Search — “Taiwan”

Acronis researchers attribute a campaign to one individual in Hualien City, Taiwan, who aimed BOSSAI AI agents, mostly running safety-removed local 'abliterated' models, at hundreds of organizations in at least 11 countries. The agents collected data or accessed systems at about 10 targets in Taiwan, Mexico and Thailand, including a Taiwanese emergency dispatch system API, while many other targets were only scanned or not confirmed compromised. Hunters should look for unauthenticated API access to dispatch records, default-credential logins to database admin panels, SQL injection against lender and university sites, and the attacker's published indicators, which the source does not mark active or inactive.

CISA added the Linux kernel XFRM ESP-in-TCP privilege-escalation flaw CVE-2026-46300 (Fragnesia) to KEV and warned it can be chained with PHP2Shell (CVE-2026-109618/CVE-2026-109619) to implant PHP webshells and run commands as root. Dream Security reported a campaign that rooted 25 servers across the US, Japan, Taiwan and South Korea and then targeted three servers in a US government-affiliated environment, though CISA itself did not share details of the attacks. Hunters should look for PHP webshells on web servers and unexpected root-level command execution from PHP processes.

Dream reports a suspected China-nexus, AI-assisted operation (Oct 23–25, 2026) that used a custom PHP2Shell exploit (CVE-2026-109618/109619) against PHP session.upload_progress on an undisclosed vendor's firewall appweb management server, chained with the Fragnesia Linux kernel LPE (CVE-2026-46300) to root 25 devices across the US, Japan, Taiwan and South Korea. The attacker planted PHP web shells in publicly accessible directories, built a reverse SSH tunnel into a US government-affiliated network, compromised an internal firewall management server, decrypted an LDAP service account password, enumerated AD users, password-sprayed and attempted to create backdoor AD accounts; success of credential theft and account creation is unconfirmed. Hunt for new PHP files in firewall web roots, outbound SSH from firewall appliances, AD password spraying from firewall/management IPs, and new AD account creation.

Sophos researchers disclosed Bronze Sandcastle, a China-aligned espionage cluster active since mid-2025 against victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. The group abuses DLL sideloading via legitimate Sandboxie executables (SandboxieWUAU.exe loading a malicious sbiedll.dll) and seven other signed binaries, with sideloaded DLLs decrypting a config.ini payload and executing shellcode in memory. Hunters should look for signed binaries loading unexpected DLLs from non-standard paths, DLLs reading local files followed by immediate in-memory execution, and payloads beaconing to file.io, gofile.io, ably.net or GitHub API endpoints.