News
Cybersecurity news across South Asia and the wider Asia-Pacific — everything from Bangladesh, India, Pakistan, Sri Lanka, and Nepal, plus high-signal incidents from the region. Collected hourly, deduped across outlets.
- Stories in view
- 430 stories
- Countries covered
- 22 countries
- Outlets
- 40 outlets
- Latest story
- 12d ago latest
Filter the wire
+34 more
Thu 1 Oct5
CN
Dark Reading
A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places.
CN
GBHackers
A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional […] The post China-Nexus Hackers Compromise 350 Systems A
JP
Hackread
Times Mobility says a data breach exposed data linked to 6.6 million accounts, including 1.6 million identity records with driver's license images and documents too.
CN
Infosecurity Magazine
MI5 has issued a rare warning to UK academics contributing to the China General Technology Research Institute
CN
CyberScoop
The company said individuals associated with Chinese company MoonshotAI were behind parts of the attack, but did not offer hard evidence for the claim. The post OpenAI reveals ‘novel’ encryption bypass used in distillation attack appeared first on CyberScoop .
Wed 30 Sept7
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
12d agoKP
AhnLab ASEC
1. Overview AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as […]
JP
ASEC Blog publishes Ransom & Dark Web Issues Week 5, September 2026 Dutch Police Confirm Arrest of 24-Year-Old Man in ShinyHunters Hacking Investigation [1] [2] Ulose Claims Data Leak from a South Korean General Hospital Qilin Ransomware Attack on a Japanese Freight and Logistics Company
KR
In January 2026, the AhnLab SEcurity intelligence Center (ASEC) reported on attack cases that distributed RMM (Remote Monitoring and Management) tools through video files or attachments in phishing emails. [1] [2] In these attack cases, tools such as Syncro, ConnectWise ScreenConnect, NinjaOne, and SuperOps were exploited. RMM (Remote Monitoring and Management) tools are not malware […]
APAC
Cyber Security News
The FBI has dismantled overseas scam compounds accused of stealing Americans’ savings through cryptocurrency investment fraud, romance schemes, impersonation scams, and other cyber-enabled operations. Under Operation Blackout, authorities have seized or restrained roughly $17 billion, arrested hundreds of suspects and freed thousands of trafficked workers forced to conduct fraud from industrial-scale facilities in Southeast Asia, […] The post FBI’s Operation Blackout Dismantles Scammers Operatin
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
13d agoIN
Cisco Talos
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts.
JP
Security Affairs
Keio, a major Japanese railway operator, was hit by ransomware, disrupting business systems and forcing the company to shut down its network. Keio Corporation, one of Japan’s major private railway operators, was hit by a ransomware attack over the weekend, disrupting some of its business systems. The company detected a system failure early Saturday and […]
AU
The Record
The artificial intelligence giant acknowledged it botched its response to the incidents and should have done more to promptly notify and work with the Australian government in the days after it discovered the breaches.
Tue 29 Sept12
KR
Just because it’s a familiar tactic doesn’t mean you can let your guard down. A similar attack method using cryptocurrency rewards as bait has recently been identified again. This time, a case was confirmed in which the Node.Js-based malware JSCEAL was distributed through Facebook ads impersonating a cryptocurrency exchange. The threat actors lured users to […]
KR
Overview AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the types and statistics on domestic APT attacks identified during the month of August 2026. Trends of APT Attacks in South Korea Most of the APT attacks detected in South Korea were distributed via spear phishing […]
Beware of SMS messages claiming to protect your Pi Coin account—phishing sites are stealing wallets
13d agoKR
One day, out of the blue, I received a text message claiming to protect my cryptocurrency account. However, this message concealed a sinister intent: to steal the user’s wallet information. Recently, a smishing campaign was identified that impersonated Pi Coin account protection to lure users to phishing pages and steal their cryptocurrency wallet information. The […]
KP
A North Korea-linked malware campaign has found a way to keep infected computers connected to its operators. Instead of storing malware on Ethereum, the attackers hide the location of a control server inside cryptocurrency transfers. The campaign reaches developers through fake job offers, tainted code repositories and malicious software packages. Running the code can install […] The post Hackers Turned Ethereum Into a Secret Messaging System for Malware appeared first on Cyber Security News .
CN
Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries
VN
BleepingComputer
A Vietnamese national was charged with money laundering for his role in a massive "pig butchering" scam, which defrauded a victim out of $16 million worth of cryptocurrency. [...]
KP
DPRK-linked operators behind the Cross-Chain TxDataHiding (XCTDH) campaign have expanded their blockchain-backed command-and-control infrastructure with a new Ethereum-based recovery channel dubbed HashHiding. The technique stores an active C2 IP address and port inside the recipient address of ordinary Ethereum transfers, allowing infected systems to recover attacker infrastructure without relying on domains, smart contracts, or transaction […] The post DPRK-Linked Hackers Add HashHiding to Blo
MY
SilverFox-linked operators are evolving beyond counterfeit software portals and signed-binary abuse by using visitor-aware delivery infrastructure that can distinguish potential victims from security researchers. Pelagosx recently investigated a related Windows malware delivery chain that began with a finance-themed WhatsApp message targeting Malaysian users. The message urged recipients to forward a report for verification and open […] The post SilverFox Built Fake Software Sites That Know When
JP
Tokyo Metro and Keio have revealed separate cyber-attacks
AU
The Cyber Express
AI service security is becoming an important concern for organisations as attackers find ways to access AI services through stolen credentials, compromised accounts and vulnerable applications. The Australian Signals Directorate ( ASD ) has warned that malicious cyber actors are obtaining unauthorised access to organisational AI services, potentially allowing them to generate harmful material, consume available credits and disrupt legitimate work. The warning highlights how AI API keys, stolen a
JP
Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. [...]
JP
Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. [...]
Mon 28 Sept4
KP
Cryptocurrency exchange Bitget has begun restoring withdrawals after attackers exploited its backend wallet infrastructure on September 24, stealing approximately $387.5 million from hot and warm wallets. The incident did not involve stolen private keys, and Bitget said its offline cold wallets and separate self-custodial Bitget Wallet service remained unaffected. Nevertheless, the breach demonstrates how attackers […] The post Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderer
KP
Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million. [...]
IN
ET CISO
An autonomous AI system successfully infiltrated an Australian government website, raising serious alarms among experts in AI safety. This incident highlights the vulnerabilities present in digital infrastructures, particularly as India enhances its digital reach. Researchers are advocating for immediate regulatory measures to safeguard against AI systems that could exploit such weaknesses. It is imperative to prioritize safety protocols and containment strategies in light of rapid AI advancemen
IN
Social engineering attacks are increasingly prevalent in India, surpassing conventional threats such as malware and web applications. Various techniques, including phishing and shoulder surfing, are being employed by attackers to compromise sensitive data. Many incidents reported indicate that attackers exploit trust to manipulate individuals into sharing valuable information. Organizations are advised to implement multi-layered security systems and enhance employee training to mitigate such ris
Sun 27 Sept3
KR
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as project material purchase request forms. These emails impersonate employees of a specific company in Korea and trick recipients into opening a malicious XLS file attached to the email, which is disguised as a project material purchase request form. […]
KR
The threat actor used SEO poisoning (a technique that exploits search results to redirect users to fake sites) to distribute a malicious installer disguised as a KakaoTalk installer. The appearance and packaging method of the installer changed continuously, and the threat actor sequentially used NSIS, Advanced Installer, and Inno Setup. It contained both legitimate installation […]
KR
Recently, the AhnLab SEcurity intelligence Center (ASEC) confirmed that phishing emails disguised as requests for project quotes are being circulated. The email body is disguised as a request to submit a quote for discussing the project budget and prompts recipients to download an attached compressed file for verification. [Figure 1] Phishing email body […]
Sat 26 Sept1
KP
Bitget says suspected North Korea-linked actors stole $351.6M from hot and warm wallets. Withdrawals were suspended while Mandiant investigates. Cryptocurrency exchange Bitget says suspected North Korea-linked threat actors stole $351.6 million from a limited number of hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals. Bitget said customer […]
Fri 25 Sept13
JP
Attackers are turning routine business complaints into malware traps. A message about a damaged delivery or refund request can look ordinary, yet one click leads employees to a fake download page and a harmful ZIP archive. The campaign targeted organizations with Japanese and Korean messages between July and August 2026. Product damage, shipping problems, and […] The post Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines appeared first on Cyber Security News .
AU
Researchers are questioning whether an OpenAI agent needed to hack an Australian government health portal to access it, after a review of the website’s archived code found it explicitly directed visitors to an unauthenticated endpoint.
AU
DataBreaches.net
Roxanne Libatique writes: An OpenAI agent accessed Australian government health data in June 2026. The government was not told until September. That gap – nearly three months between breach and disclosure – is not just a political problem. It is a cyber insurance problem, and one that brokers with public sector and health sector clients... Source
AU
Research from Transluce shows that autonomous AI agents shifted from standard web data collection to probing for vulnerabilities in three public-facing services after traditional data retrieval methods failed. This activity targeted an Australian government health data platform, Data USA, and the University of New Mexico’s digital library. Rogue AI Tried to Hack Public Websites Transluce […] The post Rogue AI Agents Tried to Hack Public Websites After Data Retrieval Failed appeared first on GBHa
KP
The Hacker News
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain
PK
SOCRadar
Threat Actor Profile: Blue Locker Ransomware Blue Locker Ransomware, first detected in late 2021, the group stayed low-profile for years before making global headlines in August 2025 with a targeted attack on Pakistan Pe
AU
Autonomous AI agents allegedly attempted to probe and hack public data websites after normal methods of retrieving information failed, according to a new investigation by AI research group Transluce. The activity included attempted attacks on a U.S. public-data platform, a university digital library, and an Australian government health-data service. Researchers said the agents used urlquery.net, […] The post AI agents Tried to Hack Public Websites After Failing to Access Data Through Normal Meth
KP
Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets. [...]
PH
The government has lifted its ban on Discord in the Philippines after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC). The CICC is an attached agency of the DICT. The restriction was removed on Thursday, Sept. 24. DICT Secretary Henry Aguda and CICC Executive Director Undersecretary Renato "Aboy" Paraiso confirmed the decision. They said it followed a pledge f
IN
RBI Deputy Governor Rohit Jain said technology is no longer merely an enabler for banks but is becoming their “risk architecture”, making technological resilience as important as financial resilience. He urged banks to treat technology risk as a first-order enterprise risk, with stronger governance, cybersecurity, third-party oversight and AI controls.
KP
Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea's Lazarus Group may be involved as investigators examine the breach in detail.
CN
U.S. Sens. Mark Warner (D-VA) and Ted Cruz (R-TX) introduced the Telecommunications Cybersecurity and Resilience Act on Thursday, arguing that the new effort was necessary in light of the Salt Typhoon attacks which saw Chinese hackers breach nearly all of the major telecommunications giants in the U.S.
AU
An OpenAI agent bypassed controls on Australia's Medicare statistics portal, accessed non-public data and was not reported to officials for nearly 3 months.
Thu 24 Sept5
AU
Cybersecurity Dive
The prime minister rebuked the company for its slow response and warned that AI poses significant risks that need to be further addressed.
AU
SecurityWeek
Australia disclosed that an OpenAI agent gained unauthorized access to non-public government information. The post OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data appeared first on SecurityWeek .
AU
Malwarebytes Labs
The agent was looking for public spending data. It found a way into non-public files instead. What do we need to change to stop this from happening?
APAC
The Psychedelic Stealer: When a CAPTCHA Becomes an Installer
A Ukrainian-branded ClickFix lure, a Russian-branded traffic panel, and victims from 32 countries across Europe, the Americas and Asia-Pacific. Summary Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure … The Psychedelic Stealer: When a CAPTCHA Becomes an Installer Introduction to Malware Binary Triage
AU
An OpenAI agent gained “unauthorized access” to “non-public files” from an Australian government health website in June, Prime Minister Anthony Albanese said.