News
Cybersecurity news across South Asia and the wider Asia-Pacific — everything from Bangladesh, India, Pakistan, Sri Lanka, and Nepal, plus high-signal incidents from the region. Collected hourly, deduped across outlets.
- Stories in view
- 41 stories
- Countries covered
- 13 countries
- Outlets
- 40 outlets
- Latest story
- 4d ago latest
Filter the wire
+34 more
showing all regions · Cyber Security News · clear all
Thu 8 Oct2
CN
Cyber Security News
A critical Sungrow inverter vulnerability could have allowed attackers to log in to the company’s iSolarCloud management platform without a valid password. The flaw affected the cloud service used to manage solar plants, inverters, and battery storage systems, creating a serious risk for customers and energy operators in Europe, China, Australia, and other regions. Sungrow […] The post Critical Sungrow Inverter Vulnerability Lets Attackers Access Solar Plants Without Passwords appeared first on
KR
A suspected lone threat actor used an AI-powered penetration-testing tool called ARTEX to breach several South Korean financial organizations and steal customer and employee data. The activity, which ran from late September to early October 2026, affected banks, savings banks, capital firms, and online lending services. The case shows how open-source AI tools can help […] The post Solo Hacker Used AI Tools to Breach South Korean Financial Organizations and Steal Data appeared first on Cyber Secu
Wed 7 Oct1
KR
Hackers breached two major South Korean churches, exposing more than one million congregant records and extensive financial and administrative data. The investigation reveals how web shells, leaked credentials, and weak access controls opened routes into connected systems. In one case, attackers entered through a web shell planted in an enterprise resource planning, or ERP, system. […] The post Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People appeared first
Mon 5 Oct2
JP
Investigators in Timor-Leste have detained 16 people after raiding a building in Dili allegedly used to run telephone scams against people in Japan. The suspects are accused of posing as Japanese police, using staged surroundings and a prepared script to make their claims appear credible. The group included seven Japanese nationals and six Chinese nationals. […] The post 16 Suspects Detained in Timor-Leste for Japanese Police Impersonation Scam appeared first on Cyber Security News .
KP
Blockchain investigator ZachXBT says he infiltrated a Chinese crypto laundering network linked to North Korea’s Lazarus Group after the $1.5 billion Bybit hack. His investigation connected private chats with public blockchain records and, he says, helped freeze stolen funds while exposing operators who claimed to handle money from several major thefts. In an October 5 […] The post Researcher Infiltrates Lazarus Group’s Crypto Laundering Network After $1.5B Bybit Hack appeared first on Cyber Secu
Sun 4 Oct1
KR
South Korean President Lee Jae Myung ordered a thorough investigation on October 4, 2026, after a series of financial sector data breaches exposed customer and worker information. The order comes as investigators examine whether AI tools helped attackers break into systems used by banks and other financial firms. According to The Korea Times, Lee received […] The post South Korean President Orders Full Security Checks After Financial Sector Hacks appeared first on Cyber Security News .
Thu 1 Oct2
CN
A China-aligned hacking group tracked as TA419 has impersonated a senior Anthropic employee and well-known policy figures to target US artificial intelligence experts. Proofpoint linked the activity to credential-phishing campaigns aimed at researchers at think tanks, universities, and law firms, with lures designed to steal access to their cloud accounts. The targeting likely supports Chinese […] The post Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts appeare
CN
A China-nexus threat actor is continuing to exploit Microsoft SharePoint Server vulnerabilities to deploy Warlock ransomware, with recent attacks striking essential-service and public-sector organizations across Portuguese- and Spanish-speaking countries. Symantec tracks the operator as Longlegs, while Microsoft uses Storm-2603; earlier activity has also been linked to CL-CRI-1040, CamoFei, and ChamelGang. During the past two months, […] The post Warlock Ransomware Exploiting SharePoint Flaws to
Wed 30 Sept1
APAC
The FBI has dismantled overseas scam compounds accused of stealing Americans’ savings through cryptocurrency investment fraud, romance schemes, impersonation scams, and other cyber-enabled operations. Under Operation Blackout, authorities have seized or restrained roughly $17 billion, arrested hundreds of suspects and freed thousands of trafficked workers forced to conduct fraud from industrial-scale facilities in Southeast Asia, […] The post FBI’s Operation Blackout Dismantles Scammers Operatin
Tue 29 Sept1
KP
A North Korea-linked malware campaign has found a way to keep infected computers connected to its operators. Instead of storing malware on Ethereum, the attackers hide the location of a control server inside cryptocurrency transfers. The campaign reaches developers through fake job offers, tainted code repositories and malicious software packages. Running the code can install […] The post Hackers Turned Ethereum Into a Secret Messaging System for Malware appeared first on Cyber Security News .
Mon 28 Sept1
KP
Cryptocurrency exchange Bitget has begun restoring withdrawals after attackers exploited its backend wallet infrastructure on September 24, stealing approximately $387.5 million from hot and warm wallets. The incident did not involve stolen private keys, and Bitget said its offline cold wallets and separate self-custodial Bitget Wallet service remained unaffected. Nevertheless, the breach demonstrates how attackers […] The post Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderer
Fri 25 Sept2
JP
Attackers are turning routine business complaints into malware traps. A message about a damaged delivery or refund request can look ordinary, yet one click leads employees to a fake download page and a harmful ZIP archive. The campaign targeted organizations with Japanese and Korean messages between July and August 2026. Product damage, shipping problems, and […] The post Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines appeared first on Cyber Security News .
AU
Autonomous AI agents allegedly attempted to probe and hack public data websites after normal methods of retrieving information failed, according to a new investigation by AI research group Transluce. The activity included attempted attacks on a U.S. public-data platform, a university digital library, and an Australian government health-data service. Researchers said the agents used urlquery.net, […] The post AI agents Tried to Hack Public Websites After Failing to Access Data Through Normal Meth
Thu 24 Sept1
AU
An autonomous OpenAI agent breached an Australian government Medicare statistics portal after a research task escalated into unauthorized system access, marking a reported world-first rogue AI intrusion into a government service. Prime Minister Anthony Albanese said the incident occurred on June 18, 2026, and raised Australia’s “extreme concern” with OpenAI CEO Sam Altman. The agent […] The post OpenAI Agent Hacked Australian Government Medicare Portal in World’s First Rogue AI Breach appeared f
Tue 22 Sept1
CN
A suspected Chinese-speaking threat actor has used WordPress vulnerabilities to break into at least 49 organizations across 29 countries. The campaign exposed how a compromised website can become a launchpad for database theft, credential abuse, and wider network intrusion. The attackers exploited the wp2shell chain, tracked as CVE-2026-63030 and CVE-2026-60137, against vulnerable WordPress installations. After […] The post Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and P
Mon 21 Sept1
North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
22d agoKP
North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews. The campaign, also known as Contagious Interview, reached at least 30,000 computers in more than 100 countries between December 2025 and July 2026. The attackers […] The post North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto appeared first on
Thu 17 Sept3
TH
A compromised Thai college website was quietly turned into a springboard for an illegal online casino, according to new findings from anti-fraud platform ADEX, which says the campaign achieved full ad cloaking without deploying a single line of cloaking code, mirroring evasion tactics seen in campaigns designed to bypass Google Ads screening. The scheme, uncovered […] The post Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino appeared first on Cyber Securit
KP
North Korean operators are using artificial intelligence, remote-control software, and hired stand-ins to make fraudulent job candidates look genuine during technical interviews. The scheme turns routine hiring into a route for sanctions evasion, payroll fraud, data theft, and access to company systems. The activity surfaced through a job advertisement posted in the Mouse Review Discord […] The post North Korean IT Workers Use AI and Remote Desktop Tools to Fake Technical Interviews appeared fir
IN
APT36, a Pakistan-linked threat group, has launched a campaign that uses infected removable drives to carry malware into disconnected government environments. The operation, called RapidRust, targets India and Afghanistan with a backdoor, file stealers, and a USB-spreading tool. This approach is important because air-gapped networks are separated from the internet to protect sensitive systems. A […] The post APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks appeared first
Wed 16 Sept1
IN
Noodle RAT is a remote-access trojan that gives attackers control of compromised computers and servers. Its renewed visibility matters because it runs on both Windows and Linux, allowing one malware family to follow victims across corporate networks. The tool has appeared in operations against organisations across Asia-Pacific, including Thailand, India, Japan, Malaysia and Taiwan. Operators […] The post Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems appeared
Tue 15 Sept3
AU
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers use to compromise Microsoft Active Directory environments. The technical guide explains how attackers exploit identity configurations, legacy protocols, certificate services, and privileged systems to escalate access, move laterally, and establish long-term persistence inside enterprise networks. Developed by the Australian Signals […] The post CISA Shares 17 Techniques Used
JP
Japan’s Digital Agency has confirmed a significant data breach affecting the Government Solution Service (GSS), a shared IT platform used across multiple ministries and government bodies, after attackers exploited a vulnerability in a VPN appliance to gain unauthorized access to internal servers. The agency disclosed on September 11 that approximately 246,000 personal records may have […] The post Japan’s Digital Agency Breach Exposes 240,000+ Users’ Personal Records to Hackers appeared first on
CN
Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers. Researchers found that a Chinese-speaking threat actor, named Red Heron, quickly turned public exploit code into an automated attack framework that stole source code, collected credentials, installed backdoors, and moved deeper into victim networks. The […] The post Hackers Actively Exploiting Gitea n-day RCE Vulnerability
Mon 14 Sept1
TH
Researchers have uncovered an exposed attacker-controlled staging server containing evidence of a wide-ranging intrusion targeting 3BB, the consumer brand operated by Thailand’s Triple T Broadband. The investigation links the operation to the exploitation of a critical SSL-VPN vulnerability, followed by privilege escalation, credential theft, internal reconnaissance, lateral movement, and persistent remote access. FortiGate SSL-VPN Vulnerability […] The post Hackers Exploit FortiGate SSL-VPN Vul
Wed 9 Sept1
CN
A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems. The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development. The alleged campaigns relied on huge volumes of automated requests sent through […] The post CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok appeared first on
Mon 7 Sept2
AU
Online maths learning platform Mathspace has confirmed a data breach that exposed the personal information of more than one million students, parents, guardians, and school staff across Australia and New Zealand, after attackers exploited a critical flaw in its internal reporting software. The Sydney-based edtech company, which is widely used in classrooms across both countries, […] The post Online Maths Learning Platform Mathspace Disclosed Data Breach Impacts 1 Million Users appeared first on
KP
South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access. The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers. The operation appears designed for patience rather than disruption. Attackers likely entered through […] The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared fir
Fri 4 Sept2
ID
Hackers have turned commercial AI models into working parts of a cyberattack operation. The campaign paired AI-directed tasking with familiar methods such as vulnerable public-facing servers, stolen credentials, webshells, and custom remote-access malware. The operation reached Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and government and education networks in mainland China. A […] The post Hackers Turn Claude, Qwen and DeepSeek Into AI Agents for Real-W
KP
Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan. The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers. The activity is tied to the long-running Contagious Interview […] The post 14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT appeared first on Cyber Se
Tue 1 Sept2
AF
Cybercriminals are posing as recruiters to turn routine job interviews into malware traps for software developers. Their latest campaign delivers two cross-platform remote access tools, NodeRabbit and PollCat, through coding challenges that look like genuine take-home tests. The activity has reached victims in aviation, aerospace and financial technology across Egypt, Ethiopia and Afghanistan. It also […] The post Hackers Pose as Recruiters and Send Fake Coding Tests to Infect Software Developer
VN
Hackers are using booby-trapped website themes to turn visits from iPhone users into a route for spyware and cryptocurrency theft. The campaign hides harmful code inside themes used by Vietnamese movie and comic streaming websites, exposing visitors without warning. The poisoned themes are installed through Composer, a tool developers use to add website components. Once […] The post Hackers Use Malicious Website Themes to Steal Crypto Wallet Seeds From iPhones appeared first on Cyber Security Ne
Fri 28 Aug2
CN
A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing […] The post Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix appeared first on Cyber Security News .
CN
A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing […] The post Hackers Use Fake Student Resume to Secretly Install Malware on Researchers’ Computers appeared first on Cyber Security News .
Thu 27 Aug3
AU
PaperCut has confirmed that hackers are actively exploiting an unpatched vulnerability in its widely used PaperCut NG and PaperCut MF print management software, prompting the company to rush out an emergency patch just hours after issuing its first warning. The Australian vendor said its security response team is investigating “confirmed customer incidents” and is treating […] The post PaperCut NG/MF Vulnerability Actively Exploited in Attack – All Versions Impacted appeared first on Cyber Secur
AU
Two Western Australian men have been charged over alleged TeamPCP supply-chain attacks that police say planted malicious open-source code and reached more than 1,000 organizations worldwide. The Australian Federal Police charged the pair on 26 August 2026 with a combined 14 offenses after search warrants in Perth, working with the Western Australia Police Force and […] The post Two Australians Charged Over TeamPCP Supply-Chain Attacks That Hit 1,000+ Organizations appeared first on Cyber Securit
CN
The U.S. Department of Justice and FBI have seized domains associated with two China-linked hacking platforms, QScan and QTRouter, allegedly used to target NASA, federal agencies, critical infrastructure, and sensitive U.S. networks. Court documents unsealed in the Southern District of California link the infrastructure to a People’s Republic of China state-sponsored group tracked as QTFY. […] The post FBI Shuts Down China-Linked Hacking Platforms Used to Target NASA and U.S. Networks appeared f
Mon 24 Aug1
KP
Kimsuky has been linked to a new espionage campaign that turns a Chrome extension into a quiet Gmail collector. The operation begins with convincing phishing emails and ends with attackers gaining access to messages, attachments, and a victim’s computer. Its mix of browser theft and remote control makes a single opened file especially risky. The […] The post Kimsuky Uses AI-Generated Chrome Extension to Automatically Steal Gmail Data appeared first on Cyber Security News .
Fri 21 Aug2
CN
A Chinese-speaking cybercrime group is using AI-assisted tools to turn vulnerable web servers into entry points. It shows how familiar flaws become more dangerous when attackers automate the work around them. The group, tracked as UAT-10147, targeted internet-facing Windows and Linux systems in government, education, media, technology, and gaming. Victims were identified across several countries, […] The post Chinese Hackers Use AI Agents to Exploit Web Servers and Automate Attacks appeared firs
JP
Sakura Internet has disclosed a potential breach involving its sales management system, placing the personal records of up to 1.36 million customer accounts at risk. The Japanese cloud and hosting provider said the incident was identified during its ongoing investigation into unauthorized access affecting Sakura Rental Server environments. The company initially announced the rental server […] The post Sakura Internet Breach – Hackers Accessed 1.36 million Customers’ Personal Records appeared fir
Wed 19 Aug1
MM
A China-nexus cyber espionage campaign is using a convincing visual trick to reach Myanmar government and technology personnel. The attackers present a virtual hard disk, or VHD, as an ordinary JPEG image, betting that recipients will not question a familiar file extension before opening it. Inside the mounted disk is what appears to be an […] The post China-Nexus Hackers Disguise Malicious VHD as JPEG to Deploy QUICAgent Backdoor appeared first on Cyber Security News .
Mon 17 Aug1
HoneyMyte CoolClient Backdoor Uses Signed Kernel Rootkit to Hide Processes, Files and C2 Traffic
57d agoPK
HoneyMyte has upgraded its CoolClient backdoor with a kernel-level rootkit for Windows. The change makes routine investigation much harder for defenders. It gives intruders tools designed to survive ordinary security checks. The activity targeted organizations in Pakistan, Mongolia, Myanmar and Russia, including government entities. In Myanmar, attackers first used PlugX, then installed CoolClient as a […] The post HoneyMyte CoolClient Backdoor Uses Signed Kernel Rootkit to Hide Processes, Files