Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
Russian state-supported cyber actors (LAUNDRY BEAR) have exploited a zero-day XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite since July 2025 to exfiltrate 90 days of email, GAL, and authentication data via a view-only phishing technique, requiring only that victims open a malicious email in a vulnerable web client. Read more
AhnLab's June 2026 report shows phishing as the top initial attack vector against financial institutions globally, followed by droppers/downloaders and infostealers, with HTML-based smuggling and script-based execution prevalent. Dark web markets actively traded financial data from Canada Life, Robinhood, Prudential, Robinhood, and AYA Bank, while ransomware groups like Lapsus$ and MORPHEUS claimed large-scale data theft. Read more
In June 2026, ASEC documented a multi-stage threat campaign targeting the Korean financial sector, where phishing via HTML attachments initiated attacks, droppers/downloaders delivered secondary payloads, and infostealers exfiltrated data via Telegram, representing 5% of observed leaks, while dark web markets traded stolen data from global financial entities including Robinhood, Prudential, and AYA Bank, alongside access credentials and KYC documents. Read more
The stolen certificates were used to sign Zhong Stealer malware, highlighting a critical gap in internal trust controls at certificate authorities. The incident underscores how legitimate support functions, when inadequately isolated, can be weaponized in supply chain attacks targeting software signing infrastructure. Read more
ASEC's Week 3, July 2026 threat summary documents three geographically and sectorally distinct cyber incidents: an AiLock ransomware attack on Japan's largest taxi and limousine operator, a cyberattack disrupting operations at Japan's largest frozen food company with cascading supply chain effects, and a DragonForce ransomware incident targeting a Saudi Arabian chemical manufacturer. The report presents these as separate events without technical details or evidence of linkage, serving as a regional situational awareness signal from AhnLab's South Korea-based telemetry. Read more
A study of 2,393 folk melodies from 16 countries finds measurable cross-country differences in musical structure, with China showing a distinct wide-leap, high-activity signature, but finds no significant correlation between musical affect and national happiness or individualism indices, rejecting ecological inference. Read more
In June 2026, BreachForums underwent leadership upheaval involving diencracked's return, conflict with HasanBroker experienced leadership instability as former operator diencracked returned, clashed with HasanBroker, announced retirement, and signaled ownership transfer to user L, raising governance concerns. Simultaneously, clone forums attempted to sell BreachForums infrastructure for $3,000 in cryptocurrency while admitting to impersonating ShinyHunters and original staff. DarkForums and XSS forums showed domain instability, DaMaGeLiB went offline after lead operator gliderexpert disappeared, and new forums BlackForums and RAIDForums emerged, underscoring the dark web ecosystem's resilience amid persistent volatility. Read more
A research paper demonstrates how Android's default ICMP socket access combined with ISP billing policies that exclude ICMP traffic enables end-to-end data tunneling via VpnService, bypassing data caps and QoS throttling in six of seven tested ISP environments across South Korea, Japan, and the U.S. Read more
GovCERT.HK has issued a High Threat Security Alert (A26-06-45) for two elevation-of-privilege vulnerabilities in the Linux kernel—DirtyClone (CVE-2026-43503) and pedit COW (CVE-2026-46331)—with public PoC exploits available, allowing local unprivileged users to gain root access on affected systems. Read more
Attackers are actively exploiting CVE-2026-46817, a critical unauthenticated remote code execution flaw in Oracle E-Business Suite's Payments module, with Defused observing real-world exploitation over the weekend and Shadowserver tracking over 450 exposed instances globally. Oracle patched the vulnerability in its May 2026 CPU but warns unpatched systems remain at risk. Read more