1-15 August 2017 Cyber Attacks Timeline

Last Updated on August 30, 2017

Eventually I have been able to catch up and now I am proud to publish the first timeline of August covering the main cyber attacks occurred between 1-15 August.

At least for once, the timeline does not report any mega-breach (that’s something!) however a new trend is emerging and is the ability, for the criminals to compromise browser add-ons (there have been multiple cases reported in this period).

Another interesting emerging trend is the compromise of software updates of legitimate applications: this time it has been the turn of NetSarang and npm (the node.js management package)

Threat actors do not take vacations though: APT28, for instance, is always on the spot (this time the group has been using the infamous Eternal Blue vulnerability to target people of interest as they connect to hotel guest wi-fi networks). Other interesting events include: a brute force attacks against the Scottish Parliament, a campaign against Russian-speaking enterprises, the discovery that North Korean organizations are still targeted by an unknown organization using the Konni malware, and a new wave of attacks by the Lazarus Group against individuals involved with US Defense contractors.

Last but not least, some crooks found the time to hijack Ariana Grande Instagram account.

As usual scroll down the whole list for all the events happened in this fortnight. And if you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015 and 2016 (regularly updated). You may also want to have a look at the Cyber Attack Statistics that are regularly published, and follow @paulsparrows on Twitter for the latest updates.

Additionally, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts), and if useful, you can access the timeline in Google Sheet format.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country
1	01/08/2017	?	University of California Los Angeles	UCLA reports a cyberattack against a Summer Sessions & International Education Office server that contains personal information provided by students. The attack happened on May 18 and affects potentially up to 32,000 students.	Unknown	Education	CC	US
2	01/08/2017	?	Chinese Telecom Firm	The Kaspersky Lab Q2 2017 DDoS Intelligence Report reveals the details of a DDoS attack launched against a Chinese Telecom Firm, lasting for 11 days.	DDoS	Industry: Telco	CC	CN
3	01/08/2017	?	Single Individuals	Malware researcher Jakub Kroustek from Avast discovers an anti-Israel and pro-Palestinian data wiper dubbed IsraBye.	Malware	Single Individuals	CC	IL
4	01/08/2017	?	Big Screen in Cardiff's Queen Street	A big screen in Cardiff’s main shopping street, Queen Street, is reportedly hacked with images of swastikas and messages about ‘Shariah’ appearing.	Unknown	Billboard	CC	UK
5	01/08/2017	?	Users of Node.js	A two-week-old campaign to steal developers' credentials using malicious code distributed through npm, the Node.js package management registry, is halted with the removal of 39 malicious npm packages.	Malware via Typosquatting	Single Individuals	CC	>1
6	01/08/2017	?	Kaleida Health	Kaleida Health notifies 2,789 patients about a phishing incident happened on May 24.	Account Hijacking	Healthcare	CC	US
7	02/08/2017	?	Chrome Web Store Account for Web Developer	The Chrome Web Store Account for Web Developer, a popular extension, is compromised via a phishing trick, and pushes adware to millions.	Account Hijacking	Single Individuals	CC	US
8	03/08/2017	Ne0-H4ck3r	Pakistan.gov.pk	An Indian hacker going by the online handle of Ne0-H4ck3r defaces the official government portal of Pakistan (Pakistan.gov.pk), leaving a deface page along with a message and a patriotic Indian song.	Defacement	Government	CW	PK
9	04/08/2017	?	Ariana Grande Instagram account	Ariana Grande is the latest celebrity that gets hacked. This time her Instagram account is hacked.	Account Hijacking	Single Individuals	CC	US
10	06/08/2017	?	Surgical Dermatology Group	Surgical Dermatology Group notifies patients after its cloud hosting and server management provider TekLinks discovers a security breach dating back to March 23, 2017.	Unknown	Healthcare	CC	US
11	07/08/2017	?	Ukrposhta (Ukraine National Postal Service)	The website for Ukraine's national postal service Ukrposhta was recently taken down by DDoS attacks for two days in a row, Interfax reports.	DDoS	Government	CC	UA
12	07/08/2017	?	Steve Weichert Twitter Account	Steve Weichert, a politician running for District 17’s State Senate Seat in the 2018 election reveals that his Twitter account has been hacked. The alleged attackers post pornographic content.	Account Hijacking	Single Individuals	CC	US
13	07/08/2017	The Binary Guardians	About 40 Venezuelan websites including those of the government, the Supreme Court and the legislature.	A hacking collective called The Binary Guardians defaces roughly 40 Venezuelan websites including those of the government, the Supreme Court and the legislature.	Defacement	Government	H	VE
14	07/08/2017	?	Russian Speaking Enterprises	Trend Micro reveals the details of a malicious email campaign against Russian-speaking enterprises, employing a combination of exploits and Windows components to deliver a new backdoor leveraging CVE-2017-0199.	Targeted Attack	Industry: >1	CE	RU
15	07/08/2017	Turkish hackers	Several Armenian Websites	Turkish hackers continue to target Armenian websites. The list of the targets involved in the latest spree of attacks includes the official website of the Development Foundation of Armenia and the official website of the Civil Service Council of Armenia.	Unknown	Government	CW	AM
16	08/08/2017	?	Several North Korean Organizations	Researchers from Cylance reveal that North Korean organisations are being increasingly targeted by an unknown hacker group, using the Konni malware, a remote access trojan (RAT). In 2017 alone, three separate campaigns targeting North Korean organisations have been spotted.	Malware (Konni)	>1	CW	KP
17	08/08/2017	?	Three major banks in Hungary	The National Bank of Hungary reveals that hackers have been targeting three major banks in Hungary with a slew of phishing attempts.	Account Hijacking	Finance	CC	HU
18	09/08/2017	?	Corporations in Brazil and Saudi Arabia	Researchers at Kaspersky Lab reveal that a new run of Mamba infections have been spotted again in Brazil and Saudi Arabia.	Malware	>1	CC	BR SA
19	09/08/2017	?	Kenya Electoral Commission IT System	Kenya opposition presidential candidate Raila Odinga claims the electoral commission's IT system has been hacked to manipulate the election results.	Account Hijacking	Government	CC	KE
20	11/08/2017	APT28	Hotel Wi-Fi Users	Researchers from FireEye reveal that APT28 AKA Fancy Bear have been using the infamous Eternal Blue vulnerability in a campaign that targeted people of interest as they connected to hotel Wi-Fi networks.	Targeted Attack	>1	CE	>1
21	11/08/2017	?	Single Individuals	SophosLabs warn of a fresh spike of attacks due to new variants of the well known Emotet malware.	Malware	Single Individuals	CC	>1
22	12/08/2017	Anonymous	Official website of Charlottesville	The Anonymous claim responsibility for carrying out a DDoS attack on the official website of Charlottesville city Virginia. The attack is conducted under the banner of #OpDomesticTerrorism	DDoS	Government	H	US
23	12/08/2017	Unknown Iraqi developer	Android users	Researchers from mobile security firm Lookout say they found at least three Android apps on the Google Play Store containing a form of advanced spyware they believe was created by an Iraqi developer. The malware author modified a version of the official Telegram app.	Malware	Single Individuals	CC	>1
24	13/08/2017	?	Blizzard Entertainment	The web servers of Blizzard Entertainment suffer a series of massive distributed denial-of-service (DDoS) attacks	DDoS	Industry: Video Games	CC	US
25	14/08/2017	31337	FireEye	A group of hackers called 31337 leaks a second dump of data allegedly stolen from security company FireEye.	Account Hijacking	Industry: Information Security	CC	US
26	14/08/2017	The Lazarus Group	Individuals involved with US Defense Contractors	Researchers from Palo Alto Networks reveal the details of a new operation carried on by the North Korea-linked Lazarus Group against individuals involved with US Defense Contractors.	Targeted Attack	Industry: US Defense Contractor	CE	US
27	14/08/2017	?	7 Chrome Extensions	Researchers from ProofPoint reveal that seven additional Chrome Extensions have been compromised after their author’s Google Account credentials were stolen via a phishing scheme.	Account Hijacking	Single Individuals	CC	>1
28	15/08/2017	? (Chinese Attackers)	NetSarang	Researchers at Kaspersky Lab find a well-hidden backdoor in NetSarang's server management software. It is assumed someone (allegedly from China) managed to hack into NetSarang's operations and silently insert the backdoor ShadowPad.	Malware	Industry: Software	CE	KR
29	15/08/2017	?	Scottish Parliament	Officials reveal that the Scottish Parliament has been targeted by a "brute force" cyber attack. The attack, from "external sources", was similar to that which affected Westminster in June.	Brute Force	Government	CE	UK
30	15//08/2017	Unnamed Nigerian criminal	4,000 organizations worldwide	Researchers from Check Point reveal the details of an operation targeting 4,000 organizations worldwide, carried on by an unnamed Nigerian criminal under the motto "Get Rich or Try Dying".	Malware	>1	CC	>1

Related Posts

Like this:

Leave a ReplyCancel reply