16-31 December 2017 Cyber Attacks Timeline

Last Updated on January 3, 2018

It’s time for the last timeline of 2017 covering the main events occurred between December 16 and 31 (as usual you can find the first one here). After this one my plan is to publish the statistics of December, and then a summary of what happened in 2017 from a statistical standpoint, so stay definitely tuned!

One thing is certain: the cryptocurrency madness continues to have consequences also in the cyberspace. This fortnight has seen a Bitcoin exchange closing down after suffering the second (deadly) cyber attack in few months (Youbit), another one having its DNS hijacked (EtherDelta), two other services crippled by DDoS attacks (Bitfinex and Exmo, this second one also had one of his lead analysts kidnapped and… Guess what, released after the payment of a $1M ransom in Bitcoins). Without considering the multiple campaigns aimed to infect users with miners and also the official Twitter account of John McAfee compromised to promote alternative cryptocurrencies.

So all these events ended up overshadowing the massive breach suffered by Nissan Canada Finance that had 1.13 million customer records compromised.

As usual, feel free to scroll down the whole list for all the events happened in this fortnight. And if you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015 and 2016 (regularly updated). You may also want to have a look at the Cyber Attack Statistics that are regularly published, and follow @paulsparrows on Twitter for the latest updates.

Additionally, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). If useful, you can access the timeline in Google Sheet format.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country
1	11/12/2017	?	Pinterest	Pinterest notifies users of suspicious activity due to attackers trying to compromise account using 'credential stuffing' (credentials obtained from other breaches).	Credential Stuffing	Industry: Online Services	CC	US
2	15/12/2017	?	Linux and Windows Servers	Researchers from F5 Networks discover an aggressive and sophisticated malware campaign, targeting Linux and Windows servers with an assortment of exploits with the goal of installing malware that mines the Monero cryptocurrency. The campaign is dubbed Zealot.	Malware	>1	CC	>1
3	17/12/2017	?	Bitfinex	Bitfinex is, once again hit by a massive DDoS attack.	DDoS	Cryptocurrency Exchange	CC	US
4	18/12/2017	?	Android Users	Kaspersky Lab reveals the details of a new Android malware called Trojan.AndroidOS.Loapi. the malware features a complicated modular architecture that means it can conduct a variety of malicious activities: mine cryptocurrencies, annoy users with constant ads, launch DDoS attacks and much more.	Malware	Single Individuals	CC	>1
5	18/12/2017	?	Wordpress Sites	WordPress sites around the globe are the targets of a massive brute-force campaign where hackers attempt to guess admin account logins in order to install a Monero miner on compromised sites.	Brute Force	Single Individuals	CC	>1
6	18/12/2017	?	iOS Users	A phony iOS version of Cuphead, a very popular retro game, finds its way into Apple's notoriously restrictive iTunes App store.	Malware	Single Individuals	CC	US
7	19/12/2017	?	Youbit	The South Korean Bitcoin exchange Youbit, previously known as Yapizon quits its operation and files for bankruptcy due to two cyber attacks in last eight months. The company suffers another data breach in which 17% of total assets have been stolen. However, the total value of stolen assets is not mentioned.	Unknown	Cryptocurrency Exchange	CC	KR
8	19/12/2017	APT-C-15?	Arabic Speaking Android Users	Researchers at Trend Micro discover a new Android malware, dubbed AnubisSpy, linked with the Sphinx cyberespionage campaign, which was discovered in 2014-15 and launched by the APT-C-15.	Malware	Single Individuals	CE	>1
9	19/12/2017	?	Wordpress Sites	Captcha, a WordPress plugin installed on over 300,000 sites is recently modified to download and install a hidden backdoor.	Compromised Wordpress Plugins	Single Individuals	CC	>1
10	19/12/2017	?	Multiple Systems Worldwide	Researchers from security firm GuardiCore discover multiple hacking campaigns conducted by a Chinese criminal gang targeting database servers. The attackers target systems worldwide for mining cryptocurrencies, exfiltrating sensitive data and building a DDoS botnet.	Malware	>1	CC	>1
11	19/12/2017	?	Medhost	The website of medhost.com is redirected to a page where the attackers post a message claiming to have stolen personal information from the servers. However they do not provide any evidence of the data.	DNS Hijacking	Healthcare	CC	US
12	20/12/2017	People’s Republic of China (PRC)-based actors	Four Western think tanks and an additional two non-governmental organizations (NGOs).	Crowdstrike reveals the details of espionage-driven targeted attacks carried on by Chinese actors against four Western think tanks and an additional two non-governmental organizations (NGOs).	Targeted Attack	Org: Think Tank Org: Non-Profit	CE	>1
13	20/12/2017	?	EtherDelta	Popular cryptocurrency exchange EtherDelta is hacked, with many users unknowingly sending their tokens to the hacker instead of the exchange. At least 308 ETH ($266,789) were stolen, as well as a large number of tokens potentially worth hundreds of thousands of dollars.	DNS Hijacking	Cryptocurrency Exchange	CC	US
14	20/12/2017	?	Single Individuals	Researchers from Trend Micro spot a new campaign exploiting CVE-2017-11882 to distribute the Loki Infostealer.	Malware	Single Individuals	CC	>1
15	20/12/2017	?	Golden Optometric	Goldon Optometric informs some patients whose information was affected by a CrySiS ransomware attack.	Malware	Healthcare	CC	US
16	21/12/2017	?	Nissan Canada Finance	Nissan Canada's vehicle-financing wing has been hacked, putting personal information on as many as 1.13 million customers at risk. The exposed data includes at least customer names, addresses, vehicle makes and models, vehicle identification numbers (VINs), credit scores, loan amounts and monthly payment figures.	Unknown	Industry: Automotive	CC	CA
17	21/12/2017	The Lazarus Group	Single Individuals	Proofpoint researchers uncover what it’s calling the first publicly documented instance of a nation-state targeting a POS-related framework for the theft of credit-card data, carried out by the notorious Lazarus Group hacking arm of Pyongyang.	PoS Malware	Single Individuals	CC	>1
18	21/12/2017	Cron Cybercrime Group	Single Individuals	Security researchers from AVAST warn of new malware designed to harvest banking and card details, which could be linked to the infamous Cron cybercrime group. The malware is dubbed Catelites Bot.	Malware	Single Individuals	CC	>1
19	21/12/2017	?	Android Users	Security researchers at Lookout find three fake Bitcoin wallet apps on Play Store developed with the intention to steal Bitcoin-related data from users.	Malware	Single Individuals	CC	>1
20	21/12/2017	?	Facebook Messenger Users	Researchers at Trend Micro discover a malicious new cryptocurrency mining malware that specifically targets Facebook Messenger users . The malware has been dubbed as Digmine.	Malware	Single Individuals	CC	>1
21	21/12/2017	?	WWE Diva Paige	Unknown hackers leak new private photo of WWE Diva Paige	Unknown	Single Individual	CE	UK
22	21/12/2017	Nexus Zeta	Huawei home router HG532	Researchers from Check Point discover a zero-day vulnerability in Huawei home router HG532 and a campaign aimed to exploit this vulnerability to inject the SATORI payload.	0-Day Vulnerability	Single Individuals	CC	>1
23	21/12/2017	?	Globex	Hackers try to steal 55 million rubles ($940,000) from Russian state bank Globex using the SWIFT international payments messaging system. At the end the hackers only withdraw around $100,000.	Malware	Finance	CC	RU
24	21/12/2017	?	Multiple Organizations	Researchers from Barracuda spot a new campaign where cybercriminals are spoofing scanners to launch attacks containing malicious attachments that appear to be coming from the network printer.	Malware	>1	CC	>1
25	22/12/2017	?	Single Individuals	A new variant of the GlobeImposter ransomware is distributed via a massive malspam campaign.	Malware	Single Individuals	CC	>1
26	22/12/2017	?	Jason's Deli	Jason's Deli notifies its customers that a large quantity of payment card information has appeared for sale on the “dark web,” and that an analysis of the data indicated that at least a portion of the data may have come from various Jason’s Deli locations.	Unknown	Industry: Restaurants	CC	US
27	22/12/2017	?	Colorado Mental Health Institute	Colorado Mental Health Institute notifies 650 patients after phishing incident.	Account Hijacking	Healthcare	CC	US
28	23/12/2017	?	Veyna & Forschino	Veyna & Forschino disclose a breach involving an unauthorized access to a company email. Compromised information includes individuals’ name, date of birth, telephone numbers, address, Social Security number, W-2 information, 1099 records including account and direct deposit bank account information.	Account Hijacking	Accounting	CC	US
29	26/12/2017	?	Single Individuals	The Necurs botnet continues its massive campaign aimed to distribute ransomware with as many as 47 million emails per day.	Malware	Single Individuals	CC	>1
30	26/12/2017	?	Offset iCloud account	Migos' Offset iCloud is hacked and nude images of fiancé Cardi B leaked.	Account Hijacking	Single Individuals	CC	US
31	27/12/2017	?	Longs Peak Family Practice	Longs Peak Family Practice notifies patients following a ransomware and hacking incident that were first detected on November 5.	Malware	Healthcare	CC	US
32	27/12/2017	?	hounddawg.org	hounddawg.org, a popular torrent tracker is hacked. The attacker claims to have downloaded the entire database and the site source code.	Unknown	Torrent Tracker	CC	NL
33	28/12/2017	?	Exmo	A UK-based Bitcoin exchange called Exmo is hit by a targeted DDoS attack. The attack happens just days after one of Exmo's leading analysts, a blockchain expert named Pavel Lerner, is kidnapped in Kiev while leaving his office. A $1M bitcoin ransom is paid to release him.	DDoS	Cryptocurrency Exchange	CC	UK
34	28/12/2017	?	John McAfee Twitter Account (@officialmcafee)	John McAfee has his Twitter account hacked and used to promote lesser-known crypto-currencies.	Account Hijacking	Single Individual	CC	UK
35	28/12/2017	?	Magento Sites	Dutch security researcher Willem de Groot discovers that Hackers are actively targeting Magento sites running a popular helpdesk extension called Mirasvit Helpdesk.	Vulnerable Magento extension	Single Individuals	CC	>1
36	28/12/2017	?	Three Plugins	The Wordpress security team removes three plugins infected with backdoors tied to the same threat actor.	Compromised Wordpress Plugins	Single Individuals	CC	>1
37	28/12/2017	?	Unnamed Organizations	The Italian researcher Marco Ramilli finds a new infostealer campaign in the wild.	Malware	>1	CC	>1
38	28/12/2017	?	Jones Memorial Hospital	A cyberattack disrupts computer systems at Jones Memorial Hospital.	Malware	Healthcare	CC	US
39	29/12/2017	?	Chrome Users	Archive Poster, a popular Chrome extension with over 105,000 users has been deploying an in-browser cryptocurrency miner to unsuspecting users for the past few weeks.	Malware	Single Individuals	CC	>1
40	29/12/2017	?	Miracle-Ear	Miracle-Ear Inc. says that 554 patient records have been compromised in a security breach to its e-mail system. The incident occurred Oct. 24, when “an unknown and unauthorized intruder” gained access to the e-mail account of an employee of Miracle-Ear’s parent company, Amplifon.	Account Hijacking	Industry: Hearing Aids	CC	US
41	31/12/2017	Anonymous	Correggio Speed Cameras database	The Anonymous hack the speed cameras database of an Italian city (Correggio) and dump the content.	Unknown	Law Enforcement	H	IT

Related Posts

Like this:

Leave a Reply Cancel reply