Taiwan Retailer Pauses Online Store as Cyberbiz Vendor Incident Is Assessed
The company says it has not been notified of similar access and is still assessing its exposure. Read more
Category: Incidents & Breaches
UK NCSC Warns AI-Driven Malware Will Likely Target Critical Infrastructure Ransomware
The UK National Cyber Security Centre assessed that attackers will very likely deploy AI-driven malware for ransomware attacks against UK critical infrastructure by 2028. AI will accelerate exploitation of known vulnerabilities in legacy systems and expand attack surface through newly deployed AI tools, making existing attacks more efficient rather than introducing entirely new methods. Read more
AhnLab Analyzes September 2026 APT Shifts Targeting Developer Ecosystems, Cloud Services
South Korean cybersecurity vendor AhnLab reported that advanced persistent threat groups in September 2026 shifted focus toward developer ecosystems, cloud credentials, supply chains, and network trust infrastructure. Attackers exploited legitimate software installers, GitHub, Microsoft 365, OneDrive, Nostr, routers, and TACACS authentication servers across multi-stage attack chains. Read more
CISA and International Partners Issue Joint Advisory on SafePay Ransomware Operations
The FBI, CISA, the USSS, and allied German and U.K. authorities released a joint cybersecurity advisory on SafePay ransomware. Active since August 2024, the group has impacted at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia using credential theft, edge-device exploits, living-off-the-land tools, and hybrid encryption. Read more
AhnLab Details Suo5 HTTP Tunneling and Pivoting Techniques Across IIS and Jenkins Systems
AhnLab ASEC published an analysis detailing how attackers exploit the Suo5 HTTP and HTTPS tunneling tool for network pivoting and lateral movement. The report documents real-world file deployment on Windows IIS web servers and fileless memory injection within Java-based Jenkins environments, outlining specific execution artifacts and defensive recommendations. Read more
AhnLab Analyzes New Rust-Based Infostealer and Dropper Disguised as Illegal Software
AhnLab identified a new Rust-based information theft malware disguised as illegal programs that first emerged in mid-August and spread widely in September. The malware steals browser, remote access, cloud, and credential data, features sophisticated anti-analysis techniques, and functions as a dropper for additional payloads. Read more
Taiwan Semiconductor and Manufacturing Supplier Cyber Risk Review
A Practical Workflow for Taiwan semiconductor and manufacturing supplier cyber risk review — 1 September 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
Critical Gitea RCE Actively Exploited in Cryptojacking Campaign
CISA warns of active exploitation of CVE-2026-60004 (CVSS 9.8) in Gitea, allowing repository write access to execute arbitrary commands via the diffpatch endpoint. Attackers leverage default open registration to gain access and deploy miner-like payloads, with U.S. federal agencies required to patch by August 28, 2026. Read more
GovCERT.HK Issues Alert on Veeam Backup & Replication Information Disclosure Flaw CVE-2026-58070
GovCERT.HK published Security Alert A26-08-44 on August 26, 2026, detailing an information disclosure vulnerability (CVE-2026-58070) in Veeam Backup & Replication version 13.0.2.29 and all earlier 13.x builds. The flaw, which could allow unauthorized data access if exploited, has been patched by Veeam via KB4902, with no evidence of active exploitation cited in the alert. The advisory underscores the risk posed by vulnerabilities in backup infrastructure, which may expose sensitive metadata and facilitate follow-on attacks even without direct system compromise. Read more
Use Taiwan MOPS Cyber Disclosures as an Incident Watchlist
A Practical Workflow for Use Taiwan MOPS cyber disclosures as an incident watchlist — 26 August 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more