{ "type": "bundle", "id": "bundle--1360f8d7-75a4-403d-8386-5b54d7c1656a", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "SecurityStudies.info", "identity_class": "organization", "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5", "created": "2026-11-10T16:32:08.759Z", "modified": "2026-11-13T06:07:08.701Z", "name": "SPH Media hit by cyberattacks; no payment card details or financial information compromised", "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, Free Malaysia Today, Mothership, The Straits Times), Nov 10, 2026. Type: data breach; sectors: financial services, media. Asia-Pacific countries affected: Singapore. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-inf-20261110/" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/politics/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-information-compromised", "description": "SPH Media hit by cyberattacks; no payment card details or financial information compromised" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sph-media-cyberattack-data-breach-6538681", "description": "SPH Media hit by cyberattacks; says no customer financial data or access exposed" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/highlight/2026/11/10/singapore-s-sph-media-hit-by-cyberattacks-personal-database-exposed", "description": "Singapore’s SPH media hit by cyberattacks, personal database exposed" }, { "source_name": "Mothership", "url": "https://mothership.sg/2026/11/sph-media-hit-by-ai-enabled-cyberattacks-subscribers-names-phone-numbers-accessed/", "description": "SPH Media hit by AI-enabled cyberattacks; subscribers' names, phone numbers accessed" } ], "x_securitystudies_occurred_on": "2026-11-10", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services", "Media" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Singapore", "country": "SG" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2971254a-e63e-57e7-86a9-28831990c695", "created": "2026-11-10T16:32:08.759Z", "modified": "2026-11-10T16:32:08.759Z", "relationship_type": "related-to", "source_ref": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-13T06:07:08.574Z", "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/" }, { "source_name": "Check Point Research", "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/", "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns" }, { "source_name": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "description": "ARTEX abuse expands as cybercriminals target financial sector" } ], "x_securitystudies_occurred_on": "2026-11-05", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Hong Kong", "country": "HK" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Cambodia", "country": "KH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "South Korea", "country": "KR" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Thailand", "country": "TH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6", "created": "2026-11-09T04:30:05.339Z", "modified": "2026-11-09T04:30:05.339Z", "name": "Storm-0940", "aliases": [ "CovertNetwork-1658", "ORB07" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/storm-0940/" } ], "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702", "created": "2026-11-10T16:32:08.626Z", "modified": "2026-11-13T06:07:08.530Z", "name": "No evidence of customer data leak in unauthorized transactions: SinoPac", "description": "Detected automatically from 3 articles in 3 outlets (Liberty Times, New Talk, Taipei Times), Nov 4 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 40,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/no-evidence-of-customer-data-leak-in-unauthorized-transactions-sinopac-20261104/" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-04/1069275", "description": "永豐銀行419人遭盜轉！金額約4千餘萬 北檢今分案偵辦" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/05/2003867168", "description": "No evidence of customer data leak in unauthorized transactions: SinoPac" }, { "source_name": "Liberty Times", "url": "https://ec.ltn.com.tw/article/breakingnews/5638871", "description": "永豐銀行資安事件今送報告 金管會全面調查缺失" } ], "x_securitystudies_occurred_on": "2026-11-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government", "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Taiwan", "country": "TW" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ea92fcab-e2b4-5704-8ab2-7dd9d7a0b086", "created": "2026-11-10T16:32:08.626Z", "modified": "2026-11-10T16:32:08.626Z", "relationship_type": "related-to", "source_ref": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--1936f227-2555-556b-92d4-7f48f4860626", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-13T06:07:08.394Z", "name": "North Korean actors steal $6.36B from Binance in largest crypto theft in history", "description": "Detected automatically from 35 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 13, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack", "description": "Binance TH pauses crypto transfers, says Thai funds safe after hack" }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/", "description": "North Korean actors steal $6.36B from Binance in largest crypto theft in history" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-10-30/1068375", "description": "金將軍又缺錢？ 幣安2千多億加密貨幣遭駭創歷來之最 北韓遭認是兇手" }, { "source_name": "Liberty Times", "url": "https://ec.ltn.com.tw/article/breakingnews/5624143", "description": "史上最大駭客攻擊！幣安遭竊逾2000億 美分析指向北韓" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000200315", "description": "N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000251315", "description": "(LEAD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000252315", "description": "(2nd LD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Japan Today", "url": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4", "description": "Hackers steal $6.3 billion from Binance in record heist blamed on North Korea" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921226", "description": "N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261101000300315", "description": "FBI says N. Korea responsible for over US$6 bln crypto theft from Binance" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/", "description": "FBI blames North Korea for $6 billion Binance crypto hack" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history", "description": "FBI blames North Korea for stolen billions from Binance in biggest hack in history" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-01/1068564", "description": "幣安逾60億美元資產遭竊　FBI指北韓所為" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921526", "description": "FBI says N. Korea responsible for over $6b crypto theft from Binance" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261101de69102", "description": "暗号資産大手バイナンスへのサイバー攻撃 FBI“北朝鮮が関与”" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921777", "description": "North Korean cyberterrorism gains renewed scrutiny after record Binance heist" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261101000351315", "description": "(LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance", "description": "FBI says North Korea behind US$6bil crypto theft from Binance" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975", "description": "N Korea behind US$6bn crypto theft, FBI says" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-02/1068750", "description": "20分鐘盜逾60億美元加密貨幣! 北韓駭客疑感情詐騙滲透幣安工程師 川普這樣說...." }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/", "description": "FBI confirms North Korea behind record $6.36B Binance crypto heist" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/", "description": "Binance outflows hit $4.7 billion after record North Korea hack" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html", "description": "FBI identifies North Korean hackers as responsible for unprecedented Binance breach" }, { "source_name": "NK News", "url": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/", "description": "Kim Yo Jong denies North Korean involvement in $6B Binance crypto theft" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311", "description": "North Korea slams FBI allegations over Binance hack as 'grave' provocation" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/", "description": "North Korea calls U.S. claims it was behind Binance hack ‘a grave political provocation’" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation", "description": "N. Korea slams FBI allegations over Binance hack as ‘grave’ provocation" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation", "description": "Sister of North Korea’s Kim slams FBI’s Binance hack allegations as ‘grave’ provocation" }, { "source_name": "VN Express", "url": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html", "description": "Triều Tiên đáp trả cáo buộc 'tấn công mạng Binance' từ FBI" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261103de69881", "description": "世界的な暗号資産取引所へのサイバー攻撃　北朝鮮が関与否定" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 5, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2dc31aa3-0df9-5ff5-8935-df97ac69a0c9", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a", "created": "2026-11-09T04:30:05.217Z", "modified": "2026-11-09T04:30:05.217Z", "name": "TraderTraitor", "aliases": [ "Jade Sleet", "Pukchong", "UNC4899" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/tradertraitor/" } ], "description": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--55952837-5ab0-5bcc-b705-b0d57744ac9d", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a967416f-84ac-5091-9236-eec7739030c4", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-13T06:07:08.404Z", "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack", "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack", "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516", "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus", "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151", "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969157", "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต" }, { "source_name": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach", "description": "THAI passenger data compromised in Amadeus security breach" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe", "description": "Thai Airways confirms passenger data leak but credit card details safe" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969937", "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Transportation", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Japan", "country": "JP" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Malaysia", "country": "MY" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-11T20:40:49.496Z", "name": "Unauthorized access: 'Possibility that the stage has shifted to targeting financial institutions'", "description": "Detected automatically from 1 article in 1 outlet (NHK), Oct 21, 2026. Title machine-translated from Japanese. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/incident-20261021/" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261021de62921", "description": "不正アクセス“金融機関が狙われる段階に変わってきた可能性”" } ], "x_securitystudies_occurred_on": "2026-10-21", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--15167757-32a5-5dae-ac45-cb8bfc38855a", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-10T16:32:08.267Z", "relationship_type": "related-to", "source_ref": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700", "created": "2026-11-10T16:32:08.071Z", "modified": "2026-11-10T16:40:20.464Z", "name": "Man loses over RM12mil in suspected crypto theft", "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Oct 10, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Malaysia. Largest figure in the headlines: 12,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/man-loses-over-rm12mil-in-suspected-crypto-theft-20261010/" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/nation/2026/10/10/man-loses-over-rm12mil-in-suspected-crypto-theft", "description": "Man loses over RM12mil in suspected crypto theft" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/10/10/man-loses-over-rm12m-in-suspected-crypto-theft/238570", "description": "Man loses over RM12m in suspected crypto theft" } ], "x_securitystudies_occurred_on": "2026-10-10", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--437f539d-d38e-565c-83bb-b7434db3be93", "created": "2026-11-10T16:32:08.071Z", "modified": "2026-11-10T16:32:08.071Z", "relationship_type": "related-to", "source_ref": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51", "created": "2026-11-10T16:32:08.013Z", "modified": "2026-11-10T16:40:20.414Z", "name": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says", "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, New York Times China, Taipei Times, The Japan Times), Oct 8, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: China. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/south-korea-bank-hack-suspect-may-be-26-year-old-in-china-us-firm-says-20261008/" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/10/08/south-korea-cyberattack-china-suspect/", "description": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-6441386", "description": "CrowdStrike says China-based suspect used AI tools in South Korean bank hacks" }, { "source_name": "New York Times China", "url": "https://www.nytimes.com/2026/10/08/world/australia/south-korea-bank-hack-china-us-ai.html", "description": "Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/front/archives/2026/10/09/2003865655", "description": "S Korean banks likely hacked by China-based actor: CrowdStrike" } ], "x_securitystudies_occurred_on": "2026-10-08", "x_securitystudies_severity": 5, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--231e90b4-4920-54e1-af65-e3447d240a54", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "China", "country": "CN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2c908ce6-1ad8-53ce-862f-6f73cc5830a9", "created": "2026-11-10T16:32:08.013Z", "modified": "2026-11-10T16:32:08.013Z", "relationship_type": "related-to", "source_ref": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51", "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb", "created": "2026-11-10T16:32:08.007Z", "modified": "2026-11-10T16:40:20.409Z", "name": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks", "description": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html", "description": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks" } ], "x_securitystudies_occurred_on": "2026-10-07", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b735b72-62fa-5c94-980b-26bd9658327a", "created": "2026-11-10T16:32:08.007Z", "modified": "2026-11-10T16:32:08.007Z", "relationship_type": "related-to", "source_ref": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:40:20.195Z", "name": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget", "description": "Detected automatically from 4 articles in 3 outlets (Channel News Asia, NK Pro, Thanh Nien News), Sep 25 to Sep 30, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Vietnam, Singapore. Largest figure in the headlines: 352,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-20260925/" }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-bitget/", "description": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-in-hack-6410806", "description": "Crypto exchange Bitget pauses withdrawals after $350 million stolen in hack" }, { "source_name": "Thanh Nien News", "url": "https://thanhnien.vn/gia-bitcoin-hom-nay-2892026-tin-tac-tau-tan-xong-83-trieu-usd-trong-vu-hack-bitget-185260928081934906.htm", "description": "Giá Bitcoin hôm nay 28.9.2026: Tin tặc tẩu tán xong 83 triệu USD trong vụ hack Bitget" }, { "source_name": "Thanh Nien News", "url": "https://thanhnien.vn/ceo-bitget-khong-may-lac-quan-ve-kha-nang-thu-hoi-3875-trieu-usd-bi-hack-185260930112333106.htm", "description": "CEO Bitget: 'Không mấy lạc quan về khả năng thu hồi 387,5 triệu USD bị hack'" } ], "x_securitystudies_occurred_on": "2026-09-25", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--db02ef0f-ae60-50ba-8bc8-cf8199b3ccbb", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:32:07.760Z", "relationship_type": "related-to", "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Vietnam", "country": "VN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--03abcbf0-41cf-5c95-a2ec-d4428c33673c", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:32:07.760Z", "relationship_type": "related-to", "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "description": "affected country" } ] }