16-31 March 2020 Cyber Attacks Timeline

April 7, 2020April 7, 2020 Paolo Passeri 0 Comments 2020, APT28, APT36, APT41, Coronavirus, COVID-19, Cyber Attacks, Cyber Crime, Cyber Espionage, Cyber Warfare, Gaza Cybergang, Hacktivism, March, Weibo

The second timeline of March is here! Unsurprisingly in this fortnight I have collected the highest number of events so far (107), and one third of them is somehow related to the COVID-19 pandemic.

Unfortunately cyber criminals are not showing any mercy in such complicated moments. Not only ransomware attacks continue to occur with a regular basis (with new high-profile victims), but the world has literally been bombarded with malicious spam, phishing campaigns, and malware in theme with the current COVID-19 outbreak.

This wave of attacks has overshadowed some mega breaches unearthed in the same period, such as the discovery of 538 million users of the Chinese social network Weibo available for sale online. And they were in good company given that even the details of 49 million Iranian citizens (users of two local messaging services), and 4.9 million Georgian citizens were equally leaked online. And just to complete the picture we should also consider a second breach to a primary hotel chain and to an Indian real estate service.

The cyber espionage front is quite crowded with multiple operations and apparently unaffected by the current situation: usual suspects such as APT28, APT36, APT41, and the Gaza CyberGang continue to populate the timeline….

And with this our summary is over. The timeline is all yours, and contains the details that you can browse and share to support my work and spread the risk awareness across the community. And don’t forget to follow @paulsparrows on Twitter, or even connect on Linkedin, for the latest updates.

ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags
1	02/03/2020	?	Vijay Sales	A threat actor posts a leaked Vijay Sales, a large electronics retail store chain in India, database on a popular dark web hacker forum. The threat actor claims the source was from an “exposed backup server” breached in February 2020.	AWS misconfiguration	G Wholesale and retail trade	CC	IN		Vijay Sales, AWS
2	02/03/2020	?	GeoCloud	A threat actor posts another database, this time from technology company GeoCloud, leaked through a public Amazon server. The data contains users’ names, email addresses, and passwords as well as the company’s social media keys and company information.	AWS misconfiguration	S Other service activities	CC	IL		GeoCloud, AWS
3	13/03/2020	?	Norwegian Cruise Line	Researchers from Dynarisk discover a breached database belonging to Norwegian Cruise Line, containing 29,969 records	Unknown	R Arts entertainment and recreation	CC	US		Dynarisk, Norwegian Cruise Line
4	14/03/2020	Maze	Hammersmith Medicines Research (HMR)	Hammersmith Medicines Research (HMR) is hit with a Maze ransomware attack.	Malware	Q Human health and social work activities	CC	UK		Hammersmith Medicines Research, HMR, Maze, Coronavirus
5	14/03/2020	?	Energy, construction, and telecoms in the United States	Researchers from Proofpoint discover a small campaign targeting energy, construction, and telecoms in the United States, using the subject line "coronavirus update disease (COVID-19) your neighbors tested positive" and distributing the Remcos remote control tool.	Malware	Y Multiple Industries	CC	US		Proofpoint, Coronavirus, COVID-19, Remcos
6	14/03/2020	?	Jamaica National Group	Jamaica National Group is hit with a ransomware attack.	Malware	K Financial and insurance activities	CC	JM		Jamaica National Group, ransomware
7	15/03/2020	?	Bluffton Township Fire District	Bluffton Township Fire District is hit with a ransomware attack.	Malware	O Public administration and defence, compulsory social security	CC	US		Bluffton Township Fire District, ransomware
8	16/03/2020	APT36	Indian government	Researchers from Malwarebytes discover a new campaign targeting India of the Pakistan-linked APT36 group exploiting COVID-19 to implant the Crimson RAT.	Targeted Attack	O Public administration and defence, compulsory social security	CE	IN		APT36, COVID-19, Crimson, Pakistan, India, Malwarebytes
9	16/03/2020	?	Single Individuals	Researchers from ESET discover a massive campaign targeting users in multiple countries carried out via a wave of 2,500 infections of just two strains of malware delivered in COVID-19-themed emails.	Malicious Spam	X Individual	CC	>1		ESET, COVID-19, Coronavirus
10	16/03/2020	TA505	U.S. healthcare, manufacturing, and pharmaceuticals industries.	Researchers from Proofpoint discover a campaign from TA505, using a coronavirus lure as part of a downloader campaign targeting the U.S. healthcare, manufacturing, and pharmaceuticals industries.	Malware	Y Multiple Industries	CC	US		Proofpoint, TA505
11	16/03/2020	?	Single Individuals	Researchers from KnowBe4 discover a new phishing campaign spoofing the CDC and WHO.	Account Hijacking	X Individual	CC	US		KnowBe4, Coronavirus, COVID-19, CDC, WHO
12	16/03/2020	?	Multiple targets in the UK	The National Cyber Security Centre (NCSC) warns that criminals are looking to exploit the spread of coronavirus to conduct cyberattacks and hacking campaigns.	>1	Y Multiple Industries	CC	UK		National Cyber Security Centre, NCSC, Coronavirus, COVID-19
13	16/03/2020	?	College of DuPage	College of DuPage offers nearly free credit monitoring to over 1,700 current and former employees following a data breach.	Unknown	P Education	CC	US		College of DuPage
14	16/03/2020	?	Android users	Researchers from Kaspersky discover MonitorMinor, a stalkerware able to intercept user data in disguise of a parental control app.	Malware	X Individual	CC	>1		Kaspersky, MonitorMinor, Android
15	17/03/2020	?	Multiple targets in the US	Researchers from Proofpoint discover a medium-sized campaign in the United States primarily targeting the manufacturing industry but also construction, transportation, healthcare, automotive, energy, and aerospace companies. The email spoofs the real address of the head of the World Health Organization (WHO), claims there is a “solution” for “total control”, distributes GuLoader and Agent Tesla, and asks the recipient to “share with all contacts.”	Malware	Y Multiple Industries	CC	US		Proofpoint, World Health Organization, WHO, GuLoader, Agent Tesla, COVID-19, Coronavirus
16	17/03/2020	?	Manufacturing and industrial targets in Spain and Portugal	Researchers from Proofpoint discover a small COVID-19 themed campaign against manufacturing and industrial targets in Spain and Portugal and distributing GuLoader.	Malware	Y Multiple Industries	CC	ES PT		Proofpoint, COVID-19, Coronavirus, GuLoader
17	17/03/2020	?	Manufacturing, technology, and industrial companies in the Netherlands	Researchers from Proofpoint discover a small campaign in Dutch targeting manufacturing, technology, and industrial companies in the Netherlands, designed to steal banking credentials.	Account Hijacking	Y Multiple Industries	CC	NL		Proofpoint, COVID-19, Coronavirus
18	17/03/2020	?	Italian users	Researchers from Cybaze-Yoroi ZLab intercept a new Ursnif campaign targeting Italian users.	Malware	X Individual	CC	IT		Cybaze-Yoroi Zlab, Ursnif
19	17/03/2020	?	Vimeo users	Video sharing site Vimeo believes a malware infection has targeted some of its user accounts for theft.	Malware	X Individual	CC	>1		Vimeo
20	17/03/2020	?	Town of Houlton Police	The Town of Houlton Police discloses that it suffered a malware attack discovered on October 2019.	Malware	O Public administration and defence, compulsory social security	CC	US		Town of Houlton Police
21	17/03/2020	?	Tandem Diabetes Care	Tandem Diabetes Care notifies 140,781 patients of a phishing incident discovered on January 17, 2020	Account Hijacking	Q Human health and social work activities	CC	US		Tandem Diabetes Care
22	17/03/2020	?	Multiple targets	A new ransomware called Nefilim that shares much of the same code as Nemty starts to become active in the wild and threatens to release stolen data.	Malware	Y Multiple Industries	CC	>1		Ransomware, Nefilim, Nemty
23	18/03/2020	?	Multiple targets	Trend Micro reveals that hackers are actively exploiting two zero-days (CVE-2020-8467 and CVE-2020-8468) in its antivirus products.	Trend Micro Vulnerabilities	Y Multiple Industries	CC	>1		Trend Micro, CVE-2020-8467, CVE-2020-8468
24	18/03/2020	Molerats group (AKA Gaza CyberGang)	Arabic speakers interested in Palestine’s potential acceptance of the peace plan	Researchers from IBM X-Force reveal the details of the EnigmaSpark campaign, a politically themed campaign opposing to the Middle East Peace Plan.	Targeted Attack	X Individual	CE	PS		IBM X-Force, EnigmaSpark, Middle East
25	18/03/2020	?	Telecommunications providers, universities and financial service	Researchers from Bitdefender discover a new variant of the infamous Trickbot malware targeting telecommunications providers, universities and financial services in a campaign that looks to be going after intellectual property and financial data.	Malware	Y Multiple Industries	CE	>1		Bitdefender, Trickbot
26	18/03/2020	?	NutriBullet	Researchers at RiskIQ identify a cyber-attack against blender vendor NutriBullet that has successfully installed credit card stealing malware on the international nutribullet.com website. Not just once, but three times within three weeks.	Malicious Script Injection	G Wholesale and retail trade	CC	US		RiskIQ, NutriBullet, Magecart
27	18/03/2020	?	Android users in Libya	Researchers from Lookout discover an Android application that appears to be the most recent piece of tooling in a larger mobile surveillance campaign, exploiting COVID-19, operating out of Libya and targeting Libyan individuals.	Targeted Attack	X Individual	CE	LY		Lookout, Android, COVID-19, Libya
28	18/03/2020	?	US retail companies	Researchers from Proofpoint discover a small COVID-19 themed phishing campaign in the United States primarily targeting retail companies and uses concerns about infected staff members to try and lure victims to click.	Account Hijacking	G Wholesale and retail trade	CC	US		Proofpoint, COVID-19, Coronavirus
29	18/03/2020	?	Blizzard	Blizzard is hit with a DDoS attack.	DDoS	R Arts entertainment and recreation	CC	US		Blizzard
30	19/03/2020	?	Keen	Cybercriminals try to disrupt a charity initiative by Keen aimed to deliver shoes to the workers on the front lines and the families at home fighting through the COVID-19 crisis.	Malicious Bot	G Wholesale and retail trade	CC	US		Keen, COVID-19, Coronavirus
31	19/03/2020	?	Brooks International	The Sodinokibi Ransomware operators publish over 12 GB of stolen data allegedly belonging to a company named Brooks International for not paying the ransom.	Malware	M Professional scientific and technical activities	CC	PK		Sodinokibi, ransomware, Brooks International
32	19/03/2020	?	Single Individuals	Researchers from Sophos reveal that sextortion scammers are now attempting to capitalize on the COVID-19 pandemic by threatening their victims to infect their family with the SARS-CoV-2 virus besides revealing all their "dirty secrets".	Malicious Spam	X Individual	CC	>1		COVID-19, Coronavirus
33	19/03/2020	?	Single Individuals	The FBI warns of a significant spike in coronavirus scams targeting three states, with unusually high rates of COVID-19 infection: California, New York and Washington.	Malicious Spam	X Individual	CC	US		FBI, coronavirus, COVID-19, California, New York, Washington
34	19/03/2020	?	Android users	Researchers from Zscaler discover "Corona Safety Mask" an Android worm in disguise of a Coronavirus safety mask.	Malware	X Individual	CC	>1		Zscaler, Android, Coronavirus, Covid-19, Corona Safety Mask
35	19/03/2020	?	US Mobile users	According to researchers at telecoms security provider AdaptiveMobile, masses of text messages are being sent out to Americans, with offers on masks, survival guides and medically-unsupported COVID-19 treatments like CBD oil.	Malicious Spam	X Individual	CC	US		AdaptiveMobile, COVID-19, CBD oil
36	19/03/2020	?	Single Individuals	Researchers from IBM X-Force discover an ongoing phishing campaign delivering emails posing as official messages from the Director-General of the World Health Organization (WHO), actively spreading HawkEye malware payloads onto the devices of unsuspecting victims.	Malware	X Individual	CC	>1		IBM X-Force, COVID-19, Coronavirus, World Health Organization, WHO, HawkEye
37	19/03/2020	APT28, AKA Fancy Bear, Sednit, and Pawn Storm	Multiple targets	Researchers from Trend Micro reveal that APT28 have continued to scan and probe the internet for vulnerable email servers during 2019.	Targeted Attack	Y Multiple Industries	CE	>1		Trend Micro, APT28, Fancy Bear, Sednit, Pawn Storm
38	19/03/2020	?	Single Individuals	A new phishing email is trying to take advantage of the Coronavirus pandemic and the race to develop medications by promoting a fake [email protected] app that installs Redline, an information-stealing malware.	Malware	X Individual	CC	>1		COVID-19, Coronavirus, [email protected], Redline
39	19/03/2020	?	Takeaway	The German food delivery service Takeaway is hit with a DDoS attack.	DDoS	I Accommodation and food service activities	CC	DE		Takeaway
40	19/03/2020	Mespinoza/Pysa	Local government authorities in France	The France's issues a warning about Mespinoza/Pysa a new ransomware gang that's been recently seen targeting the networks of local government authorities.	Malware	O Public administration and defence, compulsory social security	CC	FR		Mespinoza, Pysa, ransomware
41	19/03/2020	TA505 AKA Evil Corp	Businesses in Germany	Researchers from Prevailion discover a new campaign by the notoriously prolific TA505 cybercrime organization targeting businesses in Germany via their human resources executives.	Malware	Y Multiple Industries	CC	DE		Prevailion, TA505, Evil Corp
42	20/03/2020	?	General Electric (GE) via Canon Business Process Services	General Electric (GE) discloses that personally identifiable information of current and former employees, as well as beneficiaries, was exposed in a security incident experienced by one of GE's service providers, Canon Business Process Services. One of their employees' email accounts was breached by an unauthorized party in February.	Account Hijacking	C Manufacturing	CC	US		General Electric, GE, Canon Business Process Services
43	20/03/2020	Digital Revolution	InformInvestGroup CJSC	Russian hacker group Digital Revolution claims to have breached InformInvestGroup CJSC, a contractor for the FSB, Russia's national intelligence service, and discovered details about Fronton, a project intended for hacking Internet of Things (IoT) devices.	Unknown	M Professional scientific and technical activities	CC	RU		Digital Revolution, InformInvestGroup CJSC, FSB, Fronton, IoT
44	20/03/2020	?	Finastra	Finastra, a leading financial technology provider from the UK, announces that it had to take several servers offline following a ransomware attack.	Malware	V Fintech	CC	UK		Finastra, ransomware
45	20/03/2020	?	Single Individuals in the US	FBI's Internet Crime Complaint Center (IC3) warns of an ongoing phishing campaign delivering spam that uses fake government economic stimulus checks as bait to steal personal information from potential victims.	Account Hijacking	X Individual	CC	US		FBI, Internet Crime Complaint Center, IC3
46	20/03/2020	?	Zyxel devices	Mukashi, a new variant of the Mirai malware is targeting a recently uncovered critical vulnerability in Zyxel network-attached storage devices and exploiting them to rope the machines into an IoT botnet.	CVE-2020-9054 vulnerability	Y Multiple Industries	CC	>1		Mukashi, Mirai, Zyxel, CVE-2020-9054
47	20/03/2020	?	University of Utah Health	The University of Utah Health discloses a security breach, due to unauthorized access to some employee email accounts along with the presence of malware on its systems. The intrusion took place between January 7 and February 21, 2020.	Account Hijacking	Q Human health and social work activities	CC	US		University of Utah Health
48	20/03/2020	?	Rotherham Council	Rotherham Council's IT system is compromised by an email with "COVID-19" in the subject field.	Account Hijacking	O Public administration and defence, compulsory social security	CC	UK		Rotherham Council
49	20/03/2020	?	Oregon Department of Human Services	The Oregon Department of Human Services announces that it uncovered a “phishing” incident on March 6 that affected one staff member’s e-mail.	Account Hijacking	O Public administration and defence, compulsory social security	CC	US		Oregon Department of Human Services
50	20/03/2020	?	Golden Valley Health Centers	Golden Valley Health Centers notifies patients after an employee email account was compromised on March 3.	Account Hijacking	Q Human health and social work activities	CC	US		Golden Valley Health Centers
51	21/03/2020	?	Multiple targets	Researchers from MalwareHunterTeam detect a new Coronavirus phishing campaign installing the NetWalker ransomware.	Malware	Y Multiple Industries	CC	>1		MalwareHunterTeam, Coronavirus, NetWalker, COVID-19
52	21/03/2020	?	Lilin devices	Criminals are exploiting critical flaws in IoT devices from Lilin to enslave them in at least three botnets used to carry out DDoS attacks.	Lilin Vulnerabilities	Y Multiple Industries	CC	>1		Lilin
53	21/03/2020	?	Bitcoin users	It turns out that a network of Bitcoin-to-QR-code generators has stolen more than $45,000 from users in the past four weeks.	Account Hijacking via malicious QR-code generators	V Fintech	CC	>1		Bitcoin, Crypto, QR-Code gernerator
54	23/03/2020	?	World Health Organization	Reuters reveal that hackers tried to break into the World Health Organization earlier this month	Targeted Attack	U Activities of extraterritorial organizations and bodies	CE	INT		Reuters, World Health Organization, WHO
55	23/03/2020	?	Multiple targets	Microsoft issues a warning (ADV200006) that targeted attacks are underway against Windows 10 users, from attackers exploiting a critical vulnerability with no available fix.	Targeted Attack	Y Multiple Industries	CC	>1		Microsoft, ADV200006
56	23/03/2020	?	538 million users of Chinese social network Weibo	The personal details of more than 538 million users of Chinese social network Weibo are currently available for sale online.	Unknown	X Individual	CC	CN		Weibo
57	23/03/2020	?	SIngle Individuals	Researchers from KnowBe4 discover a new phishing campaign repurposing old emails to exploit COVID-19.	Account Hijacking	X Individual	CC	US		KnowBe4, Coronavirus, COVID-19
58	23/03/2020	?	Single Individuals	Researchers from MalwareHunterTeam discover the first MBRLocker variant with a Coronavirus theme.	Malware	X Individual	CC	>1		MalwareHunterTeam, MBRLocker, Coronavirus, COVID-19
59	23/03/2020	?	Single Individuals	Researchers from Malwarebytes discover two sites promoting a bogus Corona Antivirus, taking advantage of the current COVID-19 pandemic, to distribute a malicious payload that will infect the target's computer with the BlackNET RAT and add it to a botnet.	Malware	X Individual	CC	>1		Malwarebytes, Coronavirus, COVID-19
60	23/03/2020	?	Single Individuals	An HHS.gov open redirect is currently being used by attackers to push malware payloads onto unsuspecting victims' systems with the help of coronavirus-themed phishing emails.	Malware	X Individual	CC	US		HHS, COVID-19, Coronavirus
61	23/03/2020	?	118 118 Money	118 118 Money writes to personal loans and credit card customers to notify an intrusion.	Unknown	K Financial and insurance activities	CC	UK		118 118 Money
62	23/03/2020	?	LTI Power System	LTI Power System is hit with a ransomware attack.	Malware	C Manufacturing	CC	US		LTI Power System, ransomware
63	24/03/2020	?	Industrial-related entities in the Middle East	Researchers from Kaspersky reveal the details of operation WildPressure, a campaign targeting entities in middle east via the Milum trojan.	Targeted Attack	Y Multiple Industries	CC	>1		Kaspersky, WildPressure, Milum
64	24/03/2020	?	Android users	Researchers from Check Point issue a new warning for a malware family dubbed Tekya, using that same native code subterfuge as a previous malware called Haken to slip the security net.	Malware	X Individual	CC	>1		Check Point, Tekya, Haken
65	24/03/2020	?	Banking users in Spain	Researchers from Kaspersky reveal that the operators of the Ginp mobile banking trojan are now targeting users in Spain with a fake "Coronavirus Finder" app.	Malware	K Financial and insurance activities	CC	ES		Kaspersky, Ginp, Coronavirus Finder
66	24/03/2020	TwoSail Junk	iOS Users in Hong Kong	Researchers from Trend Micro discover a campaign aimed at infecting the iPhones of users in Hong Kong with an iOS backdoor tracked as LightSpy.	Targeted Attack	X Individual	CE	HK		Trend Micro, iPhone, iOS, LightSpy, TwoSail Junk
67	24/03/2020	?	Netflix users	Users are warned about fraudulent messages being shared on social media platforms that Netflix is offering free passes to its platform because of the Coronavirus pandemic.	Account Hijacking	X Individual	CC	>1		Netflix, Coronavirus, COVID-19
68	24/03/2020	?	Bank customers in Germany	Researchers from IBM X-Force discover TrickMo, an Android malware targeting TrickBot victims and designed to bypass MFA to bank customers when they need to authorize a transaction.	Malware	K Financial and insurance activities	CC	DE		IBM X-Force, TrickMo, Android, TrickBot
69	24/03/2020	?	Twitter users	Hackers take over a wave of Twitter accounts to aggressively advertise a website that claims to be selling face masks and toilet paper during the coronavirus pandemic.	Account Hijacking	X Individual	CC	>1		Twitter, coronavirus, COVID-19
70	24/03/2020	?	PropTiger	Private data of more than 2 million users are shared on a hacking forum following a major security breach of the Indian property website PropTiger in 2018.	Unknown	L Real estate activities	CC	IN		PropTiger
71	25/03/2020	APT41	Multiple targets	Researchers from FireEye discover a campaign carried out by the Chinese state-sponsored group APT41, using recent exploits to target security flaws in Citrix, Cisco, and Zoho appliances and devices of entities from a multitude of industry sectors spanning the globe.	Targeted Attack	Y Multiple Industries	CE	>1		FireEye, APT41
72	25/03/2020	?	Tupperware	Researchers from Malwarebytes reveal that hackers have compromised the website of the world-famous Tupperware brand and stolen customers' payment card details at checkout.	Malicious Script Injection	G Wholesale and retail trade	CC	US		Tupperware, Magecart, Malwarebytes
73	25/03/2020	?	Daniel's Hosting	The operator of the biggest free host for dark web sites, Daniel's Hosting, confirms that the service has been shut down following a hack attack that deleted all 7,595 site databases.	Unknown	S Other service activities	CC	DE		Daniel's Hosting
74	25/03/2020	Palesa	AMD	AMD admits that a hacker has stolen files related to some of its graphics products.	Unknown	C Manufacturing	CC	US		AMD, Palesa
75	25/03/2020	?	Linksys Routers	Researchers from Bitdefender reveal the details of a new campaign where the attackers change DNS settings to redirect the victim to a website that claims to be from the World Health Organization, but in reality distributing the Oski infostealer.	Malware	Y Multiple Industries	CC	>1		Bitdefender, World Health Organization, Oski infostealer, Coronavirus, COVID-19
76	25/03/2020	?	Single Individuals	Researchers from 'Doctor Web' issue a warning after discovering thousands of victims have been tricked into downloading a dangerous backdoor that is disguised as an update to Google Chrome.	Malware	X Individual	CC	>1		Doctor Web, Google Chrome
77	25/03/2020	?	Websites using Wordpress	The threat actors behind the WordPress WP-VCD malware start to distribute modified versions of Coronavirus plugins that inject a backdoor into a web site.	Malicious Wordpress Plugin	Y Multiple Industries	CC	>1		WordPress, WP-VCD, Coronavirus, COVID-19
78	25/03/2020	?	Town of Jupiter	The town of Jupiter is hit by a REvil/Sodinokibi ransomware attack.	Malware	O Public administration and defence, compulsory social security	CC	US		Jupiter, REvil, Sodinokibi, ransomware
79	26/03/2020	China	North Korea	Researchers at Google's Threat Analysis Group reveal on Thursday that an unnamed group of hackers used five zero-day vulnerabilities, or secret hackable flaws in software, to target North Koreans and North Korea-focused professionals in 2019.	Targeted Attack	O Public administration and defence, compulsory social security	CE	KR		China, North Korea, Google
80	26/03/2020	Maze	Chubb	Chubb, a major cybersecurity insurance provider for businesses hit by data breaches, is hit with a Maze ransomware attack.	Malware	K Financial and insurance activities	CC	CH		Chubb, Maze, ransomware
81	26/03/2020	DoppelPaymer	Kimchuk	Kimchuk, a medical and military electronics maker, is hit by the DoppelPaymer ransomware	Malware	C Manufacturing	CC	US		Kimchuk, DoppelPaymer, ransomware
82	26/03/2020	FIN7	Multiple targets	The FBI warns organizations and security professionals about the tactic adopted by FIN7 to deliver the GRIFFON malware: malicious USB‌ devices acting as a keyboard when plugged into a computer, injecting commands download and executing a JavaScript backdoor associated with this actor.	Targeted Attack	K Financial and insurance activities	CC	US		FIN7, GRIFFON , FBI
83	26/03/2020	Ryuk	US health care provider	A US health care provider is hit with the Ryuk ransomware.	Malware	Q Human health and social work activities	CC	US		Ryuk, ransomware
84	26/03/2020	?	Undisclosed US hospitality provider	Researchers from Trustwave reveal that a US hospitality provider has recently been the target of an incredibly rare BadUSB attack.	Malware	Q Human health and social work activities	CC	US		Trustwave, BadUSB
85	26/03/2020	?	Single Individuals	Researchers from Forcepoint discover a new phishing campaign pretending to be a missed call about a COVID-19 update.	Account Hijacking	X Individual	CC	US		Forcepoint, COVID-19, Coronavirus
86	26/03/2020	?	Single Individuals	Researchers from Forcepoint discover a new spam campaign exploiting COVID-19.	Malicious Spam	X Individual	CC	US		Forcepoint, COVID-19, Coronavirus
87	26/03/2020	?	Single Individuals	Researchers from Forcepoint discover a malicious campaign in Italy, encouraging the opening of an attachment, which it presents to be sent from the World Health Organization (WHO) with information covering all the necessary precautions against Coronavirus infections.	Malware	X Individual	CC	IT		Forcepoint, COVID-19, Coronavirus
88	27/03/2020	Silence and TA505	At least two companies operating in pharmaceutical and manufacturing sectors have been affected	Researchers from Group-IB reveal that at least two companies operating in pharmaceutical and manufacturing sectors have been affected have been affected by successful attacks carried out by Silence and TA505, exploiting CVE-2019-1405 and CVE-2019-1322	Targeted Attack	C Manufacturing	CC	EU		Group-IB, TA505, Silence, CVE-2019-1405, CVE-2019-1322
89	27/03/2020	?	Social Bluebook	Social Bluebook, a Los Angeles-based company that allows advertisers to pay social media “influencers” for posts that promote their products and services, is hacked.	Unknown	J Information and communication	CC	US		Social Bluebook
90	27/03/2020	?	U.S. Small Businesses	Researchers from IBM X-Force reveal that attackers are attempting to deliver Remcos remote access tool payloads on the systems of small businesses via phishing emails impersonating the U.S. Small Business Administration (U.S. SBA).	Malware	Y Multiple Industries	CC	US		IBM X-Force, Remcos, U.S. Small Business Administration, U.S. SBA
91	27/03/2020	?	Multiple targets in Australia	The Australian Cyber Security Centre (ACSC) issues a new threat update, seeking to raise awareness around coronavirus-themed malicious cyber activity.	Account Hijacking	Y Multiple Industries	CC	AU		Australian Cyber Security Centre, ACSC, COVID-19, Coronavirus
92	28/03/2020	?	4.9 million Georgian citizens	The personal details for more than 4.9 million Georgians, including deceased citizens, are published on a hacking forum.	Unknown	O Public administration and defence, compulsory social security	CC	GE		Georgia
93	28/03/2020	?	Single Individuals	Researchers from KnowBe4 discover a malicious campaign warning recipients that they've been exposed to the coronavirus through personal contact with a colleague, friend, or family member.	Malicious Spam	X Individual	CC	US		KnowBe4, Coronavirus, COVID-19
94	28/03/2020	Two malicious groups	Multiple targets	Researchers from Qihoo 360 reveal that since at least early December 2019, a mysterious hacker group has been taking over DrayTek enterprise routers to eavesdrop on FTP and email traffic inside corporate networks.	DrayTek Vigor enterprise routers vulnerability	Y Multiple Industries	CC	>1		Qihoo 360, DrayTek
95	28/03/2020	?	Teaching Council	A phishing incident at the Teaching Council leads to personal information relating to 9,735 teachers being shared.	Account Hijacking	P Education	CC	IE		Teaching Council
96	29/03/2020	Saudi Arabia?	Saudi citizens in the US	Saudi Arabia appears to be exploiting weaknesses in the global mobile telecoms network to track its citizens as they travel around the US.	SS7 Vulnerabilities	X Individual	CE	SA		Saudi Arabia
97	29/03/2020	?	Single Individuals	A new phishing campaign is spotted that pretends to be from a local hospital telling the recipient that they have been exposed to the Coronavirus and that they need to be tested.	Malware	X Individual	CC	>1		COVID-19, Coronavirus
98	30/03/2020	?	Major banks from the US, Canada, and Australia	Researchers from IBM X-Force discover a new phishing campaign exploiting COVID-19 to distribute the Zeus Sphinx trojan.	Malware	K Financial and insurance activities	CC	>1		IBM X-Force, COVID-19, Zeus Sphinx, Coronavirus
99	30/03/2020	?	Multiple targets	FBI warns about Zoom bombing as hijackers take over school and business video conferences.	Zoom misconfiguration	Y Multiple Industries	CC	>1		FBI, Zoom bombing
100	30/03/2020	?	Multiple targets in the US	The FBI issues an alert (the third) about state-sponsored hackers using the Kwampirs malware to attack supply chain companies and other industry sectors as part of a global hacking campaign.	Targeted Attack	Y Multiple Industries	CE	US		FBI, Kwampirs
101	30/03/2020	?	YouTuber users	A hacker has hijacked tens of YouTube accounts, renamed them to various Microsoft brands, and is currently broadcasting a cryptocurrency Ponzi scam to tens of thousands of users, posing as a message from the company's former CEO Bill Gates.	Account Hijacking	X Individual	CC	>1		YouTube, Ponzi scam, Bill Gates.
102	30/03/2020	?	GoDaddy.com	A spear-phishing hits a customer service employee at GoDaddy.com, the world’s largest domain name registrar. The phisher modifies key customer records, including transaction brokering site escrow.com.	Account Hijacking	J Information and communication	CC	US		GoDaddy.com, escrow.com.
103	30/03/2020	"Samaneye Shekar” meaning “Hunting system”	42 million Iranian citizens	The details of 42 million Iranian citizens, allegedly users of HotGram and Talagram, two local Telegram alternatives, are leaked online.	Unknown	X Individual	CC	IR		HotGram, Talagram, Telegram, Samaneye Shekar, Hunting system
104	31/03/2020	?	Marriott	Marriott confirms a second data breach in three years, this time involving the personal information on 5.2 million guests. The attackers obtained the login details of two employees, and broke in weeks earlier during mid-January. The breach was discovered on February.	Account Hijacking	I Accommodation and food service activities	CC	US		Marriott
105	31/03/2020	?	Specific Asian religious and ethnic group	Researchers from Kaspersky reveal the details of Holy Water, a campaign targeting people in a specific Asian religious and ethnic group.	Targeted Attack	X Individual	CE	>1		Kaspersky, Holy Water
106	31/03/2020	?	Multiple targets	Researchers from Mimecast discover a new campaign spreading the LimeRAT Remote Access Trojan by harnessing an old encryption technique in Excel files.	Malware	Y Multiple Industries	CC	>1		Mimecast, LimeRAT, Excel
107	31/03/2020	?	Single Individuals	Researchers from Cofense discover a new evasive phishing campaign exploiting the COVID-19 fear.	Account Hijacking	X Individual	CC	>1		Cofense, COVID-19, Coronavirus
ID	Date	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags

HACKMAGEDDON

16-31 March 2020 Cyber Attacks Timeline

Related Posts

Like this:

Leave a Reply Cancel reply

Related Posts

Share:

Like this:

Leave a Reply Cancel reply