News
Cybersecurity news across South Asia and the wider Asia-Pacific — everything from Bangladesh, India, Pakistan, Sri Lanka, and Nepal, plus high-signal incidents from the region. Collected hourly, deduped across outlets.
- Stories in view
- 430 stories
- Countries covered
- 22 countries
- Outlets
- 40 outlets
- Latest story
- 19d ago latest
Filter the wire
+34 more
Thu 24 Sept5
AU
BleepingComputer
OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project. [...]
KP
GBHackers
North Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war. The activity appears designed to […] The post Operation Conflict Compass Deploys VelvetCake PowerShell Malware Thr
AU
Cyber Security News
An autonomous OpenAI agent breached an Australian government Medicare statistics portal after a research task escalated into unauthorized system access, marking a reported world-first rogue AI intrusion into a government service. Prime Minister Anthony Albanese said the incident occurred on June 18, 2026, and raised Australia’s “extreme concern” with OpenAI CEO Sam Altman. The agent […] The post OpenAI Agent Hacked Australian Government Medicare Portal in World’s First Rogue AI Breach appeared f
AU
The Cyber Express
Australian Prime Minister Anthony Albanese has demanded answers from OpenAI chief executive Sam Altman after an AI agent broke into an Australian government website. The OpenAI hack took place in June, but the Australian government only learned of it recently, a delay the Prime Minister has openly criticized. Speaking from New York on Thursday (AEST), Albanese said the OpenAI agent "infiltrated" the Medicare Statistics Reporting Service portal, which is administered by Services Australia. The ag
AU
ET CISO
In June, an autonomous program from OpenAI accessed restricted files on an Australian government health website. Prime Minister Anthony Albanese expressed serious concerns over the breach and timing of notification. OpenAI took several months to inform the government, which Albanese found unacceptable. Investigations are ongoing, but there is currently no evidence of broader compromises to government services. OpenAI has acknowledged the incident and committed to improving security protocols.
Wed 23 Sept5
CN
HuWang—“Protect the Network”: Inside China’s Largest Nationwide Live-Fire Cyber Exercise
Every year, tens of thousands of Chinese organizations spend weeks bracing for an attack that could come at any hour, from any direction, with no advance warning of when or how – standing watch around the clock to defend their networks. The exercise is known as HuWang Operation (护网行动, hù wǎng , literally “protect the network”), or simply HW. Organized by the Ministry of Public Security (MPS), HW has evolved from a limited pilot covering “some important industries” into an annual nationwide stres
CN
Chinese startup Z.ai faced backlash after its AI coding assistant uploaded user data to cloud servers. Despite initial deletions claims, users remained concerned over data encryption and security. The company acknowledged a vulnerability related to its Codebase Indexing feature that was enabled by default. An independent security assessment confirmed that the uploaded code data had indeed been deleted. Z.
AU
BankInfoSecurity
Sydney Startup Brings Specialized Expertise in Australian Government Compliance A-Lign acquired Sydney-based AssurePoint to enter Australia's IRAP compliance market, targeting roughly 6,000 companies seeking government business before expanding into offering them products and services for SOC 2 compliance, ISO standards and penetration testing.
CN
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]
CN
CyberScoop
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups. The post Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects appeared first on CyberScoop .
Tue 22 Sept10
KR
AhnLab ASEC
Purpose and Scope This report summarizes statistics on new ransomware samples, affected systems, and statistics on targeted businesses collected during the month of August 2026, as well as major Korean & Global ransomware issues. Statistics on targeted businesses were compiled based on the time when publicly available information from ransomware groups’ DLS (Dedicated Leak Sites, […]
JP
ASEC Blog publishes Ransom & Dark Web Issues Week 4, September 2026 Metaencryptor Ransomware Attack on a South Korean Camera Module and Equipment Manufacturer Metaencryptor Ransomware Attack on a Japanese Automotive Parts Manufacturer ShinyHunters Claims Breach of a U.S. Federal Law Enforcement Agency and Theft of Sensitive Data
KP
Infosecurity Magazine
WaterPlum compromised 30,000 devices and took funds or credentials from 7000 crypto wallets
CN
SecurityWeek
A Chinese threat actor has exploited the bug to exfiltrate sensitive information from nearly 1,000 ZyXEL switches. The post Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers appeared first on SecurityWeek .
KP
SOCRadar
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-ne
CN
A suspected Chinese-speaking threat actor has used WordPress vulnerabilities to break into at least 49 organizations across 29 countries. The campaign exposed how a compromised website can become a launchpad for database theft, credential abuse, and wider network intrusion. The attackers exploited the wp2shell chain, tracked as CVE-2026-63030 and CVE-2026-60137, against vulnerable WordPress installations. After […] The post Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and P
CN
A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome. It followed Volexity’s September 9 disclosure that UTA0560 and […] The post Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits appeared first on GBHack
IN
The Department of Telecommunications (DoT) Madhya Pradesh, India LSA has cautioned citizens against fraudulent SIM cards, misuse of telecom identifiers and tampering with IMEI numbers, warning that such violations can carry serious legal consequences under India’s Telecommunications Act, 2023. The advisory follows recent cybercrime investigations that uncovered instances of unauthorized SIM activation. In one case, a Point of Sale (PoS) agent in Chhattisgarh was found to have illegally activated
JP
Security Affairs
North Korea-linked WaterPlum runs the Contagious Interview campaign, infecting over 30,000 devices using a fake job interview. On September 18, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview. […]
JP
Check Point Research
For the latest discoveries in cyber research for the week of 21st Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance. Approximately 246,000 records were exposed, […] The post 21st September – Threat Intelligence Report appeared first on Check Point Research .
Mon 21 Sept12
KP
The Hacker News
The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,
CN
Cybersecurity Dive
Researchers suspect the hacker employed LLMs to develop custom tools.
KR
Content This report summarizes the distribution channels, number of Infostealers, number of detections, and companies disguised as targets by new Infostealers collected during the month of August 2026. It is based on data from AhnLab SEcurity intelligence Center (ASEC), AhnLab product diagnostic logs, automated data collection systems, email honeypot systems, and automated C2 analysis systems. […]
CN
Hackread
FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools.
KP
It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea. The post Rust Team Members and Popular Crate Owners Targeted via Video Calls appeared first on SecurityWeek .
AU
A BYD Shark 6 was remotely hacked, exposing vehicle controls, location tracking and cabin audio, raising serious connected-car security concerns. A journalist drove a BYD Shark 6 down a country road outside Canberra while a hacker sitting on the shoulder killed the headlights with a keystroke. That’s not a hypothetical. It’s what happened during a […]
IN
North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors. SentinelOne identified an Indian IT services provider compromised with the same FLATROOF and ROOFDECK implants previously linked to the April 2026 KelpDAO-LayerZero attack. The campaign […] The post Hackers Weaponize Terraform Lock Files to Infect
SG
An overseas business unit of Boustead Singapore Limited was recently targeted by a cybersecurity incident, according to a filing made by the company on the Singapore Exchange. The Boustead Singapore cyberattack was disclosed in a company announcement dated 18 September 2026, with the Board of Directors confirming that the breach was confined to a single overseas unit and did not spread to other parts of the group. According to the filing , the affected business unit moved quickly once it became
North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
22d agoKP
North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews. The campaign, also known as Contagious Interview, reached at least 30,000 computers in more than 100 countries between December 2025 and July 2026. The attackers […] The post North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto appeared first on
JP
A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries. The group has been stealing cryptocurrency from IT professionals worldwide. A joint advisory was issued on September 18, 2026, by Japan's National Police Agency and National Cybersecurity Office, the US FBI and Department of Defense Cyber Crime Center, Australia's Signals Directorate, and Germany's Federal Intelligence Service and F
IN
The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple
IN
CYFIRMA
Strategic Insights into Sustained Ransomware Pressure, OT/ICS Vulnerabilities, and Supply Chain Cyber
Sun 20 Sept1
KP
CloudSEK
CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions. Authors : Vikas Kundu
Sat 19 Sept4
KP
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. [...]
SG
DataBreaches.net
The mistaken cc: breach still happens. Ann Neo reports: An invitation to an event sent by the National Cancer Centre Singapore (NCCS) has sparked privacy concerns after a mailing list exposed the identities, contact details and, in some instances, workplaces of individuals with a genetic cancer condition. The e-mail, an invitation to a Living with... Source
North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto
24d agoKP
North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews. This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals. The attackers use persuasive recruitment messages that mimic legitimate […] The post North Korean WaterPlum Hackers Target IT Professionals With
CN
ESET Says FamousSparrow Shifted Nearly All Targeting to Latin America A Chinese espionage group has deployed a previously undocumented backdoor against government entities in eight Latin American countries and territories, including Puerto Rico, in a campaign researchers say tracks with U.S. pressure on Chinese investments across the region.
Fri 18 Sept13
JP
A Gyazo breach exposed 23 million user records after attackers exploited a vulnerability in Helpfeel’s image upload server. Japanese software company Helpfeel is notifying Gyazo users about a data breach that compromised 23 million user records. Attackers gained unauthorized access by exploiting a vulnerability in the service’s image upload server. “We have confirmed that approximately […]
KP
SentinelLabs
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
PK
Team Cymru
Explore new findings on SideCopy’s use of AllaKore RAT, revealing connected C2 infrastructure and management activity linked to Pakistan-based threat actors.
APAC
This is the first article of a two-part series on Transparent Tribe’s CrimsonRAT infrastructure. We have been tracking CrimsonRAT , Transparent Tribe’s most ubiquitous remote access tool, over a number of months.
JP
Explore the high-level trends of recent campaigns targeting Japan in MoqHao Part 1.5. Discover how technology companies are leveraging this valuable market.
IN
Transparent Tribe (APT36, Mythic Leopard, ProjectM, Operation C-Major) is the name given to a threat actor group largely targeting Indian entities and assets.
KP
The Register
WaterPlum recruiters used bogus coding tests to backdoor jobseekers and raid more than 7,000 crypto wallets
JP
The U.S., Japan, Germany and Australia said WaterPlum operators pose as prospective employers and have infected more than 30,000 devices worldwide. The post International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data appeared first on CyberScoop .
IN
The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation
CN
China-aligned threat actors are using low-quality Chinese-language casino and adult websites to conceal PeckBirdy command-and-control infrastructure, creating a detection challenge for enterprises that routinely deprioritize gambling-related domains. Infoblox telemetry found that just over 3% of enterprise customers resolved at least one PeckBirdy-related C2 domain, indicating that the infrastructure is appearing well beyond the campaign’s apparent […] The post PeckBirdy C2 Traffic Seen Across E
CN
The Record
Over the past year, Russian cybersecurity firm Kaspersky said it investigated several incidents involving the group at Russian businesses.
Four Countries Attribute “Contagious Interview” Fake-Job Malware Campaign to North Korea’s WaterPlum
25d agoJP
Japan, the United States, Australia and Germany, today issued a joint cybersecurity advisory formally attributing the long-running "Contagious Interview" campaign to a North Korean state-sponsored group they are calling WaterPlum. The operation has infected more than 30,000 computers in more than 100 countries and stolen about 1.7 billion yen, or some $10.7 million, in cryptocurrency. The advisory carries the seals of Japan's National Police Agency and National Cybersecurity Office, the FBI and
KR
Choi Won-woo reports: Internal data amounting to 1,894 cases from the Korean-type heavy ion accelerator ‘Raon,’ built with a state budget of 1.5 trillion Korean won [USD $1,080,038,017.50 at today’s rates] was confirmed to have been leaked externally. The estimated time of the leak is 2022, and the Institute for Basic Science (IBS) Heavy Ion... Source