Loading news
Cybersecurity coverage about Malaysia from specialist security press and local media. Strict rule: every item names Malaysia or a Malaysian entity and a cyber topic. Monitored specialist sources with zero relevant matches are listed openly, never filled with unrelated world news.
A red team acts like an adversary, but only with written permission and a defined scope. The goal is to test detection and response: can the defenders notice, contain, and recover. Typical work includes scoped penetration tests, phishing simulations against staff who agreed to take part, and reviews of exposed services.
Authorised testing stays inside the permission letter: named systems, agreed dates, agreed methods. Anything outside that scope is treated the same as any other unauthorised access. Malaysia addresses computer misuse through the Computer Crimes Act 1997, protects personal data through the PDPA, and sets national cyber duties through the CyberSecurity Act 2024. When in doubt, the rule is simple: no written permission means no testing.
When you read a breach story on this site, ask what a scoped test would have caught first: the unpatched service, the leaked credential, or the slow response. Use the lens to learn defence, not to copy the attack.
White hats find weaknesses to fix them. This covers security engineers, analysts, and independent researchers who report flaws through proper channels and give owners time to patch. Typical work includes monitoring, incident response, hardening systems, and coordinated vulnerability disclosure.
Good intent does not grant access. Even well meant probing of systems you do not own can fall under the Computer Crimes Act 1997 if it exceeds authorised access. Report through the owner or through MyCERT, keep evidence of your steps, and do not extract or publish personal data, which the PDPA protects.
Use advisories on this site as patching checklists. Match each MyCERT advisory against your own systems, prioritise what is actively exploited, and track that the fix is deployed, not just planned.
Black hats break into systems without permission for profit, leverage, or disruption: ransomware, data theft, fraud, and extortion. This site describes such incidents as news. It does not provide operational attack guidance, and nothing here should be read as instructions.
Unauthorised access, data theft, and extortion are criminal. Malaysia prosecutes computer misuse under the Computer Crimes Act 1997, with related duties under the CyberSecurity Act 2024 and data protection duties under the PDPA. Victims can report to the police and to MyCERT.
Read black hat stories for impact and method at a high level: who was affected, what failed, how long recovery took. Then convert each lesson into a defensive action: backups tested, patches applied, access reviewed.
This site covers attacks as news and defence as practice. It never publishes step by step intrusion instructions.
Curated security tools and learning repos a defender can use. Every entry was verified against the GitHub API at collection time.