Original: 說明本公司發生網路資安事件
U.R. (5321)CylindricalCanine Subgroup Exploits DigiCert Support Portal to Steal Code-Signing Certificates
The stolen certificates were used to sign Zhong Stealer malware, highlighting a critical gap in internal trust controls at certificate authorities. The incident underscores how legitimate support functions, when inadequately isolated, can be weaponized in supply chain attacks targeting software signing infrastructure.
What to Log (and What Not to Log) When Tracking Public-Source Cyber Signals
A Practical Workflow for What to log (and what not to log) when tracking public-source cyber signals — 18 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims.
Hong Kong finance and cloud security signals worth escalating
Use the official GovCERT.HK security alert feed to triage Hong Kong finance, cloud, identity, telecom, and critical-infrastructure signals. This checklist provides decision criteria, ownership guidance, escalation thresholds, and next actions for security teams monitoring regional risk.
AWS Security Digest June 2026: AI Agent Controls, Egress Protections, and CVEs in AWS Tools
AWS released its June 2026 security digest featuring new capabilities for securing multi-tenant AI agents, preventing data exfiltration, and addressing CVEs in AWS tools including Kiro IDE and Aurora PostgreSQL wrappers. The update includes guidance on resource-based policies for Bedrock AgentCore, egress controls using Network Firewall and Route 53 Resolver, and a maturity roadmap for operationalizing security. Key CVEs involve file write restrictions in Kiro IDE, privilege escalation in Aurora PostgreSQL, and OS command injection in AWS CDK.
ASEC Weekly Report Maps Ransomware Threats Across Japan Transportation, Food Supply Chains, and Saudi Chemical Sector
ASEC’s Week 3, July 2026 threat summary documents three geographically and sectorally distinct cyber incidents: an AiLock ransomware attack on Japan’s largest taxi and limousine operator, a cyberattack disrupting operations at Japan’s largest frozen food company with cascading supply chain effects, and a DragonForce ransomware incident targeting a Saudi Arabian chemical manufacturer. The report presents these as separate events without technical details or evidence of linkage, serving as a regional situational awareness signal from AhnLab’s South Korea-based telemetry.
Build a Weekly East Asia Supplier Exposure Brief from Nogosee Exports
A Practical Workflow for Build a weekly ‘East Asia supplier exposure’ brief from Nogosee exports — July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims.
GovCERT.HK Issues High-Threat Alert on Actively Exploited Microsoft Vulnerabilities
GovCERT.HK has issued a High Threat Security Alert (A26-07-21) warning of multiple actively exploited vulnerabilities in Microsoft products, including two elevation-of-privilege flaws (CVE-2026-56155 and CVE-2026-56164) being used in the wild, affecting Windows, Office, SharePoint, SQL Server, .NET, Visual Studio, and related systems.
Research Digest: Music Affect Mapping Shows Geographic Signal but No Population Inference Link
A study of 2,393 folk melodies from 16 countries finds measurable cross-country differences in musical structure, with China showing a distinct wide-leap, high-activity signature, but finds no significant correlation between musical affect and national happiness or individualism indices, rejecting ecological inference.
BreachForums Governance Crisis and Clone Forum Impersonation Reveal Dark Web Volatility in June 2026
In June 2026, BreachForums underwent leadership upheaval involving diencracked’s return, conflict with HasanBroker experienced leadership instability as former operator diencracked returned, clashed with HasanBroker, announced retirement, and signaled ownership transfer to user L, raising governance concerns. Simultaneously, clone forums attempted to sell BreachForums infrastructure for $3,000 in cryptocurrency while admitting to impersonating ShinyHunters and original staff. DarkForums and XSS forums showed domain instability, DaMaGeLiB went offline after lead operator gliderexpert disappeared, and new forums BlackForums and RAIDForums emerged, underscoring the dark web ecosystem’s resilience amid persistent volatility.
Ghost Traffic: ICMP Tunneling Enables Billing Bypass in LTE Networks Without Root
A research paper demonstrates how Android’s default ICMP socket access combined with ISP billing policies that exclude ICMP traffic enables end-to-end data tunneling via VpnService, bypassing data caps and QoS throttling in six of seven tested ISP environments across South Korea, Japan, and the U.S.