{ "type": "bundle", "id": "bundle--7ad2ba6f-ddb2-4b5a-a54f-31269a6e5c84", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "SecurityStudies.info", "identity_class": "organization", "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--0a26bd3c-facd-5ce6-9f32-fb471863bc3d", "created": "2026-11-12T18:04:29.473Z", "modified": "2026-11-13T06:07:08.854Z", "name": "PHP2Shell Exploitation on Check Point Gateway", "description": "Detected automatically from 1 article in 1 outlet (Check Point Research), Nov 12, 2026. Type: exploitation. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "exploitation", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/php2shell-exploitation-on-check-point-gateway-20261112/" }, { "source_name": "Check Point Research", "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "description": "PHP2Shell Exploitation on Check Point Gateway" } ], "x_securitystudies_occurred_on": "2026-11-12", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--7872b8fa-bf74-5285-b4a4-225f6a17a083", "created": "2026-11-09T04:30:05.261Z", "modified": "2026-11-09T04:30:05.261Z", "name": "UTA0178", "aliases": [ "ARMORY CASTLE", "Red Dev 61", "UNC5221" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/uta0178/" } ], "description": "While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file modifications to allow credential harvesting. Once UTA0178 had access into the network via the ICS VPN appliance, their general approach was to pivot from system to system using compromised credentials. They would then further compromise credentials of users on any new system that was breached, and use these credentials to log into additional systems via RDP. Volexity observed the attacker obtaining credentials in a variety of ways." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--10d97677-74ad-5914-a1c1-a0877ed894a0", "created": "2026-11-12T18:04:29.473Z", "modified": "2026-11-12T18:04:29.473Z", "relationship_type": "related-to", "source_ref": "incident--0a26bd3c-facd-5ce6-9f32-fb471863bc3d", "target_ref": "intrusion-set--7872b8fa-bf74-5285-b4a4-225f6a17a083", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--15967d9e-c7f8-5a4c-a3c4-35b8f71f71c6", "created": "2026-11-13T05:15:33.953Z", "modified": "2026-11-13T05:15:33.953Z", "name": "CVE-2026-109618", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-109618" } ], "description": "PHP Memory Corruption Vulnerability" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--38af4144-4476-532c-9291-fcce48ad0123", "created": "2026-11-12T18:04:29.473Z", "modified": "2026-11-12T18:04:29.473Z", "relationship_type": "related-to", "source_ref": "incident--0a26bd3c-facd-5ce6-9f32-fb471863bc3d", "target_ref": "vulnerability--15967d9e-c7f8-5a4c-a3c4-35b8f71f71c6", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--27205f2b-486b-5022-85cf-2d3480ec0094", "created": "2026-11-13T05:15:33.953Z", "modified": "2026-11-13T05:15:33.953Z", "name": "CVE-2026-109619", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-109619" } ], "description": "PHP Stale Internal Request-State Vulnerability" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2014eaa5-3556-524d-9c03-b4aae7e6a2c6", "created": "2026-11-12T18:04:29.473Z", "modified": "2026-11-12T18:04:29.473Z", "relationship_type": "related-to", "source_ref": "incident--0a26bd3c-facd-5ce6-9f32-fb471863bc3d", "target_ref": "vulnerability--27205f2b-486b-5022-85cf-2d3480ec0094", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--63e26040-c47a-59b3-bb54-3edb29f47426", "created": "2026-11-12T18:04:25.663Z", "modified": "2026-11-12T18:04:25.663Z", "name": "CVE-2026-123039", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-123039" } ] }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--3cfe52f4-3271-5bff-86f7-b87b05e1c187", "created": "2026-11-12T18:04:29.473Z", "modified": "2026-11-12T18:04:29.473Z", "relationship_type": "related-to", "source_ref": "incident--0a26bd3c-facd-5ce6-9f32-fb471863bc3d", "target_ref": "vulnerability--63e26040-c47a-59b3-bb54-3edb29f47426", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--0db8cf87-a221-57a1-9cb2-ee3a259ab206", "created": "2026-11-12T12:05:12.132Z", "modified": "2026-11-13T06:07:08.828Z", "name": "Ministry of Digital Affairs: AI helps hackers launch cyberattacks, over a dozen companies have 8 million personal data records leaked", "description": "Detected automatically from 1 article in 1 outlet (New Talk), Nov 12, 2026. Title machine-translated from Chinese. Type: data breach; sectors: government. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 8,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/ministry-of-digital-affairs-ai-helps-hackers-launch-cyberattacks-over-20261112/" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-12/1070779", "description": "數發部：AI助駭客網攻 十多家企業共800萬筆個資外洩" } ], "x_securitystudies_occurred_on": "2026-11-12", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government" ], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Taiwan", "country": "TW" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7f4593f3-b068-5154-bb10-4efa555804f1", "created": "2026-11-12T12:05:12.132Z", "modified": "2026-11-12T12:05:12.132Z", "relationship_type": "related-to", "source_ref": "incident--0db8cf87-a221-57a1-9cb2-ee3a259ab206", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5", "created": "2026-11-10T16:32:08.759Z", "modified": "2026-11-13T06:07:08.701Z", "name": "SPH Media hit by cyberattacks; no payment card details or financial information compromised", "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, Free Malaysia Today, Mothership, The Straits Times), Nov 10, 2026. Type: data breach; sectors: financial services, media. Asia-Pacific countries affected: Singapore. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-inf-20261110/" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/politics/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-information-compromised", "description": "SPH Media hit by cyberattacks; no payment card details or financial information compromised" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sph-media-cyberattack-data-breach-6538681", "description": "SPH Media hit by cyberattacks; says no customer financial data or access exposed" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/highlight/2026/11/10/singapore-s-sph-media-hit-by-cyberattacks-personal-database-exposed", "description": "Singapore’s SPH media hit by cyberattacks, personal database exposed" }, { "source_name": "Mothership", "url": "https://mothership.sg/2026/11/sph-media-hit-by-ai-enabled-cyberattacks-subscribers-names-phone-numbers-accessed/", "description": "SPH Media hit by AI-enabled cyberattacks; subscribers' names, phone numbers accessed" } ], "x_securitystudies_occurred_on": "2026-11-10", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services", "Media" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Singapore", "country": "SG" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2971254a-e63e-57e7-86a9-28831990c695", "created": "2026-11-10T16:32:08.759Z", "modified": "2026-11-10T16:32:08.759Z", "relationship_type": "related-to", "source_ref": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f", "created": "2026-11-11T20:35:29.928Z", "modified": "2026-11-13T06:07:08.619Z", "name": "SonicWall SSL-VPN authentication bypass vulnerability exploited in actual attacks, multi-factor authentication also neutralized", "description": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 9, 2026. Title machine-translated from Korean. Type: exploitation. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "exploitation", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/sonicwall-ssl-vpn-authentication-bypass-vulnerability-exploited-in-act-20261109/" }, { "source_name": "Dailysecu (Korean)", "url": "https://www.dailysecu.com/news/articleView.html?idxno=209394", "description": "소닉월 SSL-VPN 인증 우회 취약점 실제 공격에 악용, 다중인증도 무력화" } ], "x_securitystudies_occurred_on": "2026-11-09", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "South Korea", "country": "KR" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fe97fcb5-287d-56c6-a798-914b08267c23", "created": "2026-11-11T20:35:29.928Z", "modified": "2026-11-11T20:35:29.928Z", "relationship_type": "related-to", "source_ref": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--502a9f8f-a5b4-5afc-abed-dfd1c77c5cd6", "created": "2026-11-13T05:15:33.953Z", "modified": "2026-11-13T05:15:33.953Z", "name": "CVE-2026-19868", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-19868" } ], "description": "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fa591481-207c-519e-a125-a9c868ca1360", "created": "2026-11-11T20:35:29.928Z", "modified": "2026-11-11T20:35:29.928Z", "relationship_type": "related-to", "source_ref": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f", "target_ref": "vulnerability--502a9f8f-a5b4-5afc-abed-dfd1c77c5cd6", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-13T06:07:08.574Z", "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/" }, { "source_name": "Check Point Research", "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/", "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns" }, { "source_name": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "description": "ARTEX abuse expands as cybercriminals target financial sector" } ], "x_securitystudies_occurred_on": "2026-11-05", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Hong Kong", "country": "HK" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Cambodia", "country": "KH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Thailand", "country": "TH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6", "created": "2026-11-09T04:30:05.339Z", "modified": "2026-11-09T04:30:05.339Z", "name": "Storm-0940", "aliases": [ "CovertNetwork-1658", "ORB07" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/storm-0940/" } ], "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e", "created": "2026-11-10T16:32:08.658Z", "modified": "2026-11-10T16:32:08.658Z", "relationship_type": "related-to", "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702", "created": "2026-11-10T16:32:08.626Z", "modified": "2026-11-13T06:07:08.530Z", "name": "No evidence of customer data leak in unauthorized transactions: SinoPac", "description": "Detected automatically from 3 articles in 3 outlets (Liberty Times, New Talk, Taipei Times), Nov 4 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 40,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/no-evidence-of-customer-data-leak-in-unauthorized-transactions-sinopac-20261104/" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-04/1069275", "description": "永豐銀行419人遭盜轉！金額約4千餘萬 北檢今分案偵辦" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/05/2003867168", "description": "No evidence of customer data leak in unauthorized transactions: SinoPac" }, { "source_name": "Liberty Times", "url": "https://ec.ltn.com.tw/article/breakingnews/5638871", "description": "永豐銀行資安事件今送報告 金管會全面調查缺失" } ], "x_securitystudies_occurred_on": "2026-11-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government", "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--ea92fcab-e2b4-5704-8ab2-7dd9d7a0b086", "created": "2026-11-10T16:32:08.626Z", "modified": "2026-11-10T16:32:08.626Z", "relationship_type": "related-to", "source_ref": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--ca649294-37b3-58a6-b905-21498e809401", "created": "2026-11-10T16:32:08.548Z", "modified": "2026-11-13T06:07:08.467Z", "name": "Personal information of Lee, presidential staff leaked: report", "description": "Detected automatically from 11 articles in 6 outlets (Hankyoreh, NHK, New Talk, South China Morning Post, The Korea Herald, Yonhap), Nov 2 to Nov 4, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/personal-information-of-lee-presidential-staff-leaked-report-20261102/" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261102013200320", "description": "Personal information of Lee, presidential staff leaked: report" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261102013251320", "description": "(LEAD) Personal information of Lee, presidential staff leaked: report" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261103003700315", "description": "Presidential office holds emergency meeting over leak of personal data of president, trip entourage" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10923757", "description": "Presidential office holds emergency meeting over leak of personal data of president, trip entourage" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261103003751315", "description": "(LEAD) Presidential office holds emergency meeting over leak of personal data of president, trip entourage" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/asia/east-asia/article/3373065/south-korea-rushes-reissue-passports-president-lee-wife-after-data-leak", "description": "South Korea rushes to reissue passports to President Lee, wife after data leak" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-03/1069015", "description": "長達逾5個月！ 李在明護照資料遭公開 韓國政府急善後..." }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261103010400315", "description": "Main opposition slams presidential office for leak of Lee's personal data" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261103de70007", "description": "韓国大統領や高官の個人情報流出 イ大統領パスポート再発行へ" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_national/1285585.html", "description": "Passport numbers of Lee, 167 others leaked in presidential jet data breach" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_national/1285767.html", "description": "Foreign Ministry employee likely behind presidential jet passenger data leak" } ], "x_securitystudies_occurred_on": "2026-11-02", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government" ], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6dbd0ffd-b3ab-5689-9e97-81680954e607", "created": "2026-11-10T16:32:08.548Z", "modified": "2026-11-10T16:32:08.548Z", "relationship_type": "related-to", "source_ref": "incident--ca649294-37b3-58a6-b905-21498e809401", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--1936f227-2555-556b-92d4-7f48f4860626", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-13T06:07:08.394Z", "name": "North Korean actors steal $6.36B from Binance in largest crypto theft in history", "description": "Detected automatically from 35 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 13, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack", "description": "Binance TH pauses crypto transfers, says Thai funds safe after hack" }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/", "description": "North Korean actors steal $6.36B from Binance in largest crypto theft in history" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-10-30/1068375", "description": "金將軍又缺錢？ 幣安2千多億加密貨幣遭駭創歷來之最 北韓遭認是兇手" }, { "source_name": "Liberty Times", "url": "https://ec.ltn.com.tw/article/breakingnews/5624143", "description": "史上最大駭客攻擊！幣安遭竊逾2000億 美分析指向北韓" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000200315", "description": "N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000251315", "description": "(LEAD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261031000252315", "description": "(2nd LD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm" }, { "source_name": "Japan Today", "url": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4", "description": "Hackers steal $6.3 billion from Binance in record heist blamed on North Korea" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921226", "description": "N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261101000300315", "description": "FBI says N. Korea responsible for over US$6 bln crypto theft from Binance" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/", "description": "FBI blames North Korea for $6 billion Binance crypto hack" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history", "description": "FBI blames North Korea for stolen billions from Binance in biggest hack in history" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-01/1068564", "description": "幣安逾60億美元資產遭竊　FBI指北韓所為" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921526", "description": "FBI says N. Korea responsible for over $6b crypto theft from Binance" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261101de69102", "description": "暗号資産大手バイナンスへのサイバー攻撃 FBI“北朝鮮が関与”" }, { "source_name": "The Korea Herald", "url": "https://www.koreaherald.com/article/10921777", "description": "North Korean cyberterrorism gains renewed scrutiny after record Binance heist" }, { "source_name": "Yonhap", "url": "https://en.yna.co.kr/view/AEN20261101000351315", "description": "(LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance", "description": "FBI says North Korea behind US$6bil crypto theft from Binance" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975", "description": "N Korea behind US$6bn crypto theft, FBI says" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-02/1068750", "description": "20分鐘盜逾60億美元加密貨幣! 北韓駭客疑感情詐騙滲透幣安工程師 川普這樣說...." }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/", "description": "FBI confirms North Korea behind record $6.36B Binance crypto heist" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/", "description": "Binance outflows hit $4.7 billion after record North Korea hack" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html", "description": "FBI identifies North Korean hackers as responsible for unprecedented Binance breach" }, { "source_name": "NK News", "url": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/", "description": "Kim Yo Jong denies North Korean involvement in $6B Binance crypto theft" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311", "description": "North Korea slams FBI allegations over Binance hack as 'grave' provocation" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/", "description": "North Korea calls U.S. claims it was behind Binance hack ‘a grave political provocation’" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation", "description": "N. Korea slams FBI allegations over Binance hack as ‘grave’ provocation" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation", "description": "Sister of North Korea’s Kim slams FBI’s Binance hack allegations as ‘grave’ provocation" }, { "source_name": "VN Express", "url": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html", "description": "Triều Tiên đáp trả cáo buộc 'tấn công mạng Binance' từ FBI" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261103de69881", "description": "世界的な暗号資産取引所へのサイバー攻撃　北朝鮮が関与否定" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 5, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2dc31aa3-0df9-5ff5-8935-df97ac69a0c9", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a", "created": "2026-11-09T04:30:05.217Z", "modified": "2026-11-09T04:30:05.217Z", "name": "TraderTraitor", "aliases": [ "Jade Sleet", "Pukchong", "UNC4899" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/tradertraitor/" } ], "description": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--55952837-5ab0-5bcc-b705-b0d57744ac9d", "created": "2026-11-10T16:32:08.478Z", "modified": "2026-11-10T16:32:08.478Z", "relationship_type": "related-to", "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626", "target_ref": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--da4486a6-8e50-55a2-ac09-6542436a1c4e", "created": "2026-11-10T16:32:08.501Z", "modified": "2026-11-13T06:07:08.410Z", "name": "Foreign Ministry hit by hacking, along with ANA, Muji brand operator", "description": "Detected automatically from 4 articles in 3 outlets (Japan Today, NHK, New Talk), Oct 30 to Nov 12, 2026. Type: data breach; sectors: government, media. Asia-Pacific countries affected: Japan. Largest figure in the headlines: 1,090,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/foreign-ministry-hit-by-hacking-along-with-ana-muji-brand-operator-20261030/" }, { "source_name": "Japan Today", "url": "https://japantoday.com/category/crime/update3-japan-foreign-ministry-hit-by-hacking-along-with-ana-muji-brand-operator", "description": "Foreign Ministry hit by hacking, along with ANA, Muji brand operator" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-04/1069337", "description": "日本無印良品爆個資外洩 109萬筆信用卡資料恐遭存取" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261112de74562", "description": "無印良品 展開の良品計画 不正アクセスを受けた会見で陳謝" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-11-12/1070830", "description": "日無印良品爆個資外洩! 逾百萬會員資料流出 社長致歉 : 全額補償損失" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government", "Media" ], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Japan", "country": "JP" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fc4020b6-2b21-5da5-8bad-468eaa960904", "created": "2026-11-10T16:32:08.501Z", "modified": "2026-11-10T16:32:08.501Z", "relationship_type": "related-to", "source_ref": "incident--da4486a6-8e50-55a2-ac09-6542436a1c4e", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a967416f-84ac-5091-9236-eec7739030c4", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-13T06:07:08.404Z", "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack", "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack", "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516", "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus", "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151", "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969157", "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต" }, { "source_name": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach", "description": "THAI passenger data compromised in Amadeus security breach" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe", "description": "Thai Airways confirms passenger data leak but credit card details safe" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969937", "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Transportation", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Malaysia", "country": "MY" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--1f6565c0-fcd5-5391-865f-7393e5c00f07", "created": "2026-11-11T20:35:29.573Z", "modified": "2026-11-12T00:02:26.992Z", "name": "Puma Shen's vehicle campaign system hacked; National Security Bureau mobilizes to investigate CCP election interference", "description": "Detected automatically from 1 article in 1 outlet (New Talk), Oct 29, 2026. Title machine-translated from Chinese. Type: espionage campaign; sectors: government. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/puma-shens-vehicle-campaign-system-hacked-national-security-bureau-mob-20261029/" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-10-29/1068075", "description": "沈伯洋車掃系統遭網駭 國安局動起來是否查中共介選" } ], "x_securitystudies_occurred_on": "2026-10-29", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government" ], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--9ab54f53-548b-590a-b93b-0064a006f43b", "created": "2026-11-10T16:32:08.384Z", "modified": "2026-11-11T20:40:49.647Z", "name": "First-time voter lottery target Yakira hit by cyberattack; Chiang office and KMT councilors show support: Do not create a chilling effect", "description": "Detected automatically from 1 article in 1 outlet (New Talk), Oct 27, 2026. Title machine-translated from Chinese. Type: espionage campaign; sectors: government. Asia-Pacific countries affected: Taiwan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/yakira-20261027/" }, { "source_name": "New Talk", "url": "https://newtalk.tw/news/view/2026-10-27/1067745", "description": "代抽首投族Yakira遭網攻　蔣辦、藍議員聲援：別造成寒蟬效應" } ], "x_securitystudies_occurred_on": "2026-10-27", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Government" ], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--3ec711cf-4ce3-54be-a9a2-2f2abd5481c8", "created": "2026-11-10T16:32:08.384Z", "modified": "2026-11-10T16:32:08.384Z", "relationship_type": "related-to", "source_ref": "incident--9ab54f53-548b-590a-b93b-0064a006f43b", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-11T20:40:49.496Z", "name": "Unauthorized access: 'Possibility that the stage has shifted to targeting financial institutions'", "description": "Detected automatically from 1 article in 1 outlet (NHK), Oct 21, 2026. Title machine-translated from Japanese. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/incident-20261021/" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261021de62921", "description": "不正アクセス“金融機関が狙われる段階に変わってきた可能性”" } ], "x_securitystudies_occurred_on": "2026-10-21", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--15167757-32a5-5dae-ac45-cb8bfc38855a", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-10T16:32:08.267Z", "relationship_type": "related-to", "source_ref": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--770aa1eb-30f0-53d5-934d-f22af8129c4e", "created": "2026-11-10T16:32:08.166Z", "modified": "2026-11-11T20:40:49.354Z", "name": "Yamato Transport confirms 5.31 mil customer records leaked", "description": "Detected automatically from 2 articles in 2 outlets (Japan Today, NHK), Oct 16, 2026. Type: data breach; sectors: transportation. Asia-Pacific countries affected: Japan. Largest figure in the headlines: 5,300,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/yamato-transport-confirms-531-mil-customer-records-leaked-20261016/" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261016de60395", "description": "ヤマト運輸 個人情報530万件あまりが外部流出" }, { "source_name": "Japan Today", "url": "https://japantoday.com/category/business/update1-japan%27s-yamato-transport-confirms-5.31-mil.-customer-records-leaked", "description": "Yamato Transport confirms 5.31 mil customer records leaked" } ], "x_securitystudies_occurred_on": "2026-10-16", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Transportation" ], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--4a526097-2521-56f6-8f52-0698befdf9c1", "created": "2026-11-10T16:32:08.166Z", "modified": "2026-11-10T16:32:08.166Z", "relationship_type": "related-to", "source_ref": "incident--770aa1eb-30f0-53d5-934d-f22af8129c4e", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--fddc4a05-71b8-5e8d-bc3e-3b5324194c3b", "created": "2026-11-10T16:32:08.148Z", "modified": "2026-11-11T20:40:49.348Z", "name": "ARMORY CASTLE Exploits BeyondTrust", "description": "Detected automatically from 1 article in 1 outlet (Google Threat Intelligence), Oct 15, 2026. Type: exploitation. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "exploitation", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/armory-castle-exploits-beyondtrust-20261015/" }, { "source_name": "Google Threat Intelligence", "url": "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/", "description": "ARMORY CASTLE Exploits BeyondTrust" } ], "x_securitystudies_occurred_on": "2026-10-15", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [], "x_securitystudies_eu_relevance": "low" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--464ba24d-7ee9-5826-b099-2db35c9782bb", "created": "2026-11-10T16:32:08.148Z", "modified": "2026-11-10T16:32:08.148Z", "relationship_type": "related-to", "source_ref": "incident--fddc4a05-71b8-5e8d-bc3e-3b5324194c3b", "target_ref": "intrusion-set--7872b8fa-bf74-5285-b4a4-225f6a17a083", "description": "actor named in the coverage (the sources' attribution)" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--6b872d82-b152-568a-b9fb-3e0c6d0a225d", "created": "2026-11-13T05:15:33.953Z", "modified": "2026-11-13T05:15:33.953Z", "name": "CVE-2026-102764", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-102764" } ], "description": "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--f4d2620e-e2fa-5f49-92b8-5d0daf502231", "created": "2026-11-10T16:32:08.148Z", "modified": "2026-11-10T16:32:08.148Z", "relationship_type": "related-to", "source_ref": "incident--fddc4a05-71b8-5e8d-bc3e-3b5324194c3b", "target_ref": "vulnerability--6b872d82-b152-568a-b9fb-3e0c6d0a225d", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--e605301f-5b42-5124-823d-7f87abe644c0", "created": "2026-11-13T05:15:33.953Z", "modified": "2026-11-13T05:15:33.953Z", "name": "CVE-2023-46805", "external_references": [ { "source_name": "cve", "external_id": "CVE-2023-46805" } ], "description": "Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2d3ba56d-2205-5059-a316-558be65e76e4", "created": "2026-11-10T16:32:08.148Z", "modified": "2026-11-10T16:32:08.148Z", "relationship_type": "related-to", "source_ref": "incident--fddc4a05-71b8-5e8d-bc3e-3b5324194c3b", "target_ref": "vulnerability--e605301f-5b42-5124-823d-7f87abe644c0", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "vulnerability", "id": "vulnerability--eacf01b0-6294-574d-aded-655c2c972960", "created": "2026-11-13T05:15:33.953Z", "modified": "2026-11-13T05:15:33.953Z", "name": "CVE-2024-21887", "external_references": [ { "source_name": "cve", "external_id": "CVE-2024-21887" } ], "description": "Ivanti Connect Secure and Policy Secure Command Injection Vulnerability" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8defc091-73a1-5a08-b157-a0fb894179c7", "created": "2026-11-10T16:32:08.148Z", "modified": "2026-11-10T16:32:08.148Z", "relationship_type": "related-to", "source_ref": "incident--fddc4a05-71b8-5e8d-bc3e-3b5324194c3b", "target_ref": "vulnerability--eacf01b0-6294-574d-aded-655c2c972960", "description": "vulnerability exploited" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700", "created": "2026-11-10T16:32:08.071Z", "modified": "2026-11-10T16:40:20.464Z", "name": "Man loses over RM12mil in suspected crypto theft", "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Oct 10, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Malaysia. Largest figure in the headlines: 12,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/man-loses-over-rm12mil-in-suspected-crypto-theft-20261010/" }, { "source_name": "Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/nation/2026/10/10/man-loses-over-rm12mil-in-suspected-crypto-theft", "description": "Man loses over RM12mil in suspected crypto theft" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/10/10/man-loses-over-rm12m-in-suspected-crypto-theft/238570", "description": "Man loses over RM12m in suspected crypto theft" } ], "x_securitystudies_occurred_on": "2026-10-10", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--437f539d-d38e-565c-83bb-b7434db3be93", "created": "2026-11-10T16:32:08.071Z", "modified": "2026-11-10T16:32:08.071Z", "relationship_type": "related-to", "source_ref": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51", "created": "2026-11-10T16:32:08.013Z", "modified": "2026-11-10T16:40:20.414Z", "name": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says", "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, New York Times China, Taipei Times, The Japan Times), Oct 8, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: China. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/south-korea-bank-hack-suspect-may-be-26-year-old-in-china-us-firm-says-20261008/" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/10/08/south-korea-cyberattack-china-suspect/", "description": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-6441386", "description": "CrowdStrike says China-based suspect used AI tools in South Korean bank hacks" }, { "source_name": "New York Times China", "url": "https://www.nytimes.com/2026/10/08/world/australia/south-korea-bank-hack-china-us-ai.html", "description": "Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says" }, { "source_name": "Taipei Times", "url": "https://www.taipeitimes.com/News/front/archives/2026/10/09/2003865655", "description": "S Korean banks likely hacked by China-based actor: CrowdStrike" } ], "x_securitystudies_occurred_on": "2026-10-08", "x_securitystudies_severity": 5, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--231e90b4-4920-54e1-af65-e3447d240a54", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "China", "country": "CN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2c908ce6-1ad8-53ce-862f-6f73cc5830a9", "created": "2026-11-10T16:32:08.013Z", "modified": "2026-11-10T16:32:08.013Z", "relationship_type": "related-to", "source_ref": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51", "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb", "created": "2026-11-10T16:32:08.007Z", "modified": "2026-11-10T16:40:20.409Z", "name": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks", "description": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/" }, { "source_name": "Hankyoreh", "url": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html", "description": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks" } ], "x_securitystudies_occurred_on": "2026-10-07", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b735b72-62fa-5c94-980b-26bd9658327a", "created": "2026-11-10T16:32:08.007Z", "modified": "2026-11-10T16:32:08.007Z", "relationship_type": "related-to", "source_ref": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:40:20.195Z", "name": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget", "description": "Detected automatically from 4 articles in 3 outlets (Channel News Asia, NK Pro, Thanh Nien News), Sep 25 to Sep 30, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Vietnam, Singapore. Largest figure in the headlines: 352,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "crypto_theft", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-20260925/" }, { "source_name": "NK Pro", "url": "https://www.nknews.org/pro/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-bitget/", "description": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/business/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-in-hack-6410806", "description": "Crypto exchange Bitget pauses withdrawals after $350 million stolen in hack" }, { "source_name": "Thanh Nien News", "url": "https://thanhnien.vn/gia-bitcoin-hom-nay-2892026-tin-tac-tau-tan-xong-83-trieu-usd-trong-vu-hack-bitget-185260928081934906.htm", "description": "Giá Bitcoin hôm nay 28.9.2026: Tin tặc tẩu tán xong 83 triệu USD trong vụ hack Bitget" }, { "source_name": "Thanh Nien News", "url": "https://thanhnien.vn/ceo-bitget-khong-may-lac-quan-ve-kha-nang-thu-hoi-3875-trieu-usd-bi-hack-185260930112333106.htm", "description": "CEO Bitget: 'Không mấy lạc quan về khả năng thu hồi 387,5 triệu USD bị hack'" } ], "x_securitystudies_occurred_on": "2026-09-25", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Cryptocurrency" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--db02ef0f-ae60-50ba-8bc8-cf8199b3ccbb", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:32:07.760Z", "relationship_type": "related-to", "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Vietnam", "country": "VN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--03abcbf0-41cf-5c95-a2ec-d4428c33673c", "created": "2026-11-10T16:32:07.760Z", "modified": "2026-11-10T16:32:07.760Z", "relationship_type": "related-to", "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad", "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d", "description": "affected country" } ] }