Cybersecurity Monthly Report (August 2026)
Cybersecurity Monthly Report (August 2026)
1. Cybersecurity: Long Story Short
1.1 What to Do When an Attack Disrupts Organizational Operations?
As a Chief Information Security Officer (CISO), imagine receiving panic-driven reports from department heads one day: systems are under cyberattack, and critical services have come to a near standstill. Facing overwhelming chaos and intense internal and external pressure, how should you respond?
In the face of a cyberattack, organizations often react instinctively with a desire to "restore at all costs" or "immediately assign blame". However, making hasty decisions amidst incomplete information and high stress can actually complicate recovery. To address this, the UK’s National Cyber Security Centre (NCSC) published the guidance titled "What to do when cyber attacks disrupt your organization" on July 28, 2026 [Note 1]. It divides recovery operations into three core phases: "Immediate Action" ➔ "Recovery and Investigation" ➔ "Rebuilding", providing corresponding response measures to help organizations systematically complete their recovery.
1.2 The Three Response Phases: Parsing the Core Mindset Behind the NCSC Guidance
(1) Phase 1: Immediate Action (First Few Hours) — Stay Calm, Stabilize the Situation
The initial hours of a cyber incident are when an organization is most vulnerable to extreme chaos and deep anxiety. Therefore, it is crucial to approach the situation with a calm and professional demeanor, grasping essential details—such as what happened, the extent of the impact, who takes charge next, and whether external assistance is needed—to prevent further escalation.
A. Replace "Collective Anxiety from Dispersed Decision-Making" with a "Clear Command Structure":
When business operations come to a complete halt and information is chaotic, the worst-case scenario is a chaotic state where "everyone is working on it, but no one knows who makes the decisions." The priority is to immediately activate the established incident command mechanism and delegate duties appropriately. Clearly define the operational boundaries for decision-making, technical remediation, business continuity, and Public Relations communications. This prevents fragmented efforts, ensures smooth communication flow, enables an orderly response, and halts further damage.
B. "Shutting Down" vs. "Disconnecting from the Network": A Trade-off in Multi-Dimensional Risk Management:
Upon discovering a compromised system, deciding whether to shut it down completely or disconnect it from the network is often the first major decision. While an emergency shutdown quickly halts active malicious activity, it may erase vital forensic evidence and prevent root-cause analysis of how the attacker gained access, significantly increasing the risk of re-compromise later. On the other hand, disconnecting network connections prevents attackers from remotely controlling compromised devices and reduces the risk of lateral movement, but it may not stop malicious processes that have already been triggered and are running locally. As CISO, you must act as a "risk balancer", weighing the urgency of threat propagation, business impact, and forensic investigation needs before deciding between power-off or network isolation—seeking external incident response experts if necessary.
(2) Phase 2: Recovery & Investigation (First Few Days to Weeks) — Allocate Limited Resources, Ensure Minimum Viable Operations
Once the initial chaos is brought under control, the focus shifts to systematically restoring critical services, leveraging alternative solutions where necessary to bring the organization to a Minimum Viable Operations (MVO) state.
A. Break Departmental Silos: Prioritize Recovery Based on "Business Needs":
During the recovery stage, every department will likely argue that its own systems are the most critical and must be restored first. The CISO must lead business units past these departmental silos, ensuring business recovery priorities are driven by "critical business continuity needs" and "Business Impact Analysis (BIA)", rather than by an IT technical perspective or solely by system size and dependencies. Under limited time and resources, temporary offline workarounds should be implemented to quickly restore MVO and avoid complete operational stagnation.
B. Avoid Rushing Recovery to Prevent Re-Compromise Risks:
Following an attack, internal and external pressures often drive organizations to rush the recovery process. However, restoring systems before confirming that attacker entry points are blocked and malicious activity is completely eradicated creates a high risk of secondary compromise. Because Directory Services (such as Active Directory) serve as the foundation for enterprise applications—and attackers may have established persistence via compromised or newly created privileged accounts—the recovery process should prioritize re-establishing a trusted identity authentication mechanism to prevent re-compromise.
C. Burnout Crisis Management: Keep Staff from Reaching a Breaking Point:
Cyberattack recovery is not a 100-meter sprint; it is a marathon testing organizational endurance. CISOs should monitor staff well-being under high stress, maintain open channels of communication, care for mental health, and implement shift rotations. When internal teams are exhausted or understaffed, leverage temporary reinforcements or external incident response teams to alleviate workload and safeguard the recovery effort.
(3) Phase 3: Rebuilding (Next Few Months) — Transform Crisis into Future Defensive Resilience
A. Allow Staff Time to Rest and Recover, Not Just Systems:
Employees are a vital component of organizational resilience. After a major cyber incident, frontline technical teams are often physically and mentally drained. "Restoring your people" is just as important as rebuilding systems. Proactively providing time for rest and adjustment is not only humanistic care, but also a critical strategic decision to prevent the loss of key cybersecurity talent, boost morale, and ensure a steady return to normal operations.
B. Root Cause Analysis and Knowledge Sharing:
Organizations must uncover root causes from the incident, continuously address security weaknesses, and foster a culture of sharing lessons learned—translating experience into future cybersecurity defense and resilience plans. However, avoid attempting a full-scale cybersecurity transformation before the organization has fully recovered and stabilized, as this can delay business recovery timelines and burden an already exhausted workforce.
1.3 A Message to CISOs
The NCSC response guide provides practical guidance covering initial identification, damage control, internal/external communication, system recovery, and post-incident review. This aligns closely with the core spirit of the Cyber Security Incident Response Action Guidelines published by Taiwan's Administration for Cyber Security (Ministry of Digital Affairs) on July 31, 2026, both emphasizing the establishment of a comprehensive emergency response framework.
A cybersecurity incident tests far more than technical capability—it measures an organization's ability to demonstrate resilience under high stress and uncertainty. Truly resilient organizations are not defined by never facing a crisis, but by their ability to remain calm, respond swiftly, and recover steadily when crisis hits—translating lessons into institutional, technical, and operational improvements that leave the organization stronger than before.
Note 1: What to do when cyber attacks disrupt your organization, 28 July 2026
2. Recent Policy Highlights
Organizations Must Strengthen Cybersecurity Management of External Connections for Network and IoT Devices
To reduce the risk of network and Internet of Things (IoT) devices being compromised and exploited as attack vectors, the Administration for Cyber Security of the Ministry of Digital Affairs recommends that all agencies and organizations implement the following measures:
(1) Maintain a complete asset inventory, clearly designate management responsibilities, and evaluate external attack surface exposure from the public internet side.
(2) Strictly prohibit exposing network and IoT device management interfaces directly to the internet. Remote access must be routed through Virtual Private Networks (VPNs) or governed by Zero Trust mechanisms.
(3) Close unnecessary services and ports. For services that must remain accessible, disable known insecure or unencrypted protocols (e.g., Telnet, FTP, SNMP v1/v2c) and adopt secure, encrypted alternatives (e.g., SSH, SFTP, SNMPv3).
(4) Regularly update device firmware and set strong passwords. Establish a schedule for vulnerability patching and strongly recommend enabling multi-factor authentication for administrative accounts. Additionally, set a phase-out timeline for end-of-life devices that no longer receive security updates.
(5) When procuring network and IoT devices, incorporate cybersecurity requirements (e.g., secure update mechanisms and the ability to disable remote connection functions) into procurement specifications.
(6) Place IoT devices on isolated, independent network segments to restrict their outbound connection behavior.
(7) Government agencies are strictly prohibited from downloading, installing, or using products that pose a threat to national cyber security.
The implementation of the above measures, alongside the domain management of outsourced event and project websites, will be included as evaluation criteria in future cybersecurity audits conducted by the Executive Yuan.
3. Recent Cybersecurity Incident Sharing
Incomplete Equipment Handover and Ineffective Vulnerability Management
Due to its broad geographic jurisdiction, a government agency established surveillance cameras and systems across multiple locations, deploying firewalls at the system front-end to enhance security. However, following a recent cybersecurity alert regarding suspicious network activity, an investigation confirmed that a firewall had been compromised by hackers. The attackers gained control of the device, altered the super administrator account credentials, and leveraged the compromised unit to connect into the agency's internal network, posing a severe security threat.
Subsequent investigation revealed that the primary cause was flaws in the equipment handover process and subsequent asset inventory. During the operational handover, verification strictly on paper records without inspecting the actual condition of the equipment (e.g., active firmware/software versions, vendor maintenance status, operational lifespan, and scheduled replacement timelines), rendering the handover incomplete.
Furthermore, after taking over operations, the receiving department failed to perform thorough asset inventories or track equipment maintenance and replacement status. Consequently, they were unaware that the firewall had passed its End of Support (EOS) date and continued operating it without vendor support. Lacking official security updates and patches, the device was eventually exploited through vulnerabilities. Hackers obtained administrative control, altered the super administrator credentials, and pivoted into the agency’s internal network, severely compromising the organization's overall cybersecurity posture.
Lessons Learned
The core issue in this incident was not merely outdated hardware, but the failure to ascertain equipment status and enforce lifecycle management following an operational handover. This left what should have been the first line of defense in a cybersecurity blind spot, creating a critical breach. To prevent similar occurrences, organizations should implement the following protective measures:
(1) Conduct Cybersecurity Health Checks During Equipment Handover
A. Thoroughly Audit Equipment Status: During organizational restructuring or operational handovers, agencies must go beyond counting hardware units and reviewing basic records. They must verify software/firmware versions, patch status, End of Support/Life (EOS/EOL) dates, and maintenance contracts to gain full visibility into the actual security posture of all devices.
B. Clarify Maintenance Roles and Contract Status: During handover, verify whether devices remain covered by valid vendor support or maintenance contracts. Clearly define maintenance responsibilities and funding sources, and proactively schedule replacement timelines based on current equipment condition to prevent gaps in accountability or maintenance coverage.
(2) Access Control for IoT Devices
A. Avoid Exposing Management Interfaces Directly to the Internet: As a rule, management interfaces for IoT devices—such as surveillance cameras and firewalls—should not be directly exposed to the public internet, reducing the risk of external cyberattacks.
B. Enforce Network Segmentation and Isolation: IoT device management interfaces should be physically or logically separated from data transmission network segments. Through strict access controls, even if a device is compromised, attackers can be effectively blocked from moving laterally into the agency's internal network.
C. Strengthen Remote Operations and Maintenance (O&M) Access Control: Where management is required, on-site maintenance should be prioritized. Remote connections should follow the principle of "prohibited by default, allowed by exception". If remote access is necessary, it must be restricted to "short durations" with temporary privileges revoked immediately after use. Implementing Zero Trust architecture, source IP whitelisting, and anomaly monitoring mechanisms will further enhance security.
Reference Material:
Regulations Governing the Classification of Cyber Security Responsibility Levels — Appendix 10: Security Baselines for Information and Communication Systems— Access Control, System, and Information Integrity.
4. Cybersecurity Trends
4.1 Ex ante joint defense and monitoring
This month, a total of 77,717 cybersecurity joint defense intelligence items were collected from government agencies (an increase of 4,067 items compared to the previous month). Among identifiable threat categories, information collection ranked first (55%), primarily involving the acquisition of information through techniques such as scanning, probing, and social engineering. This was followed by intrusion attempts (24%), mainly involving attempts to access unauthorized hosts, and intrusion attacks (8%), most of which involved unauthorized system access or the acquisition of system or user privileges. The distribution of intelligence volume over the past year is shown in Figure 1.
Figure 1: Statistics of cybersecurity monitoring intelligence in joint defense
Hackers are stealing sensitive host information via malicious emails
Upon further consolidating and analyzing joint defense threat intelligence, it was found that hackers have recently been distributing XWorm via malicious emails to steal sensitive computer information. XWorm is an info-stealing Remote Access Trojan (RAT) equipped with capabilities for remote control, keylogging, screen capture, and sensitive data exfiltration. Beyond stealing sensitive information, it also possesses the functionality to download additional malware payloads. In this campaign, hackers employed social engineering tactics centered on financial topics—such as payment notifications and account credit alerts—using compressed attachments containing malicious JavaScript script files to trick recipients into executing the script and triggering follow-on malware. Relevant threat intelligence along with monitoring and defensive recommendations have been provided to member agencies for joint defense.
4.2 In-process reporting and responding
A total of 136 cybersecurity incidents were reported this month (including 55 cyber defense exercise incidents), representing 0.87 times the volume from the same period last year. Illegal intrusion was the primary incident type, accounting for 47.06% of total reports this month. It was observed this month that certain Internet-facing devices and web services still suffer from inadequate security controls. Issues include unpatched device vulnerabilities, exposed management interfaces, use of default credentials, and insufficient input validation and access controls. These weaknesses leave systems vulnerable to unauthorized attempts to extract website data via vulnerability exploitation, SQL Injection, directory traversal, and API authorization bypass. For detailed statistics on cybersecurity incident notifications over the past year, please refer to Figure 2.
Figure 2: Statistics of cybersecurity incident reports
5. International Cybersecurity News
CISA Gives Feds 3 Days to Fix Actively Exploited Ray RCE Bug
Source: The Register
CISA reported that CVE- 2025-62593 (CVSSv4: 9.4), a critical RCE vulnerability in Ray, an open-source framework for scaling Python and machine-learning workloads, is now being actively exploited. The flaw affects Ray versions prior to 2.52.0. The vulnerability stems from Ray's mechanism of identifying and blocking browser requests by checking whether the User-Agent header is 'Mozilla'. However, Firefox and Safari browsers allow web scripts (JavaScript) to modify this header field via the Fetch API. Once a developer visits a suspicious website or receives malicious advertisements in an affected browser, this flaw could be exploited. This enables attackers to compromise the developer's computer to execute arbitrary code, or use the browser as a springboard to attack Ray nodes on corporate private networks, thereby compromising other Ray hosts on the same network segment. Ray 2.52.0 has addressed the issue, adding optional token-based authentication as an additional defense. CISA mandated that federal agencies remediate the vulnerability within three days, rather than the typical 14 days.
US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure
Source: Bleeping Computer
U.S. cybersecurity agencies have issued a joint advisory warning that hackers are using AI-generated scripts to target Siemens S7 series programmable logic controllers (PLCs) in critical infrastructure sectors. PLCs are dedicated industrial computers used to automate and control machinery and physical processes in factories and other critical infrastructure.
Threat actors are utilizing internet scanning tools such as Censys and ZoomEye to locate PLCs exposed to the internet. They use artificial intelligence to develop Python attack scripts and leverage the snap7.dll and python-snap7 libraries to disguise them as legitimate Operational Technology (OT) monitoring software, obtaining read and write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol. Currently, the threat actors' activities appear to focus on "long-term persistence and reconnaissance", likely preparing for future disruptions to critical infrastructure. The primary targets are Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 PLCs. The report recommends that organizations conduct a comprehensive asset inventory of S7 PLCs, apply the latest security updates, block direct access from external networks, strengthen access control measures, and monitor these devices for abnormal activity.
Appendix: Major Vulnerability Alerts
| Alert Type | Category | Description |
|---|---|---|
| Vulnerability Alert |
Enterprise Applications and ERP Platforms SAP Commerce Cloud, SAP MII, and SAP NetWeaver Severity: CVE-2026-58231: CVSS 10.0 CVE-2026-44772: CVSS 9.9 CVE-2026-34265: CVSS 9.8 CVE-2026-44758: CVSS 9.1 |
|
| Workload Security Protection Platforms Cisco Secure Workload Severity: CVE-2026-20231: CVSS 9.9 CVE-2026-20315: CVSS 10.0 CVE-2026-20317: CVSS 10.0 CVE-2026-20318: CVSS 9.6 CVE-2026-20319: CVSS 7.5 |
|
|
| Web Application Firewalls (WAF) Fortinet FortiWeb Severity: CVE-2026-26035: CVSS 9.8 |
|
|
| Known Exploited Vulnerabilities | Application Delivery and Load Balancing Equipment Progress LoadMaster Severity: CVE-2026-8037: CVSS 9.8 |
|
| Network Firewalls and VPN Equipment Cisco Secure Firewall ASA and Secure Firewall FTD Severity: CVE-2026-20349: CVSS 8.6 |
|
|
| Virtualization Management Platforms Broadcom VMware vCenter Severity: CVE-2026-59310: CVSS 9.8 |
|
|
| Collaboration and Document Platforms Microsoft Office SharePoint Severity: CVE-2026-55040: CVSS 9.1 |
|
Alert Explanation:
"Vulnerability Alert": This is a verified vulnerability that has not yet been widely exploited by attackers. It is recommended to patch the vulnerability as soon as possible.
"Known Exploited Vulnerabilities": Successful attacks using this vulnerability are known. It is recommended to immediately evaluate and patch it.