16-31 August 2017 Cyber Attacks Timeline

Last Updated on September 6, 2017

August’s gone (and the Summer with it unfortunately)… You are ready to start your usual activities after, hopefully, having recharged the batteries. So why don’t you spend a few minutes to scroll down the second timeline of August (first part here), covering the main cyber attacks occurred between August 16th and 31st.

Actually, I do not remember such a troubled fortnight since a while, it simply looks like crooks never take any personal time off, and this ended up in a timeline with 60 events.

Unfortunately, the list of mega breaches is growing as well: the victims of this fortnight include: the NHS (an affiliated to the anonymous collective claims to have stolen 1.2 million records), the second-hand electronics retailer CeX (2 million customers affected), and also Instagram where an API vulnerability allowed the attackers to allegedly steal 6 million records.

And while a misconfigured spambot has leaked a trove of 700 million email addresses, the MacEwan University has lost $11.8 million after a classical Business Email Compromise.

This fortnight has also been characterized by the leak of more private photos of other celebrities (the Fappening 2017) including: Tiger Woods, Katharine McPhee, Lindsey Vonn, Miley Cyrus, Kristen Stewart, Stella Maxwell and Dakota Johnson: and by the OurMine collective, that was also particularly active. The list of the social media accounts hijacked by them include HBO, and two iconic football teams like Barcelona and Real Madrid (rivals also when hacking is concerned).

The list of operations carried on by state-sponsored actors is pretty long (first spoiler: it includes two old acquaintances like Turla and APT28), and also the malware infections do not seem to recede (second spoiler: LG had to shut down some parts of its network after a WannaCry infection).

As usual scroll down the whole list for all the events happened in this fortnight. And if you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015 and 2016 (regularly updated). You may also want to have a look at the Cyber Attack Statistics that are regularly published, and follow @paulsparrows on Twitter for the latest updates.

Additionally, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts), and if useful, you can access the timeline in Google Sheet format.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country
1	16/08/2017	OurMine	Several HBO Twitter Accounts	Several HBO Twitter accounts are taken over by the notorious OurMine hacking group, posting #HBOHacked messages and warnings about security. Affected accounts include the main HBO Twitter account, as well as those for TV shows including Game of Thrones and Girls.	Account Hijacking	Industry: Broadcast	CC	US
2	16/08/2017	?	OSHA (Occupational Safety and Health Administration)	OSHA suspends user access to the Injury Tracking Application (ITA) after the Department of Homeland Security notifies the Department of Labor of a potential compromise of user information.	Unknown	Government	CC	US
3	17/08/2017	Turla	G20 Participants	ProofPoint reveals that Turla appears to be actively targeting G20 participants and those interested in its activities including policymakers, member nations and journalists. The analysis is based on the discovery of a new JavaScript dropper for a backdoor called KopiLuwak that Turla has been known to use.	Targeted Attack	Government	CE	>1
4	17/08/2017	Anonymous	22 GOP Senators	Hacktivist collective Anonymous reportedly leaks the private contact details of 22 GOP senators, in the wake of the Charlottesville violence and US President Donald Trump's controversial response to the event, asking for Trump's impeachment.	Unknown	Government	H	US
5	17/08/2017	?	Android Users	Researchers from Kaspersky Lab discover a new version of the malicious Android banking Trojan Faketoken, targeting users of popular apps for booking taxis and paying traffic tickets.	Malware	Single Individuals	CC	>1
6	18/08/2017	Anonymous	NHS (via SwiftQueue)	A member of the Anonymous hacking collective claims to have stolen data belonging to 1.2 million patients of the United Kingdom's National Health Service (NHS). The breach affected SwiftQueue, a software provider of dashboard and metrics solutions to healthcare clinics, according to which only 32,000 records were stolen.	Unknown	Healthcare	H	UK
7	18/08/2017	?	Single Individuals	A second wave of the Locky ransomware variant called IKARUSdilapidated is identified. The source of the ransomware is a botnet of zombie computers able to send 62,000 emails in three days.	Malware	Single Individuals	CC	>1
8	18/08/2017	?	Single Individuals	Two new Locky variants are discovered called Diablo6 and Lukitus. This new wave is boosted by the Necurs botnet.	Malware	Single Individuals	CC	>1
9	19/08/2017	?	Bittrex	A fake website pretends to be the official site for Bittrex exchange, but in reality, it is a phishing domain not only stealing login credentials of unsuspecting users but also the money saved in the exchange.	Account Hijacking	Cryptocurrency Exchange	CC	US
10	19/08/2017	?	Pacific Alliance Medical Center	Pacific Alliance Medical Center notifies 266,123 patients of a ransomware incident occurred on June 14	Malware	Healthcare	CC	US
11	20/08/2017	?	Official Twitter and Facebook PlayStation accounts	The official Twitter and Facebook PlayStation accounts are taken over by the hacking group OurMine. The attackers also claim to have managed to access a PSN database.	Account Hijacking	Industry: Video Games	CC	JP
12	21/08/2017	?	LG	Global consumer electronics manufacturer LG confirms it had to shut down some parts of its network after systems fell victim to WannaCry ransomware. More security news. Ransomware is found on an LG self-service kiosk in South Korea.	Malware	Industry: Consumer Electronics	CC	KR
13	21/08/2017	?	Sinopec’s Shengli Oilfield	Sinopec’s Shengli Oilfield says it will cut its Internet connection for some of its offices after a ransomware attacked 21 of its Internet terminals.	Malware	Industry: Oil and Gas	CC	CN
14	21/08/2017	?	Enigma Blockchain Project	Another attack exploiting an Initial Coin Offering. As much as $500,000 in ether is stolen from supporters of the Enigma blockchain project following a security compromise. Attackers are able to take control of the project’s website domain, one of the administrator accounts on its Slack channel and its mailing lists. Once in control, the attackers distribute solicitations for an initial coin offering "presale."	Account Hijacking	Cryptocurrency Exchange	CC	US
15	21/08/2017	?	Single Individuals	Trend Micro reveals the details of CoinMiner, a new malware family (cryptocurrency miner) using the EternalBlue exploit to infect victims and the WMI toolkit as a method to run commands on infected systems.	Malware	Single Individuals	CC	>1
16	21/08/2017	?	Android Users	The Lookout Security Intelligence team discovers an advertising SDK called Igexin that has the capability of spying on victims through benign apps by downloading malicious plugins. Over 500 apps available on Google Play used the Igexin ad SDK, which were downloaded over 100 million times.	Malware	Single Individuals	CC	>1
17	21/08/2017	?	22 Malaysian websites	A group of hackers called ExtremeCrew believed to be linked to Indonesia claim responsibility for defacing at least 33 Malaysian websites after an embarrassing blunder saw the Indonesian flag printed upside down on the official guidebook for the Southeast Asian Games.	Defacement	>1	CW	MY
18	21/08/2017	?	Several Stars including Tiger Woods, Katharine McPhee, Lindsey Vonn, Miley Cyrus, Kristen Stewart, Stella Maxwell and Dakota Johnson	Fappening 2017: private nude photos of various naked stars emerge, including Tiger Woods, Katharine McPhee, Lindsey Vonn, Miley Cyrus, Kristen Stewart, Stella Maxwell and Dakota Johnson.	Unknown	Single Individuals	CC	>1
19	21/08/2017	?	Android Users	Android users are warned to avoid two applications discovered on the Google Play Store, after they were found to be laced with the notorius BankBot Trojan.	Malware	Single Individuals	CC	>1
20	22/08/2017	APT28 AKA Fancy Bears	Several Football players	APT 28 AKA Fancy Bears release documents alleging 'drug use' in football.	Unknown	Single Individuals	CC	>1
21	22/08/2017	?	Single Individuals	EasyJet warns Facebook users over an online scam offering free flights.	Account Hijacking	Single Individuals	CC	>1
22	22/08/2017	?	Single Individuals	Researchers from FireEye discover a new global malvertising campaign using the Neptune Exploit Kit (AKA Terror) to drop the Monero coin miner.	Malvertising	Single Individuals	CC	>1
23	22/08/2017	?	Crystal Finance Millennium	Hackers breach the servers of Crystal Finance Millennium (CFM), another Ukraine company that makes accounting software for local businesses, sparking fear of a new global cyberattack.	Malware	Industry: Software	CC	UA
24	22/08/2017	?	Worldwide gamers	Security researchers from ESET discover a new malware, dubbed Joao, targeting gamers around the world.	Malware	Single Individuals	CC	>1
25	23/08/2017	OurMine	FC Barcelona Twitter and Facebook Accounts	The OurMine collective takes over the official Twitter and Facebook accounts of Barcelona and falsely announce the signing of Angel Di Maria from Paris Saint-Germain.	Account Hijacking	Football Team	CC	ES
26	23/08/2017	?	Counter-Strike: Global Offensive (CS:GO) players	Sentinel One reveals the details of a campaign targeting Counter-Strike: Global Offensive (CS:GO) players. A malicious version of a cheating tool called vHook installs a Monero miner detected under the name of OSX.Pwnet.A.	Malware	Single Individuals	CC	>1
27	23/08/2017	?	HIDS4U	UK firm HIDS4U, warns customers to be wary of phishing emails after it came to light that a database of customers was found on a hacked website.	Account Hijacking	Industry: Car Conversion Kits	CC	UK
28	23/08/2017	?	Multiple Industries	Flashpoint reveals the details of a business email compromise campaign emanating out of Western Africa, and targeting companies in a wide swathe of industries.	Account Hijacking	Industry: >1	CC	>1
29	24/08/2017	North Korea?	Unnamed Bitcoin Exchange in South Korea	The CWIC Cyber Warfare Research Center in South Korea reveals that a domestic exchange for bitcoin has been the target of an attempted hacking. Suspects are directed to North Korea.	Unknown	Cryptocurrency Exchange	CW	KR
30	24/08/2017	?	Single Individuals	Netskope Threat Research Labs detects several samples related to a coin miner malware named Zminer, whose kill chain begins with the delivery of a drive-by executable that downloads payloads from Amazon S3 to the victim’s machine.	Malware	Single Individuals	CC	>1
31	24/08/2017	?	Healthcare, education, manufacturing and tech sectors in the US and UK	A new ransomware dubbed Defray is discovered by ProofPoint, going after the healthcare, education, manufacturing and tech sectors in the US and UK.	Malware	>1	CC	US UK
32	24/08/2017	?	Facebook Users	Kaspersky Lab reveals the details of a new multi platform malware/adware spreading via Facebook Messenger.	Malware	Single Individuals	CC	>1
33	24/08/2017	?	DreamHost	DreamHost is hit by a powerful and sustained DDoS attack after briefly hosting a new edition of the neo-Nazi website Daily Stormer.	DDoS	Industry: Web Hosting	H	US
34	24/08/2017	?	33,000 Entries of Telnet credentials	A list of 33,000 entries of Telnet credentials is discovered, sitting online on Pastebin since June 11.	Unknown	>1	CC	>1
35	25/08/2017	?	NHS Lanarkshire	NHS services in Lanarkshire (Scotland) are hit by a new ransomware campaign. The culprit is identified as a new variant of Bitpaymer ransomware.	Malware	Healthcare	CC	UK
36	25/08/2017	Chinese State-Sponsored Actors (Deputy Dog? AKA APt17)	Multiple Targets	ProofPoint reveals the details of Operation Rat Cook, a targeted email campaign attempting a spear phishing attack using a Game of Thrones lure. The malicious attachment attempts to install a “9002” remote access Trojan (RAT) historically used by state-sponsored actors.	Targeted Attack	>1	CE	>1
37	25/08/2017	?	Loopia	Swedish web hosting provider Loopia reveals to have been hacked with the attackers able to access part of the customer database.	Unknown	Industry: Web Hosting	CC	SE
38	28/08/2017	?	Zazzle	Zazzle sends an email to customers revealing that that hackers in June used brute-force techniques to cycle through account usernames and passwords that were stolen from a breach of another unnamed site.	Brute-force	Industry: E-Commerce	CC	US
39	28/08/2017	?	Indian and Pakistani Entities	Symantec reveals to have identified a sustained cyber spying campaign, likely state-sponsored, against Indian and Pakistani entities involved in regional security issues. The espionage campaign dates back to October 2016.	Targeted Attack	Government	CE	IN PK
40	28/08/2017	?	US Citizens	The Internal Revenue Service (IRS) warns US citizens of a new phishing scheme that poses as official IRS communications in the hopes that victims access a link, download a file, and hopefully get infected with ransomware.	Malware	Single Individuals	CC	US
41	28/08/2017	?	Selena Gomez Instagram account	The Instagram hack begins… Selena Gomez’s Instagram account is hacked and posts several nude photos of Justin Bieber	Account Hijacking	Single Individuals	CC	US
42	28/08/2017	?	South Korean Android users	Security researchers from McAfee reveal the details of a new Android banking Trojan dubbed MoqHao, targeting South Korean users via SMS phishing messages.	Malware	Single Individuals	CC	KR
43	28/08/2017	OurMine	Real Madrid Twitter Account	Real Madrid’s official Twitter account is hacked with a post announcing the signing of rival Lionel Messi appearing on their feed.	Account Hijacking	Football Team	CC	ES
44	28/08/2017	?	Medical Oncology Hematology Consultants	Medical Oncology Hematology Consultants, reports a ransomware attack that affected 19,203 patients.	Malware	Healthcare	CC	US
45	29/08/2017	?	CeX	Second-hand electronics dealership CeX notifies 2 million customers that their personal information may have been compromised by hackers.	Unknown	Industry: Retail	CC	UK
46	29/08/2017	?	Swiss Individuals	The Reporting and Analysis Centre for Information Assurance (MELANI) says that around 21,000 passwords and personal details used to access online services have been stolen and could be used illegally.	Unknown	Single Individuals	CC	CH
47	29/08/2017	?	Coinbase users	Researchers from Forcepoint discover a new variant of Trickbot variant able to monitor Coinbase exchange sites.	Malware	Single Individuals	CC	>1
48	30/08/2017	?	Single Individuals	More than 700 million email addresses, as well as a number of passwords, leak publicly thanks to a misconfigured spambot, in one of the largest data breaches ever.	Unknown	Single Individuals	CC	>1
49	30/08/2017	Turla	Embassies and Consulates in Europe	Researchers from ESET uncover Gazer, a new malware tool used by the infamous threat actor Turla to spy on embassies and consulates in Europe.	Targeted Attack	Government	CE	>1
50	30/08/2017	?	Central German state of Saxony-Anhalt	Internet and telephone networks at the regional parliament in the central German state of Saxony-Anhalt are offline after a ransomware attack.	Malware	Government	CC	DE
51	30/08/2017	?	CMS Users	Sucuri detects a massive online scanning campaign that's searching for websites that use the Adminer database management script.	Adminer vulnerability	>1	CC	>1
52	30/08/2017	?	Single Individuals	Security researcher MalwareBreakdown releases the analysis of a new attack performed when a user visits a compromised site and is asked to install the Roboto Condensed. The fake font pack is used to install malware.	Malware	Single Individuals	CC	>1
53	30/08/2017	?	dms[.]nwcg[.]gov	Ankit Anubhav of NewSky Security discovers a U.S. government website hosting a malicious JavaScript downloader, leading victims to installations of Cerber ransomware.	Malware	Government	CC	US
54	30/08/2017	?	Kaleida Health	Kaleida Health notifies (once again) 2,800 patients of a new phishing attack.	Account Hijacking	Healthcare	CC	US
55	31/08/2017	?	MacEwan University	MacEwan University staffers are tricked into transferring $11.8 million into scammers’ bank accounts. The majority of the money, $11.4 million, has been traced to bank accounts in Montreal and Hong Kong.	Account Hijacking	Education	CC	CA
56	31/08/2017	?	Instagram	Instagram reveals that one or more hackers have been stealing celebrities' e-mail addresses, phone numbers, and other personal information by exploiting a bug. A database, Doxagram, is published online immediately after with the attacker claiming to have stolen 6 million records. Few	Instagram API Vulnerability	Social Network	CC	US
57	31/08/2017	China?	Vietnam?	Security company FireEye reveals to Reuters that cyber spies working for or on behalf of China’s government have broadened attacks against official and corporate targets in Vietnam at a time of raised tension over the South China Sea,	Targeted Attack	Government	CW	VN
58	31/08/2017	?	WikiLeaks	WikiLeaks’ website appears to have been hacked by the OurMine collective.	DNS Hijacking	Org: Non-Profit	CC	INT
59	31/08/2017	?	Free Online File Converter	An anonymous researcher reveals that the server hosting dozens of free-to-use online file conversion websites, including combinepdf.com, imagetopdf.com, jpg2pdf.com, pdftoimage.com, pdfcompressor.com, and wordtojpeg.com, has been hacked several times in the past year	ImageMagick Vulnerability	Online Services	CC	FR
60	31/08/2017	?	Single Individuals	Researchers at Malwarebytes uncover a campaign which is harnessing RIG on hacked websites in order to distribute the Princess/PrincessLocker ransomware.	Malware	Single Individuals	CC	>1

Related Posts

Like this:

Leave a Reply Cancel reply