1-15 January 2018 Cyber Attacks Timeline

Last Updated on March 4, 2018

Let’s open this infosec 2018 with the first cyber attacks timeline covering the main events occurred between January 1st and January 15th, which brings in a novelty with regards to the taxonomy of the target classes. As a matter of fact, in order to facilitate the classification, as suggested by some readers, I have decided to adopt the International Standard Industrial Classification, with a small modification to take into account the cases when the targets are multiple, or single individuals.

That being said, let’s have a quick look at the main events (as usual scroll down the list for additional details).

So the beginning of the year confirms that cryptocurrencies are the new gold for criminals: this fortnight has recorded an attack to a crypto wallet (BlackWallet), and the discovery of four botnets/operations aimed to mine cryptocurrencies from the victim’s machines.

The 2018 unwelcome list of the mega breaches is opened by Health South-East RHF, the healthcare organization that manages hospitals in Norway’s southeast region, victim of an attack affecting over 2.9 million individuals.

Despite all the countermeasures, Android malware confirms its momentum (a fake Uber app, some fake security apps, and the first example of a malware written in Kotlin are only few examples).

Last but not least, the Olympic Games have not started yet, and a campaign targeting them (Operation PowerShell Olympics) has already been uncovered. In the meantime. Meanwhile APT28 (AKA Fancy Bear, AKA PawnStorm) continues to be quite active, similarly to Turla, on the spot again with a new campaign targeting embassies and consulates in East Europe with a fake Flash update.

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015, 2016 , and 2017 (regularly updated). You may also want to have a look at the Cyber Attack Statistics that are regularly published, and follow @paulsparrows on Twitter for the latest updates.

Additionally, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). If useful, you can access the timeline in Google Sheet format.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country
1	01/01/2018	?	Faye Brookes	2018 begins with a new round of Fappening leaks. This time the victim is Faye Brookes, whose explicit video is leaked on several video sharing websites.	Unknown	X Individual	CC	UK
2	01/01/2018	?	Rockingham County Schools	Rockingham County Schools servers are compromised by the Emotet malware after an employee opens a phishing email.	Malware	P Education	CC	US
3	02/01/2018	Andariel	Unnamed South Korean Company	Bloomberg reveals that a hacking unit called Andariel seized a server at a South Korean company in the summer of 2017 and used it to mine about 70 Monero coins, worth about $25,000 as of Dec. 29.	Unknown	Z Unknown	CC	KR
4	02/01/2018	@0x55Taylor	thefly.com	A hacker using the twitter handle @0x55Taylor posts some screenshots of a breach affecting all users who registered at thefly.com a leading digital publisher of real-time financial news between 2006 and 2015. The leak contains the data of 100,000 individuals, and the credit card details of 27,000 among them.	SQLi?	J Information and communication	CC	US
5	03/01/2018	?	Uber Users	Symantec researchers discover a new malware strain, dubbed Android.Fakeapp, that sneakily spoofs Uber’s Android app and harvests users’ passwords, allowing attackers to take over users’ accounts.	Malware	X Individual	CC	>1
6	03/01/2018	?	Android Users	Researchers from Trend Micro discover 36 apps on Google Play in disguise of security tools, but in reality able to secretly harvesting user data, tracking user location, and aggressively pushing advertisements.	Malware	X Individual	CC	>1
7	03/01/2018	?	City of Farmington	The city of Farmington is hit by a variant of the SamSam ransomware.	Malware	Q Human health and social work activities	CC	US
8	03/01/2018	?	Linux Servers	Researchers at F5 discover a new Linux crypto-miner botnet dubbed PyCryptoMiner spreading over SSH. The Monero miner botnet is based on Python and leverages Pastebin as command and control server when the original C&C isn’t available.	Malware	X Individual	CC	>1
9	03/01/2018	?	Bank customers globally	Researchers from security company Quick Heal reveal the detail of Android.banker.A9480, an Android banking trojan targeting more than 232 banking apps of financial institutions globally.	Malware	X Individual	CC	>1
10	03/01/2018	?	Big Line Holiday	Big Line Holiday, a Hong Kong travel agency, reveals that hackers might have broken into its database a day before and gained possession of some of its customers’ personal information.	Malware	R Arts entertainment and recreation	CC	HK
11	04/01/2018	?	Ukrainian users	Researchers from Cisco Talos reveal that unknown attackers have compromised the official website of Ukrainian accounting software developer Crystal Finance Millennium to distribute a new variant of the malicious Zeus banking trojan. The compromised website hosts the payload retrieved by a dropper distributed via a spam campaign.	Malware	X Individual	CC	UA
12	04/01/2018	?	City of Belle Fourche	The city of Belle Fourche is hit by a ransomware attack.	Malware	O Public administration and defence; compulsory social security	CC	US
13	04/01/2018	?	Goldjoy	Goldjoy, another travel agency in Hong Kong, reveals that unauthorised parties accessed its customer database containing personal information such as names and ID card numbers, passport details and phone numbers, asking for a ransom.	Malware	R Arts entertainment and recreation	CC	HK
14	05/01/2018	?	Android Users	Security researchers from Check Point uncover LightsOut, a new mobile adware program hidden in 22 fake applications on the Google Play Store. According to the researchers, the apps were downloaded between 1.5 million and 7.5 million times.	Malware	X Individual	CC	>1
15	05/01/2018	?	Reddit	Reddit confirms that one of its email providers, Mailgun, has been breached, resulting in the hacks of user profiles and their linked cryptocurrency accounts.	Account Hijacking	J Information and communication	CC	US
16	05/01/2018	?	Beautyblender	Beautyblender notifies 3,673 individuals that their information might have been compromised after the discovery of a malware on its online shop.	Malware	G Wholesale and retail trade; repair of motor vehicles and motorcycles	CC	US
17	05/01/2018	?	Oklahoma State University Center for Health Sciences (OSUCHS)	Oklahoma State University Center for Health Sciences notifies an undisclosed number of affected patients of an unauthorized third party occurred on November 2017.	Unknown	Q Human health and social work activities	CC	US
18	05/01/2018	@0x55Taylor	Creditseva	After defacing it, @0x55Taylor manages to gain access to creditseva main website server and a copy of the s3 bucket credentials.	Unknown	K Financial and insurance activities	CC	IN
19	05/01/2018	The Dark Overlord	Columbia Falls School District Number 6	The Columbia Falls School District Number 6 in Montana, sends out letters to notify the breach occurred after the attack carried on by The Dark Overlord begun on September 1st, 2017.	Unknown	P Education	CC	US
20	06/01/2018	?	Olympic Games in South Korea	Researchers from McAfee uncover a campaign, dubbed Operation PowerShell Olympics, targeting organizations involved with next month's Games in South Korea, with the aim of controlling infected machines.	Targeted Attack	R Arts entertainment and recreation	CE	KR
21	06/01/2018	?	BlackBerry Mobile Site	The Blackberry Mobile site is hacked exploiting a vulnerability of Magento. The attackers install a Monero miner using the Coinhive library.	Magento Vulnerability	J Information and communication	CC	CA
22	06/01/2018	?	Florida's Agency for Health Care Administration (FAHCA)	A phishing attack on an employee at Florida's Agency for Health Care Administration (discovered in November 20, 2017) results in the exposure of sensitive information on 30,000 Medicaid patients.	Account Hijacking	Q Human health and social work activities	CC	US
23	07/01/2018	?	CVE 2017-10271 Vulnerable Machines	A report published by the SANS Technology Institute reveals that attackers are exploiting a critical Oracle WebLogic flaw (CVE 2017-10271) to inject Monero cryptocurrency miners on victim’s machines.	Malware	X Individual	CC	>1
24	08/01/2018	?	Health South-East RHF	Health South-East RHF, a healthcare organization that manages hospitals in Norway's southeast region, announces a security breach. A hacker or hacker group might have stolen healthcare data for more than half of Norway's population. (over 2.9 million individuals)	Unknown	Q Human health and social work activities	CC	NO
25	08/01/2018	?	Single Individuals	Alien Vault reveals to have found malware that appears to install code for mining Monero cryptocurrency, sending any mined coins to a server at a North Korean university.	Malware	X Individual	CC	>1
26	08/01/2018	?	Onco360	Onco360 notifies a phishing incident involving an employee’s email account and affecting potentially 53,000 users.	Account Hijacking	Q Human health and social work activities	CC	US
27	08/01/2018	?	Caremed Specialty Pharmacy	Caremed Specially Pharmacy is victim of the same event affecting Onco360	Account Hijacking	Q Human health and social work activities	CC	US
28	09/01/2018	Turla	Embassies and consulates in East Europe	Researchers from ESET unveil the details of a new operation carried on by the Turla cyber espionage group, targeting embassies and consulates in East Europe using a fake Adobe Flash updater.	Targeted Attack	O Public administration and defence; compulsory social security	CE	>1
29	09/01/2018	?	Android Users	Researchers at Trend Micro find in the Google Play Store the first Android malware designed to steal information, carry out click ad fraud, and sign users up to premium SMS services without their permission, written using the Kotlin programming language.	Malware	X Individual	CC	>1
30	09/01/2018	?	Single Individuals	Malwarebytes reveal the details of a RIG exploit campaign distributing malware coin miners delivered via drive-by download attacks from malvertising, exploiting the RIG Exploit Kit.	Malvertising	X Individual	CC	>1
31	10/01/2018	Pawn Storm AKA Fancy Bear AKA APT28	International Olympic Committee	APT28 AKA Pawn Storm AKA Fancy Bear publish a set of apparently stolen emails purportedly belong to officials from the International Olympic Committee, the United States Olympic Committee, and third-party groups associated with the organizations.	Unknown	U Activities of extraterritorial organizations and bodies	CC	N/A
32	10/01/2018	?	Android Users	Researchers from Symantec discover a fake Telegram (Teligram) app on the Google Play Store that claims to be a new, updated version of the popular encrypted messenger app, but whose real purpose is to distribute malware.	Malware	X Individual	CC	>1
33	10/01/2018	?	Russian Bank Customers	Researchers at Trend Micro discover a new mobile malware that primarily targets Russian banking customers, taking over victims' SMS capabilities, allowing cybercriminals to intercept text messages that contain bank security codes, The malware is dubbed FakeBank.	Malware	X Individual	CC	CC
34	10/01/2018	?	Netflix Users	Netflix users are warned to avoid clicking on any suspicious email links after a phishing scam is uncovered by security firm Mailguard, which security experts say is designed to steal credit card details.	Account Hijacking	X Individual	CC	>1
35	11/01/2018	?	Unpatched Windows and Linux servers	Researchers from Check Point and Certego reveals the details of a new campaign distributing a malware dubbed RubyMiner, turning outdated web servers into Monero miners.	Malware	Y Multiple Industries	CC	>1
36	11/01/2018	?	German Users	German authorities warn about phishing emails trying to take advantage of the Spectre and Meltdown vulnerabilities, promising fake patches and distributing the Smoke Loader malware.	Malware	X Individual	CC	DE
37	11/01/2018	?	Apple Mac users	Patrick Wardle, a security researcher, discovers OSX MaMi, a new, undetectable strain of malware affecting Apple Macs that can hijack a device's DNS settings and steal victims' personal data.	Malware	X Individual	CC	>1
38	11/01/2018	?	North Korean defectors	Researchers at McAfee unveil the details of operation Sun Team, a campaign targeting North Korean defectors, along with those who help them, which aims to infect their devices with trojan malware for the purposes of spying on them.	Malware	X Individual	CE	KP
39	11/01/2018	?	Adams Health Network	Adams Health Network, which runs Adams Memorial Hospital, confirms that a ransomware attack targeted some of its computer servers.	Malware	Q Human health and social work activities	CC	US
40	12/01/2018	Pawn Storm AKA Fancy Bear AKA APT28	US Senate	Researchers from Trend Micro reveal that the state sponsored hackers behind APT28 (AKA Pawn Storm AKA Fancy Bear) targeted the US Senate in mid-2017).	Targeted Attack	O Public administration and defence; compulsory social security	CE	US
41	12/01/2018	?	Hancock Regional Hospital	The Hancock Regional Hospital, in the state of Indiana, confirms to be running on pen and paper following a SAMSAM ransomware attack, which hit the day prior. The hospital eventually pays up hackers $55,000 to restore control.	Malware	Q Human health and social work activities	CC	US
42	12/01/2018	?	Android Users	Researchers from Check Point reveals the details of 'AdultSwine', a malware displays pornographic advertising on Android applications, found in 60 gaming apps on Google Play and downloaded between three and seven million times.	Malware	X Individual	CC	>1
43	13/01/2018	?	New Zealand Football	New Zealand Football says it is investigating a potential hack of its official website after a fake news article popped up "announcing" the resignation of its CEO Andy Martin.	Defacement	R Arts entertainment and recreation	CC	NZ
44	13/01/2018	?	BlackWallet	An unidentified thief reportedly steals more than $400,000 in Stellar lumens after hacking the digital wallet provider BlackWallet.	DNS Hijacking	K Financial and insurance activities	CC	DE
45	14/01/2018	?	Devices powered by ARC CPUs	Researchers from infosec group Malware Must Die discover a new variant of the Mirai botnet capable of infecting devices powered by ARC CPUs. The botnet is dubbed "Okiru", which means "wake up" in Japanese.	Malware	X Individual	CC	>1
46	14/01/2018	Ayyıldız Tim	Syed Akbaruddin's Twitter Account @AkbaruddinIndia	The verified Twitter account of Syed Akbaruddin. India's top diplomat to the United Nations, is briefly taken over by suspected Turkish hackers.	Account Hijacking	X Individual	H	IN
47	14/01/2018	Ayyıldız Tim	Borge Brende's Twitter Account @borgebrende	The same hackers also manage to hijack the verified account of Borge Brende, the president of the World Economic Forum and former minister of foreign affairs for Norway.	Account Hijacking	X Individual	H	NO
48	15/01/2018	?	OnePlus	Chinese smartphone manufacturer OnePlus launches an investigation after a number of customers who used its website to purchase products complain of attempted fraud. Few days after (January 19) the company confirms to have been hacked via a malicious script injected into its website, potentially compromising the payment card details of up to 40,000 customers.	Malicious Script	C Manufacturing	CC	CN
49	15/01/2018	?	Chrome Users	Security researchers from ICEBRG find four malicious Chrome extensions available in the Chrome store, laced with suspicious code, and infecting more than 500,000 users across the globe, including workstations within major organizations.	Malicious Browser Extension	X Individual	CC	>1
50	15/01/2018	?	Financial Organizations in Latin America	Researchers from Trend Micro spot a new variant of the KillDisk disk-wiping malware targeting companies in the financial sector in Latin America.	Malware	K Financial and insurance activities	CC	>1

Related Posts

Like this:

Leave a Reply Cancel reply