The second cyber attacks timeline of November 2021 is finally out (you can find the first one here or in the link below)! In the second half of this month I have collected 96 events, with a daily average slightly decreasing to 6.4 events/day from 6,67 events/day. Ransomware continues to dominate the threat landscape but the percentage of events directly or indirectly characterized dropped to 22% from 30.6% of the previous timeline (but despite the decrease, the criminals are still asking for massive ransoms.) I wonder if this is an effect of the increasing pressure of the law enforcement agencies against the ransomware syndicates.

Another common trend of this period is the impact of vulnerabilities: in this timeline they characterized the 12% of events including several ransomware attacks. We have, among the others, a new 0-day for Android (CVE-2021-1048), the Tortilla threat actor exploiting ProxyShell to deploy the Babuk ransomware, and several widespread operations exploiting Zoho’s ManageEngine ADSelfService Plus CVE-2021-4053 (and yes, threat actors continue to exploit SolarWinds’ Serv-U CVE-2021-35211.

Robinhood had the information of approximately 7 million customers compromised, and another decentralized finance (DeFi) platform has bitten the dust, suffering the theft of $55 million worth of crypto assets by a suspected North Korean threat actor.

As usual, the cyber espionage front is quite crowded, a threat actor dubbed DEV-0322 has been very busy to exploit the ManageEngine vulnerability, the Lazarus Group never misses a timeline, along with other well known threat actors such as Lyceum and Kimsuky. Another important cyber espionage campaign characterizing this timeline is the PhoneSpy spyware targeting Android users in South Korea.

Expand for details

Enjoy the interactive timeline, and thanks for sharing it, and supporting my work in spreading the risk awareness across the community. Also, don’t forget to follow @paulsparrows on Twitter, or even connect on Linkedin, for the latest updates.



The “Breachometer” compares the current number of events/day with the max and min values recorded in the previous 12 months.

  • 2023 Stats Featrured Image2024 Cyber Attacks Statistics

    In 2023, there was a 35% increase in cyber attacks to 4,128 events, with the MOVEit CVE-2023-34362 vulnerability being heavily exploited. Cybercrime dominated as the main motivation at 79%, while malware led attack techniques with 35.9%. Healthcare remained a top target for ransomware. The data ...

  • network servers on an enclosureCVEs Targeting Remote Access Technologies

    In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies. In this blog post I summarized the main CVEs exploited so far in 2024.

  • Q4 2023 Featured ImageQ4 2023 Cyber Attacks Statistics

    In Q4 2023, cyber attack events decreased by 7.1% to 1029 compared to the previous quarter. Cybercrime remains the primary motive, although slightly reduced, while malware tops attack techniques, increasing from the last quarter. Multiple industries and healthcare are the most targeted sectors. These statistics ...

  • computer program language text1-15 February 2024 Cyber Attacks Timeline

    In the cyber attacks timeline of February H1 2024, I collected 139 events dominated by malware attacks. Ransomware and vulnerabilities also played an important role in the threat landscape.

  • List Of Hacked Celebrities Who Had (Nude) Photos Leaked

    During Summer we always try to spend our free time in a more profitable manner, for instance reading gossip chronicles. From this point of view, July 2012 has not been a particularly lucky month for Carly Rae Jepsen. On July the 7th, her website has been ...


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.