A hacker group calling itself NEXUSEC says it broke into two Cambodian state institutions: the National Council of Science, Technology and Innovation (NCSTI) and the investor portal of the Cambodia Securities Exchange (CSX). It claims to have stolen administrator credentials, policy documents, investor personal data and, in one account, more than 18,000 database records. Neither the Cambodian government nor either institution has confirmed the intrusions, and no regulator or national CERT statement has been published. The size of the alleged theft is also disputed. CambodiaHelp, citing the Chinese-language channel "Sihanoukville Diary", reports more than 18,000 exfiltrated records. The 0x0 breach blog, working from a translated summary by the Chinese threat-intel feed libaisec CTI, describes the NCSTI leak as a database of just 40 user records. Until a victim or authority speaks, read every figure here as the attacker's claim.
What Happened
According to 0x0, NEXUSEC disclosed the NCSTI breach on November 11, 2026. CambodiaHelp reported the wider claim a day later. It says the group named both NCSTI and the CSX investor portal as victims and claimed it had planted backdoors in both for future access.
CambodiaHelp's report also says weaknesses were found in ten subdomains belonging to Cambodia's National Center for HIV/AIDS, Dermatology and Venereal Disease (NCHADS). These include open debug logs, admin panels with no access restrictions, and weak encryption settings. The report does not say clearly whether NEXUSEC made this finding or whether anything was taken from NCHADS.
The claim comes during a rough few weeks for Cambodian public-sector security. On October 28, KPS-TV reported that a different actor, using the alias "DaOnlySpark", had claimed to exploit a remote code execution flaw against several institutions:
- the Cambodia Academy of Digital Technology (about 5.8GB of source code, student and staff records, payment API credentials and system keys)
- the Ministry of Interior (records on 1,498 officials, 395 system accounts and 3,912 identity and family documents)
- the Ministry of Commerce (an internal network map)
- the National Employment Agency (more than 25,000 résumés and data on 8,185 companies)
Cambodian authorities have not confirmed those incidents either. Nothing published so far connects DaOnlySpark to NEXUSEC.
What Was Taken
Accounts of the haul vary by institution and by who is reporting it.
- NCSTI: CambodiaHelp reports stolen administrator credentials, the national technology roadmap and more than 18,000 database records. 0x0, citing libaisec CTI, describes a 40-record user database that includes admin accounts and profiles from a national talent directory, with personal details, contact information and login credentials. 0x0 adds that government policy documents, technology roadmaps and research funding plans were exposed. The gap between 40 and 18,000+ is large. One explanation is that the larger figure covers several tables or both victims, but no source says so.
- CSX investor portal: CambodiaHelp reports that the group claims to hold names, email addresses and phone numbers of "thousands of investors". No exact count has been given, and no sample has been independently checked in public reporting.
- NCHADS: CambodiaHelp describes this as exposure (debug logs and open admin panels), not confirmed theft. Even so, any leak from an HIV and sexual-health agency would be highly sensitive.
The investor data matters most for ordinary people. Names, emails and phone numbers tied to a confirmed securities account are well suited to targeted investment scams and account-takeover phishing.
Why It Matters
Alleged persistent access is worse than the data. Both CambodiaHelp and 0x0 say the attackers left backdoors behind. 0x0 specifically names a PHP webshell and a command execution backdoor on the NCSTI server. If that is true, the data already taken may matter less than the access that remains, especially at a stock exchange.
Cambodia's financial sector is fragile to rumour. The Kouprey newsletter reported in October that the National Bank of Cambodia had issued another statement denying rumours about bank health. The NBC threatened legal action against people spreading false information, after a year of liquidations and deposit restrictions. Kouprey also noted that reports of a South Korean data breach involving KB Kookmin, the parent of KB Prasac, had circulated in Khmer-language Facebook posts during that period. In that climate, a claimed securities exchange breach that goes unanswered can cause damage whether or not it is true. Fast, factual disclosure is the best defence.
The claims follow a pattern. Several Cambodian agencies have been named as victims within about three weeks: CADT, the Interior and Commerce ministries, NEA, NCSTI, CSX and NCHADS. Every one of these claims has surfaced first through Chinese-language Telegram channels or threat-intel feeds rather than official disclosure. Some leaked data has held up to scrutiny. In its October 26 analysis of the NEA leak, 0x0 found that record counts matched the hackers' claims. The leak also contained official NEA page templates and identifiers matching the structure of nea.gov.kh URLs. That does not prove the NEXUSEC claims are real, but defenders should not dismiss them.
The Attack Technique
No technical details of how NEXUSEC got in have been published. Only one detail comes from reporting on this incident: 0x0's mention of a PHP webshell and command execution backdoor on NCSTI infrastructure. CambodiaHelp's description of open debug logs, unrestricted admin panels and weak encryption on NCHADS subdomains points to exposed, poorly configured web applications rather than an advanced exploit.
That fits the methods that recent security advisories describe as working on internet-facing government systems:
- CISA advisory AA26-281A (October 8, 2026) describes Chinese state-linked actors combining automated scanning, botnets, cross-site scripting and password spraying with hands-on exploitation of old, known CVEs. Some of those CVEs date back to 2014.
- Huntress (November 9, 2026) documents attackers exploiting an authentication bypass and an unauthenticated RCE flaw in AhsayCBS backup consoles (CVE-2026-105133 and CVE-2026-105134). The attackers then placed several webshell families, including one that hides encrypted payloads inside PNG images, and went after backup credentials.
- Kaspersky's Securelist (November 5, 2026) shows how a webshell running entirely in memory inside an IIS worker process, delivered through the SharePoint ToolShell flaws, left almost no trace on disk.
None of these reports mentions NEXUSEC or Cambodia, and they should not be read as attribution. They do show that "webshell plus backdoor" claims are realistic, and that this kind of access can be hard to find without deliberate hunting.
What Organizations Should Do
- Hunt for webshells now, not after confirmation. Cambodian public bodies, and any partners with integrations into NCSTI or CSX systems, should search web roots for unexpected PHP, JSP and ASPX files. They should also check for odd child processes spawned by web server workers and for in-memory implants, not just files on disk.
- Reset privileged credentials and enforce MFA. Administrator credentials were reportedly taken, so rotate admin, service and API credentials on affected portals. Require multifactor authentication everywhere it is supported, as CISA recommends.
- Lock down admin panels and debug output. Take admin interfaces off the public internet or put them behind a VPN or allowlist. Turn off debug logging in production and retire weak TLS settings across all subdomains, not only the main site.
- Warn investors before the scammers reach them. CSX and its member brokers should tell investors directly that phishing calls, texts and emails referring to their accounts are likely, and explain how to verify genuine contact.
- Patch internet-facing software and protect backups. Prioritise known-exploited flaws in web applications, VPNs and backup consoles. Keep backup infrastructure separate from production credentials.
- Say something. In a market already sensitive to rumour, a short holding statement confirming that an investigation is underway does far less harm than silence while leak claims spread.
Sources: Hackers Claim Breach of Cambodian Government Systems | Chinese Government-linked Cyber Threat Actors Combine Automated and... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and... | National Council of Science, Technology and Innovation of Cambodia... | Official Records, Job Resumes and System Keys Reportedly Leaked Acr... | Cambodia National Employment Agency Data Breach Threat Intelligence... | NBC quells persistent banking rumors - Kouprey