The second cyber attacks timeline of November 2021 is finally out (you can find the first one here or in the link below)! In the second half of this month I have collected 96 events, with a daily average slightly decreasing to 6.4 events/day from 6,67 events/day. Ransomware continues to dominate the threat landscape but the percentage of events directly or indirectly characterized dropped to 22% from 30.6% of the previous timeline (but despite the decrease, the criminals are still asking for massive ransoms.) I wonder if this is an effect of the increasing pressure of the law enforcement agencies against the ransomware syndicates.

Another common trend of this period is the impact of vulnerabilities: in this timeline they characterized the 12% of events including several ransomware attacks. We have, among the others, a new 0-day for Android (CVE-2021-1048), the Tortilla threat actor exploiting ProxyShell to deploy the Babuk ransomware, and several widespread operations exploiting Zoho’s ManageEngine ADSelfService Plus CVE-2021-4053 (and yes, threat actors continue to exploit SolarWinds’ Serv-U CVE-2021-35211.

Robinhood had the information of approximately 7 million customers compromised, and another decentralized finance (DeFi) platform has bitten the dust, suffering the theft of $55 million worth of crypto assets by a suspected North Korean threat actor.

As usual, the cyber espionage front is quite crowded, a threat actor dubbed DEV-0322 has been very busy to exploit the ManageEngine vulnerability, the Lazarus Group never misses a timeline, along with other well known threat actors such as Lyceum and Kimsuky. Another important cyber espionage campaign characterizing this timeline is the PhoneSpy spyware targeting Android users in South Korea.

Expand for details

Enjoy the interactive timeline, and thanks for sharing it, and supporting my work in spreading the risk awareness across the community. Also, don’t forget to follow @paulsparrows on Twitter, or even connect on Linkedin, for the latest updates.



The “Breachometer” compares the current number of events/day with the max and min values recorded in the previous 12 months.

  • 2022 Cyber Attacks Statistics

    And finally I have aggregated all the data collected in 2022 from the cyber attacks timelines. In the past year I have collected 3074 events...

  • Photo by Towfiqu barbhuiya on UnsplashThe Biggest Data Breaches of 2023

    Similarly to what I have done in 2022 and 2021, I am collecting the main mega breaches...

  • TCP Split Handshake Attack Explained

    Update May 12: TCP Split Handshake: Why Cisco ASA is not susceptible Update May 11: The Never Ending Story Update April 21: Other Considerations on TCP Split Handshake Few days ago, independent security research and testing NSS Labs, issued a comparative report among six network security ...

  • February 2018 Cyber Attacks Statistics

    Time flies, and finally I have found the time to publish the statistics derived from the cyber attacks timelines of February (part I and part II). Before drilling down into the statistics, let me say that many readers keep on asking how I derive the ...

  • January 2021 Cyber Attacks Statistics

    It's time to publish the cyber attacks statistics derived from the corresponding timelines that I have recently posted. In January I have collected 160 events...


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.