/data-breaches/personal-info-of-39000-persons-leaked-from-mirae-asset-securities/135669047", "description": "Personal info of 39,000 persons leaked from Mirae Asset Securities" } ], "x_securitystudies_occurred_on": "2026-11-06", "x_securitystudies_severity": 3, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8730a6a4-1342-5393-ac9d-7cfd7315a152", "created": "2026-11-10T16:32:08.678Z", "modified": "2026-11-10T16:32:08.678Z", "relationship_type": "related-to", "source_ref": "incident--6eb20c15-2e94-5172-8c2c-bb1d822f59b8", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "South Korea", "country": "KR" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--65a71513-9667-5cbf-8f43-633d1647f9aa", "created": "2026-11-10T16:32:08.678Z", "modified": "2026-11-10T16:32:08.678Z", "relationship_type": "related-to", "source_ref": "incident--6eb20c15-2e94-5172-8c2c-bb1d822f59b8", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--f930550a-e9fd-5a9b-b713-a6aecbb01a92", "created": "2026-11-10T16:32:08.256Z", "modified": "2026-11-11T20:40:49.481Z", "name": "State Bank of India reports cyberattack involving nearly 3,900 customer records", "description": "Detected automatically from 1 article in 1 outlet (Channel News Asia), Oct 21, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/state-bank-of-india-reports-cyberattack-involving-nearly-3900-customer-20261021/" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/state-bank-india-reports-cyberattack-involving-nearly-3900-customer-records-6477746", "description": "State Bank of India reports cyberattack involving nearly 3,900 customer records" } ], "x_securitystudies_occurred_on": "2026-10-21", "x_securitystudies_severity": 3, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c7d39e72-caa5-5141-9775-c82f2bf404ca", "created": "2026-11-10T16:32:08.256Z", "modified": "2026-11-10T16:32:08.256Z", "relationship_type": "related-to", "source_ref": "incident--f930550a-e9fd-5a9b-b713-a6aecbb01a92", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2", "created": "2026-11-10T16:32:07.714Z", "modified": "2026-11-10T16:40:20.163Z", "name": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties", "description": "Detected automatically from 1 article in 1 outlet (SentinelLabs), Sep 18, 2026. Type: espionage campaign; sectors: cryptocurrency. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-20260918/" }, { "source_name": "SentinelLabs", "url": "https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/", "description": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties" } ], "x_securitystudies_occurred_on": "2026-09-18", "x_securitystudies_severity": 3, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--b4e71c1e-9c90-5ae0-9b58-182232b8dfbc", "created": "2026-11-10T16:32:07.714Z", "modified": "2026-11-10T16:32:07.714Z", "relationship_type": "related-to", "source_ref": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--f7ec5c4f-7c84-552d-9249-9fd7f5a9263c", "created": "2026-11-09T04:30:08.704Z", "modified": "2026-11-09T04:30:08.704Z", "name": "WageMole", "aliases": [ "Contagious Interview", "DEV#POPPER", "DeceptiveDevelopment", "Famous Chollima", "Gwisin Gang", "Nickel Tapestry", "PurpleBravo", "Storm-1877", "TAG-121", "Tenacious Pungsan", "UNC5267", "Void Dokkaebi", "Wagemole", "WaterPlum" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G1052", "url": "https://attack.mitre.org/groups/G1052/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/wagemole/" } ], "description": "WageMole is a North Korean state-sponsored APT that employs social engineering and technology to secure remote job opportunities in Western countries, leveraging stolen personal data from the Contagious Interview campaign. Threat actors create fake identities, including passports and driver's licenses, and prepare study guides for interviews, often utilizing generative AI for well-structured responses. They target small to mid-sized businesses and utilize job platforms like Upwork and Indeed, while employing automation scripts for account creation. WageMole's activities include sharing code within their group and requesting payments through platforms like PayPal to conceal their identity." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--dc23a4b9-3aa3-52ec-a3a8-c6407a7f72db", "created": "2026-11-10T16:32:07.714Z", "modified": "2026-11-10T16:32:07.714Z", "relationship_type": "related-to", "source_ref": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2", "target_ref": "intrusion-set--f7ec5c4f-7c84-552d-9249-9fd7f5a9263c", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-10T16:26:37.587Z", "name": "GitLab maximum-severity path traversal exploited within hours of disclosure", "description": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.", "confidence": 50, "labels": [ "supply_chain", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog" } ], "x_securitystudies_occurred_on": "2026-09-11", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology and Software Supply Chain", "Financial Services", "Government" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United States", "country": "US" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fc3a7591-bd53-50ae-8a72-e41de1afbd37", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United Kingdom", "country": "GB" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2659c6c3-953e-58b2-9aa3-3265700a2b97", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Germany", "country": "DE" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--689583b4-610b-5c43-be4e-fd6b7195d101", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Japan", "country": "JP" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a7ac4e90-1e57-5eb8-ab78-8e93cbae1ba1", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1e5d137b-c900-551e-a96d-d91718577e9d", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Singapore", "country": "SG" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--43d29671-3132-541c-b643-0985fe12aebb", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "description": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/" }, { "source_name": "source", "url": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Technology", "Financial Services", "Healthcare" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7f4ae124-6b26-520d-8306-f3df41bdc29a", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--61f8abc6-b0fd-5c03-ac7f-45ee19b1d8a6", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--0f08bb4e-8dc7-5fda-8c39-751c887e6e04", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Australia", "country": "AU" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--343d1641-2005-55b4-a2ff-02e0f31e83a4", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8d466d58-e466-5116-9c0d-9743d902f512", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-10T16:26:37.587Z", "name": "JFrog Artifactory flaws chained to administrator access and Rust backdoor deployment", "description": "Wiz disclosed coordinated exploitation of CVE-2026-42018, which returns an internal anonymous-user token to an unauthenticated caller, chained with CVE-2026-42016 to escalate that token to administrator scope, taking attackers from first request to new admin account in under five minutes. Separately CVE-2026-82329, a CVSS 9.8 authentication bypass, was exploited between 1 and 8 September with approximately 406,000 attempts detected on 2 September alone. Post-compromise activity included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and extraction of cluster join keys for lateral movement. Cloud instances were unaffected; CISA KEV-listed CVE-2026-42016 and CVE-2026-42018 on 11 September and CVE-2026-82329 on 2 September.", "confidence": 50, "labels": [ "supply_chain", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/jfrog-artifactory-flaws-chained-to-administrator-access-and-rust-backdoor-deployment/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog" } ], "x_securitystudies_occurred_on": "2026-09-01", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology and Software Supply Chain", "Financial Services", "Telecommunications" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--cfec3d19-bfa2-575a-803c-48d5a663cd46", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--623d501b-23aa-52d8-a2d8-074c27fb5234", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Israel", "country": "IL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e6aba39b-8a85-516e-aec0-d40f54fe57cf", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--259590b5-9f37-55c7-b69b-83fb922fc57b", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8015834a-a6cd-53fd-804b-fde3f523a5d9", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" } ] }