News
Cybersecurity news across South Asia and the wider Asia-Pacific — everything from Bangladesh, India, Pakistan, Sri Lanka, and Nepal, plus high-signal incidents from the region. Collected hourly, deduped across outlets.
- Stories in view
- 431 stories
- Countries covered
- 22 countries
- Outlets
- 40 outlets
- Latest story
- 29d ago latest
Filter the wire
+34 more
Mon 14 Sept1
CN
Acronis TRU
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. The activity progressed from source-code theft to persistent access, credential collection, and lateral movement.
Sun 13 Sept5
KP
Security Affairs
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter REVSTEALER ramps up Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode GuardBreaker: Derailing AI-assisted malware analysis with a code comment DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive […]
KR
AhnLab ASEC
Note The August 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—active on the deep web and dark web. It is noted that the accuracy of some information could not be verified. Major Issues NoName057(16), BD Anonymous, and Dark Storm Team claimed responsibility for repeated DDoS attacks targeting websites of […]
KR
Note The August 2026 Dark Web Issue Trend Report summarizes Major Issues that occurred on the deep web and dark web. The report notes that, due to the nature of its sources, it may contain some information whose accuracy cannot be fully verified. Major Issue After the RaidForums domain was suspended, a new domain was […]
CN
BleepingComputer
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]
KR
DataBreaches.net
Shin Da-eun and Park Kang-su report: Korea was not the only country where victims who sent Google removal requests about illegally obtained sexual images ended up having their private information posted online, the Hankyoreh has confirmed. “Photos of me from when I was a minor were distributed without my consent. They were posted on an... Source
Sat 12 Sept7
AU
The Hacker News
The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the
CN
GBHackers
China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome […] The post China-Linked Hackers Chain Chrome Zero-Day Wi
AU
A swarm of AI agents believed to be operated internally by OpenAI uploaded more than 2,000 malicious packages to RubyGems in May 2026, abusing the ecosystem’s documentation build process to execute code remotely and attempting to steal user API keys through a then-undisclosed server-side flaw. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said […] The post OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE appeared first on GBHackers Security | #1 Gl
IN
ET CISO
PayU introduced an AI fraud solution for Indian merchants accepting international card payments. This new Fraud Liability Protect uses AI to assess transactions and reduce friction. It aims to protect businesses from AI-enabled scams and chargebacks effectively. Merchants have seen improved international payment success rates and reduced fraud exposure. The solution targets small and medium businesses in key sectors like travel and e-commerce.
IN
Quick-commerce platforms face a fraud surge, exceeding traditional e-commerce rates significantly. Suspected phishing on these platforms is four times higher than in regular online retail. Ultra-fast delivery limits transaction verification time, which fraudsters exploit effectively. Organized return fraud and multi-account farming are emerging as key challenges. India's overall fraud landscape is also evolving with new tactics and reporting systems.
IN
US Senators have urged action against three India-based companies for alleged data theft. These firms reportedly hacked thousands of Americans and US companies over fifteen years. Investigations suggest these groups operated at the behest of the Qatari government. The Senators want the companies added to an Entity List to cut off access. This action aims to prevent further cyber threats and protect US citizens' rights.
CN
Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. [...]
Fri 11 Sept7
CN
Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax. Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large, powerful AI model assumes the role of a "teacher" to
JP
JiJi Press reports: Japan’s Digital Agency said Friday that about 246,000 sets of personal information, including the names and email addresses of government employees, may have been compromised through the unauthorized access of a network system operated by the agency. So far, no secondary damage such as the misuse of the possibly breached personal information... Source
CN
SecurityWeek
Noteworthy stories that might have slipped under the radar: Invisible Unicode slips past phishing filters, US puts $10 million bounty on Iranian cyber official, military ties of Chinese hacking group QTFY. The post In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review appeared first on SecurityWeek .
CN
A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns
IN
In response to the surge in Aadhaar authentications, UIDAI is advancing its AI capabilities to tackle fraud effectively. With over ten crore authentications processed daily, the authority braces for even greater volumes. The introduction of the Aadhaar Face Authentication SDK enhances integration and testing, merging AI with biometrics to ensure reliable identity verification. Emphasis on spoofing detection and safeguarding biometric data is now a priority for organizations.
ID
Dark Reading
The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately.
CN
CyberScoop
The report details a Russian-aligned espionage campaign against more than 20 organizations, an exploit foundry run by Chinese undergraduates and ShinyHunters-affiliated breaches, among other disrupted operations. The post AI lets small actors run state-level hacking campaigns, Anthropic report finds appeared first on CyberScoop .
Thu 10 Sept7
KR
Korea JoongAng Daily reports: Korea’s privacy regulator is sharply raising the cost of data breaches, aiming to push companies to treat data protection as a preventive investment rather than a routine cost of doing business. Starting Friday, companies found to have leaked the personal data of 10 million or more people through intent or gross negligence... Source
CN
U.S. security agencies have accused Chinese AI companies of illegally copying sophisticated American models through a method known as distillation. Reports indicate that Chinese authorities may be complicit in these actions. This troubling situation raises serious issues surrounding the safeguarding of proprietary AI technologies on a global scale and emphasizes the dangers associated with unauthorized creation of AI capabilities.
CN
Infosecurity Magazine
The US Treasury has placed sanctions on notorious Chinese cybercrime marketplace Xinbi Guarantee
IN
Global enterprises are boosting information security spending as artificial intelligence adoption grows. Organizations in APAC face rising concerns over AI vulnerabilities and deepfakes. Employee use of third-party AI tools like ChatGPT presents significant security risks. Many companies allow these external tools with specific usage restrictions and training. Enterprises are also developing internal AI solutions to enhance business operations and efficiency.
CN
Proofpoint
CN
The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime
CN
US agencies accuse six Chinese AI firms of extracting billions of tokens from US AI models to accelerate development and copy advanced capabilities. NSA, CISA, and the FBI jointly published an advisory accusing six Chinese AI companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, of running industrial-scale extraction campaigns against US frontier models since […]
Wed 9 Sept13
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
33d agoCN
Volexity
On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). […] The post Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows appeared first on Volexity .
CN
U.S. cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. [...]
CN
Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,
CN
The Record
A Google Chrome bug identified in August was exploited by at least four China-linked cyber-espionage groups, according to researchers.
KR
ASEC Blog publishes Ransom & Dark Web Issues Week 2, September 2026 The Gentlemen Ransomware Attack on a Canadian Airline LAPSUS$ Group Resumes Chapter II and Teases New Victim Disclosure AUDIT TEAM Data Extortion Attacks on Four Organizations in South Korea, Germany, and Argentina
CN
Widening the Circle of Chinese Hacker Group QTFY: ELEX's Intelligence Client List and Lexbell's PLA Contracts
On August 26, 2026, the FBI, NSA, and U.S. Cyber Command’s Cyber National Mission Force released a joint cybersecurity advisory on China-linked hacking group QTFY, attributing it to Nanjing Xinjiuwei Network Technology Co. (XJW) (南京鑫玖维网络科技有限公司). Since at least 2018, QTFY has allegedly developed malicious tooling, traded malware and exploits within freelance hacking networks, established and maintained an obfuscation botnet, and targeted a wide range of U.S. government and critical-infrastructure
CN
Distillation is an ‘attack’ against an AI model designed to capture outputs, understand reasoning processes, and subsequently train a different model. The post US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities appeared first on SecurityWeek .
CN
U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks. The activity has been described as occurring at an industrial-scale and one that forms the "core" of their AI development strategy, according to
CN
Cyber Security News
A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems. The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development. The alleged campaigns relied on huge volumes of automated requests sent through […] The post CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok appeared first on
JP
JPCERT/CC Alerts
IN
India must build sovereign digital trust layers for its expanding digital economy. The nation is transitioning to quantum-safe security, moving from policy to planning. Banks are assessing their cryptographic inventory and identifying vulnerable systems. This quantum-security push is driven by both quantum risks and AI-enabled attacks.
CN
A joint advisory alleges Chinese companies are using sophisticated systems to route millions of data requests to US AI models across different accounts and platforms. The post Feds accuse China of ‘systematic’ distillation of U.S. AI models appeared first on CyberScoop .
SG
WASHINGTON – Malone Lam, 22, a citizen of Singapore and recent resident of Miami, pleaded guilty today in U.S. District Court in Washington D.C. in connection with his role as ringleader of an international cybercrime conspiracy that used social engineering to steal and launder cryptocurrency valued at more than $245 million, announced U.S. Attorney Jeanine... Source
Tue 8 Sept6
AU
Hackread
Mathspace says hackers exploited a Metabase flaw and downloaded account data belonging to 1.08 million students, parents and staff in Australia and New Zealand.
CN
A Chinese-language group is compromising government and education sites to create a reverse-proxy network with gambling-themed sites.
KP
North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally. North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software running at the edge of two South Korean companies’ networks. Rapid7’s […]
IN
Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the Indian state of Rajasthan since at least 2015, driven by two IT service providers named WeConnect
APAC
Group-IB
Group-IB's 2026 data shows ransomware accelerating across APAC. See where response plans fail, and the 5-pillar framework built to hold under pressure.
AU
CYFIRMA
Regional & Sector Threat Intelligence | Ransomware, Dark Web, Vulnerability & AI-Enabled
Mon 7 Sept4
AU
Online maths learning platform Mathspace has confirmed a data breach that exposed the personal information of more than one million students, parents, guardians, and school staff across Australia and New Zealand, after attackers exploited a critical flaw in its internal reporting software. The Sydney-based edtech company, which is widely used in classrooms across both countries, […] The post Online Maths Learning Platform Mathspace Disclosed Data Breach Impacts 1 Million Users appeared first on
KR
kbizoom reports: Weverse, the fan platform operated by HYBE-affiliated Weverse Company, has confirmed a security incident that affected 422,584 user accounts. The company said the exposed information consisted mainly of internal identifiers that cannot be used outside the platform. “We received a notification from the Korea Internet & Security Agency (KISA) on September 3 that... Source
AU
Ashish Khaitan reports: The Mathspace data breach has affected 1,079,819 people in Australia and New Zealand after unauthorized parties accessed an internal reporting system and downloaded user information. Mathspace confirmed the security incident on September 3, 2026, and said the affected records involve students, parents or guardians, teachers, and Mathspace staff. The company said names,... Source
KP
The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance. The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek .