Cybersecurity News Roundup (20.7 - 26.7): AI-powered attacks, data breaches and critical vulnerabilities
- Thanh Hoang
- Jul 27
- 8 min read
The final week of July 2026 brought a series of significant cybersecurity developments, ranging from Vietnam's proposed data security regulations to global espionage campaigns, large-scale data breaches, and critical vulnerabilities capable of leading to full system compromise.
Among the most notable incidents were the use of an autonomous AI agent during post-exploitation activities, critical vulnerabilities affecting Microsoft Bing Images and Ubuntu, and saoa sophisticated campaign exploiting Zimbra to steal emails and two-factor authentication (2FA) recovery codes.
Cybersecurity news in Vietnam
1. Vietnam proposes stricter data security requirements for International Telecommunications companies
Vietnam's Ministry of Public Security is drafting a new Data Security Law that would expand compliance obligations for international telecommunications, Internet, and technology companies processing data generated within Vietnam.
Under the proposal, affected organizations may be required to:
Store specific categories of data within Vietnam.
Establish a legal entity or representative office in the country.
Maintain local copies of important business data even when using overseas cloud infrastructure.
Core and critical data may also need to be stored in domestic data centers. Organizations could further be required to retain transmission logs, implement incident detection capabilities, and cooperate with authorities during cybersecurity investigations or incident response activities.
According to publicly available information, approximately 80% of enterprise cloud data in Vietnam is currently hosted outside the country. This has become one of the primary drivers behind the government's push to strengthen data sovereignty and regulatory oversight.
Business Impact
Organizations relying on international cloud providers should begin reviewing:
Data residency locations
Backup strategies
Data classification policies
Cloud provider contractual obligations
Cross-border data transfer mechanisms
2. Vietnam considers fines of up to 5% of annual revenue for serious data security violations
Another major provision in the draft Data Security Law proposes administrative penalties of up to 5% of an organization's previous fiscal year's revenue for severe violations involving critical or core data.
For multinational corporations, penalties could potentially be calculated based on global revenue, although the proposed maximum remains capped at 5%.
While the regulation has not yet taken effect and is still under public consultation, it signals a significant shift in how cybersecurity governance will be enforced.
Data security is no longer viewed solely as an IT responsibility.
It is increasingly becoming a corporate governance, legal compliance, and financial risk issue that requires executive-level oversight.
Organizations lacking:
Proper data classification
Cross-border data governance
Compliance documentation
Security evidence
may ultimately face financial consequences far exceeding the cost of implementing preventive security controls.
3. Autonomous AI raises new concerns about automated cyber attacks
Recent incidents involving AI agents have highlighted growing concerns over how autonomous artificial intelligence can be abused during cyber intrusions.
Unlike traditional AI chatbots, AI agents can be granted permission to:
Execute commands
Access files
Use external tools
Perform long-running multi-step tasks
When approval mechanisms are disabled or excessive privileges are granted, these agents may automatically:
Enumerate systems
Collect sensitive information
Search for privilege escalation paths
Maintain attacker persistence
The underlying problem is not necessarily the AI model itself.
Instead, the risk often stems from poor governance surrounding:
Machine identities
Privileged access
Secret management
Execution permissions
Monitoring and audit logging
Recommendation
Organizations deploying AI agents should implement:
Least privilege access
Human approval for sensitive actions
Sandboxed execution environments
Continuous monitoring of AI-generated activities
AI-specific security risk assessments before production deployment
International cybersecurity news
4. Nearly 100,000 cyberattacks target South Korean Diplomatic organizations
South Korea's Ministry of Foreign Affairs, the Korea Foundation, and the Korea International Cooperation Agency reported a combined 96,483 cyberattack attempts during the first half of 2026.
This exceeds the approximately 73,700 attacks recorded throughout all of 2025.
Most activities involved:
Network reconnaissance
Unauthorized system access attempts
Information gathering
Data theft operations
The Korea Foundation alone reported nearly 70,000 attack attempts, while the Ministry of Foreign Affairs recorded 16,254 incidents.
Although these figures do not indicate successful compromises, they clearly demonstrate that diplomatic organizations remain high-value targets for cyber espionage due to the sensitive political, strategic, and personnel information they possess.
To reduce detection time for suspicious activity, government agencies and critical infrastructure operators increasingly rely on Security Operations Centers (SOC) capable of continuously monitoring identity, endpoint, network, and cloud telemetry.
5. Hermes AI Agent operated unattended inside Thailand's Ministry of Finance Network
Researchers uncovered an attacker deploying Hermes, an open-source AI agent, on a rented server while disabling confirmation prompts for high-risk actions.
The agent was subsequently directed toward Thailand's Ministry of Finance infrastructure.
According to the investigation, Hermes autonomously:
Scanned servers
Searched for root privilege escalation opportunities
Explored file systems
Accessed personnel records dating back to 2012
Researchers confirmed that the attacker had already obtained initial access before deploying the AI agent.
Therefore, Hermes itself was not the vulnerability.
Instead, it served as an automated post-exploitation assistant capable of dramatically accelerating attacker operations.
Investigators also discovered approximately 585 files and nearly 470 MB of offensive tooling stored on a publicly accessible directory.
This incident illustrates how AI is rapidly evolving from a productivity tool into an operational force multiplier for cybercriminals.
Security Operations Centers should expect future attacks to become:
Faster
More autonomous
More persistent
Less dependent on human interaction
6. Origin energy confirms customer data breach
Australian energy provider Origin Energy confirmed that attackers gained unauthorized access to customer information, including names, addresses, dates of birth, phone numbers, and Origin account details.
Some customer records also contained the last four digits of payment cards or the final three digits of bank account numbers. According to the company, the exposed financial information is insufficient to directly process payments or access customer bank accounts.
Origin Energy serves approximately 4.8 million customer accounts across Australia but has not disclosed the exact number of affected individuals. Meanwhile, an individual claiming responsibility for the attack alleged that data belonging to two million customers had been compromised, although this claim has not been independently verified.
Business Impact
The greatest risk following this incident is identity-based fraud.
Even when complete financial information is not exposed, attackers can combine personal information with phishing techniques to impersonate utility providers, conduct social engineering campaigns, or commit identity theft.
Organizations experiencing similar incidents should immediately:
Isolate affected systems
Determine the scope of exposure
Preserve forensic evidence
Notify impacted customers and regulators where required
Reset compromised credentials and access tokens
7. Critical Bing images vulnerabilities could execute commands with SYSTEM privileges
Researchers disclosed two critical vulnerabilities affecting Microsoft Bing's image processing infrastructure:
CVE-2026-32194
CVE-2026-32191
Both received a CVSS score of 9.8.
According to the researchers, specially crafted SVG image files could cause Bing's backend image-processing servers to execute arbitrary commands with:
NT AUTHORITY\SYSTEM privileges on Windows
root privileges on Linux
The vulnerabilities were associated with Bing's image upload functionality and its capability to retrieve images from external URLs.
Microsoft remediated both issues on the server side before technical details became public.
As a result, no action is currently required from Bing users.
Key Security Lesson
Image files should never be assumed to be harmless.
Formats such as SVG can contain XML structures, embedded references, and executable logic that may trigger vulnerabilities in image parsing components.
Organizations should therefore:
Restrict accepted file types
Sandbox image-processing services
Remove unnecessary conversion features
Perform regular security assessments on web applications handling user-uploaded content
8. Russian espionage group exploits Zimbra to steal emails and 2FA recovery codes
A Russian state-linked espionage group exploited CVE-2025-66376 in Zimbra Collaboration Server to compromise government agencies and commercial organizations across multiple Western countries.
The vulnerability is a stored cross-site scripting (XSS) flaw affecting Zimbra's Classic UI.
A specially crafted HTML email can execute malicious JavaScript when opened, allowing attackers to operate within the victim's authenticated session.
The malware payload was specifically designed to steal:
Emails from the previous 90 days
Organizational contact lists
Browser-stored passwords
Two-factor authentication recovery codes
The vulnerability affects:
Zimbra Collaboration 10.0 prior to 10.0.18
Zimbra Collaboration 10.1 prior to 10.1.13
Business Impact
Applying security patches closes the vulnerability but does not recover credentials that may already have been stolen.
Organizations should immediately:
Reset passwords
Revoke active sessions
Review email forwarding rules
Audit authentication logs
Monitor for suspicious account activity
9. Ubuntu snap-confine vulnerability allows local privilege escalation
Security researchers disclosed CVE-2026-8933, a privilege escalation vulnerability affecting default Ubuntu Desktop installations.
The flaw carries a CVSS score of 7.8 and impacts:
Ubuntu Desktop 24.04
Ubuntu Desktop 25.10
Ubuntu Desktop 26.04
The vulnerability results from a race condition inside snap-confine, Ubuntu's sandbox initialization component.
An attacker with local user access—or the ability to execute code on the system—could exploit the flaw to write files into sensitive locations and ultimately obtain root privileges.
Canonical has released security updates through snapd.
Administrators are advised to verify the installed snapd version rather than relying solely on the operating system version or previous update status.
10. Australia iIdentifies cybersecurity as a major economic challenge
Cybersecurity is increasingly being viewed as an economic issue rather than solely a technical concern.
Growing attacks against energy providers, financial institutions, service providers, and critical infrastructure continue to increase operational costs for organizations.
The financial impact of a cyber incident extends well beyond technical recovery and often includes:
Business interruption
Incident investigation
Customer notification
Legal compliance
Regulatory reporting
Reputation damage
The Origin Energy incident demonstrates that even when complete financial information is not exposed, personal information alone remains valuable to cybercriminals and can fuel long-term phishing and identity fraud campaigns.
Three key cybersecurity trends
1. AI is becoming an operational tool for attackers
AI agents are evolving beyond productivity assistants.
They are increasingly capable of automating reconnaissance, privilege escalation discovery, data collection, and post-exploitation activities once attackers gain initial access.
Organizations should implement AI governance covering:
Identity management
Privileged access
Tool permissions
Secret management
Human approval workflows
Continuous monitoring
2. Identity and Email Remain Primary Attack Targets
The Zimbra campaign demonstrates that modern attacks rarely focus on passwords alone.
Threat actors increasingly seek to compromise:
Authentication tokens
Browser credentials
Email accounts
Recovery codes
Session cookies
Organizations should complement multi-factor authentication with phishing-resistant authentication methods, privileged access management, session monitoring, and identity threat detection.
3. Data security has become an executive-level responsibility
Vietnam's proposed regulatory changes illustrate that cybersecurity governance is rapidly expanding beyond IT departments.
Executive leadership is now expected to oversee:
Data classification
Regulatory compliance
Third-party risk management
Cloud governance
Security investments
Incident preparedness
Periodic security assessments can help organizations identify technical vulnerabilities, governance gaps, and compliance risks before they evolve into significant business disruptions.
This week's cybersecurity developments demonstrate how rapidly the threat landscape continues to evolve.
Autonomous AI agents are accelerating post-exploitation activities, critical software vulnerabilities remain attractive attack vectors, and identity-based attacks continue to dominate modern cyber campaigns.
Meanwhile, governments are placing increasing emphasis on data sovereignty and regulatory accountability, making cybersecurity both a technical and strategic business priority.
Organizations should prioritize:
Prompt vulnerability remediation
Continuous identity monitoring
Secure AI deployment
Data governance
Incident response readiness
Regular security assessments
Cybersecurity is no longer simply about preventing attacks—it is about maintaining business resilience in an increasingly connected and AI-driven world.
-------------------
Referral
Gần 100.000 vụ tấn công mạng nhằm vào cơ quan ngoại giao Hàn Quốc: https://nhandan.vn/gan-100000-vu-tan-cong-mang-nham-vao-co-quan-ngoai-giao-han-quoc-post978093.html
Bộ Công an đề xuất cơ chế siết an ninh dữ liệu với các tập đoàn viễn thông quốc tế: https://vnexpress.net/bo-cong-an-de-xuat-co-che-siet-an-ninh-du-lieu-voi-cac-tap-doan-vien-thong-quoc-te-5100743.html
AI “vượt rào” tự tấn công mạng là lời cảnh tỉnh cho cuộc đua trí tuệ nhân tạo: https://vietnamnet.vn/ai-vuot-rao-tan-cong-mang-la-loi-canh-tinh-cho-cuoc-dua-tri-tue-nhan-tao-2538299.html
Đề xuất phạt tới 5% doanh thu nếu doanh nghiệp vi phạm về an ninh dữ liệu: https://vietnamnet.vn/de-xuat-phat-toi-5-doanh-thu-neu-doanh-nghiep-vi-pham-ve-an-ninh-du-lieu-2538442.html
An ninh mạng trở thành thách thức kinh tế lớn của Australia: https://baomoi.com/an-ninh-mang-tro-thanh-thach-thuc-kinh-te-lon-cua-australia-c55696095.epi
Personal and banking details among customer data stolen in Origin Energy hack: https://www.theguardian.com/australia-news/2026/jul/23/personal-and-banking-details-among-customer-data-stolen-in-origin-energy-hack
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers: https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry: https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes: https://thehackernews.com/2026/07/russian-espionage-group-exploited.html
Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs: https://thehackernews.com/2026/07/ubuntu-snap-confine-flaw-could-give.html
Comments