16-30 September 2017 Cyber Attacks Timeline

Last Updated on October 18, 2017

It’s time to publish the second timeline of September 2017 (first timeline here), covering the main cyber-attacks occurred between September 16^th and September 30^th (exceptionally including a few incidents that occurred before but I did not include in the previous one).

There have been several remarkable events, probably the most important of which is probably the compromise of the well-known utility CCleaner: what appeared initially as an isolate incident, in reality turned out to be an orchestrated operation targeting hi-tech giants of the likes of Cisco, Samsung and Microsoft. Meanwhile, the list of high-profile victims has been enriched with new entries like the U.S. Securities and Exchange Commission, Deloitte, and Sonic.

And while the operations of a new actor, APT33, have been unmasked, the Electronic Frontier Foundation has revealed the details of “Phish for the Future”, a campaign targeting digital civil liberties activists at Free Press and Fight For the Future.

As usual scroll down the whole list for all the events happened in this fortnight. And if you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015 and 2016 (regularly updated). You may also want to have a look at the Cyber Attack Statistics that are regularly published, and follow @paulsparrows on Twitter for the latest updates.

Additionally, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). If useful, you can access the timeline in Google Sheet format.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country
1	12/09/2017	?	Litebit	Hackers gain access to Litebit’s backend and obtain email addresses, hashed passwords, and IBAN information, among other things. No money is stolen in the process, though.	Unknown	Cryptocurrency Exchange	CC	NL
2	12/09/2017	?	Single Individuals	Security researchers at Sophos discover a new RAT called Kedi that uses Gmail to steal data from the targeted computer. The malware is disguised as a Citrix utility.	Malware	Single Individuals	CC	>1
3	13/09/2017	?	UAE Government	A trove of leaking emails belonging to the UAE government reveals an alleged plot to "conquer" Qatar.	Unknown	Government	CC	UAE
4	13/09/2017	The Dark Overlord	SMART Physical Therapy	SMART (“Sports Medicine and Rehabilitation Therapy”) Physical Therapy is the n-th victim of The Dark Overlord.	Unknown	Healthcare	CC	US
5	16/09/2017	?	The Pirate Bay Users	A cryptocurrency miner appear on The Pirate Bay website, using the computer resources of visitors to mine Monero coins and hence spiking its visitors' CPU.	Cryptocurrency Miner	Single Individuals	CC	>1
6	18/09/2017	?	Multiple Companies	Cisco Talos publishes a technical analysis of a backdoor which was included with version 5.33 of the CCleaner application. The analysis reveals that the attack was conceived to target multiple companies including Cisco itself.	Malware	Industries: >1	CE	>1
7	18/09/2017	The Dark Overlord	Columbia Falls and Flathead County School Districts	The Dark Overlord sends a threatening ransom note to the Columbia Falls (Montana) school district forcing officials to shutter its schools to ensure the safety of the students.	Unknown	Education	CC	US
8	18/09/2017	?	Multiple Targets	Researchers from Kaspersky reveal the details of a new attack technique leveraging an undocumented Word feature to gather information on users.	Targeted Attack	>1	CC	>1
9	19/09/2017	?	Single Individuals	Researchers from Barracuda Advanced Technology Group spot a new Locky campaign launching around 20 million fresh attacks in just a day.	Malware	Single Individuals	CC	>1
10	19/09/2017	?	Android Users	Researchers from SfyLabs reveal the details of Red Alert 2.0, an Android malware targeting over 60 bank and social media apps on Google Play.	Malware	Single Individuals	CC	>1
11	19/09/2017	?	The Irish National Teachers Organisation (INTO)	The Irish National Teachers Organisation warns users of its online learning portal that their personal data may have been compromised following the hacking of the website. Around 30,000 users details were potentially compromised by the hack.	Unknown	Org: Education	CC	IE
12	19/09/2017	?	Google Chrome Users	SafeBrowse, a Chrome browser extension, with over 140,000 users, is found containing a JavaScript Crypto Miner based on Coinhive.	Malware	Single Individuals	CC	>1
13	20/09/2017	APT 33	Aviation Firms in the US and Saudi Arabia	FireEye reveals the details of APT33, a group operational since 2013 and focused on the aerospace industry, successfully hacking firms with aviation in the U.S. and Saudi Arabia in the last year. Other targets include Petrochemical firms in South Korea and Saudi Arabia.	Targeted Attack	Industry: Aviation	CC	US UAE
14	20/09/2017	?	U.S. Securities and Exchange Commission	The U.S Securities and Exchange Commission reveals that its computer system had been hacked last year, giving the attackers private information that could have been exploited for trading. The breach was discovered in August.	Unknown	Government	CC	US
15	21/09/2017	?	Single Individuals	Researchers at MalwareHunterTeam spot a ransomware, called nRansomware, demanding naked photographies instead of Bitcoins.	Malware	Single Individuals	CC	>1
16	24/09/2017	?	Arkansas Oral & Facial Surgery Center	Arkansas Oral & Facial Surgery Center disclose a ransomware incident that may or may not have resulted in access to protected health information of as many as 128,000 patients.	Malware	Education	CC	US
17	25/09/2017	?	Deloitte	The Guardian reveals that Deloitte, one of the world’s “big four” accountancy firms has been targeted by a sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients.	Targeted Attack	Indiustry: Professional Services	CC	UK
18	25/09/2017	?	Android Users	Researchers from Trend Micro reveal the details of ZNIU, the first Android malware to exploit the Dirty Cow (CVE-2016-5195) vulnerability. ZNIU has been detected in more than 40 countries, in about 1,200 and has affected so far more than 5,000 users.	Malware	Single Individuals	CC	>1
19	25/09/2017	?	showtime.com showtimeanytime.com	Two Showtime domains are found serving Coinhive, a JavaScript library that mines Monero using the CPU resources of users visiting Showtime's websites. It is not clear if the event is the consegue of a hack or an experiment.	Malware	Single Individuals	CC	US
20	26/09/2017	?	Sonic Drive-In	Sonic Drive-In, a fast-food chain with nearly 3,600 locations across 45 U.S. states, acknowledges a breach affecting an unknown number of store payment systems.	PoS Malware	Industry: Restaurant	CC	US
21	26/09/2017	?	National Football League (NFL)	Researchers from MacKeeper discover a misconfigured Elasticsearch database containing the details of 1,133 NFL players. Unfortunately the researchers also show evidence that criminals have been able to access the data.	Misconfigured database	Org: Sport	CC	US
22	26/09/2017	The Dark Overlord	Auburn Eye Care Associates	TheDarkOverlord reveal another hack involving patient data. This time the victim is Auburn Eye Care Associates, despite the original hack dates back in June.	Unknown	Healthcare	CC	US
23	27/09/2017	Aslan Neferler Tim	Danish Ministries of Immigration and Foreign Affairs	The Ministry of Immigration and the Ministry of Foreign Affairs of Denmark, are hit by a DDoS attack thought to have come from a Turkish hacker group dubbed Aslan Neferler Tim.	DDoS	Government	H	DK
24	28/09/2017	?	Whole Foods Market	Whole Foods Market says payment card information has been stolen from taprooms, restaurants and other venues located within some of its stores.	PoS Malware	Industry: Retail	CC	US
25	28/09/2017	?	Unpatched IIS 6.0 servers	ESET reveals that a malware author (or authors) has made around $63,000 during the past five months by hacking unpatched IIS 6.0 servers and mining Monero using CVE-2017-7269.	Vulnerability	Single Individuals	CC	>1
26	28/09/2017	?	Free Press Fight For the Future	The Electronic Frontier Foundation (EFF) reveals the details of “Phish For The Future,” an advanced persistent spearphishing campaign targeting digital civil liberties activists at Free Press and Fight For the Future discovered between July 7th and August 8th of 2017.	Targeted Attack	Org: Non-Profit	CE	N/A
27	28/09/2017	?	Single Individuals	Researchers from Malwarebytes spot a campaign abusing native ad and content provider Taboola to serve malvertising,	Malvertising	Single Individuals	CC	>1
28	28/09/2017	?	San Ysidro School District	Malware infect of the San Ysidro School District, deleting emails and forcing the district to temporarily shut down part of its systems.	Malware	Education	CC	US
29	28/09/2017	?	Toms River Police Department	The township of Toms River plans to notify about 3,700 people that their personal information may have been compromised by a data breach inside the police department over the summer.	Unknown	Law Enforcement	CC	US
30	29/09/2017	?	Saudi Arabia’s General Entertainment Authority (GEA)	Saudi Arabia’s General Entertainment Authority (GEA), says that its website had been the target of cyber attacks from outside the kingdom.	DDoS	Government	CC	AE
31	29/09/2017	?	IRINN (Indian Registry for Internet Names and Numbers)	Researchers from Seqrite’s Cyber Intelligence Labs discover 6000 login credentials up for sale on DarkNet, belonging to Indian ISPs, government departments and private businesses. The researchers identify the origin of the breach from the IRINN.	Unknown	Internet Services	CC	IN
32	29/09/2017	?	Wordpress Users	A cyber-criminal hides the code for a PHP backdoor inside the source code of a WordPress plugin masquerading as a security tool named "X-WP-SPAM-SHIELD-PRO" The attacker tried to leverage the reputation of a legitimate and highly popular WordPress plugin called "WP-SpamShield Anti-Spam".	PHP Backdoor	Single Individuals	CC	>1
33	30/09/2017	?	Gianfranco Dell'Alba	The director of the General Confederation of Italian Industry group in Brussels falls victim of an email scam and transfers 500,000 EUR (590,000 USD) to an unknown bank account.	Account Hijacking	Single Individuals	CC	IT
34	30/09/2017	?	national-lottery.co.uk	Camelot reveals that a DDOS attack took down the website of the National Lottery,	DDoS	Industry: Lottery	CC	UK
35	30/09/2017	?	R6DB	R6DB, a fan-powered online gaming service that provides statistics for players of Ubisoft's tactical FPS Rainbow Six Siege, is hit by hackers, who wipe its databases and hold the data for ransom.	Malicious Bot	Online Gaming Service	CC	US

Related Posts

Like this:

Leave a Reply Cancel reply