Faizal Jufri

🚨 Security First: Threat Insights Secuna’s Monthly Cyber Threat Intelligence Brief Cyber threats are evolving faster than ever across the Philippines and beyond. Yet many organizations struggle to turn complex reports into real security action. Security First: Threat Insights is Secuna’s structured monthly brief built to cut through the noise and translate intelligence into action. It distills major incidents, emerging attack techniques, newly disclosed vulnerabilities, and regulatory developments into insights that leaders can immediately act on. Each edition provides:  • A structured summary of major global and local cyber incidents  • Clear explanations of emerging attack trends and vulnerabilities  • Practical implications for organizations in the Philippine threat landscape  • Expert commentary grounded in Secuna’s offensive security perspective As a company built on the principle of putting Security First, Secuna is committed not only to identifying vulnerabilities, but also to empowering organizations with the knowledge to anticipate and mitigate risk. 🛡️ Because informed organizations are resilient organizations. #Cybersecurity #CyberThreatIntelligence #CyberSecurityPH #ThreatInsights

1

Compliance is mandatory. Qualified leadership isn’t optional. As organisations prepare for requirements under the Brunei Cybersecurity Act 2024, one key question will continue to surface: Who is accountable for your cybersecurity strategy — and are they equipped to lead it? The ISACA Certified Information Security Manager (CISM) remains the global standard for professionals managing enterprise information security programmes. And the good news — registration is still open! Innov8 Labs, Brunei’s accredited training provider under ISACA, is bringing this internationally recognised certification programme this May. 📅 Date: 4 – 8 May 2026 ⏰ Time: 8:00 AM – 5:00 PM 📍 Venue: Innov8 Labs Office Why CISM is critical right now? ✅ Strengthens leadership for enterprise-wide cybersecurity programmes ✅ Supports governance frameworks aligned with national requirements ✅ Enhances incident response and organisational resilience ✅ Demonstrates capability during CII compliance assessments ✅ Bridges cybersecurity strategy with business and regulatory priorities Designed for cybersecurity officers, IT security managers, risk and compliance professionals, and decision-makers responsible for protecting CII environments. Seats are filling up — don’t miss the opportunity to lead with confidence in CII cybersecurity compliance. 🔗 Register here or scan the QR code: https://lnkd.in/gMnd-iWF Contact us for official quotations, group registrations, or corporate packages.

1

Snode’s Cyber Threat Intelligence Advisory is published weekly to assist security teams in maintaining awareness of the evolving threat landscape. That’s because cyber defence improves when intelligence is shared.   The latest advisory is available below. Read through the Advisory by scrolling through the post below.   Stay informed. Stay prepared. Defend As One.   #Cybersecurity #cyberthreatintelligence #CTI #cybersecurity #informationsecurity

9

National cyber marks may soon be required for sensitive contracts Singapore’s monetary authority (MAS) and cyber security agency (CSA) have signalled a regulatory shift that could soon require vendors to obtain national cybersecurity certifications Cyber Essentials or Cyber Trust marks before they can secure licences or participate in government tenders involving access to sensitive systems or data. This proactive stance comes in response to growing concerns about third-party supply chain risks. 📈 Business impact for across cybersecurity ecosystem - Mandatory compliance likely: Certification may become a prerequisite for vendors bidding for public contracts or engaging in regulated sectors such as finance. - Increased assurance standards: Businesses will need to align with the frameworks outlined under the Cyber Essentials (for SMEs) or Cyber Trust (for high-risk operations) marks both now expanded to include cloud, AI, and OT security. - Readiness assessment urged: Organisations handling sensitive data or seeking partnerships with public or regulated entities in Singapore should begin evaluating their current cybersecurity posture against certification requirements. - Competitive advantage: Early adopters may gain a distinct edge in procurement and licensing by signalling stronger cybersecurity governance and trustworthiness. - Government support available: CSA’s co-funded CISO-as-a-service programme supports eligible SMEs working towards cyber essentials compliance. At Eurofins Electrical & Electronics, we provide cybersecurity testing, standards compliance assessments, and technical validation services to help businesses prepare for mandatory certifications. Whether aligning with national frameworks or international benchmarks, our expertise supports secure, future-ready digital operations. 🔗 Get ahead of cybersecurity regulations and build digital trust from the ground up. Explore our cybersecurity and regulatory assessment services: https://lnkd.in/gG9_VnMm #CyberSecurityCertification #SupplyChainSecurity #CyberEssentials #CyberTrust #MAS #CSA #ThirdPartyRisk #DigitalTrust #RegulatoryCompliance #Eurofins #TestingForLife

1

Critical information infrastructure owners must report suspected advanced cyberattacks under new rules: Josephine Teo Singapore will implement new regulations requiring owners of critical information infrastructure (CII) to report any suspected incidents involving advanced persistent threats (APTs) to the Cyber Security Agency of Singapore (CSA). These rules will take effect later in 2025 amid an increased National Cyber Threat Alert Level due to an ongoing attack by the UNC3886 group, described by cybersecurity firm Mandiant as a China-linked espionage entity targeting strategic organizations worldwide. Minister for Digital Development and Information Josephine Teo emphasized the importance of early reporting to enable coordinated national responses and prevent organizations from confronting attackers alone. She highlighted the rising threat from APTs, which use sophisticated methods to gain prolonged access to critical systems, often for espionage or to develop capabilities to disrupt essential services. APT activity in Singapore has increased more than fourfold from 2021 to 2024. The CSA has engaged CII CEOs through classified briefings on the evolving threat landscape, underscoring the necessity of heightened vigilance and improved cyber hygiene. Mrs Teo stressed that cyber defense requires collective action, as attackers do not adhere to established rules. She cited international incidents where cyberattacks disrupted critical public utilities, pointing to the serious societal and economic risks. To strengthen defense capabilities, the CSA will collaborate with ST Engineering to enhance access to advanced cybersecurity tools and expertise, and support the formation of an Operational Technology special interest group under ISACA. CSA chief executive David Koh reaffirmed the agency’s commitment to working with local and global partners to share information and respond effectively to cyber threats. #AsiaRisk #CriticalInfrastructureFailure #Singapore https://lnkd.in/gSUDWBnF

🔒End-to-End Encryption with Sunnic E-Trust Plus – Simplifying MAS TRM Compliance Protecting sensitive data at every stage is a clear expectation in the MAS TRM Guidelines. Sunnic’s E-Trust Plus End-to-End Encryption delivers application-level encryption for both data-at-rest and data-in-motion, ensuring confidential information remains secure and unreadable to unauthorized parties.  👉 Read the full article below for details! #EndToEndEncryption #DataProtection #Compliance #MAS #TRM #FinancialServices #Cybersecurity #ABPGroup #Sunnic #ETrustPlus

9

Companies should stop using NRIC numbers to authenticate individuals or as passwords due to the risks of impersonation and data breaches, according to a formal advisory by PDPC and CSA. CNA Personal Data Protection Commission (PDPC) Ministry of Digital Development and Information #cybersecurity #datasecurity #databreach #singapore

5

2 Comments

New measure under the Cybersecurity Act to be implemented later in 2025. The new measure requires mandatory reporting by operators of critical systems, such as those that manage Singapore’s energy, water and transportation services, to Singapore’s Cyber Security Agency of Singapore (CSA) of suspected advanced persistent threat (APT) attacks. Source: https://lnkd.in/gaYxWtjw Feel free to contact us for professional advice at +65 66363691, +65 9326 2271 or info@lnmsolutions.com! #dataprivacy #dataprotection #ITSecurity #Networksecurity #corporatesolutions #cybersecurity #cybersecuritynews #Singapore #LNMSolutions

2

Tuesday's reading - Cybersecurity Report 2024 by Hong Kong’s Cyber Security and Technology Crime Bureau (CSTCB) — a landmark publication that offers a thorough analysis of the evolving cyber threat landscape both globally and within Hong Kong. As cyber threats grow in scale and sophistication, this report shared the key challenges facing governments, businesses, and individuals in today’s digital age. It explores emerging risks such as AI-powered attacks, supply chain vulnerabilities, and deepfake scams. It also highlighted the critical importance of protecting our digital infrastructure and personal data. Beyond identifying threats, the report emphasizes proactive defense strategies, legislative advancements, and the vital role of collaboration between law enforcement, industry, and the public. It presents actionable insights to help organisations strengthen their cybersecurity posture and cultivate resilience against an ever-changing array of cyber risks. For anyone invested in understanding the future of cybersecurity and building safer digital ecosystems, this report is an essential resource that underscores the collective effort required to safeguard our interconnected world. https://lnkd.in/g-yKHY3P #Cybersecurity #CSTCB #HongKong #DigitalSecurity #CyberThreats #AI #CyberResilience

43

2 Comments

Critical infrastructure operators in Singapore will soon be required to report suspected advanced persistent threat (APT) attacks under new measures introduced in an amended Cybersecurity Act. The move, reported by The Straits Times, was announced by Minister for Digital Development and Information Josephine Teo at a cybersecurity forum on Monday. She said the requirement — part of broader changes to the law — is expected to take effect later in 2025 and will mandate reporting to the Cyber Security Agency of Singapore (CSA). The amendment follows the recent July 18 disclosure of state-linked cyber-espionage activity by group UNC3886, believed by experts to be China-linked. It’s among several APT actors whose targeting of Singapore’s critical systems has surged more than four-fold between 2021 and 2024. “If organisations suspect they’ve been targeted, they cannot and should not confront the attackers on their own,” said Teo during the fifth Operational Technology Cybersecurity Expert Panel forum. “These requirements will support the early detection of APT activities, and enable CSA to take more timely actions, together with other government agencies, to defend CII owners against the attacks.” APT actors are often state-sponsored and operate with significant resources, using stealthy tools to infiltrate high-value networks, steal data, or disrupt essential services. Singapore’s 11 critical information infrastructure (CII) sectors include energy, water, land transport, healthcare, and government systems. Other sectors are aviation, maritime, security and emergency services, banking and finance, maritime, as well as infocomm. The Act was previously amended in 2024 to expand CSA’s oversight to cloud and supply chain risks. CII operators are now required to report not only direct attacks but also any disruption stemming from service providers or third parties. With the latest revision, temporary systems supporting major events — such as vaccine distribution or international summits — will also fall under CSA’s purview. This marks the first time Singapore has publicly acknowledged specific APT threats. “We want the public to know these threats are real,” said Teo, citing recent global incidents including a Ukrainian malware attack that cut heating to 600 homes, and a breach in Norway that caused a dam to release seven billion litres of water. “The threats you face are no longer simple ransomware attacks. APTs have you in their sights,” she warned CII operators. In response to the heightened threat level, CSA has convened a closed-door briefing with CII leaders and is ramping up collaboration across sectors. #medicolegal #healthcare #mlsm

1

IntroSecurity ASEAN Warns Enterprises of Emerging Cybersecurity Risks from ChatGPT-5 The release of ChatGPT-5 has generated excitement, but also new cybersecurity risks that organisations cannot afford to overlook. Independent research has already revealed weaknesses in jailbreak resistance, model routing, and zero-click exfiltration attacks, alongside wider ecosystem threats such as malware disguised as ChatGPT apps. At IntroSecurity ASEAN, we believe it is critical for business leaders and CISOs across Southeast Asia to understand these risks now - before adversaries exploit them at scale. We’ve published a press release outlining the key concerns and our recommendations for how enterprises can defend against these emerging threats. Read more here https://lnkd.in/dKzfZrNR

6

TB-CERT Cybersecurity Annual Conference 2025 – A Strong Close with Practical Fraud Defense 🇹🇭 Day 2 of the TB-CERT Cybersecurity Annual Conference 2025 concluded with a well-attended and oversubscribed workshop delivered by SoftScheck APAC’s Director of Enterprise Security, Tyler Tang: “Designing Cyber Resilience: Addressing Fraud through Threat Modeling.” In this interactive session, participants examined real-world fraud cases where millions were lost and regulations tightened, before diving into how threat modeling can be applied to identify vulnerabilities, outthink fraud tactics, and design resilient controls that strengthen enterprise defences. This workshop equipped attendees with not only the tools to reassess their current fraud-prevention strategies, but also practical frameworks that can be embedded into their day-to-day security operations. The close of Day 2 highlighted the conference’s central theme: cyber resilience as the cornerstone of trust in the digital economy. By combining innovation, collaboration, and practical strategies, organisations can better prepare for evolving threats and secure long-term growth. SoftScheck is proud to have played a role in these important conversations, and we look forward to continuing our mission of building stronger, more resilient organisations across the Asia-Pacific region. #softScheckAPAC #Cybersecurity #CyberResilience #ThreatModeling #FraudPrevention #EnterpriseSecurity #FinancialServicesSecurity #TBcert2025 #AI #SGCybersecurity

30

Cybersecurity losses don’t start with headlines 🚨 They start with a phishing email, a weak password, or an unpatched system 🔓 Today, the average cost of a breach exceeds USD 4.8M, and in large organizations it can reach USD 15M per incident 💸 Yet many companies still act only after the damage is done. In our latest blog, “Avoid multimillion-dollar losses: the power of prevention in cybersecurity,” Alejandra Vázquez and María Fernanda Márquez share their analysis—using data from the last five years—on why a proactive security strategy delivers measurable ROI 📊 From cost comparisons between proactive vs. reactive models to real savings in operational time, the numbers are clear: prevention is not an expense, it’s a business decision. If your organization depends on digital operations (and it does), this read is for you. 👉 Read our blog: ESP: https://lnkd.in/et34k98z ENG: https://lnkd.in/ek57Avm8 #Batuta #Cybersecurity #ProactiveSecurity #EndpointSecurity #RiskManagement #BusinessContinuity

12

🚨 New Nation-State Threat Alert 🚨 A Chinese APT group has been observed deploying EggStreme, a sophisticated fileless malware, to infiltrate Philippine military systems. 🔎 Key Insights: • Fileless malware like EggStreme operates in-memory, leaving minimal forensic footprints. • Targets critical defense infrastructure, aiming for long-term persistence and intelligence gathering. • Reflects the growing trend of APTs leveraging stealthier techniques to evade traditional defenses. 💡 Takeaway for Security Leaders: This campaign highlights the urgent need for behavioral detection, memory monitoring, and threat hunting capabilities beyond signature-based tools. 🌍 In today’s threat landscape, cyber warfare and geopolitics are inseparable — making national defense and enterprise security more intertwined than ever. #Cybersecurity #APT #ThreatIntelligence #Malware #FilelessAttack #Philippines #CyberDefense

2

1 Comment