Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
Taiwan’s TWCERT/CC published a critical vulnerability notice for an OS command injection flaw in Hgiga iSherlock appliances/software, including MailSherlock, SpamSherlock, and AuditSherlock. The issue (CVE-2026-6349, CVSS 9.8) could allow arbitrary OS command execution on the server under the conditions described in the advisory. Hgiga provides fixed package versions for both the 4.5 and 5.5 branches. Read more
Taiwan’s TWCERT/CC disclosed two high-severity vulnerabilities affecting ThreatSonar Anti-Ransomware versions earlier than 4.0.0: an arbitrary file deletion issue via path traversal (CVE-2026-5966) and a privilege escalation flaw enabling OS command injection executed as root (CVE-2026-5967). Both issues require authentication and specific operational access (web or shell). TWCERT/CC recommends installing the vendor patch identified as version 20260302. Read more
Taiwan’s national CERT (TWCERT/CC) reports an active social-engineering campaign that combines legitimate Microsoft 365 email accounts, near-typosquat domains, and short-term SSL certificates to bypass email and web defenses. The activity includes two waves: (1) broad phishing emails themed as “Microsoft account abnormal sign-in activity” and (2) targeted spear-phishing that repeatedly sends “Microsoft one-time code” lures to create urgency before delivering an “abnormal sign-in” message. A notable tactic described by TWCERT is URL-pattern-based gating: victims who match attacker-defined URL rules see a customized phishing page that harvests credentials, while non-matching visitors are redirected to a legitimate login page—reducing detection and increasing credibility. Read more
Taiwan’s TWCERT/CC issued an urgent alert citing SecurityScorecard’s STRIKE team research into “Operation WrtHug,” a sustained campaign targeting ASUS small office/home office routers worldwide. The activity is reported to abuse known, publicly disclosed OS command-injection vulnerabilities—including issues referenced alongside CVE-2023-39780—focused on the AiCloud service. TWCERT/CC says compromised routers may be backdoored and incorporated into a large global infected network used for follow-on cyber threat activity and espionage, with STRIKE reporting identification of more than 50,000 infected IP devices over the past six months. The advisory urges immediate firmware updates, replacement of end-of-life (EoL) models that cannot be patched, and consultation of ASUS product security advisories for official mitigation steps. Read more
Taiwan’s TWCERT/CC is urging organizations to urgently patch a high-severity Windows Server Update Services (WSUS) vulnerability, CVE-2025-59287 (CVSS 9.8), after U.S. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog and Dutch NCSC-NL also confirmed real-world exploitation. The flaw enables unauthenticated remote code execution as SYSTEM via a deserialization trigger, but only impacts Windows Server systems where the WSUS server role is enabled. TWCERT/CC also cited Huntress reporting attacker scanning for exposed WSUS ports 8530/8531 and delivering malicious requests, with post-exploitation activity potentially involving PowerShell-based payload execution and data discovery/exfiltration. Read more
Taiwan’s national CERT (TWCERT/CC) warns that attackers are increasingly using public blockchains as command-and-control (C2) infrastructure. The advisory highlights “EtherHide,” a technique first described by security researchers in October 2023, where adversaries store malicious commands or payload locations inside smart contracts. Malware (or malicious web scripts) can then query the chain for updated instructions, reducing the effectiveness of traditional controls like domain/IP blocking and traffic monitoring. TWCERT/CC also notes EtherHide is frequently chained with the “ClearFake” social-engineering pattern—fake system notifications or software update prompts—often delivered via compromised WordPress sites embedding malicious JavaScript. The combined flow uses Binance Smart Chain (BSC) smart contracts and read-only calls (e.g., eth_call) to retrieve attacker instructions without on-chain transaction fees, improving stealth and persistence. Read more
Taiwan’s national CERT (TWCERT/CC) held its 2025 Taiwan Cybersecurity Incident Notification & Response Annual Conference on Dec. 3 under the theme “Build Secure Products, Connect a Trusted Defense Line.” Government leaders from the Ministry of Digital Affairs and the Administration for Cyber Security emphasized that product security is now tied to brand trust and global market access, citing AI, IoT, and smart manufacturing expansion—and noting that international rules increasingly treat product security as a supply-chain governance requirement. The event brought together major Taiwan and regional vendors and institutes (including ASUS, Zyxel, Delta Electronics, Synology, Panasonic Taiwan, Institute for Information Industry, and others) to share practices around AI-driven threats, vulnerability disclosure, and PSIRT governance—signals relevant to global security and infrastructure teams that rely on Taiwan-linked hardware, NAS, networking, and industrial components. Read more
Taiwan’s TWCERT/CC warns that a high-risk MongoDB Server vulnerability, CVE-2025-14847 (CVSS v4: 8.7), is under active exploitation and can leak sensitive data from server memory. The issue—dubbed “MongoBleed” by researchers—stems from incorrect handling of the reported length of zlib-decompressed messages, which can cause uninitialized heap memory residues to be included in responses. TWCERT/CC notes that more than 87,000 internet-exposed MongoDB servers could be at risk, and that CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2025-12-29, signaling elevated urgency for enterprises and government agencies. Read more
OpenSSF’s review of CVE-2024-3094 describes an intentionally inserted, obfuscated backdoor affecting xz/liblzma 5.6.0 and 5.6.1. The tampering was designed to land in specific Linux distribution build outputs—DEB/RPM packages for x86-64 built with gcc and the GNU linker—rather than appearing uniformly across all builds. Red Hat warned the issue could allow remote compromise via sshd authentication bypass, but OpenSSF notes exposure was limited because the impacted versions were largely confined to experimental or pre-release distro channels and were detected quickly through community oversight and coordinated distro response. Read more
Taiwan’s TWCERT/CC reports a technical evolution in the “Contagious Interview” campaign: instead of relying on victims to manually execute a file, attackers embed a malicious VS Code workspace configuration so code runs automatically when developers open a project folder in Trusted Mode. The technique abuses VS Code’s tasks.json automation (including a run-on-folder-open behavior) and social engineering around Workspace Trust prompts. The activity primarily targets cryptocurrency software engineers and freelancers via recruiting outreach on LinkedIn and gig platforms, then directs them to download test projects from GitHub/GitLab. TWCERT/CC says the resulting payload has been identified as a newer BeaverTail variant (Type 701), with noted functional overlap with OtterCookie (sometimes referred to as “OtterCandy”), and is focused on stealing crypto-related browser extension and wallet data as well as high-value browser-stored secrets. Read more