Government

ESET: Turla hides new Cereal toolset on government Exchange servers to collect NATO and EU correspondence

ESET said on November 10 that it found a previously undocumented modular .

According to United Daily News, a 38-year-old man surnamed Lin in Kaohsiung used AI to write scripts to illegally breach the website backends of government agencies and private enterprises, stealing over 230,000 personal data records of citizens and selling them on the dark web .

The Record reports that pro-Russian hackers published the personal information of Italian Foreign Minister Antonio Tajani and other senior European officials on the dark web, offering cryptocurrency rewards for more details about them and their families .

According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .

According to Security NEXT, an improperly configured application file on the website for Fukuoka Prefecture's nursing care workplace certification program allowed personal data of 183 corporate officers across 24 organizations to be viewed by third parties .

According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

Acronis TRU disclosed on Nov 4 an attack framework called BOSSAI that combined 12 AI agents, targeted organizations in 11 countries over 12 observed days, and was assessed to be run by an individual in Hualien City, Taiwan .

ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .

According to Security NEXT, Japan's Ministry of Foreign Affairs (MOFA) detected an intrusion on an externally connected network on July 27, 2026, and subsequently blocked access and disabled authentication credentials .

According to Security NEXT, the Aichi Prefectural Mental Health and Welfare Center lost 79 mental disability certificate applications and 154 medical care for services and supports for persons with disabilities certificate applications, affecting 172 individuals after deduplication .

According to Security NEXT, Japan's Ministry of Economy, Trade and Industry (METI) announced that the Dentrinet website associated with the Electricity and Gas Market Surveillance Commission suffered a cyberattack in the early hours of October 27, 2026 .

Query responses from the Central Election Commission (CEC) candidate asset declaration website included non-public National ID numbers of candidates that could be retrieved via browser developer tools; after a civic developer discovered and reported the issue on October 27, the CEC suspended the service that same day to fix the bug and stated on October 28 that preliminary findings pointed to an outsourced vendor error .

According to reports by the United Daily News and China Times, a written operational report submitted by the National Security Bureau (NSB) to the Legislative Yuan on October 20 stated that through September, Taiwan's Government Service Network (GSN) experienced an average of over 2.

Vulone disclosed on Oct 18 that a China-linked, financially motivated operator built an AI-agent intrusion platform on the open-source Cairn framework and ran 66 operations between Sep 24 and Oct 14, 48 of which reached at least session-level access .

On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.

CISA, the FBI, the NSA and international partners warned that Integrity Technology Group, a China-based cybersecurity company with ties to the Chinese government, is enabling threat actors to target multiple critical infrastructure sectors worldwide .

Switzerland's FDPIC said PK Softech AG reported a cyberattack on its IT infrastructure on October 8, with data extracted from several pension funds including the federal pension fund Publica, and it opened a formal investigation on October 22 .

Japanese cloud provider IDC Frontier said on October 7 that an outage in its IDCF Cloud East Japan Region 1 starting at about 3:40 a.

According to The Record, the Danish government said on October 5 that someone exploited an unnamed Danish company's legitimate access to the Central Person Register (CPR) to obtain the names, addresses and CPR numbers of about 8.