It’s time to publish the second timeline of October, covering the main events occurred between October 16 and October 31 (the first timeline is here). The total number of collected events is 58, showing a light increase compared with the 54 events of the previous fortnight.
Many events to pinpoint these days, starting from the massive breach to Cathay Pacific, potentially affecting 9.4 million users, and not exactly an example of how breaches should be handled in the GDPR era.
Attacks against crypto exchanges play also an important role in this timeline: Trade.io has suffered an illegitimate withdrawn of $7.5 Million worth in token, while MapleChange has suffered $6 Million worth losses, despite there are many doubts this could be an exit scam.
Interesting timeline also from a cyberwarfare and hacktivism perspective: Ukraine (and Poland) were hit by GreyEnergy, yet another long-lasting operation, direct successor of the infamous BlackEnergy, whose origin dates back to 2015: while Italian hacktivists affiliated to Anonymous kicked off Op #FifthOfNovember against Universities, Trade Unions, and other websites.
Again, 58 events are too many to summarize in few lines, so feel free to read carefully the whole timeline to have a complete view of the threat landscape (and also share it!). The timelines of the main Cyber Attacks in 2011, 2012, 2013, 2014, 2015, 2016, 2017 and now 2018 are also available, and do not forget the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.
Finally, you may always ask for the raw data, but please do not forget to include a short presentation and the purpose of the project. I will not accept requests without any details.
ID
Date
Author
Target
Description
Attack
Target Class
Attack Class
Country
Link
Tags
1
05/10/2018
?
National Ambulatory Hernia Institute
National Ambulatory Hernia Institute notifies almost 16,000 patients of Gamma ransomware attack occurred on October 5.
Malware
Q Human health and social work activities
CC
US
National Ambulatory Hernia Institute, Ransomware
2
16/10/2018
?
New Share Counts
Researchers from Sucuri reveal that New Share Counts, a discontinued Tweet counter is hijacked, redirecting the users to scam pages.
Malicious Script
X Individual
CC
>1
New Share Counts, Sucuri
3
16/10/2018
Attackers linked to Hezbollah
Multiple Targets
The Czech Security Intelligence Service (BIS) reveals to have taken down the infrastructure used by Hezbollah operatives to target and infect users around the globe with mobile malware.
Malware
Y Multiple Industries
CW
>1
Hezbollah, BIS
4
16/10/2018
?
City of West Haven
The City of West Haven pays $2,000 after having 23 of its servers encrypted from a ransomware attack.
Malware
O Public administration and defence, compulsory social security
CC
US
West Haven, Ransomware
5
17/10/2018
GreyEnergy
Energy companies and other high-value targets in Ukraine and Poland
Researchers from ESET uncover details of the successor of the BlackEnergy APT group, named GreyEnergy. Since December 2015, the group attacked energy companies and other high-value targets in Ukraine and Poland for the past three years.
Targeted Attack
D Electricity gas steam and air conditioning supply
CW
>1
GreyEnergy, ESET, Ukraine, Poland
6
17/10/2018
?
A primary company in the Italian Naval Industry
Researchers from Yoroi discover a new targeted campaign against one of the most important companies in the Italian Naval Industry. The malware is dubbed MartyMcFly.
Targeted Attack
H Transportation and storage
CE
IT
Yoroi, MartyMcFly
7
17/10/2018
?
Vesta Control Panel (VestaCP)
Vesta Control Panel, the provider of an open-source hosting panel software reveals a security breach during which an unknown hacker contaminated the project's source code with malware. The malicious code was added on May 31, this year, and later removed two weeks later, on June 13.
Malware
J Information and communication
CC
>1
Vesta Control Panel, VestaCP
8
17/10/2018
?
Single Individuals
Researchers from Zscaler uncover a new SEO poisoning campaign, targeting keywords associated with the U.S. midterm elections. Attackers have hacked over 10,000 web sites in order to promote 15,000 different keywords
SEO Poisoning
X Individual
CC
>1
Zscaler
9
17/10/2018
?
City of Muscatine
The City of Muscatine is hit with a ransomware attack on October 17. Financial and other servers are affected.
Malware
O Public administration and defence, compulsory social security
CC
US
Muscatine, Ransomware
10
17/10/2018
?
Facepunch
As reported by Troy Hunt's Have I Been Pwned breach notification service, the Facepunch game studio was the victim of a data breach in June 2016 which led to sensitive information of 396,650 users being exposed.
Unknown
R Arts entertainment and recreation
CC
UK
Troy Hunt, Have I Been Pwned, Facepunch
11
18/10/2018
Oceansalt
Targets in US and Canada linked to South Korea
Researchers from McAfee discover a new attack targeting Korean-speaking victims, and borrowing code from a reconnaissance tool linked to Comment Crew, a Chinese nation-state threat actor exposed in 2013.
Targeted Attack
Y Multiple Industries
CC
>1
McAfee, Comment Crew, Oceansalt
12
18/10/2018
?
Indiana National Guard
The Indiana National Guard reports that a non-military server that contains the personal information of civilian and military personnel is hit with ransomware
Malware
O Public administration and defence, compulsory social security
CC
US
Indiana National Guard, Ransomware
13
18/10/2018
Tick (or also Redbaldknight, or Bronze Butler)
Targets in South Korea and Japan
Researchers from Cisco Talos reveal the details of the latest campaign carried out by a group dubbed Tick (or also Redbaldknight, or Bronze Butler), targeting South Korea and Japan.
Targeted Attack
Y Multiple Industries
CE
>1
Cisco Talos, Tick, Redbaldknight Bronze Butler
14
19/10/2018
?
Healthcare.gov
The Centers for Medicare & Medicaid Services (CMS) announces that Healthcare.gov, the federally operated health insurance marketplace, has suffered a data breach. The CMS believes files for as many as 75,000 people were accessed,
Unknown
O Public administration and defence, compulsory social security
CC
US
Healthcare.gov, CMS, Centers for Medicare & Medicaid Services
15
19/10/2018
?
Around 50 victims located in Russia, Iran and Egypt, related to nuclear energy, telecommunications, IT, aerospace and R&D.
Researchers from Kaspersky reveal a campaign targeting systems used in aerospace, nuclear energy, and other industries, using three tools leaked from the NSA: DarkPulsar, DanderSpritz, and Fuzzbunch.
Targeted Attack
D Electricity gas steam and air conditioning supply
Researchers from 360 Total Security reveal the details of a recent attack carried out by APT-C-27 and targeting Arabic countries.
Targeted Attack
Y Multiple Industries
CE
>1
360 Total Security
17
19/10/2018
?
Twitter users
Twitter shuts down a bot network pushing out pro-Saudi government tweets.
Social Network Bots
X Individual
CW
>1
Twitter, Saudi Arabia
18
19/10/2018
?
Catawba Valley Medical Center
Catawba Valley Medical Center notifies patients of a phishing email incident occurred on August 13, 2018.
Account Hijacking
Q Human health and social work activities
CC
US
Catawba Valley Medical Center
19
19/10/2018
?
Investimer, or Hyipblock, or Mmpower
Researchers from Doctor Web expose an online scammer targeting thousands of victims interested in cryptocurrencies via a large and diverse business that includes phishing and fraud operations.
Account Hijacking
Fraud
X Individual
CC
>1
Investimer, Hyipblock, Mmpower, Doctor Web, Crypto
20
20/10/2018
?
8 Adult Websites
Eight poorly secured websites are hacked, exposing megabytes of personal data. 1.2M users are exposed.
Unknown
R Arts entertainment and recreation
CC
US
Adult Websites
21
21/10/2018
?
Trade.io
Cryptocurrency exchange Trade.io reveals a security breach: an unknown party withdraws over 50 million Trade tokens (TIO), worth over $7.5 million, from its cold storage wallets.
Unknown
V Fintech
CC
CH
Trade.io, Crypto
22
21/10/2018
?
Python users
A malicious package is uploaded into the official repository of Python. The package is called “Colourama" and is able to inject a cryptocurrency clipboard hijacker.
Malware
X Individual
CC
>1
Python, Colourama, Crypto
23
22/10/2018
?
Davos in the Desert
The website of the Saudi Arabian investment conference, referred to as “Davos in the Desert”, is defaced with anti-Saudi messages, to protest against the death of journalist Jamal Khashoggi.
Defacement
U Activities of extraterritorial organizations and bodies
H
SA
Davos in the Desert, Jamal Khashoggi
24
22/10/2018
?
Orange County Branch of the Girl Scouts of America
Hackers breach the Orange County, Calif. branch of the Girl Scouts of America, potentially exposing personal information for 2,800 members and their families.
Account Hijacking
U Activities of extraterritorial organizations and bodies
CC
US
Orange County, Girl Scouts of America
25
22/10/2018
?
Vulnerable IoT devices
Researchers from SophosLabs reveal the details of a new IoT botnet called Chalubo, targeting internet-facing SSH servers on Linux-based systems.
Account Hijacking
Y Multiple Industries
CC
>1
Sophos, Chalubo
26
23/10/2018
?
Axa Mexico
Insurer Axa reveals it suffered a cyber attack that prompted an alert from the Mexico central bank alert, however clients’ information and resources are safe and have not been affected.
Unknown
K Financial and insurance activities
CC
MX
AXA
27
23/10/2018
?
Eurostar
Eurostar has reset its customers' login passwords after detecting attempts to break into an unspecified number of accounts taking place between 15 and 19 October.
Unknown
H Transportation and storage
CC
FR
UK
Eurostar
28
23/10/2018
Magecart
Vulnerable Magento Servers
The researcher Willem de Groot reveals that now the Magecart gang is targeting vulnerable Magento servers via 20 vulnerable extensions.
Vulnerable Magento Extensions
Y Multiple Industries
CC
>1
Magecart, Magento
29
23/10/2018
?
Ad Publishers
Google removes the apps and blacklists the websites employed in a massive ad scam that made millions for fraudsters using bots trained to mimic human user behavior.
Bots
M Professional scientific and technical activities
CC
>1
Google
30
23/10/2018
?
Single individuals in the UK, Italy, and Canada
Researchers from ProofPoint reveal the details of a malicious campaign, carried out via a new PowerShell downloader dubbed sLoad, characterized by sophisticated reconnaissance features.
Malware
X Individual
CC
UK
IT
CA
ProofPoint, sLoad, PowerShell
31
23/10/2018
?
Jones Eye Clinic and Surgery Center
40K users are affected by a ransomware attack, occurred on August 23, targeting Jones Eye Clinic and Surgery Center.
Malware
Q Human health and social work activities
CC
US
Jones Eye Clinic and Surgery Center, Ransomware
32
23/10/2018
?
Internet Solutions
Internet Solutions (IS) sends a notice to clients to warn them about a breach, and urges them to change their passwords and take additional steps to secure their servers. Later the company confirms that its internal monitoring systems have detected “irregular activity” on some of its virtual services.
Unknown
J Information and communication
CC
ZA
Internet Solutions
33
23/10/2018
?
Children’s Hospital of Philadelphia (CHOP)
Children’s Hospital of Philadelphia (CHOP) notifies some of its current and former patients of two email incidents, both involving health information, occurred respectively on August 23, and September 6.
Account Hijacking
Q Human health and social work activities
CC
US
Children’s Hospital of Philadelphia, CHOP
34
24/10/2018
?
Cathay Pacific
Cathay Pacific announces to have discovered unauthorised access to some of its information system containing passenger data of up to 9.4 million people. The attack started in March and went undetected for some months.
Unknown
H Transportation and storage
CC
HK
Cathay Pacific
35
24/10/2018
?
Android users
The McAfee Mobile Research team identifies an active phishing campaign that traps users by sending an SMS to influence them on downloading and installing an Android malware app TimpDoor.
Malware
X Individual
CC
>1
McAfee, Android, TimpDoor
36
25/10/2018
NARWHAL SPIDER
Japanese Users
Researchers from Crowdstrike uncover a new spam campaign carried out via the Cutwail botnet, targeting Japanese speaking victims, and using a mixture of malicious PowerShell and steganography to distribute the URLZone malware family (a.k.a. Bebloh).
Researchers from Trend Micro discover an unknown attacker scanning for exposed Docker Engine APIs and utilizing them to deploy containers that download and execute a coin miner.
Misconfiguration
Y Multiple Industries
CC
>1
Trend Micro, Docker, Crypto
38
25/10/2018
?
Vulnerable Hadoop Clusters
Researchers from Radware reveal the details of DemonBot, a botnet targeting Hadoop clusters to launch DDoS attacks.
Hadoop Vulnerability
Y Multiple Industries
CC
>1
Radware, Hadoop
39
26/10/2018
China
Multiple Targets in US and Canada
An academic paper published by researchers from the US Naval War College and Tel Aviv University reveals that China Telecom has started abusing BGP hijacks after it entered into a pact with the US in September 2015 to stop all government-back cyber operations aimed at intellectual property theft.
BGP Hijacking
Y Multiple Industries
CC
CA
US
US Naval War College, Tel Aviv University, China Telecom, BGP
40
26/10/2018
Iran
Facebook users in the US and UK
Facebook announces to have removed 82 Pages, Groups and accounts for coordinated inauthentic behavior that originated in Iran and targeted people in the US and UK.
Social Network Bots
X Individual
CW
US
UK
Facebook, Iran
41
27/10/2018
?
Bank Islami
Karachi-based Bank Islami acknowledges of suffering a security breach of its payment cards system but denies reports of having lost an alleged $6 million in what local press have called the biggest cyber-attack in the country's history.
Unknown
K Financial and insurance activities
CC
PK
Bank Islami
42
27/10/2018
?
Python users
12 additional Python libraries uploaded on the official Python Package Index (PyPI) are found containing malicious code.
Malware
X Individual
CC
>1
Python Package Index, PyPI
43
28/10/2018
?
MapleChange
MapleChange, a Canadian crypto exchange, suffers a hack and looses all the funds (913 BTC, $6M worth), despite many accuse the exchange of attempting to stage an exit scam.
Vulnerability
V Fintech
CC
CA
MapleChange, Crypto
44
28/10/2018
Anonymous
70 Gabon Government Websites
The hacktivist group Anonymous takes down 70 Gabon government websites as part of its “anti-dictatorships” campaign.
DDoS
O Public administration and defence, compulsory social security
H
GA
Anonymous, Gabon
45
28/10/2018
?
Tomorrowland Festival
Hackers breach computer security at the Tomorrowland festival organizers, and steal the data of 64,000 people who signed up for tickets for the 2004 edition.
Unknown
R Arts entertainment and recreation
CC
BE
Tomorrowland
46
29/10/2018
LulzSec ITA and AntiSec ITA
Several Italian Universities
In name of Op #FifthOfNovember, the Italian branch of the Anonymous hacks several Italian Universities.
SQLi
P Education
H
IT
Op #FifthOfNovember, Anonymous, Antisec ITA, LulzSec ITA
47
29/10/2018
?
Mac Users
Researchers from Malwarebytes discover a malicious app, dubbed Coin Ticker, installing backdoor to unsuspecting Mac users for a purpose not completely clear.
Malware
X Individual
CC
>1
Malwarebytes, Coin Ticker
48
30/10/2018
?
FIFA
FIFA acknowledges that its computer systems were hacked earlier in March, for the second time, and officials from European soccer’s governing body fear they also might have suffered a data breach.
Unknown
U Activities of extraterritorial organizations and bodies
CC
N/A
FIFA
49
30/10/2018
?
US Voters
Researchers from Carbon Black reveal to have found 20 different state voter databases available for purchase on the dark web.
Unknown
O Public administration and defence, compulsory social security
CC
US
Carbon Black, US voters
50
30/10/2018
LulzSec ITA and AntiSec ITA
Websites affiliated to trade unions
In the second day of Op #FifthOfNovember, LulzSec ITA and AntiSec ITA target some websites affiliated to trade unions.
SQLi
N Administrative and support service activities
H
IT
Op #FifthOfNovember, Anonymous, Antisec ITA, LulzSec ITA
51
30/10/2018
?
UK’s leading construction, architecture and property firms
Over 600,000 breached corporate log-ins belonging to staff at the UK’s leading construction, architecture and property firms are found for sale on the dark web.
Account Hijacking
C Manufacturing
CC
UK
construction, architecture, property
52
30/10/2018
?
Mobile Users
A mobile malvertising campaign recently found targeting three digital advertising platforms has been using a malware, dubbed JuiceChecker-3PC, which checks a phone’s battery level as part of an unusual new technique for avoiding detection.
Malware
X Individual
CC
>1
JuiceChecker-3PC
53
31/10/2018
?
Iran
Iranian infrastructure and strategic networks are allegedly hit by a computer virus similar to Stuxnet but “more violent, more advanced and more sophisticated,”
Targeted Attack
Y Multiple Industries
CW
IR
Stuxnet
54
31/10/2018
?
Multiple Targets using Cisco Devices
Cisco reveals that attackers are actively exploiting CVE-2018-15454, a SIP vulnerability in the software of its firewall devices.
Vulnerability (CVE-2018-15454)
Y Multiple Industries
CC
>1
Cisco, CVE-2018-15454
55
31/10/2018
?
Radisson Hotel Group
The hotel chain Radisson Hotel Group suffered a security breach that exposed personal information of the members of its loyalty scheme. The incident happened on September 11, but was identified only on October first.
Unknown
I Accommodation and food service activities
CC
US
BE
Radisson Hotel Group
56
31/10/2018
?
SIngle Individuals
Security researchers from Cisco reveal that two recent sextortion scam campaigns seem to rely on the Necurs botnet infrastructure to distribute the messages.
Malicious Spam
X Individual
CC
>1
Necurs, Cisco
57
31/10/2018
LulzSec ITA and AntiSec ITA
Federazione Italiana Medici Medicina Generale Pisa
Third day of Op #FifthOfNovember, and this time LulzSec ITA and AntiSec ITA deface a new target.
Defacement
Q Human health and social work activities
H
IT
Op #FifthOfNovember, Anonymous, Antisec ITA, LulzSec ITA, Federazione Italiana Medici Medicina Generale Pisa
58
31/10/2018
?
Single Individuals
According to a report from Kryptos Logic, the Emotet malware family has started mass-harvesting full email messages from infected victims in a new mysterious campaign.
Malware
X Individual
CC
>1
Kryptos Logic, Emotet
59
31/10/2018
?
NorthBay Healthcare Corporation
NorthBay Healthcare Corporation suffers a data breach affecting the information of everyone who applied for a position within the organization between December 2012 and May 2018.
Where are the actual cyber attacks timelines for 16-31 October 2018?
The issue has been fixed. You can check again and let me know if it does not work.
Apologies for any inconvenience.