Vapor Panda used agentic AI tool ARTEX against about 140 targets
CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.
84
Country
Philippines
- Mentions · 7d3
- Mentions · 30d16
- All mentions30
- First seenAug 26, 2026
- Last mentioned6h ago
Timeline
30 articles · newest firstCrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
Meta quietly launches Waddle World, an AI pet journal app
The free adult-only app is listed in the Philippines; Meta also launched Style Sketch in parts of Southeast Asia.
28
DDoS waves took North Korean state websites offline for about 32 hours
Kentik tied failures starting October 20 to traffic from Vietnam, Venezuela and elsewhere, but named no operator.
48
DDoS waves knock more than 40 North Korean websites offline
Kentik tied October 20 outages to synchronized traffic from Vietnam, the Philippines and Venezuela; no perpetrator was identified.
52
BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
74
Bronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
72
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
72
American pleads guilty to fraud scheme targeting US servicemembers
He faces up to 40 years after using stolen military PII through July 2019, with money mules moving funds to the Philippines.
48
Sextortion “help” firm took $60 million from victims, FTC alleges
The FTC alleges a sextortion-help firm collected at least $60 million while failing to deliver promised assistance.
68
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Honeypots recorded 1,423 attempts exploiting Langflow's critical authenticated RCE, CVE-2026-105740.
78
Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger halted Asia and Hong Kong reseller sales after tampered wallets stole seed phrases over LTE.
78
Who Is Planting Backdoors in Ledger Crypto Wallets?
Hardware implants in Ledger wallets sold by authorized resellers enabled theft of about $102 million.
80
Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis
Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet linked to cryptocurrency theft.
70
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Cisco Talos says China-nexus UAT-11587 deployed the Antino backdoor against Asian government and policy organizations.
78
Researchers find Chinese hacking campaigns targeting AI firms, Asian governments
Chinese state-backed groups phished AI researchers and used the Antino backdoor against Asian governments, hitting about 350 endpoints.
76
Meta Names Dhruv Vohra to Lead Southeast Asia Business
Meta named Dhruv Vohra managing director of its Southeast Asia global business group.
18
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
US-focused CSuite phishing steals Microsoft 365 sessions and installs RMM tools for persistent access.
72
Meta Partners With Government Agencies, Law Enforcement, and Safety Organizations to Launch Regional Anti-Scam Education Campaign
Meta's One Step Ahead anti-scam campaign reached 303 million people across 18 Asia-Pacific countries.
32
Misconfigured Supabase apps expose data in over 16,000 databases
UpGuard found over 16,000 misconfigured Supabase databases exposing PII, passwords, tokens, and some payment data.
78
ChatGPT Ads expands to Southeast Asia and Taiwan
OpenAI is rolling out ChatGPT Ads across Southeast Asia and Taiwan after a $1 billion run rate.
44
Grab and OpenAI bring practical AI skills to Southeast Asia
OpenAI and Grab partner to train 30,000 Southeast Asian gig workers in practical AI skills over two years.
40
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.
62
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency
Threat actors exploited old unpatched ownCloud vulnerabilities to breach the Philippines nuclear agency, stealing reactor databases, personnel records, and credentials.
73
Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.
72
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
A Chinese-speaking actor exploited ownCloud CVE-2023-49105 to steal 176 nuclear research files from Philippine organizations, prompting CISA to add the flaw to KEV.
75
88 ID Verification Breaches Show the Cost of Collecting Identity Data
A report catalogs 88 ID-verification breaches since 2011 exposing at least 2.15 billion records, with 41 incidents leaking irreplaceable biometric data and documents.
68
Related CVEs
by mentions- CVE-2024-2800068%9.8Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache
- CVE-2026-919829%9.8Unauthenticated RCE Chain in IBM Langflow OSS 1.0.0-1.10.0
- CVE-2023-4910543%9.8Improper Authentication in ownCloud Server Allows Unauthenticated File Access
- CVE-2026-55255<1%8.4IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows
- CVE-2026-53362<1%7.8Out-of-Bounds Write in Linux Kernel IPv6 Stack via UDPv6 MSG_SPLICE_PAGES
- CVE-2026-66384<1%5.3Authenticated Path Traversal Write in JFrog Artifactory Exploited in the Wild
- Langflow: Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio"…
- Langflow: The MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before…
- CVE-2026-07682%9.8Langflow code Code Injection Remote Code Execution Vulnerability
- CVE-2026-69255<1%9.2Authenticated Code Injection to Root RCE in Flowise CSVAgent before 3.1.3
Appears with
- Sandboxieproduct · 3
- GoldFactorythreat actor · 3
- Shelterproduct · 3
- Ledgervendor · 3
- Googlevendor · 3
- Vworkmalware · 3
- Metavendor · 3
- Sophosorganization · 3
- Gigabudmalware · 3
- CryptoBilisorganization · 3
- ownCloudvendor · 3
- Bronze Sandcastlethreat actor · 3
- Group-IBvendor · 3
- CrowdStrikeorganization · 2
- LiteSpeed Cacheproduct · 2
- Microsoft 365product · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.