16-31 July Cyber Attacks Timeline

Last Updated on August 22, 2017

Here we go with the second timeline of July (first part here) covering the main cyber attacks occurred between July 16 and 31. A fortnight so rich of events, that I really do not know where to start from…

So, it looks like cryptocurrency is the new frontier for cybercriminals since this fortnight has recorded three attacks directed towards cryptocurrency exchange organizations (or their users): CoinDash, Veritaseum and the users of Parity’s Ethereum will remember this July for a long time.

But despite all this attention towards cryptocurrency, the megabreaches are not over… This fortnight has revealed the occurrence of a massive breach against the Kansas Department of Commerce and the discovery of over 40 million US voter records from nine states in an underground market called RaidForums.

And while the level of attention towards the Russian activity in the cyber space is always high (Reuters have revealed that Russian intelligence agents attempted to spy on President Emmanuel Macron’s election campaign earlier this year by creating phony Facebook personas), new and all threat actors emerge (like DarkHotel, an old acquaintance; SpringDragon, targeting some high-profile organizations around the South China Sea; CopyKittens, targeting several countries including Israel, Saudi Arabia, the United States, Germany, Jordan and Turkey; CobaltGipsy (a group allegedly linked to Iran); and FIN7, targeting a US-based restaurant chain.

Other interesting events include: the discovery of two attacks against Unicredit, the main Italian bank (400,000 records compromised), an attack against a FireEye analyst, the leak of an episode of Game of Thrones, part of a trove of 1.5 TB of data stolen from HBO, and an endless trail of campaigns against Android users: GhostCTRL, Stantinko, Lipizzan, a version of Triada “bundled” with some cheap Chinese devices, and Svpeng.

As usual scroll down the whole list for all the events happened in this fortnight. And if you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015 and 2016 (regularly updated). You may also want to have a look at the Cyber Attack Statistics that are regularly published, and follow @paulsparrows on Twitter for the latest updates.

Additionally, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts), and if useful, you can access the timeline in Google Sheet format.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country
1	16/07/2017	?	South Carolina's Voter Registration System	According to a post-election report by the South Carolina State Election Commission, South Carolina's voter registration system was reportedly hit by almost 150,000 hack attempts on Election Day 2016.	>1	Government	CW	US
2	16/07/2017	?	Twitter users	ZeroFOX Threat Research reveal the details of a large-scale, spam pornography botnet on Twitter dubbed SIREN	Account Hijacking	Single Individuals	CC	>1
3	17/07/2017	?	UK Energy Sector	The National Cyber Security Centre (NCSC), part of the UK's intelligence agency GCHQ, issues a warning about hackers targeting the country's energy sector, and says that some industrial control system organizations are likely to have been successfully compromised.	Targeted Attack	Utility: Energy	CW	UK
4	17/07/2017	?	CoinDash	An unknown hacker takes over the official website of the CoinDash platform and modifies an Ethereum wallet address during the company's ICO (Initial Coin Offering) being able to steal $7 million worth of Ethereum.	Unknown	Cryptocurrency Exchange	CC	US
5	17/07/2017	?	Android Users	Trend Micro reveals the details of GhostCtrl, an Android malware able to take control of devices to spy, steal and do its bidding.	Malware	Single Individuals	CC	>1
6	17/07/2017	?	Customers of international and U.S.-based financial institutions.	Researchers from Flashpoint observe a new, Necurs-powered Trickbot spam campaign developed to target and infect customers of international and U.S.-based financial institutions.	Malware	Finance	CC	>1
7	18/07/2017	?	Women’s Health Care Group of PA (WHCGPA)	Women’s Health Care Group of PA (WHCGPA) reveals to have been hit by ransomware on May 16, 2017. 300,000 patient records are affected.	Malware	Healthcare	CC	US
8	18/07/2017	?	KQED	KQED, a San Francisco radio station is still recovering from a ransomware attack, nearly one month after.	Malware	Org; Non-Profit	CC	US
9	18/07/2017	?	Sarah Hyland	Nude photos and video of Sarah Hyland are leaked online.	Account Hijacking	Single Individual	CC	US
10	19/07/2017	DarkHotel	Political figures and senior business users	Bitdefender reveals a new high-level spear-phishing attack targeting political figures and senior business users. Dubbed 'Inexsmar', the attack appears to be operated by the DarkHotel group, which has been perpetrating similar threats since 2007.	Targeted Attack	Single Individuals	CE	>1
11	19/07/2017	?	Individuals using Parity's Ethereum wallet	A vulnerability in Parity's Ethereum wallet software is exploited by thieves to rob victims on a massive scale. Targeted accounts are drained of 150,000 coins worth just over US$30 million at the current price.	Vulnerability	Single Individuals	CC	>1
12	19/07/2017	?	Loblaws	According to an email sent out to Loblaws account holders, the security of a ‘small number’ of accounts has been compromised, marking the second time the company has suffered a security breach this year. Comprised websites include Loblaws.ca, Joefresh.com and Beautyboutique.ca, as well as other Loblaws grocery chain websites.	Unknown	Industry: Retail	CC	CA
13	20/07/2017	?	Kansas Department of Commerce	A security breach in the Kansas Department of Commerce exposes millions of Social Security numbers from people across 10 states to hackers. Many other accounts are also attacked.	Unknown	Government	CC	US
14	20/07/2017	?	Newcastle University	Newcastle University issues an alert, warning prospective students to be careful when seeking to apply and pay online for courses, after discovering the existence of a sophisticated phishing scam.	Account Hijacking	Education	CC	UK
15	20/07/2017	?	Android Users	According to a new report released by ESET, over 500,000 users have had their computers infected with a stealthy malware named Stantinko.	Malware	Single Individuals	CC	>1
16	21/07/2017	?	Bank of America customers	A new campaign targets Bank of America customers via emails pretending to be from representatives of the Bank of America.	Account Hijacking	Finance	CC	US
17	21/07/2017	?	University of Vermont Medical Center	University of Vermont Medical Center notifies 2,300 patients of a phishing incident occurred back in May 2017.	Account Hijacking	Healthcare	CC	US
18	23/07/2017	chikri95	Kylie Jenner's Snapchat account	Kylie Jenner's Snapchat account is hacked. The attacker claims to reveal nude pictures.	Account Hijacking	Single Individual	CC	US
19	23/07/2017	@headassgang	Victoria Justice's Twitter account	Victoria Justice's Twitter account is hacked. The attacker claims to reveal nude pictures.	Account Hijacking	Single Individual	CC	US
20	24/07/2017	?	Veritaseum	Another day another Ethereum related breach. This time the target is Veritaseum, whose Initial Coin Offering (ICO) suffers a data breach in which around US$8.4 million worth of Ethereum are stolen.	Unknown	Cryptocurrency Exchange	CC	US
21	24/07/2017	Spring Dragon	Some high-profile organizations around the South China Sea.	Kaspersky Lab reveals the details of a new wave of attacks carried on by a long running APT actor dubbed Spring Dragon.	Targeted Attack	>1	CE	CN
22	25/07/2017	?	Over 110,000 people from Edinburgh	Cybercriminals have reportedly been found selling personal information of over 110,000 people from Edinburgh on an unspecified dark web marketplace	Unknown	Government	CC	UK
23	25/07/2017	Logan	Over 40 million US voter records	A dark web vendor is reportedly selling over 40 million US voter records from nine states in an underground market called RaidForums. The data being sold allegedly includes full names, addresses, voter IDs, voter status and party affiliations.	Account Hijacking	Government	CC	US
24	25/07/2017	CopyKittens	Several countries including Israel, Saudi Arabia, the United States, Germany, Jordan and Turkey	Trend Micro reveals the details of a new massive cyber espionage campaign called "Operation Wilted Tulip", carried on by CopyKittens, an Iran-linked cyber espionage group targeting several countries including Israel, Saudi Arabia, the United States, Germany, Jordan and Turkey.	Targeted Attack	>1	CE	>1
25	25/07/2017	?	Single Individuals	Kaspersky Lab analysts detect CowerSnail, a malicious program for Windows apparently created by the same group responsible for SambaCry.	Malware	Single Individuals	CC	>1
26	25/07/2017	?	942,609 Yorkshire people	The Yorkshire Post reveals that the personal data of 942,609 Yorkshire people is listed for sale on an underground marketplace.	Account Hijacking	Single Individuals	CC	UK
27	26/07/2017	?	Android Users	Google discovers a new family of spyware called Lipizzan containing references to a cyber arms company called Equus Technologies.	Malware	Single Individuals	CE	>1
28	26/07/2017	?	UniCredit	UniCredit SpA, Italy’s No. 1 bank, says that hackers took biographical and loan data from 400,000 client accounts. The attack occurred in September and October of 2016 and June and July of this year.	Unknown (third party breach)	Finance	CC	IT
29	27/07/2017	Russia?	Macron Campaign	Reuters reveals that Russian intelligence agents attempted to spy on President Emmanuel Macron's election campaign earlier this year by creating phony Facebook personas.	Account Hijacking	Government	CE	FR
30	27/07/2017	?	Virgin America	Virgin America confirms that a hacker broke into its corporate network earlier this year on March 13.	Unknown	Industry: Airline	CC	US
31	27/07/2017	CobaltGipsy (a group allegedly linked to Iran)	Several entities in the Middle East and North Africa with a focus on Saudi Arabian organizations	Securworks reveal the details of a group, allegedly linked to Iran, dubbed "Cobalt Gypsy", reportedly using well-established fake online personas of attractive women to befriend targets, gain their trust and later dupe them into opening malicious software that could provide hackers with "full access" to private computer networks.	Targeted Attack	>1	CE	>1
32	27/07/2017	?	Critical Infrastructures	The Epoch Times reveals that an underground dark web marketplace, dubbed CMarket, is selling access to the private computer networks of critical infrastructure targets, including power plants, government departments, hospitals, financial firms and airlines in exchange for bitcoin	Unknown	>1	CC	>1
33	27/07/2017	?	Unnamed Canadian Organization	Cytelligence reveals that an undisclosed Canadian organization has reportedly paid criminals $425,000 in bitcoin after its systems were crippled in a ransomware attack.	Malware	N/A	CC	CA
34	28/07/2017	?	CIA	WikiLeaks publishes three new alleged CIA hacking tools as part of its new Vault 7 dump.	Unknown	Government	H	US
35	28/07/2017	?	Plastic Surgery Associates	Plastic Surgery Associates reveals that a data breach may have compromised patient records after it was hit with a ransomware attack earlier this year on 12 February.	Malware	Healthcare	CC	US
36	28/07/2017	?	Bharat Sanchar Nigam Limited (BSNL) and Mahanagar Telephone Nigam Limited (MTNL)	The author of the BrickerBot malware claims responsibility for a cyber-attack that took place in various Indian states and causes over 60,000 modems and routers to lose Internet connectivity.	Malware	Industry: Telco	CC	IN
37	28/07/2017	?	Android Users	Security researchers from Dr.Web find the Triada malware inside the firmware of several low-cost Android smartphones, such as Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20.	Malware	Single Individuals	CC	>1
38	28/07/2017	?	WestJet	WestJet says it is working with police in Calgary and the RCMP cybercrime unit after some members' profile data were disclosed online.	Unknown	Industry: Airline	CC	CA
39	31/07/2017	?	HBO	HBO joins the ranks of Hollywood entertainment companies to suffer a major cyber attack. The company network is compromised and the attacker claim to have stolen 1.5 TB of data. Few days after they leak an episode of the new season of Games of Thrones	Unknown	Industry: Entertainment	CC	US
40	31/07/2017	?	Android Users	Kaspersky Lab reveals the details of a new variant of the Svpeng trojan working as a keylogger and stealing data through the accessibility services.	Malware	Single Individuals	CC	>1
41	31/07/2017	?	Mandiant (a FireEye company)	A Mandiant threat intelligence analyst is the victim of Operation #LeakTheAnalyst. Attackers infiltrate his computer for more than a year and leak some internal data.	Targeted Attack	Industry: Information Security	CC	US
42	31/07/2017	?	Wix.com	Website-building service Wix.com reveals to have been the subject of a massive cyber-attack in April 2016 when a botnet of rogue Chrome extensions was creating Wix websites to spread itself to new users.	Malware	Industry: Internet Services	CC	US
43	31/07/2017	FIN7	U.S.-based chain restaurants	ProofPoint researchers reveal that the threat actor commonly referred to as FIN7 has added a new JScript backdoor called Bateleur and updated macros to its toolkit to target U.S.-based chain restaurants.	Targeted Attack	Industry: Restaurants	CC	US
44	31/07/2017	?	Copyfish Chrome Web Store Account	Phishers hack Copyfish, an extension for Google Chrome, after compromising the Chrome Web Store account of German developer team a9t9 software and abuse to distribute spam messages to unsuspecting users.	Account Hijacking	Single Individuals	CC	DE

Related Posts

Like this:

Leave a Reply Cancel reply