1-15 November 2023 Cyber Attacks Timeline

Last modified: January 9, 2024

Follow me on X

Connect on Linkedin

Connect on Mastodon

EVENTS

EVENTS/DAY

EVENTS

EVENTS/DAY

Motivations November H1 2023

Attack Techniques November H1 2023

In the first half of November 2023, I collected 173 events (11.53 events per day), while confirming the high level of activity that characterized the end of 2023. this number revealed a slight decrease compared to the 188 events (11.75 events per day) of the previous timeline.

Ransomware continued to characterize the threat landscape (45 events were directly or indirectly related to this kind of attack, corresponding to 26%) and consequently malware attacks led the chart of the attack techniques with 38.2% (66 events,) considerably up from 34.4% of the second half of October. On the other hand, the exploitation of vulnerabilities characterized 15.6%, substantially in line with 15.3% of the previous two weeks.

September 2026 Cyber Attacks Statistics Infographic

September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%.

In the fintech sector, Poloniex suffered a massive hack leading to the theft of $100 million worth of crypto assets. Onyx was also the victim of a hack, but in this case the bounty stolen by the attackers was “only” $2.1 million worth. Other interesting events included a new campaign by the North Korean Lazarus Group targeting blockchain engineers of a cryptocurrency exchange platform through a new malware strain named KandyKorn, and a new operation leading to the theft of $60 milion worth of cryptocurrency from 99,000 people in six months.

In terms of mega breaches, the aftermaths of the widespread exploitation of the MOVEit CVE-2023-34362 vulnerability continued, continued, and the State of Maine announced that its systems were breached exploiting the above flaw, allowing the threat actors to access personal information of about 1.3 million individuals, close to the state’s entire population.

And once again, confirming a trend that characerized 2023, threat actors driven by cyber espionage were quite busy in exploiting the numerous vulnerabilities disclosed in this period (and not only.) For example several groups including Winter Vivern exploited the CVE-2023-37580 Zimbra vulnerability, whilst APT29 continued to rely on the WinRAR CVE-2023-38831 vulnerability for their campaigns. Other threat actors busy in the same period involved the Iranian groups APT34 (a.k.a. OilRig) and Imperial Kitten, the North Korean APT38 (a.k.a. BlueNoroff,) and the pro-Palestine TA402 (a.ka. Molerats and Gaza Cybergang.)

And the war in Middle East continued to motivate multiple operations against organizations in Israel carried out by the Abnaa AlSaada and Soldiers of Solomon threat actors, but also a destructive attack by the threat actor Agonizing Serpens carried out via a wiper dubbed BiBi Wiper.

Of course, my suggestion is always the same: browse the timeline, and obviously share it to support my work in spreading the risk awareness across the community. And don’t forget to follow @paulsparrows on X (formerly Twitter,) or even connect on Linkedin, or Mastodon for the latest updates.

Geo Map November H1 2023

No Data Found

ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags
1	01/11/2023	23/09/2023	12/10/2023	?	Okta	Okta warns nearly 5,000 current and former employees that their personal information was exposed after Rightway Healthcare, a third-party vendor was breached.	Unknown	Professional, scientific and technical	Cyber Crime	US		Okta, Rightway Healthcare
2	01/11/2023	Since at least 27/10/2023	27/10/2023	HelloKitty	Multiple organizations	Researchers from Rapid7 reveal that the HelloKitty ransomware operation is exploiting the Apache ActiveMQ CVE-2023-46604 vulnerability to breach networks and encrypt devices.	CVE-2023-46604 Vulnerability	Multiple Industries	Cyber Crime	>1		Rapid7, HelloKitty, ransomware, Apache ActiveMQ, CVE-2023-46604
3	01/11/2023	01/11/2023	01/11/2023	?	Mr. Cooper	U.S. mortgage lending giant Mr. Cooper suffers a cyberattack that causes the company to shut down IT systems, including access to their online payment portal.	Unknown	Finance and insurance	Cyber Crime	US		Mr. Cooper
4	01/11/2023	-	-	Lazarus Group	Blockchain engineers of a cryptocurrency exchange platform	Researchers from Elastic reveal the details of REF7001, a campaign using a new macOS malware dubbed 'KandyKorn,' targeting blockchain engineers of a cryptocurrency exchange platform.	Malware	Fintech	Cyber Crime	N/A		Elastic, REF7001, macOS, KandyKorn
5	01/11/2023	During October 2023	During late October 2023	Crambus (aka OilRig, APT34, MuddyWater)	Two organizations in Israel	Researchers from Deep Instinct discover a new campaign from the “MuddyWater” group targeting two Israeli targets.	Targeted Attack	Multiple Industries	Cyber Espionage	IL		Crambus, OilRig, APT34, MuddyWater, Israel, Iran, Deep Instinct
6	01/11/2023	-	-	Soldiers of Solomon	Flour Mills Ltd	The Pro-Palestinian hackers group ‘Soldiers of Solomon’ claims to have breached the infrastructure of the production plant of Flour Mills Ltd, a multinational company engaged in the processing and marketing of flour and related food products. The threat actors claim to have damaged the production cycle.	Unknown	Accommodation and food service	Hacktivism	IL		Israel, Palestine, Soldiers of Solomon, Flour Mills Ltd
7	01/11/2023	-	-	Lorentz	Cogdell Memorial Hospital	The Cogdell Memorial Hospital announces to be experiencing a computer network incident that prevents the hospital from accessing some of its systems and severely limiting the operability of its phone system. The Lorentz ransomware group claims responsibility for the attack.	Malware	Human health and social work	Cyber Crime	US		Cogdell Memorial Hospital, Lorentz, ransomware
8	01/11/2023	-	-	Pwned	Clinique	The Spanish branch of Skincare products maker Clinique, a subsidiary of cosmetics giant Estée Lauder, reportedly experiences a significant data breach, with the personal information of over 700,000 customers exposed by a threat actor with the moniker of Pwned.	Unknown	Manufacturing	Cyber Crime	ES		Clinique, Estée Lauder, Pwned
9	01/11/2023	25/10/2023	25/10/2023	ALPHV AKA BlackCat	Advarra	An Advarra employee falls victim of a compromise of their phone number and the threat actors from ALPHV/BlackCat claim to have acquired over 120GB+ of confidential data belonging to customers, patients, and current and former employees.	Account Takeover	Professional, scientific and technical	Cyber Crime	US		Advarra, ALPHV, BlackCat
10	01/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from Netskope identify a new DarkGate variant delivered via MSI using a loading approach based on Cobalt Strike Beacon’s default shellcode stub.	Malware	Multiple Industries	Cyber Crime	>1		Netskope, DarkGate, MSI, Cobalt Strike
11	01/11/2023	01/11/2023	01/11/2023	?	Onyx	Decentralized finance protocol Onyx is the victim of a $2.1 million hack.	Vulnerability	Fintech	Cyber Crime	N/A		Onyx
12	01/11/2023	25/10/2023	31/10/2023	NoEscape	Spolzino Termosanitari	The NoEscape ransomware gang claims responsibility for a cyber attack against Spolzino Termosanitari.	Malware	Manufacturing	Cyber Crime	IT		NoEscape, ransomware, Spolzino Termosanitari
13	02/11/2023	30/10/2023	30/10/2023	?	Allied Pilots Association	Allied Pilots Association (APA), a labor union representing 15,000 American Airlines pilots, discloses a ransomware attack.	Malware	Other service activities	Cyber Crime	US		Allied Pilots Association, APA, American Airlines, ransomware
14	02/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from Bitsight discover Socks5Systemz, a proxy botnet delivered by PrivateLoader and Amadey.	Malware	Multiple Industries	Cyber Crime	>1		Bitsight, Socks5Systemz, PrivateLoader, Amadey
15	02/11/2023	Since mid-August 2023	-	?	Android users in Saudi Arabia, Yemen and Azerbaijan	Researchers from Kaspersky reveal that unknown hackers are targeting users in Saudi Arabia, Yemen and Azerbaijan with the CanesSpy spying malware distributed through user-created WhatsApp mods that customize or add new features to the service.	Malware	Individual	Cyber Espionage	AZ SA YE		Kaspersky, Android, WhatsApp, CanesSpy
16	02/11/2023	31/10/2023	31/10/2023	?	Associated Press	The Associated Press news website (apnews) is hit with a DDoS attack.	DDoS	Information and communication	Cyber Crime	US		Associated Press, apnews
17	02/11/2023	01/12/2022	10/01/2023	?	Hilb Group Operating Company	The Hilb Group Operating Company (Hilb) files a notice of data breach after learning that an unauthorized party was able to access certain employee email accounts.	Account Takeover	Finance and insurance	Cyber Crime	US		Hilb Group Operating Company, Hilb
18	02/11/2023	Since at least 27/10/2023	27/10/2023	hktalent	Multiple organizations	Researchers from Phylum discover a new set of 48 malicious npm packages in the npm repository with capabilities to deploy a reverse shell on compromised systems.	Malware	Multiple Industries	Cyber Crime	>1		Phylum, npm, hktalent
19	02/11/2023	28/07/2023	11/08/2023	?	BHS Physicians Network	BHS Physicians Network confirms a breach of a Microsoft Office 365-hosted business email account that was used by a medical assistant.	Account Takeover	Human health and social work	Cyber Crime	US		BHS Physicians Network
20	02/11/2023	-	-	ALPHV AKA BlackCat	Town of Iowa	The ransomware group ALPHV (BlackCat) publishes a first part of exfiltrated data from the Town of Iowa in the state of Louisiana.	Malware	Public admin and defence, social security	Cyber Crime	US		ALPHV, BlackCat, Town of Iowa
21	02/11/2023	-	31/10/2023	SingularityMD	Jeffco Public Schools	The Jeffco Public Schools has some data stolen from a threat actor named SingularityMD.	Unknown	Education	Cyber Crime	US		SingularityMD, Jeffco Public Schools
22	03/11/2023	SInce at least 10/10/2023	10/10/2023	TellYouThePass	Multiple organizations	Researchers from Arctic Wolf reveal that Internet-exposed Apache ActiveMQ servers are also targeted in TellYouThePass ransomware attacks exploiting the CVE-2023-46604 Vulnerability.	CVE-2023-46604 Vulnerability	Multiple Industries	Cyber Crime	>1		Arctic Wolf, Apache ActiveMQ, TellYouThePass, ransomware, CVE-2023-46604
23	03/11/2023	'Recently'	'Recently'	Kinsing AKA Money Libra	Multiple organizations	Researchers from Aqua Security reveal that the operators of the Kinsing malware are targeting cloud environments with systems vulnerable to "Looney Tunables," a Linux vulnerability identified as CVE-2023-4911 that allows a local attacker to gain root privileges on the system.	CVE-2023-4911 Vulnerability	Multiple Industries	Cyber Crime	>1		Aqua Security, Kinsing, Money Libra, Looney Tunables, Linux, CVE-2023-4911
24	03/11/2023	Between 27/03/2023 02/05/2023, and between 07/04/2023 and 19/04/2023.	45048	?	Perry Johnson & Associates	Perry Johnson & Associates (PJ&A) files a notice of data breach after discovering that an unauthorized party was able to access files stored on the company’s computer network.	Unknown	Administration and support service	Cyber Crime	US		Perry Johnson & Associates, PJ&A
25	03/11/2023	01/11/2023	01/11/2023	?	Public healthcare institutions in Singapore	Threat actors disrupt internet connectivity in public healthcare institutions in Singapore with distributed denial-of-service (DDoS) attacks.	DDoS	Human health and social work	Cyber Crime	SG		Singapore, Synapxe
26	03/11/2023	-	-	LockBit 3.0	Summit Health	Summit Health is added in the LockBit 3.0 ransomware group leak site.	Malware	Human health and social work	Cyber Crime	US		Summit Health, LockBit 3.0, ransomware
27	03/11/2023	-	-	?	Infosys McCamish Systems	Indian IT service provider Infosys discloses that its U.S. unit, Infosys McCamish Systems, was impacted by a cyber security event, resulting in the non-availability of certain applications and systems.	Unknown	Professional, scientific and technical	Cyber Crime	US		Infosys, Infosys McCamish Systems
28	03/11/2023	-	-	?	Crystal Run Healthcare	Crystal Run Healthcare tells patients to expect longer wait times than usual amid a cyber incidents affecting some services.	Unknown	Human health and social work	Cyber Crime	US		Crystal Run Healthcare
29	03/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from McAfee discover a recent AsyncRAT campaign being distributed through a malicious HTML file.	Malware	Multiple Industries	Cyber Crime	>1		McAfee, AsyncRAT, HTML
30	03/11/2023	24/05/2023	'Recently'	?	Life Generations Healthcare	Life Generations Healthcare (LGH) files a notice of data breach after discovering that an unauthorized party temporarily gained access to certain employee email accounts.	Account Takeover	Human health and social work	Cyber Crime	US		Life Generations Healthcare, LGH
31	03/11/2023	-	31/05/2023	Clop AKA Lace Tempest, TA505, and FIN11	AlohaCare	AlohaCare files a notice of data breach after confirming that a vulnerability in the file-transfer program MOVEit resulted in confidential patient information being accessible to an unauthorized party.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, CVE-2023-47246, AlohaCare
32	03/11/2023	01/09/2023	05/09/2023	NoEscape	Mulkay Cardiology Consultants at Holy Name Medical Center	Mulkay Cardiology Consultants at Holy Name Medical Center (Mulkay) notifies of an incident affecting a total of 79,582 people. The NoEscape ransomware gang claims responsibility for the attack, acquiring 60 GB of confidential and personal data on more than 30,000 patients.	Malware	Human health and social work	Cyber Crime	US		Mulkay Cardiology Consultants at Holy Name Medical Center, Mulkay, NoEscape, ransomware
33	03/11/2023	03/11/2023	03/11/2023	?	Crystal Run Healthcare	Crystal Run Healthcare experiences system issues that are impacting some of its services, resulting in longer than usual wait times, following a cyber attack.	Malware	Human health and social work	Cyber Crime	US		Crystal Run Healthcare
34	03/11/2023	-	02/11/2023	LockBit 3.0	De Gregoris	The LockBit 3.0 ransomware gang claims responsibility for a cyber attack to De Gregoris.	Malware	Wholesale and retail	Cyber Crime	IT		LockBit 3.0, ransomware, De Gregoris
35	04/11/2023	Since at least mid-October	During mid-October	?	BrickLink	BrickLink, an online Lego parts marketplace owned by Lego, is back online after several days of downtime due to a cybersecurity incident that apparently targeted some merchant accounts. The company said it received a “threat and ransom demand”, presumably in regard to company or user data, leading it to shut down the site “out of an abundance of caution.”	Malware	Arts entertainment, recreation	Cyber Crime	DK		BrickLink, Lego
36	04/11/2023	-	27/10/2023	Apathy	Rosgosstrakh	A threat actor named Apathy hits Rosgosstrakh (Russian: Росгосстрах), Russia’s second-largest insurance company, successfully stealing 400GB of data.	Unknown	Finance and insurance	Hacktivism	RU		Apathy, Rosgosstrakh, Росгосстраx
37	04/11/2023	31/03/2023	31/03/2023	?	Financial Asset Management Systems	Financial Asset Management Systems (FAMS) files a notice of data breach after discovering that a “network disruption” affected the company’s ability to access certain files on its computer system.	Malware	Finance and insurance	Cyber Crime	US		Financial Asset Management Systems, FAMS, ransomware
38	04/11/2023	End of October 2023	End of October 2023	?	Bitfinex	Bitfinex announces to have resolved a minor information security incident after a small portion of the customer support boards was accessed by an individual or group, through the phishing of a customer support agent.	Account Takeover	Fintech	Cyber Crime	TW		Bitfinex
39	06/11/2023	'Recently'	'Recently'	?	Android users	Researchers from ThreatFabric discover a new dropper-as-a-service (DaaS) cybercrime operation named 'SecuriDropper', using a method that bypasses the 'Restricted Settings' feature in Android to install malware on devices and obtain access to Accessibility Services.	Malware	Individual	Cyber Crime	>1		ThreatFabric, dropper-as-a-service, DaaS, SecuriDropper, Restricted Settings, Android
40	06/11/2023	'Recently'	'Recently'	?	Android users	Researchers from ThreatFabric discover Zombinder an additional Android malware bypassing the 'Restricted Settings' feature.	Malware	Individual	Cyber Crime	>1		ThreatFabric, Zombinder, Restricted Settings, Android
41	06/11/2023	05/11/2023	05/11/2023	Cerber	Multiple organizations	Researchers from Rapid7 reveal that attackers are exploiting the CVE-2023-22518 vulnerability, a recently patched and critical severity Atlassian Confluence authentication bypass flaw to encrypt victims' files using Cerber ransomware.	Malware	Multiple Industries	Cyber Crime	>1		Rapid7, CVE-2023-22518, Atlassian Confluence, Cerber, ransomware
42	06/11/2023	During September and October 2023	During September and October 2023	BlueNoroff (AKA APT38, Sapphire Sleet, CageyChameleon, and CryptoCore)	Cryptocurrency exchanges, venture capital firms and banks	Researchers from Jamf discover a new campaign by the North Korean-backed BlueNoroff threat group targeting Apple customers with a new macOS malware tracked as ObjCShellz that can open remote shells on compromised devices.	Malware	Finance and insurance	Cyber Crime	JP US		Jamf, North Korea, BlueNoroff, Apple, macOS, ObjCShellz, APT38, Sapphire Sleet, CageyChameleon, CryptoCore
43	06/11/2023	07/09/2023	07/09/2023	INC	WellLife Network	WellLife Network posts a notice informing patients and employees that their IT team discovered a cyberattack in early September. The INC ransomware gang claims responsibility for the attack.	Malware	Human health and social work	Cyber Crime	US		WellLife Network, INC, ransomware
44	06/11/2023	02/11/2023	02/11/2023	ALPHV AKA BlackCat	Japan Aviation Electronics	Manufacturing giant Japan Aviation Electronics confirms that its systems are facing a cyberattack that has forced the company to shut down its website. The ALPHV/BlackCat ransomware gang claims responsibility for the attack.	Malware	Manufacturing	Cyber Crime	JP		Japan Aviation Electronics, ALPHV, BlackCat, ransomware
45	06/11/2023	'Over the last two weeks'	'Over the last two weeks'	?	Organizations in the education and healthcare sectors	Researchers from Carbon Black observe an uptick of infections involving the Jupyter infostealer.	Malware	Multiple Industries	Cyber Crime	>1		VMware, Carbon Black Threat Analysis Unit, Jupyter
46	06/11/2023	-	-	Hive0127 (AKA UNC2565)	Multiple organizations	Researchers from IBM discover “GootBot”, a variant of the notorious Gootloader malware.	Malware	Multiple Industries	Cyber Crime	>1		IBM, GootBot, Gootloader
47	06/11/2023	'In. recent months'	'In. recent months'	?	Government and defense organizations in India	Researchers from Seqrite discover multiple campaigns of the Pakistan-based APT SideCopy, targeting Indian government and defense entities, exploiting the recent WinRAR vulnerability CVE-2023-38831 to deploy AllaKore RAT, DRat and additional payloads.	CVE-2023-38831 Vulnerability	Public admin and defence, social security	Hacktivism	IN		Seqrite, India, Pakistan, SideCopy, WinRAR, CVE-2023-38831, AllaKore RAT, DRat
48	06/11/2023	-	05/11/2023	Medusa	Canadian Psychological Association	The Canadian Psychological Association (CPA), the primary representative body for psychologists across Canada, allegedly falls victim to a cyberattack by the notorious Medusa ransomware group.	Malware	Other service activities	Cyber Crime	CA		Canadian Psychological Association, CPA, Medusa, ransomware
49	06/11/2023	27/09/2023	12/10/2023	?	Blue Ridge Electric Membership Corporation	Blue Ridge Electric Membership Corporation (Blue Ridge Energy) files a notice after discovering that a data breach at Meridian, one of Blue Ridge Energy’s vendors, experienced a data security incident.	Unknown	Electricity, gas steam, air conditioning	Cyber Crime	US		Blue Ridge Electric Membership Corporation, Blue Ridge Energy
50	06/11/2023	'Recently'	30/05/2023	?	Hillman Group	The Hillman Group files a notice of data breach after discovering that an unauthorized party gained access to the company’s computer network.	Unknown	Manufacturing	Cyber Crime	US		Hillman Group
51	06/11/2023	27/09/2023	29/09/2023	Qilin	Cardiovascular Consultants	Cardiovascular Consultants (CVC Heart) is hit with a Qilin ransomware attack. The threat actors claim to have exfiltrated 205.93 GB of data.	Malware	Human health and social work	Cyber Crime	US		Cardiovascular Consultants, CVC Heart, Qilin, ransomware attack
52	06/11/2023	-	05/11/2023	LockBit 3.0	Consorzio di Bonifica dell’Emilia Centrale	The LockBit 3.0 ransomware gang claims responsibility for a cyber attack to Consorzio di Bonifica dell’Emilia Centrale.	Malware	Water supply, waste mgmt, remediation	Cyber Crime	IT		LockBit 3.0, ransomware, Consorzio di Bonifica dell’Emilia Centrale.
53	06/11/2023	07/09/2023	07/09/2023	?	Prestige Care	Prestige Care files a notice of data breach after discovering that an unauthorized party accessed the company’s computer network.	Unknown	Human health and social work	Cyber Crime	US		Prestige Care
54	07/11/2023	19/10/2023	20/10/2023	?	Marina Bay Sands	The Marina Bay Sands (MBS) luxury resort and casino in Singapore discloses a data breach that impacts personal data of 665,000 customers.	Unknown	Arts entertainment, recreation	Cyber Crime	SG		Marina Bay Sands, MBS
55	07/11/2023	05/11/2023	05/11/2023	?	Crypto users	Microsoft removes from its store a fraudulent Ledger Live app for cryptocurrency management after multiple users lost at least $768,000 worth of cryptocurrency assets.	Malware	Fintech	Cyber Crime	>1		Microsoft, Ledger Live
56	07/11/2023	During the second half of October 2023	During the second half of October 2023	?	Sberbank	Russian financial organization Sberbank states in a press release that two weeks ago it faced the most powerful distributed denial of service (DDoS) attack in recent history.	DDoS	Finance and insurance	Hacktivism	RU		Sberbank
57	07/11/2023	03/11/2023	03/11/2023	?	Sumo Logic	Security and data analytics company Sumo Logic discloses a security breach after discovering that its AWS (Amazon Web Services) account was compromised.	Account Takeover	Professional, scientific and technical	Cyber Crime	US		Sumo Logic, AWS, Amazon Web Services
58	07/11/2023	-	-	Social Design Agency (SDA), the Institute for Internet Development, and Structura	Individuals in multiple countries in Latin America	The U.S. State Department uncovers an ongoing Russia-funded disinformation campaign across Latin America aimed at undermining support for Ukraine and discrediting the U.S. and NATO.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	AR BO BR CL CO CU EC MX PY PE UY VE		Social Design Agency, SDA, Institute for Internet Development, Structura, U.S. State Department, Russia, Ukraine, U.S., NATO
59	07/11/2023	07/11/2023	07/11/2023	?	Washington’s State Department of Transportation	The Washington’s State Department of Transportation is hit by a cyberattack that causes a range of issues for local ferries and apps used for maps.	Unknown	Transportation and storage	Cyber Crime	US		Washington’s State Department of Transportation
60	07/11/2023	-	-	?	Pharmacy Group of Mississippi	Pharmacy Group of Mississippi files a notice of data breach after discovering that information that had been entrusted to the company was subject to unauthorized access.	Unknown	Human health and social work	Cyber Crime	US		Pharmacy Group of Mississippi
61	07/11/2023	-	'Recently'	?	Robert W. Baird & Co. Incorporated	Robert W. Baird & Co. Incorporated (Baird) files a notice of data breach after discovering that confidential information that consumers placed in the company’s care was subject to unauthorized access.	Unknown	Finance and insurance	Cyber Crime	US		Robert W. Baird & Co. Incorporated, Baird
62	07/11/2023	-	'Recently'	?	CRC Insurance Services	CRC Insurance Services (CRC Group) files a notice of data breach after discovering that an unauthorized party was able to access information that had been entrusted to the company.	Unknown	Finance and insurance	Cyber Crime	US		CRC Insurance Services, CRC Group
63	07/11/2023	07/11/2023	07/11/2023	?	Pulaski County Public Schools	The Pulaski County Public Schools are hit with a ransomware attack.	Malware	Education	Cyber Crime	US		Pulaski County Public Schools, ransomware
64	07/11/2023	-	05/11/2023	ALPHV AKA BlackCat	Corsica Ferries	The ALPHV/BlackCat ransomware group claims responsibility for a cyber attack to Corsica Ferries.	Malware	Transportation and storage	Cyber Crime	FR IT		ALPHV, BlackCat, ransomware, Corsica Ferries
65	07/11/2023	07/11/2023	07/11/2023	NoName057(16)	5 organizations in Italy	The Pro-Russian hacktivists from NoName057(16) launch a DDoS attack against five targets in Italy including a subdomain of the Ministry of Defense, and a primary bank (Credito Cooperativo.)	DDoS	Multiple Industries	Hacktivism	IT		Russia, NoName057(16), Italian Ministry of Defense, Credito Cooperativo
66	08/11/2023	Since early 2022	-	'Silent Ransom Group' (SRG) and 'Luna Moth'	Casino servers	The Federal Bureau of Investigation warns that ransomware threat actors are targeting casino servers and use legitimate system management tools to increase their permissions on the network.	Malware	Arts entertainment, recreation	Cyber Crime	US		Silent Ransom Group', SRG, 'Luna Moth', FBI, Federal Bureau of Investigation, ransomware
67	08/11/2023	08/11/2023	08/11/2023	Anonymous Sudan?	OpenAI	OpenAI addresses "periodic outages" due to DDoS attacks targeting its API and ChatGPT. The pro-Russia group Anonymous Sudan claims responsibility for the attack.	DDoS	Professional, scientific and technical	Cyber Crime	US		OpenAI, ChatGPT, Russia, Anonymous Sudan
68	08/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from Malwarebytes reveal that a threat actor has been abusing Google Ads to distribute a trojanized version of the CPU-Z tool to deliver the Redline info-stealing malware.	Malvertising	Multiple Industries	Cyber Crime	>1		Malwarebytes, Google Ads, CPU-Z, Redline
69	08/11/2023	During 2023	During 2023	?	Multiple organizations	Researchers from Checkmarx say they have been tracking malware intended to infect the computers of developers who work with the popular Python language and have a need to obfuscate their code via a malicious payload named BlazeStealer.	Malware	Multiple Industries	Cyber Crime	>1		Checkmarx, Python, BlazeStealer
70	08/11/2023	-	-	?	Comhairle nan Eilean Siar	A suspected ransomware attack causes significant disruption to IT systems at Scotland's Western Isles local authority, Comhairle nan Eilean Siar.	Malware	Public admin and defence, social security	Cyber Crime	GB		Ransomware, Scotland's Western Isles, Comhairle nan Eilean Siar
71	08/11/2023	Since at least September 2023	Between September and October 2023	Two prominent Chinese government hacking groups	At least 24 Cambodian government organizations	Researchers from Palo Alto Networks reveal that two prominent Chinese government hacking groups are targeting at least 24 Cambodian government organizations through cloud backup services.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	KH		Palo Alto Networks, Cambodia, China
72	08/11/2023	08/12/2021	08/12/2021	?	US Radiology Specialists	US Radiology Specialists, one of the nation’s largest private radiology companies agrees to pay a $450,000 fine after a 2021 ransomware attack, exploiting the SonicWall CVE-2021-20016 vulnerability, led to the exposure of sensitive information from nearly 200,000 patients.	Malware	Human health and social work	Cyber Crime	US		US Radiology Specialists, ransomware, SonicWall, CVE-2021-20016
73	08/11/2023	-	-	?	Multiple organizations in the U.S.	The US cybersecurity agency CISA issues a warning on threat actors exploiting CVE-2023-29552, a Service Location Protocol (SLP) vulnerability that allows for denial-of-service (DoS) attacks with a high amplification factor.	CVE-2023-29552 Vulnerability	Multiple Industries	Cyber Crime	>1		CISA, CVE-2023-29552, Service Location Protocol, SLP, DoS
74	08/11/2023	'In the past few weeks'	'In the past few weeks'	BlueNoroff (AKA APT38, Sapphire Sleet, CageyChameleon, and CryptoCore)	IT Job Seekers	Microsoft researchers warn of a new social engineering campaign from the BlueNoroff North Korean threat actor, aimed at IT job seekers that relied on a new cluster of bogus skills assessment portals.	Account Takeover	Multiple Industries	Cyber Espionage	>1		Microsoft, BlueNoroft, APT38, Sapphire Sleet, CageyChameleon, CryptoCore
75	08/11/2023	Since 2015	-	Eight individuals	Financial and education institutions, and official government sites in Australia	Police in Malaysia dismantle BulletProof Link, a major phishing-as-a-service (PhaaS) and initial access broker (IAB) operation that supplied thousands of threat actors.	Account Takeover	Multiple Industries	Cyber Crime	AU		BulletProofLink, Malaysia
76	08/11/2023	During July 2023	During July 2023	Crambus (aka OilRig, APT34, MuddyWater)	Offtec	Researchers from Deep Instinct discover a new campaign from the “MuddyWater” group targeting Offtec, a Jordanian conglomerate using MuddyC2Go, a new C2 Framework.	Targeted Attack	Administration and support service	Cyber Espionage	JO		Deep Instinct, Crambus, OilRig, APT34, MuddyWater, Offtec, MuddyC2Go
77	08/11/2023	During September 2023	During September 2023	Crambus (aka OilRig, APT34, MuddyWater)	Korek	Researchers from Deep Instinct discover a new campaign from the “MuddyWater” group targeting Korek, an Iraqi Telecom provider using MuddyC2Go, a new C2 Framework.	Targeted Attack	Information and communication	Cyber Espionage	IQ		Deep Instinct, Crambus, OilRig, APT34, MuddyWater, Korek, MuddyC2Go
78	08/11/2023	During October 2023	During October 2023	Crambus (aka OilRig, APT34, MuddyWater)	Unknown organization(s) in Israel	Researchers from Deep Instinct discover a new campaign from the “MuddyWater” group targeting Israel, using MuddyC2Go, a new C2 Framework.	Targeted Attack	Unknown	Cyber Espionage	IL		Deep Instinct, Crambus, OilRig, APT34, MuddyWater, Israel, MuddyC2Go
79	08/11/2023	Early October 2023	Early October 2023	?	Butler County	Police in Malaysia dismantle BulletProofLink, a major phishing-as-a-service (PhaaS) and initial access broker (IAB) operation that supplied thousands of threat actors.	Unknown	Public admin and defence, social security	Cyber Crime	US		Butler County
80	08/11/2023	-	-	?	Multiple organizations	Researchers from Aon discover a stealthy backdoor named Effluence deployed following the successful exploitation of CVE-2023-22515, the recently disclosed security flaw in Atlassian Confluence Data Center and Server.	CVE-2023-22515 Vulnerability	Unknown	Cyber Crime	N/A		Aon, CVE-2023-22515, Atlassian Confluence Data Center and Server
81	08/11/2023	During September 2023	-	?	Monero	The Monero Project admits that one of its wallets was drained by an unknown source, losing the equivalent of around $437,000.	Wallet-draining	Fintech	Cyber Crime	N/A		Monero
82	08/11/2023	-	05/10/2023	?	Edward C. Taylor, Ph.D.	Edward C. Taylor, Ph.D. confirms that an unauthorized individual had gained access to its network and exfiltrated files containing company information.	Unknown	Human health and social work	Cyber Crime	US		Edward C. Taylor, Ph.D.
83	08/11/2023	-	-	Medusa	Hopewell Area School District	The Hopewell Area School District is hit with a Medusa ransomware attack.	Malware	Education	Cyber Crime	US		Hopewell Area School District, Medusa, ransomware
84	08/11/2023	Since at least 2019	During March 2023	Farnetwork	Multiple organizations	Researchers from Group-IB identify a ransomware operator they call "Farnetwork." associated with the JSWORM, Karma, Nemty, and Nefilim ransomware.	Malware	Multiple Industries	Cyber Crime	>1		Group-IB, Farnetwork, JSWORM, Karma, Nemty, Nefilim, ransomware
85	08/11/2023	08/11/2023	09/11/2023	LockBit 3.0	Fawry	The LockBit 3.0 ransomware group successfully encrypts files and also allegedly exfiltrates data from Egyptian e-payment provider Fawry.	Malware	Professional, scientific and technical	Cyber Crime	EG		LockBit 3.0, ransomware, Fawry
86	08/11/2023	08/11/2023	09/11/2023	LockBit 3.0	Amber Hill Group	The LockBit 3.0 ransomware group adds Amber Hill Group the their leak site.	Malware	Finance and insurance	Cyber Crime	EG		LockBit 3.0, ransomware, Amber Hill Group
87	09/11/2023	10/10/2022 and 12/10/2022	10/10/2022 and 12/10/2022	Sandworm	Ukrainian critical infrastructure organization	Researchers from Mandiant reveal that Russian state hackers have evolved their methods for breaching industrial control systems by adopting living-off-the-land techniques used for disruptive events in Ukraine.	Malware	Electricity, gas steam, air conditioning	Cyber Warfare	UA		Mandiant, Sandworm, Russia, Ukraine, ICS, living-off-the-land
88	09/11/2023	'Recently'	'Recently'	Clop AKA Lace Tempest, TA505, and FIN11	Multiple organizations	Researchers from Microsoft reveal that the threat actors from the Clop group are exploiting the CVE-2023-47246 zero-day vulnerability in the service management software SysAid to gain access to corporate servers for data theft and to deploy ransomware.	CVE-2023-47246 Vulnerability	Multiple Industries	Cyber Crime	>1		Clop, Cl0p, Lace Tempest, TA505, FIN11, Microsoft, CVE-2023-47246, SysAid
89	09/11/2023	09/11/2023	09/11/2023	Anonymous Sudan	CloudFlare	Cloudflare is hit by a DDoS attack. The Pro-Russia group Anonymous Sudan claims responsibility for the attack.	DDoS	Professional, scientific and technical	Hacktivism	US		Cloudflare, Russia, Anonymous Sudan
90	09/11/2023	Since 28/10/2023	28/10/2023	?	healthcare organizations in the U.S.	Researchers from Huntress warn that hackers are targeting multiple healthcare organizations in the U.S. by abusing the ScreenConnect remote access tool.	Vulnerability	Human health and social work	Cyber Crime	US		Huntress, ScreenConnect
91	09/11/2023	During October 2023	During October 2023	Imperial Kitten AKA Tortoiseshell, TA456, Crimson Sandstorm, and Yellow Liderc	Organizations in the transportation, logistics and technology sectors in Israel	Researchers from Crowdstrike reveal the details of a new campaign from Imperial Kitten targeting transportation, logistics, and technology firms in Israel using a novel malware family.	Targeted Attack	Professional, scientific and technical	Cyber Espionage	IL		Imperial Kitten, Tortoiseshell, TA456, Crimson Sandstorm, Yellow Liderc, Israel, Crowdstrike
92	09/11/2023	-	-	LockBit 3.0	Allen & Overy	Allen & Overy discloses to have suffered a "data incident", after social media posts suggested it had been hacked by the Lockbit cybercrime gang. According to rumors, the attack was carried out exploiting the CVE-2023-4966 Citrix Bleed vulnerability.	Malware	Professional, scientific and technical	Cyber Crime	GB		Allen & Overy, Lockbit 3.0, Lockbit, ransomware
93	09/11/2023	between 07/01/2023, and 21/03/2023	-	?	Urdu speakers in Kashmir	Researchers from ESET discover a new Android spyware called Kamran allegedly distributed through a so-called watering hole attack involving a compromised news website called Hunza News, targeting Urdu speakers in Kashmir.	Targeted Attack	Individual	Cyber Espionage	PK		ESET, Android, Kamran, Hunza News, Urdu, Kashmir
94	09/11/2023	Since December 2021	During October 2023	?	Multiple organizations	Researchers from Cisco Talos observe an increase in spam messages abusing a feature of quizzes created within Google Forms.	Spam	Individual	Cyber Crime	>1		Cisco Talos, Google Forms, Quiz
95	09/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from Trend Micro uncover a phishing campaign involving threat actors sending socially engineered emails containing a link to DRACOON.team, a file-sharing solution known for its secure data storage, management, and file-sharing features.	Malware	Multiple Industries	Cyber Crime	>1		Trend Micro, DRACOON.team
96	09/11/2023	-	-	?	Healix Infusion Therapy	Healix Infusion Therapy (Healix) files a notice of data breach after discovering that an unauthorized party was able to access confidential information that had been provided to the company.	Unknown	Human health and social work	Cyber Crime	US		Healix Infusion Therapy, Healix
97	09/11/2023	-	14/05/2023	?	Refresco Beverages U.S.	Refresco Beverages U.S. files a notice of data breach after discovering that an unauthorized party accessed portions of the company’s computer network.	Unknown	Accommodation and food service	Cyber Crime	US		Refresco Beverages U.S.
98	09/11/2023	-	22/09/2023	?	Cinfed Federal Credit Union	Cinfed Federal Credit Union (Cinfed CU) files a notice of data breach after discovering that an unauthorized party was able to access portions of the company’s computer system.	Unknown	Finance and insurance	Cyber Crime	US		Cinfed Federal Credit Union, Cinfed CU
99	09/11/2023	04/11/2023	04/11/2023	?	Butte School District	The Butte School District is forced to shut down its computer system to investigate an unknown breach of the network that serves all the public schools in the city.	Unknown	Education	Cyber Crime	US		Butte School District
100	09/11/2023	-	08/11/2023	Black Basta	Califano Carrelli	The Black Basta ransomware gang claims responsibility for a cyber attack to Califano Carrelli.	Malware	Manufacturing	Cyber Crime	IT		Black Basta, ransomware, Califano Carrelli
101	09/11/2023	15/09/2023	24/09/2023	?	Warren General Hospital	Warren General Hospital (WGH) files a notice of data breach after discovering that an unknown actor accessed certain WGH computer systems.	Unknown	Human health and social work	Cyber Crime	US		Warren General Hospital
102	10/11/2023	08/11/2023	08/11/2023	LockBit 3.0	Industrial & Commercial Bank of China	The U.S. branch of the Industrial & Commercial Bank of China (ICBC) confirms its services were disrupted by a ransomware attack that impacted its systems. According to rumors, the attack was carried out exploiting the CVE-2023-4966 Citrix Bleed vulnerability.	Malware	Finance and insurance	Cyber Crime	US		Industrial & Commercial Bank of China, ICBC, ransomware, Lockbit, Lockbt 3.0
103	10/11/2023	Between 28/05/2023 and 29/05/2023	31/05/2023	Clop AKA Lace Tempest, TA505, and FIN11	State of Maine	The State of Maine announces that its systems were breached after threat actors exploited the vulnerability in the MOVEit file transfer tool and accessed personal information of about 1.3 million, which is close to the state's entire population.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, State of Maine, CVE-2023-34362, MOVEit
104	10/11/2023	10/11/2023	10/11/2023	?	Poloniex	Threat actors steal more than $100 million worth of Bitcoin and Ethereum from cryptocurrency trading platform Poloniex.	Unknown	Fintech	Cyber Crime	US		Poloniex, Bitcoin, Ethereum
105	10/11/2023	Between late August or early September 2023	-	?	Dolly.com	On-demand moving and delivery platform Dolly.com is hit with a ransomware attack, allegedly pays a ransom but the threat actors find an excuse not to hold their end of the bargain.	Malware	Arts entertainment, recreation	Cyber Crime	US		Dolly.com, ransomware
106	10/11/2023	Since at least April 2023	Since at least April 2023	DarkCasino	Online Trading Platforms	Researchers from NSFOCUS reveal the details of the latest campaign from the DarkCasino threat against online trading platforms exploiting the CVE-2023-38831 WinRAR vulnerability.	CVE-2023-38831 Vulnerability	Finance and insurance	Cyber Crime	>1		NSFOCUS, DarkCasino, CVE-2023-38831, WinRAR
107	10/11/2023	Since 23/08/2023	-	Actor230830	Relevant personnel of the European Parliament	Researchers from NSFOCUS reveal that a threat actor marked as Actor230830 launched attacks on relevant personnel of the European Parliament exploiting the CVE-2023-38831 WinRAR vulnerability.	CVE-2023-38831 Vulnerability	Extraterritorial orgs and bodies	N/A	GB PT		NSFOCUS, Actor230830, CVE-2023-38831, WinRAR, European Parliament
108	10/11/2023	Early October 2023	-	Actor231003	Serbia	Researchers from NSFOCUS reveal that a threat actor marked as Actor231003 launched attacks against Serbia exploiting the CVE-2023-38831 WinRAR vulnerability to deliver the REMCOS malware.	CVE-2023-38831 Vulnerability	Multiple Industries	N/A	RS		NSFOCUS, Actor231003, CVE-2023-38831, WinRAR, REMCOS
109	10/11/2023	-	-	Actor231004	Governmental sectors of New Zealand	Researchers from NSFOCUS reveal that a threat actor marked as Actor231004 launched attacks against governmental sectors of New Zealand exploiting the CVE-2023-38831 WinRAR vulnerability to deliver the Bumblebee malware.	CVE-2023-38831 Vulnerability	Public admin and defence, social security	N/A	NZ		NSFOCUS, Actor231003, CVE-2023-38831, WinRAR, Bumblebee
110	10/11/2023	27/09/2023	27/09/2023	Actor231010 AKA SkeletonWolf	Russia and Belarus	Researchers from NSFOCUS reveal that a threat actor marked as Actor231010 launched attacks against Russia and Belarus exploiting the CVE-2023-38831 WinRAR vulnerability to deliver the AthenaAgent malware.	CVE-2023-38831 Vulnerability	Multiple Industries	N/A	BY RU		NSFOCUS, Actor231010, SkeletonWolf, CVE-2023-38831, WinRAR, AthenaAgent
111	10/11/2023	-	-	Actor231009	China	Researchers from NSFOCUS reveal that a threat actor marked as Actor231009 launched attacks against China exploiting the CVE-2023-38831 WinRAR vulnerability to deliver the SmokeLoader malware.	CVE-2023-38831 Vulnerability	Multiple Industries	N/A	CN		NSFOCUS, Actor231009, CVE-2023-38831, WinRAR, SmokeLoader
112	10/11/2023	09/11/2023	09/11/2023	?	Tri-City Medical Center	A cyberattack affects operations at Tri-City Medical Center.	Unknown	Human health and social work	Cyber Crime	US		Tri-City Medical Center
113	10/11/2023	Between March and early October 2023,	Between March and early October 2023,	DuckTail	Marketing professionals in India	Researchers from Kaspersky reveal that the Vietnamese threat actors behind the Ducktail stealer malware have been linked to a new campaign that ran targeting marketing professionals in India with an aim to hijack Facebook business accounts.	Malware	Professional, scientific and technical	Cyber Crime	IN		Kaspersky, Vietnam, Ducktail, Facebook
114	10/11/2023	16/10/2023	18/10/2023	?	Southland Integrated Services	Southland Integrated Services (SIS) files a notice of data breach after discovering that an unauthorized party gained access to its computer network.	Unknown	Human health and social work	Cyber Crime	US		Southland Integrated Services, SIS
115	10/11/2023	01/12/2022	28/12/2022	?	Acrisure	Acrisure files a notice of data breach after discovering that an unauthorized third party gained access to a portion of the company’s computer network. The incident resulted in an unauthorized party being able to access consumers’ sensitive information	Unknown	Fintech	Cyber Crime	US		Acrisure
116	10/11/2023	-	09/09/2023	?	International Association of Sheet Metal Air Rail Transportation Workers (“SMART”)	The International Association of Sheet Metal Air Rail Transportation Workers (SMART) files a notice of data breach after discovering that files stored on the company’s network were subject to unauthorized access.	Unknown	Other service activities	Cyber Crime	US		International Association of Sheet Metal Air Rail Transportation Workers, SMART
117	10/11/2023	-	-	?	Republic Bank of Chicago	Republic Bank of Chicago (Republic Bank) files a notice of data breach after discovering that sensitive information within the company’s control was subject to unauthorized access.	Unknown	Finance and insurance	Cyber Crime	US		Republic Bank of Chicago, Republic Bank
118	12/11/2023	Since January 2023 and continuing as recently as October 2023	During October 2023	Agonizing Serpens AKA Agrius, BlackShadow, Pink Sandstorm, and DEV-0022	Organizations in Israel in the education and technology sectors	The Israel Computer Emergency Response Team (CERT) issues an alert about the BiBi wiper malware targeting organizations in Israel in the education and technology sectors. The attacks are attributed to the Iranian APT Agonizing Serpens.	Malware	Multiple Industries	Cyber Warfare	IL		Agonizing Serpens, Agrius, BlackShadow, Pink Sandstorm, DEV-0022, Israel, BiBi wiper, Israel, Iran
119	12/11/2023	Since mid-2023	'Recently'	?	Crypto users	Researcher from Scam Sniffer reveal that malicious actors have been abusing Ethereum's 'Create2' function to bypass wallet security alerts and poison cryptocurrency addresses, which led to stealing $60,000,000 worth of cryptocurrency from 99,000 people in six months.	Vulnerability	Fintech	Cyber Crime	>1		Scam Sniffer, Ethereum, 'Create2'
120	12/11/2023	12/11/2023	12/11/2023	?	City of Huber Heights	A ransomware attack on the city of Huber Heights, Ohio, causes significant problems for several city systems.	Malware	Public admin and defence, social security	Cyber Crime	US		Ransomware, Huber Heights, Ohio
121	12/11/2023	Since May 2023	Since May 2023	?	68 hotels in Japan affiliated with Booking.com	68 hotels in Japan affiliated with Booking.com are hit by a phishing campaign aimed to steal credit card details.	Malware	Accommodation and food service	Cyber Crime	JP		Booking.com
122	12/11/2023	-	-	Abnaa AlSaada	Cowboysfarm	The Yemeniti hacktivists from Abnaa AlSaada claim to have hacked Cowboysfarm, an Israeli meat producer.	Unknown	Accommodation and food service	Hacktivism	IL		Abnaa AlSaada, Cowboysfarm, Israel, Yemen
123	12/11/2023	12/11/2023	12/11/2023	?	Unknown victim	A threat actor appears to have drained $27 million worth of Tether stablecoins from a crypto wallet tied to Binance.	Unknown	Fintech	Cyber Crime	N/A		Tether, Binance
124	12/11/2023	'Recently'	'Recently'	?	Individuals in China	Researchers from SlowMist discover a campaign targeting individuals in China looking for banned international applications such as Skype.	Malware	Individual	Cyber Crime	CN		SlowMist, China
125	13/11/2023	SInce at least 17/08/2023	08/11/2023	Multiple threat actors	Federal Agencies in the U.S.	CISA warns federal agencies to secure Juniper devices on their networks against four vulnerabilities now used in remote code execution (RCE) attacks as part of a pre-auth exploit chain.	CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847 Vulnerabilities	Public admin and defence, social security	N/A	US		CISA, Juniper, Remote Code Execution, RCE, CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847
126	13/11/2023	10/11/2023	10/11/2023	?	DP World Australia	A cyberattack on international logistics firm DP World Australia severely disrupts the regular freight movement in multiple large Australian ports. According to rumors, the attack was carried out exploiting the CVE-2023-4966 Citrix Bleed vulnerability.	Unknown	Transportation and storage	Cyber Crime	AU		DP World Australia
127	13/11/2023	Since September 2022	-	Royal	Multiple organizations	The FBI and CISA reveal in a joint advisory that the Royal ransomware gang has breached the networks of at least 350 organizations worldwide since September 2022.	Malware	Multiple Industries	Cyber Crime	>1		FBI, CISA, Royal, ransomware
128	13/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from Ahnlab reveal that MySQL servers are being targeted by the 'Ddostf' malware botnet to enslave them for a DDoS-as-a-Service platform whose firepower is rented to other cybercriminals.	Malware	Multiple Industries	Cyber Crime	>1		Ahnlab, MySQL, 'Ddostf'
129	13/11/2023	23/09/2023	10/11/2023	Medusa	Moneris	Moneris, a technology company created by two of Canada’s largest banks, is listed in the Medusa ransomware gang leak site, despite the company claims it stopped the access to critical data.	Malware	Professional, scientific and technical	Cyber Crime	CA		Moneris, Medusa, ransomware
130	13/11/2023	-	-	UAC-0050	Government agencies in Ukraine	Researchers from the Ukraine Computer Emergency Response Team (CERT-UA) discover a new campaign distributing the REMCOS rat via phishing letters to their targets, disguising them as official requests from Ukraine’s security service (SBU).	Malware	Public admin and defence, social security	Cyber Espionage	UA		Ukraine, UAC-0050, Computer Emergency Response Team, CERT-UA, REMCOS, Ukraine’s Security Service, SBU
131	13/11/2023	12/11/2023	12/11/2023	?	North Carolina Central University	The North Carolina Central University (NCCU) experience some disruptions after suffering a cyber attack.	Unknown	Education	Cyber Crime	US		North Carolina Central University, NCCU
132	13/11/2023	Since April 2023	Since April 2023	Multiple threat actors	Multiple organizations	Google announces to be taking legal action against cybercriminals who delivered malware through websites that told users they could download the Google Bard AI tool.	Malware	Multiple Industries	Cyber Crime	>1		Google, Bard
133	13/11/2023	-	-	Haimai and Haixun (two Chinese firms)	Individuals in South Korea	The National Intelligence Service (NIS), the South Korean spy agency, identifies a network of 38 fake news websites run by Chinese firms Haimai and Haixun operating within the country to influence public opinion.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	KR		South Korea, National Intelligence Service, NIS, Haimai, Haixun
134	13/11/2023	-	06/11/2023	?	3rd party associated with McGraw Hill	An online forum user shares a database allegedly stolen from a 3rd party associated with McGraw Hill, which the threat actor claims to contain information from 90,875 users.	Unknown	Unknown	Cyber Crime	N/A		McGraw Hill
135	13/11/2023	'Recently'	'Recently'	?	Multiple organizations	Researchers from Cado Security Labs discover a novel campaign targeting publicly-exposed instances of the Docker Engine API to deliver a malicious Docker container, built from an image named “oracleiv_latest” and containing Python malware acting as a Distributed Denial of Service (DDoS) bot agent.	Misconfiguration	Multiple Industries	Cyber Crime	>1		Cado Security, Docker Engine API, oracleiv_latest, DDOS
136	13/11/2023	Since at least July 2023	During July 2023	?	Online gaming community	Researchers from Sekoia.io discover a targeted campaign using Discord messages and fake download websites to distribute information-stealing malware within the gaming sphere.	Malware	Arts entertainment, recreation	Cyber Crime	>1		Sekoia, Discord
137	13/11/2023	-	-	?	Southwest Behavioral Health Center	Southwest Behavioral Health Center files a notice of data breach after discovering that confidential information that had been provided to the company was subject to unauthorized access.	Unknown	Human health and social work	Cyber Crime	US		Southwest Behavioral Health Center
138	13/11/2023	-	-	?	Recology	Recology confirms reports that the company experienced a cyberattack.	Unknown	Water supply, waste mgmt, remediation	Cyber Crime	US		Recology
139	13/11/2023	-	-	?	Otsego Memorial Hospital	Otsego Memorial Hospital suffers a cyber incident.	Unknown	Human health and social work	Cyber Crime	US		Otsego Memorial Hospital
140	13/11/2023	-	26/10/2023	Hunters International	Homeland	Homeland is added to the “victim list” of a ransomware group, raising concerns that the company may have experienced a data breach	Malware	Real estate	Cyber Crime	US		Hunters International, Homeland, ransomware
141	13/11/2023	18/05/2023	-	?	West Central District Health Department	The West Central District Health Department in Nebraska (WDCHD) confirms to have suffered an unauthorized access to its network and patient data has been exposed.	Unknown	Human health and social work	Cyber Crime	US		West Central District Health Department in Nebraska, WDCHD
142	13/11/2023	-	12/11/2023	LockBit 3.0	Plati	The LockBit 3.0 ransomware gang claims responsibility for a cyber attack to Plati.	Malware	Manufacturing	Cyber Crime	IT		LockBit 3.0, ransomware, Plati
143	13/11/2023	13/11/2023	13/11/2023	Alpha Team	Federprivacy	The Alpha Team collective defaces the website of Federpivacy, an Italian Cyber Security organization.	Account Takeover	Other service activities	Cyber Crime	IT		Alpha Team, Federprivacy
144	14/11/2023	09/11/2023	09/11/2023	?	Henry County Schools	The Henry County Schools in Atlanta warn parents of a cyber incident.	Unknown	Education	Cyber Crime	US		Henry County Schools, Atlanta
145	14/11/2023	-	-	?	Beaverton School District	Oregon’s Beaverton School District is hit by a cybersecurity incident.	Unknown	Education	Cyber Crime	US		Oregon, Beaverton School District
146	14/11/2023	Early November 2023	Early November 2023	?	Bladen County	Bladen County says it became the victims of a cyberattack.	Unknown	Public admin and defence, social security	Cyber Crime	US		Bladen County
147	14/11/2023	During September 2023	During September 2023	APT29, AKA Cozy Bear or Blue Bravo	Embassies and international organizations	The Ukraine’s National Cyber Security Coordination Center (NCSCC) reveals that Russian state-sponsored hackers from APT29 have targeted embassies and international organizations exploiting the WinRAR CVE-2023-38831 vulnerability.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	AZ IT GR RO		APT29, Cozy Bear, Blue Bravo, Ukraine’s National Cyber Security Coordination Center, NCSCC, Russia, WinRAR, CVE-2023-38831
148	14/11/2023	-	-	?	Unknown organization(s) in the U.S.	The Cybersecurity and Infrastructure Security Agency (CISA) adds three Microsoft vulnerabilities, CVE-2023-36033, CVE-2023-36025 and CVE-2023-36036, to its Known Exploited vulnerabilities catalog.	CVE-2023-36033, CVE-2023-36025 and CVE-2023-36036 Vulnerabilities	Unknown	N/A	U.S.		Cybersecurity and Infrastructure Security Agency, CISA, Microsoft, CVE-2023-36033, CVE-2023-36025, CVE-2023-36036, Known Exploited Vulnerabilities Catalog
149	14/11/2023	-	-	Medusa	Toyota Financial Services Europe & Africa	Toyota Financial Services Europe & Africa confirms being targeted in a cyberattack, which appears to have been conducted by the Medusa ransomware group exploiting the CVE-2023-4966 CitrixBleed vulnerability.	Malware	Finance and insurance	Cyber Crime	JP		Toyota Financial Services Europe & Africa, Medusa, ransomware, CVE-2023-4966, CitrixBleed
150	14/11/2023	28/05/2023	23/08/2023	Clop AKA Lace Tempest, TA505, and FIN11	Medical Eye Services	Medical Eye Services (MESVision) files a notice of data breach after discovering that MOVEit, a software program used by MESVision, contained a critical vulnerability that gave hackers access to confidential data in the company’s possession.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Medical Eye Services, MESVision, Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit, CVE-2023-34362
151	14/11/2023	During October 2023	During October 2023	Kritec	Multiple organizations	Researchers from Malwarebytes reveal a resurgence of the Kritec web skimming campaign.	Malicious Script Injection	Wholesale and retail	Cyber Crime	>1		Malwarebytes, Kritec, Magento, Google Tag Manager
152	14/11/2023	From July to October 202	From July to October 202	TA402 (AKA Molerats, Gaza Cybergang, Frankenstein, WIRTE)	Government organizations in the Middle East and North Africa	Researchers from Proofpoint discover a new campaign from the pro-Palestine threat actor named TA402, using a new initial access downloader dubbed IronWind.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	>1		TA402, Molerats, Gaza Cybergang, Frankenstein, WIRTE, Proofpoint, IronWind
153	14/11/2023	'During the last three weeks'	'During the last three weeks'	ALPHV AKA BlackCat	Multiple organizations	Researchers from eSentire observe the notorious ALPHV/BlackCat ransomware gang using Google Ads to distribute malware.	Malware	Multiple Industries	Cyber Crime	>1		eSentire, ALPHV, BlackCat, ransomware
154	14/11/2023	07/11/2023	07/11/2023	?	Harris Center for Mental Health	The Harris Center for Mental Health falls victim to a ransomware attack.	Malware	Human health and social work	Cyber Crime	US		Harris Center for Mental Health
155	14/11/2023	25/10/2023	-	NoEscape	Southeastern Orthopaedic Specialists	Southeastern Orthopaedic Specialists is added to the NoEscape ransomware gang leak site. The threat actors claim to have exfiltrated 3 GB of data.	Malware	Human health and social work	Cyber Crime	US		Southeastern Orthopaedic Specialists, NoEscape, ransomware
156	14/11/2023	10/11/2023	-	NoEscape	Carespring	Carespring is added to the NoEscape ransomware gang leak site. The threat actors claim to have exfiltrated 364 GB of data.	Malware	Human health and social work	Cyber Crime	US		Carespring, NoEscape, ransomware
157	14/11/2023	-	03/09/2023	?	Catholic Charities of Long Island	Catholic Charities of the Diocese of Rockville Centre, doing business as Catholic Charities of Long Island in New York, notifies 13,000 patients that some of their personal information was exposed and potentially acquired by unauthorized individuals.	Account Takeover	Human health and social work	Cyber Crime	US		Catholic Charities of the Diocese of Rockville Centre, Catholic Charities of Long Island
158	14/11/2023	-	-	?	Individuals	A security researcher from the Electronic Frontier Foundation reveals that the Dragon Touch KidzPad Y88X tablet comes infected with the Corejava malware.	Malware	Individual	Cyber Crime	>1		Electronic Frontier Foundation, Dragon Touch KidzPad Y88X, Corejava
159	14/11/2023	During 2022	During 2022	?	Securities America	Securities America (SAI) files a notice describing a data breach at McCord LLC, an unaffiliated company that registers its financial professionals with SAI.	Account Takeover	Finance and insurance	Cyber Crime	US		Securities America, SAI, McCord
160	14/11/2023	-	-	?	International Paper Company Group Health and Welfare Plan	International Paper Company Group Health and Welfare Plan (IP Plan) files a notice of data breach, after a cyber incident that resulted in an unauthorized party being able to access consumers’ sensitive information.	Unknown	Finance and insurance	Cyber Crime	US		International Paper Company Group Health and Welfare Plan, IP Plan
161	14/11/2023	27/05/2023	31/05/2023	Clop AKA Lace Tempest, TA505, and FIN11	Medical College of Wisconsin	The Medical College of Wisconsin (MCW) confirms that the protected health information of 240,667 individuals was stolen by the Clop hacking group, which exploited the zero day vulnerability in Progress Software’s MOVEit Transfer.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, Medical College of Wisconsin, MOVEit, Progress Software
162	14/11/2023	During October 2023	During October 2023	?	River Valley School	The River Valley School suffers a wire fraud incident, when an outside network of one of the district’s vendors is breached and used to make a fraudulent wire transfer of $736,126.91.	Account Takeover	Education	Cyber Crime	US		River Valley School
163	15/11/2023	Mid-November 2023	Mid-November 2023	?	Crypto users	Multiple fake accounts impersonating cryptocurrency scam investigators and blockchain security companies are promoting phishing pages to drain wallets in an ongoing campaign on X (former Twitter).	Account Takeover	Fintech	Cyber Crime	>1		Crypto, X, Twitter
164	15/11/2023	Since May 2023	-	Rhysida	Multiple organizations	The FBI and CISA warn of Rhysida ransomware gang's opportunistic attacks targeting organizations across multiple industry sectors.	Malware	Multiple Industries	Cyber Crime	US		FBI, CISA, Rhysida, ransomware
165	15/11/2023	13/11/2023	13/11/2023	?	Samsung Electronics	Samsung Electronics notifies some of its UK customers of a data breach that exposed their personal information to an unauthorized individual.	Vulnerability in third-party app	Manufacturing	Cyber Crime	GB		Samsung Electronics
166	15/11/2023	07/11/2023	-	ALPHV AKA BlackCat	MeridianLink	The AlphV/BlackCat ransomware group adds MeridianLink to its leak site and reports its victim to the Securities Exchange Commission (SEC.)	Malware	Professional, scientific and technical	Cyber Crime	US		AlphV, BlackCat, ransomware, MeridianLink, Securities Exchange Commission, SEC
167	15/11/2023	14/11/2023	14/11/2023	?	City of Long Beach	The Californian City of Long Beach warns that it suffered a cyberattack that led to shut down portions of the IT network to prevent the attack's spread.	Unknown	Public admin and defence, social security	Cyber Crime	US		City of Long Beach
168	15/11/2023	15/11/2023	15/11/2023	?	North Muskegon Public Schools	The North Muskegon Public Schools in Michigan is forced to cancel school after suffering a "cyber incident."	Unknown	Education	Cyber Crime	US		North Muskegon Public Schools
169	15/11/2023	During May 2023	During May 2023	Multiple groups, likely including Russia’s state-sponsored Sandworm	22 energy companies in Denmark	SektorCERT, Denmark's state-funded organization handling cyber incidents in the critical sector, reveals that 22 energy companies were breached during May 2023, exploiting the CVE-2023-28771 Zyxel vulnerability.	CVE-2023-28771 Vulnerability	Electricity, gas steam, air conditioning	Cyber Espionage	DK		Russia, Sandworm, SektorCERT, Critical infrastructures, CVE-2023-28771, Zyxel vulnerability.
170	15/11/2023	-	-	FahriDinerPlume and Panic	Plume	The smart Wi-Fi service provider, Plume, apparently falls victim to a data breach. The perpetrators, claiming responsibility for the incident, make their announcement on the notorious Breach Forums.	Unknown	Professional, scientific and technical	Cyber Crime	US		FahriDinerPlume, Panic, Plume
171	15/11/2023	-	13/11/2023	Snatch	Tyson Foods	Tyson Foods, the world’s second-largest chicken, beef, and pork processor, is listed among the victims of a Snatch ransomware attack.	Malware	Accommodation and food service	Cyber Crime	US		Tyson Foods, Snatch, ransomware
172	15/11/2023	-	14/11/2023	Abnaa AlSaada	Profal	A threat actor codenamed Abnaa AlSaada, possibly from Yemen, claims to have taken over control of aluminum manufacturing company Profal’s operations.	Unknown	Manufacturing	Hacktivism	IL		Abnaa AlSaada, Yemen, Profal
173	15/11/2023	-	15/11/2023	Play	Donald W. Wyatt Detention Facility	The Play ransomware group claims to have successfully hit the Donald W. Wyatt Detention Facility.	Malware	Public admin and defence, social security	Cyber Crime	US		Play, ransomware, Donald W. Wyatt Detention Facility
174	15/11/2023	-	29/06/2023	?	Government organization in Greece	Researchers from Google's Threat Analysis Group (TAG) discover a campaign targeting a government organization in Greece, exploiting the CVE-2023-37580 Zimbra email server vulnerability.	CVE-2023-37580 Vulnerability	Public admin and defence, social security	Cyber Espionage	GR		Google's Threat Analysis Group, TAG, CVE-2023-37580, Zimbra
175	15/11/2023	-	11/07/2023	Winter Vivern	Government organizations in Moldova and Tunisia	Researchers from Google's Threat Analysis Group (TAG) discover a campaign targeting government organizations in Moldova and Tunisia, exploiting the CVE-2023-37580 Zimbra email server vulnerability.	CVE-2023-37580 Vulnerability	Public admin and defence, social security	Cyber Espionage	MD TN		Google's Threat Analysis Group, TAG, CVE-2023-37580, Zimbra
176	15/11/2023	-	20/07/2023	?	Government organization in Vietnam	Researchers from Google's Threat Analysis Group (TAG) discover a campaign targeting government organization in Vietnam, exploiting the CVE-2023-37580 Zimbra email server vulnerability.	CVE-2023-37580 Vulnerability	Public admin and defence, social security	Cyber Espionage	VN		Google's Threat Analysis Group, TAG, CVE-2023-37580, Zimbra
177	15/11/2023	-	25/08/2023	?	Government organization in Pakistan	Researchers from Google's Threat Analysis Group (TAG) discover a campaign targeting government organization in Pakistan, exploiting the CVE-2023-37580 Zimbra email server vulnerability.	CVE-2023-37580 Vulnerability	Public admin and defence, social security	Cyber Espionage	PK		Google's Threat Analysis Group, TAG, CVE-2023-37580, Zimbra
178	15/11/2023	Since September 2021	-	?	Individuals	Swedish digital rights organization Qurium discovers around 250 cloned websites to drive people to China-linked gambling sites.	Cloned websites	Individual	Cyber Crime	>1		Qurium, China
179	15/11/2023	Since early October 2023	'Recently'	?	Smartphone users in South Korea	Researchers from McAfee discover a new SpyAgent campaign infecting smartphone users in South Korea.	Malware	Individual	Cyber Crime	KR		McAfee, SpyAgent
180	15/11/2023	10/02/2023	06/03/2023	?	Stanley Steemer International	Stanley Steemer International (Stanley Steemer) filed a notice of data breach with the Attorney General of Maine after discovering that an unauthorized party was able to access portions of the company’s computer network.	Unknown	Professional, scientific and technical	Cyber Crime	US		Stanley Steemer International
181	15/11/2023	25/04/2023	'Recently'	?	Westside Community Services	Westside Community Services (Westside Health) file a notice of data breach after discovering that there was unauthorized access to its computer system.	Unknown	Human health and social work	Cyber Crime	US		Westside Community Services, Westside Health
182	15/11/2023	15/05/2023	16/05/2023	?	Adams Bank & Trust	Adams Bank & Trust (ABT) files a notice of data breach after confirming that the bank’s computer system was accessed by an unauthorized party.	Unknown	Finance and insurance	Cyber Crime	US		Adams Bank & Trust, ABT
183	15/11/2023	-	-	Knight	Studio D.E.L.L.A.	The Knight ransomware group claims responsibility for a cyber attack to Studio D.E.L.L.A..	Malware	Professional, scientific and technical	Cyber Crime	IT		Knight, ransomware, Studio D.E.L.L.A.
ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags

Creating the timelines is a very time-consuming task.

Any little helps!

No Data Found

The “Breachometer” compares the current number of events/day with the max and min values recorded in the previous 12 months.

September 2026 Cyber Attacks Statistics
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...
Mega Breaches in 2026
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
September 2026 Cyber Attacks Statistics Infographic
September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%. Malware led the techniques with 53 campaigns, ahead of Remote Code Execution with 32. More than a quarter of breaches started with an exploited public-facing ...
October 2026 Cyber Attacks Timeline
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
AI-Assisted Malicious Campaigns
In this blog post I am collecting the campaigns that show evidence of being AI-generated, or make use of AI tools to increase their impact. As always I will continue to update the list as soon as new campaigns emerge.