1-15 December 2023 Cyber Attacks Timeline

Last modified: February 13, 2024

Follow me on X

Connect on Linkedin

Connect on Mastodon

EVENTS

EVENTS/DAY

EVENTS

EVENTS/DAY

Motivations December H1 2023

Attack Techniques December H1 2023

After several months of sustained activity, the first half of December 2023 saw an important decrease in the in the number of recorded events. In particular I collected 135 events that represent a sharp drop if compared to 207 of the previous timeline.

But even in a scenario with a lower number of events, ransomware continued to characterize the threat landscape (48 out of 135 events were directly or indirectly related to this kind of attack), corresponding to 35.5% of cases (it was 34.78% in the previous timeline, definitely a very value that continues to be quite high) a number that also reflect the high percentage of malware attacks (46.7%), slightly up from 45.9% of the second half of November.

The exploitation of vulnerabilities played a part in 18 events, corresponding to 13.3% of events, up from 9.2% of the previous timeline, and in counter-tendency with the trend of the latest months.

Rogue AI Agents

AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a

There were several mega breaches, but some of them (such as Norton Healthcare) were already reported in previous timelines. The only one that was never disclosed before hit ESO Solutions, a provider of software products for healthcare organizations and fire departments, which had the data belonging to 2.7 million patients compromised as a result of a ransomware attack.

In the fintech sector, the only mega theft of crypto asset hit the decentralized exchange OKX, which fell victim after a private key belonging to the proxy admin owner was leaked, leading to total losses equivalent to approximately $2.7 million.

And unsurprisingly, another leitmotif, of the last few months, the complex geopolitical situation continued to affect the cyber espionage landscape, with threat actors from Russia (APT28, APT29, Callisto), North Korea (Lazarus and Andariel), and China, particularly active. The APT28 threat group especially, was busy in carrying out multiple global operations exploiting the CVE-2023-23397 Microsoft Outlook vulnerability and CVE-2023-38831 WinRAR vulnerability. There was also an unconfirmed news of an alleged cyber attack against the Sellafield nuclear waste and decommissioning site in the UK, from threat actors linked to Russia and China.

Last but not least, security researchers discovered also a new campaign by the pro-Hamas threat actor known as Gaza Cybergang, targeting Palestinian entities (and this was not the only event related to the war between Israel and Hamas).

This timeline is particularly long, so my suggestion is always the same: browse the timeline, and obviously share it to support my work in spreading the risk awareness across the community. And don’t forget to follow @paulsparrows on X (formerly Twitter,) or even connect on Linkedin, or Mastodon for the latest updates.

Geo Map December H1 2023

No Data Found

ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags
1	01/12/2023	-	-	Nation-state threat actors	Organizations in the United States, the Middle East, and Africa	Researchers from Palo Alto Networks discover a threat activity cluster, named CL-STA-0002, carried out via a novel malware named 'Agent Raccoon' (or Agent Racoon) used in cyberattacks against organizations in the United States, the Middle East, and Africa.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Palo Alto Networks, CL-STA-0002, Agent Raccoon, Agent Racoon
2	01/12/2023	End of November/Early December 2023	End of November/Early December 2023	?	Multiple organizations	Researchers at Wordfence and PatchStack discover a campaign emailing WordPress administrators with fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 to infect sites with a malicious plugin.	Malware	Multiple Industries	Cyber Crime	>1		Wordfence, PatchStack, WordPress, CVE-2023-45124
3	01/12/2023	03/09/2023	03/09/2023	?	The Hershey Company	The Hershey Company, the American manufacturer of popular sweets such as Kit Kat and Reese's Peanut Butter Cups, tells regulators that more than 2,200 people were potentially affected by a data breach after hackers gained access to some of the company’s email accounts.	Account Takeover	Accommodation and food service	Cyber Crime	US		The Hershey Company, Kit Kat, Reese's Peanut Butter Cups
4	01/12/2023	Since at least November 2023	During November 2023	Storm-0216 (a.k.a. Twisted Spider and UNC2198)	Multiple organizations	Researchers from Microsoft reveal that the threat actor Storm-0216 (a.k.a. Twisted Spider and UNC2198) is using the Danabot malware distributed through online advertisements to infect victims with the Cactus ransomware.	Malware	Multiple Industries	Cyber Crime	>1		Microsoft, Storm-0216, Twisted Spider, UNC2198, Danabot, Cactus, ransomware
5	01/12/2023	-	-	Cyber Av3ngers	Four water utilities and an aquarium in the U.S.	The FBI, the Environmental Protection Agency, the Cybersecurity and Infrastructure Security Agency, (CISA,) and Israel’s National Cyber Directorate reveal that at least four water utilities and an aquarium in the U.S. have been targeted by the Iranian hacktivists from the Cyber Av3ngers targeting vulnerable Unitronics controllers.	Unitronics vulnerability	Water supply, waste mgmt, remediation	Hacktivism	US		FBI, Environmental Protection Agency, Cybersecurity and Infrastructure Security Agency, CISA, Israel, Iran, Israel’s National Cyber Directorate, Cyber Av3ngers, Unitronics
6	01/12/2023	-	22/09/2023	Cuba	Rock County	Rock County issues notification letters about a Cuba ransomware attack and data breach that affected 25,823 individuals.	Malware	Public admin and defence, social security	Cyber Crime	US		Rock County, Cuba, ransomware
7	01/12/2023	-	-	Medusa	Great Valley School District	The Medusa ransomware gang claims to have hit Great Valley School District in Pennsylvania.	Malware	Education	Cyber Crime	US		Medusa, ransomware, Great Valley School District
8	01/12/2023	-	29/11/2023	LockBit 3.0	Pacific Cataract and Laser Institute	Pacific Cataract and Laser Institute is hit with a LockBit 3.0 ransomware attack.	Malware	Human health and social work	Cyber Crime	US		Pacific Cataract and Laser Institute, ransomware LockBit 3.0
9	03/12/2023	During November 2023	-	Qilin	Multiple organizations	A new version of the Qilin ransomware is discovered targeting VMware ESXi systems.	Malware	Multiple Industries	Cyber Crime	>1		Qilin, ransomware, VMware ESXi
10	04/12/2023	As early as April 2022.	As early as April 2022.	Forest Blizzard a.k.a. APT28, Fancy Bear, Strontium, Fighting Ursa, TA422, ITG05	Government, energy, transportation, and other key organizations in the United States, Europe, and the Middle East.	Microsoft's Threat Intelligence team issues a warning about the Russian state-sponsored actor APT28 (aka "Fancy Bear" or "Strontium") actively exploiting the CVE-2023-23397 Outlook vulnerability to hijack Microsoft Exchange accounts and steal sensitive information.	Targeted Attack	Multiple Industries	Cyber Crime	US >1		Microsoft, Russia, APT28, Fancy Bear, Strontium, CVE-2023-23397, Outlook, Microsoft Exchange
11	04/12/2023	-	-	P2Pinfect	Multiple organizations	Researchers from Cado discover a new variant of the P2Pinfect botnet, focusing on infecting devices with 32-bit MIPS processors, such as routers and IoT devices.	Brute-force	Multiple Industries	Cyber Crime	>1		Cado, P2Pinfect, MIPS, IoT
12	04/12/2023	02/12/2023	03/12/2023	ALPHV a.k.a. BlackCat	Tipalti	Accounting software giant Tipalti says it is investigating reports of a ransomware attack after the BlackCat/ALPHV ransomware gang spent the weekend attempting to extort the company and its customers.	Malware	Professional, scientific and technical	Cyber Crime	CA		Tipalti, ransomware, BlackCat, ALPHV, ransomware
13	04/12/2023	'Recently'	27/11/2023	Malek Team	Ziv Medical Center	Malek Team, a group allegedly linked to Iran, claims to have leaked thousands of medical records from Ziv Medical Center, an Israeli hospital, including those of Israeli soldiers.	Unknown	Human health and social work	Hacktivism	IL		Malek Team, Iran, Ziv Medical Center, Israel
14	04/12/2023	End of November 2023	End of November 2023	Cyber Av3ngers	St. Johns River Water Management District	St. Johns River Water Management District, a regulatory agency in Florida that oversees the long-term supply of drinking water, confirms that it responded to a cyberattack after the Cyber Av3ngers said it attacked the organization, providing samples of what it stole.	Unknown	Water supply, waste mgmt, remediation	Hacktivism	US		Cyber Av3ngers, St. Johns River Water Management District, Israel
15	04/12/2023	25/07/2023	-	?	St. Landry Parish Schools	The St. Landry Parish Schools district is hit with a ransomware attack.	Malware	Education	Cyber Crime	US		St. Landry Parish Schools, ransomware
16	04/12/2023	-	05/11/2023	HelloKitty?	Hermon School Department	The Hermon School Department suffers a ransomware attack after the threat actors exploit the CVE-2023-46604 Apache ActiveMQ vulnerability,	Malware	Education	Cyber Crime	US		HelloKitty, Hermon School Department, ransomware, CVE-2023-46604, Apache ActiveMQ
17	04/12/2023	18/05/2023	16/11/2023	?	Taylor University	Taylor University notifies individuals whose information may have been impacted by a ransomware attack discovered in May.	Malware	Education	Cyber Crime	US		Taylor University, ransomware
18	04/12/2023	As far back as 2015	-	Threat actors linked to Russia and China	Sellafield Nuclear Waste and Decommissioning Site	Threat actors linked to Russia and China have allegedly hacked into the systems of the Sellafield nuclear waste and decommissioning site in the UK, according to an investigation conducted by The Guardian. However, the British government has dismissed the reports.	Malware	Electricity, gas steam, air conditioning	Cyber Espionage	GB		Russia, China, Sellafield, The Guardian
19	04/12/2023	Since October 2023	During October 2023	?	Android Banking Users	Researchers from Cyble discover a new variant of the TrickMo banking trojan, using an overlay attack technique.	Malware	Finance and insurance	Cyber Crime	>1		Cyble, Android, TrickMo, Overlay
20	04/12/2023	28/08/2023	-	?	Sharonview Federal Credit Union	Sharonview Federal Credit Union (Sharonview) files a notice of data breach after discovering that an unauthorized party was able to access an employee’s email account.	Account Takeover	Finance and insurance	Cyber Crime	US		Sharonview Federal Credit Union, Sharonview
21	04/12/2023	-	04/10/2023	?	Neurosurgical Associates of New Jersey	Neurosurgical Associates of New Jersey (Neurosurgeons of New Jersey) files a notice of data breach after discovering that an unauthorized party accessed an employee’s email account.	Account Takeover	Human health and social work	Cyber Crime	US		Neurosurgical Associates of New Jersey, Neurosurgeons of New Jersey
22	04/12/2023	-	-	Akira	Hangzhou Great Star Industrial	The American division of the Chinese multinational Hangzhou Great Star Industrial Co., Ltd (Great Star), pays a ransom of 1 million dollars in a BTC wallet to the Akira ransomware group.	Malware	Manufacturing	Cyber Crime	US		Hangzhou Great Star Industrial, Great Star, Akira, ransomware
23	05/12/2023	Since the beginning of 2023	Since the beginning of 2023	SpyLoan	Android users in Mexico, India, Thailand, Indonesia, Nigeria, Philippines, Egypt, Vietnam, Singapore, Kenya, Colombia, and Peru.	Researchers from ESET discover more than a dozen malicious loan apps, generically named SpyLoan, downloaded more than 12 million times.	Malware	Finance and insurance	Cyber Crime	CO EG ID IN KE MX NG PE PH SG TH VN		ESET, SpyLoan, Android
24	05/12/2023	During June 2023	During June 2023	?	Two federal agencies in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns about threat actors actively exploiting a critical vulnerability in Adobe ColdFusion identified as CVE-2023-26360 to gain initial access to government servers.	CVE-2023-26360 Vulnerability	Public admin and defence, social security	Cyber Espionage	US		U.S. Cybersecurity and Infrastructure Security Agency, CISA, Adobe ColdFusion, CVE-2023-26360
25	05/12/2023	-	30/11/2023	ALPHV a.k.a. BlackCat	HTC Global Services	IT services and business consulting company HTC Global Services confirms they suffered a cyberattack after the ALPHV/BlackCat ransomware gang begins leaking screenshots of stolen data, allegedly obtained exploiting the CVE-2023-4966 Citrixbleed vulnerability.	Malware	Professional, scientific and technical	Cyber Crime	US		HTC Global Services, ALPHV, BlackCat, ransomware, CVE-2023-4966, Citrixbleed
26	05/12/2023	-	-	?	Nissan Oceania	Japanese car maker Nissan investigates a cyberattack that targeted its systems in Australia and New Zealand, which may have let hackers access personal information.	Unknown	Manufacturing	Cyber Crime	AU NZ		Nissan Oceania
27	05/12/2023	Since at least March 2022	Since at least March 2022	Doppelgänger	Ukraine	Researchers from Recorded Future discover additional activity from the Russia-linked ‘Doppelgänger’ social media operation targeting Ukraine.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	UA		Recorded Future, Russia, Doppelgänger, Ukraine
28	05/12/2023	Since at least March 2022	Since at least March 2022	Doppelgänger	Germany and U.S.	Researchers from Recorded Future discover another campaign from the Russia-linked ‘Doppelgänger’ social media operation targeting Germany and the U.S.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	DE US		Recorded Future, Russia, Doppelgänger
29	05/12/2023	-	-	Andariel	South Korean companies connected to the defense industry	The Seoul Metropolitan Police accuses the North Korean group Andariel of targeting South Korean companies connected to the defense industry and stealing 1.2 terabytes of sensitive information about anti-aircraft weapon systems.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	KR		Seoul Metropolitan Police, North Korea, Andariel
30	05/12/2023	-	-	Andariel	Three organizations in South Korea and abroad	Separately, the Seoul Metropolitan Police investigators discover that the group extorted three ransomware victims in South Korea and abroad for about $357,000 worth of Bitcoin.	Malware	Mining and quarrying	Cyber Crime	KR N/A		Seoul Metropolitan Police, North Korea, Andariel
31	05/12/2023	Since late September 2023	Since late September 2023	?	44 individuals across 22 different organizations	Researchers from Abnormal Security discover a sophisticated, personalized, phishing attack impersonating Disney+	Account Takeover	Multiple Industries	Cyber Crime	>1		Abnormal Security, Disney+
32	05/12/2023	-	-	Chinese Threat Actors	United States Postal Service (USPS) users	Researchers from Bolster discover a widespread phishing campaign, using a domain impersonating Walmart, and cleverly designed to mimic the appearance of the USPS.com website.	Account Takeover	Individual	Cyber Crime	US		Bolster, Walmart, USPS.com
33	05/12/2023	Since at least February 2022	Since at least February 2022	Doppelganger	Individuals in Germany, Ukraine, and the U.S.	Researchers from Recorded Future discover a new campaign by the Russia-linked influence operation called Doppelganger, aimed to amplify content designed to undermine Ukraine as well as propagate anti-LGBTQ+ sentiment, U.S. military competence, and Germany's economic and social issues.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	DE UA US		Recorded Future, Russia, Doppelganger, Ukraine, LGBTQ+, U.S., Germany, Structura National Technologies, Social Design Agency
34	05/12/2023	Since at least March 2023	Since at least March 2023	Forest Blizzard a.k.a. APT28, Fancy Bear, Strontium, Fighting Ursa, TA422, ITG05	Organizations in Europe and North America	Researchers from Proofpoint discover a new campaign by the Russian threat actor APT28 exploiting the CVE-2023-23397 Microsoft Outlook vulnerability and CVE-2023-38831 WinRAR vulnerability.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Proofpoint, Russia, APT28, Fancy Bear, Strontium, Fighting Ursa, TA422, ITG05, CVE-2023-23397, Microsoft Outlook, CVE-2023-38831, WinRAR
35	05/12/2023	05/12/2023	05/12/2023	BlackSuit	Groveport Madison Schools	The Groveport Madison Schools is hit with a BlackSuit ransomware attack.	Malware	Education	Cyber Crime	US		Groveport Madison Schools, BlackSuit, Ransomware
36	05/12/2023	18/10/2022	22/10/2022	?	Advantis Global	Advantis Global files a notice of data breach after discovering a “security incident” involving its corporate email system.	Account Takeover	Administration and support service	Cyber Crime	US		Advantis Global
37	05/12/2023	End of May 2023	01/06/2023	Clop a.k.a. Lace Tempest, TA505, and FIN11	1st Source Bank	1st Source Bank confirms that the protected health information of 1,477 individuals was stolen in May 2023 when hackers exploited the zero day vulnerability in Progress Software’s MOVEit Transfer solution.	CVE-2023-34362 Vulnerability	Finance and insurance	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, 1st Source Bank, MOVEit
38	05/12/2023	16/11/2023	19/11/2023	?	4 Over	4 Over provides notice of a data security incident. after detecting suspicious activity affecting systems within the network.	Unknown	Administration and support service	Cyber Crime	US		4 Over
39	05/12/2023	-	-	?	Dameron Hospital	Dameron Hospital reschedules some procedures after suffering a cyberattack,	Unknown	Human health and social work	Cyber Crime	US		Dameron Hospital
40	05/12/2023	03/11/2023	03/11/2023	?	Hi-School Pharmacy	Hi-School Pharmacy discloses a ransomware attack.	Malware	Human health and social work	Cyber Crime	CA		Hi-School Pharmacy, ransomware
41	05/12/2023	30/11/2023	30/11/2023	?	Rappler	Rappler, a digital media company in the Philippines, is hit by a massive series of crippling DDoS attacks.	DDoS	Information and communication	Cyber Crime	PH		Rappler
42	05/12/2023	Between 03/11/203 and 07/11/2023	-	?	Manchester Public Schools	Manchester Public Schools lose $180K after making three payments, totaling roughly $180,000, to a potentially fraudulent bank account after a vendor was hacked.	Business Email Compromise	Education	Cyber Crime	US		Manchester Public Schools
43	06/12/2023	-	06/12/2023	Hunters International	Austal USA	Austal USA, a shipbuilding company and a contractor for the U.S. Department of Defense (DoD) and the Department of Homeland Security (DHS) confirms it suffered a cyberattack and is currently investigating the impact of the incident, after the Hunters International ransomware and data extortion group claimed to have breached Austal USA and leaked some information as proof of the intrusion.	Malware	Manufacturing	Cyber Crime	US		Austal USA, U.S. Department of Defense, DoD, Department of Homeland Security, DHS, Hunters International, ransomware
44	06/12/2023	-	-	LockBit 3.0	La Prensa	The LockBit 3.0 ransomware gang add La Prensa to the list of their victims.	Malware	Information and communication	Cyber Crime	NI		LockBit 3.0, ransomware, La Prensa
45	06/12/2023	-	-	Medusa	Campbell County School District	The Campbell County School District is listed in the leak site of the Medusa ransomware gang.	Malware	Education	Cyber Crime	US		Campbell County School District, Medusa, ransomware
46	06/12/2023	Since at least 28/04/2023	'Recently'	?	Multiple organizations	Researchers from Kaspersky discover several cracked applications distributed by unauthorized websites and loaded with a Trojan-Proxy targeting MacOS, Windows, and Android users.	Malware	Multiple Industries	Cyber Crime	>1		Kaspersky,Trojan-Proxy, MacOS, Windows, Android
47	06/12/2023	-	-	Akira	Compass Group Italia	The Akira ransomware gang adds Compass Group Italia to the list of their victims.	Malware	Accommodation and food service	Cyber Crime	IT		Akira, ransomware, Compass Group Italia
48	06/12/2023	-	-	Akira	Aqualectra Holdings	The Akira ransomware gang adds Aqualectra Holdings to the list of their victims.	Malware	Water supply, waste mgmt, remediation	Cyber Crime	BR		Akira, ransomware, Aqualectra Holdings
49	06/12/2023	-	-	?	Multiple organizations	Researchers from AhnLab discover a new campaign distributing the AsyncRAT in WSF script format.	Malware	Multiple Industries	Cyber Crime	KR		AhnLab, AsyncRAT, WSF
50	06/12/2023	15/03/2023	15/03/2023	?	United Home Loans	United Home Loans (UHL) files a notice of data breach after discovering that what appeared to be suspicious activity on its computer network turned out to be a cyberattack.	Unknown	Finance and insurance	Cyber Crime	US		United Home Loans, UHL
51	06/12/2023	22/10/2023	22/10/2023	DragonForce	Heart of Texas Behavioral Health Network	Heart of Texas Behavioral Health Network (HOTBHN) notifies certain current and former patients that their personal information may have been accessed as part of cyber security incident.	Malware	Human health and social work	Cyber Crime	US		Heart of Texas Behavioral Health Network, HOTBHN, DragonForce, ransomware
52	06/12/2023	-	-	Clop a.k.a. Lace Tempest, TA505, and FIN11	CBIZ KA	CBIZ KA, a revenue cycle management vendor is affected by a MOVEit breach. Nine of Ontario Prime Healthcare's hospitals are affected.	CVE-2023-34362 Vulnerability	Administration and support service	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, CBIZ KA, MOVEit, CVE-2023-34362
53	06/12/2023	-	05/11/2023	?	Eye Physicians of Central Florida	Eye Physicians of Central Florida announces that the protected health information of 31,189 patients was exposed and potentially stolen in a recent cyberattack.	Unknown	Human health and social work	Cyber Crime	US		Eye Physicians of Central Florida
54	07/12/2023	Since 2021	-	?	Telecommunications companies predominantly in Thailand	Researchers from Group-IB discover a remote access trojan named Krasue, targeting Linux systems of telecommunications companies predominantly in Thailand, and managed to remain undetected since 2021.	Malware	Information and communication	Cyber Crime	TH >1		Group-IB, Krasue, Linux
55	07/12/2023	Since late 2015	During 2023	Callisto Group a.k.a. Seaborgium or Star Blizzard	Multiple organizations worldwide	The UK National Cyber Security Centre (NCSC) and Microsoft, together with multiple agencies, warn that the Russian state-backed actor "Callisto Group" (aka "Seaborgium" or "Star Blizzard") is targeting organizations worldwide with spear-phishing campaigns used to steal account credentials and data.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		UK National Cyber Security Centre, NCSC, Microsoft, Russia, Callisto Group, Seaborgium, Star Blizzard
56	07/12/2023	'Over the past 20 months'	-	Forest Blizzard a.k.a. APT28, Fancy Bear, Strontium, Fighting Ursa, TA422, ITG05	At least 30 organizations within 14 NATO countries	Researchers from Palo Alto Networks reveal that Russian APT28 military hackers used the Microsoft Outlook CVE-2023-23397 zero-day vulnerability to target multiple European NATO member countries, including a NATO Rapid Deployable Corps.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	>1		Palo Alto Networks, APT28, Forest Blizzard, Fancy Bear, Strontium, Fighting Ursa, Microsoft Outlook, CVE-2023-23397, NATO, NATO Rapid Deployable Corps, Russia, TA422, ITG05
57	07/12/2023	-	06/12/2023	LockBit 3.0	Undisclosed franchise partner	Billion-dollar shoe seller Aldo says that a recent claim by the notorious LockBit ransomware gang was related to one of the company’s franchise partners.	Malware	Wholesale and retail	Cyber Crime	N/A		Aldo, LockBit, LockBit 3.0, ransomware
58	07/12/2023	from March to October 2023	-	Russia-aligned group	Individuals in Ukraine	Researchers from Microsoft discover an anti-Ukraine propaganda campaign by a Russia-aligned group, manipulating videos of well-known American actors to spread a message that Ukraine's president is a “corrupt drug addict.”	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	UA		Microsoft, Russia, Ukraine
59	07/12/2023	23/11/2023	07/12/2023	Play	Greater Richmond Transit Company	The Play ransomware gang lists the Greater Richmond Transit Company (GRTC) in their leak site.	Malware	Transportation and storage	Cyber Crime	US		Play, ransomware, Greater Richmond Transit Company, GRTC
60	07/12/2023	-	-	Multiple threat actors	Multiple organizations in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2023-41265 and CVE-2023-41266 targeting Qlik Sense to its catalog of exploited vulnerabilities.	CVE-2023-41265 and CVE-2023-4126 vulnerabilities	Multiple Industries	N/A	US		U.S. Cybersecurity and Infrastructure Security Agency, CISA, CVE-2023-41265, CVE-2023-41266, Qlik Sense
61	07/12/2023	-	-	?	Multiple organizations	Researchers from Aqua Security discover a new variant of the HeadCrab malware, adding infected devices to a botnet for use in cryptomining and other attacks, which controls responses and has rootkit-like actions.	Malware	Multiple Industries	Cyber Crime	>1		Aqua Security, HeadCrab
62	07/12/2023	End of November 2023	End of November 2023	?	Multiple organizations	Researchers from Fortinet identify an email phishing campaign using deceptive booking information to entice victims into clicking on a malicious PDF file. The PDF downloads a .NET executable file created with PowerGUI and then runs a PowerShell script to fetch the final malware, known as MrAnon Stealer.	Malware	Multiple Industries	Cyber Crime	>1		Fortinet, PDF, .NET, PowerGUI, PowerShell, MrAnon Stealer.
63	07/12/2023	Mid-October 2023	07/12/2023	?	Individuals	Researchers from Check Point discover a phishing campaign delivering the maliicious phishing page via Genial.ly, a platform where users can create interactive content.	Account Takeover	Individual	Cyber Crime	>1		Check Point, Genial.ly
64	07/12/2023	12/10/2023	12/10/2023	?	CompleteCare Health Network	CompleteCare Health Network (CCHN) files a notice of data breach after discovering that the company was the recent victim of a ransomware attack.	Malware	Human health and social work	Cyber Crime	US		CompleteCare Health Network, CCHN, ransomware
65	07/12/2023	28/09/2023	29/09/2023	?	Financial Risk Mitigation	Financial Risk Mitigation (FRM) files a notice of data breach after discovering that an unauthorized actor was able to gain access to its computer system.	Unknown	Professional, scientific and technical	Cyber Crime	US		Financial Risk Mitigation, FRM
66	07/12/2023	-	-	UAC-0050	Ukrainian and Polish authorities	Ukrainian and Polish authorities are the targets of a campaign from the threat actor tracked as UAC-0050, delivering the RemcosRAT and MeduzaStealer malware strains.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	PL UA		UAC-0050, RemcosRAT, MeduzaStealer
67	08/12/2023	19/11/2023	19/11/2023	Hunters International	Fred Hutchinson Cancer Center	The Hunters International ransomware gang claims to be behind a cyberattack on the Fred Hutchinson Cancer Center (Fred Hutch) that resulted in patients receiving personalized extortion threats.	Malware	Human health and social work	Cyber Crime	US		Hunters International, ransomware, Fred Hutchinson Cancer Center,Fred Hutch
68	08/12/2023	-	-	Rhysida	Travian Games	The ransomware group Rhysida claims to have stolen a massive catalog from the German game developer Travian Games, with nearly 800,000 files that comprise 560GB of data.	Malware	Arts entertainment, recreation	Cyber Crime	DE		Ransomware, Rhysida, Travian Games
69	08/12/2023	07/12/2023	07/12/2023	?	University of Wollongong	The University of Wollongong discloses a security breach.	Unknown	Education	Cyber Crime	AU		University of Wollongong
70	08/12/2023	11/04/2023	16/10/2023	?	UnitedHealthcare Services	UnitedHealthcare Services (UHC) files a notice of data breach after discovering that an unauthorized party was able to access an email account belonging to Equality Health, an Accountable Care Organization that serves some UHC members.	Account Takeover	Human health and social work	Cyber Crime	US		UnitedHealthcare Services, UHC, Equality Health, Accountable Care Organization
71	08/12/2023	10/08/2023	14/08/2023	?	VNS Health	VNS Health (VNS Health Home Care, VNS Health Hospice Care, and VNS Health Personal Care in New York) notify patients that an unauthorized third party gained access to the email accounts of some of its employees and potentially viewed or obtained some of their protected health information.	Account Takeover	Human health and social work	Cyber Crime	US		VNS Health, VNS Health Home Care, VNS Health Hospice Care, VNS Health Personal Care
72	08/12/2023	During December 2023	During December 2023	Forest Blizzard a.k.a. APT28, Fancy Bear, Strontium, Fighting Ursa, TA422, ITG05	At least 13 nations worldwide	Researchers from IBM X-Force discover a new campaign from the Russian threat actor APT28, leveraging the ongoing Israel-Hamas war to facilitate the delivery of the Headlace backdoor.	Targeted Attack	Multiple Industries	Cyber Espionage	AU AZ BE DE HU IT KZ LT PL RO SA TR UA		Forest Blizzard, APT28, Fancy Bear, Strontium, Fighting Ursa, TA422, ITG05, IBM X-Force, Russia, Israel, Hamas, Headlace
73	08/12/2023	08/12/2023	08/12/2023	?	Kaunas University of Technology	The Kaunas University of Technology is hit with a cyber attack.	Unknown	Education	Cyber Crime	LT		Kaunas University of Technology
74	09/12/2023	Early November 2023	Early November 2023	BianLian	Akumin	Akumin is the victim of a ransomware attack from the BianLian group.	Malware	Professional, scientific and technical	Cyber Crime	US		Akumin, ransomware, BianLian
75	10/12/2023	-	-	Knight	City of Defiance	The Knight ransomware gang claims to have breached the city of Defiance.	Malware	Public admin and defence, social security	Cyber Crime	US		Knight, ransomware, city of Defiance
76	10/12/2023	-	26/05/2023	?	Italian Istituto Poligrafico e Zecca dello Stato (IPZS)	The Italian Istituto Poligrafico e Zecca dello Stato (IPZS) (State Mint and Polygraphic Institute) falls victim of a BEC scam and sends 3 million Euros (3.23 million USD) in Hungary.	Business Email Compromise	Public admin and defence, social security	Cyber Crime	IT		Italian Istituto Poligrafico e Zecca dello Stato, IPZS, State Mint and Polygraphic Institute
77	11/12/2023	Since at least March 2023	-	Lazarus a.k.a. Diamond Sleet, ZINC, Labyrinth Chollima	Manufacturing, agricultural, and physical security companies worldwide.	Researchers from Cisco Talos discover a new campaign conducted by the Lazarus Group called “Operation Blacksmith,” exploiting the CVE-2021-44228 Log4J vulnerability, and employing at least three new DLang-based malware families: NineRAT, DLRAT, and BottomLoader.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Lazarus, Diamond Sleet, ZINC, Labyrinth Chollima, Cisco Talos, Operation Blacksmith, DLang, NineRAT, DLRAT, BottomLoader, CVE-2021-44228, Log4J
78	11/12/2023	Since at least September 2022	Since at least September 2022	Multiple threat actors	Multiple organizations	Sophos decides to backport a security update for CVE-2022-3236 for end-of-life (EOL) firewall firmware versions after discovering hackers actively exploiting the flaw in attacks.	CVE-2022-3236 Vulnerability	Multiple Industries	N/A	>1		Sophos, CVE-2022-3236
79	11/12/2023	10/12/2023	10/12/2023	?	Unnamed set-top box provider in UAE	A group of threat actors targets a television service in the United Arab Emirates, replacing the original broadcast with graphic footage from the war between Israel and Hamas.	Unknown	Information and communication	Hacktivism	UAE		Israel, Hamas
80	11/12/2023	During the previous week	During the previous week	Cyber Av3ngers	Private group water scheme in the rural Erris area of County Mayo	Residents of a remote area on Ireland’s west coast are left without water due to a cyberattack perpetrated by the pro-Iran group Cyber Av3ngers.	Unitronics vulnerability	Water supply, waste mgmt, remediation	Hacktivism	IE		Cyber Av3ngers, Erris, County Mayo
81	11/12/2023	06/12/2023	06/12/2023	Medusa	Glendale Unified School District	The Medusa ransomware gang claims responsibility for an attack to Glendale Unified School District (GUSD) and leaks dozens of sensitive documents.	Malware	Education	Cyber Crime	US		Medusa, ransomware, Glendale Unified School District, GUSD
82	11/12/2023	-	-	Medusa	Hinsdale School District	The Medusa ransomware gang claims responsibility for an attack to Glendale Unified School District and lists the victim in their website.	Malware	Education	Cyber Crime	US		Medusa, ransomware, Hinsdale School District
83	11/12/2023	11/12/2023	11/12/2023	?	Newsquest	A cyberattack at Newsquest, one of the UK’s largest regional media groups, has disrupted operations at its local news outlets, causing intermittent website outages and leaving journalists unable to file stories.	Unknown	Information and communication	Cyber Crime	GB		Newsquest
84	11/12/2023	October and Early November 2022	October and Early November 2022	Threat actors from China, Iran, and Russia	United States	The FBI, the CIA, the NSA, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of the Director of National Intelligence (ODNI) confirm they detected evidence of foreign interference during the 2022 US federal elections through multiple attack techniques such as DDoS, scanning of federal websites, etc.	>1	Public admin and defence, social security	Cyber Warfare	US		FBI, CIA, NSA, Cybersecurity and Infrastructure Security Agency, CISA, Office of the Director of National Intelligence, ODNI, Iran, Russia, China, 2022 Federal Elections
85	11/12/2023	Mid-November 2023	Mid-November 2023	?	Professionals at companies in Saudi Arabia	A new campaign is using hundreds of fake profiles on LinkedIn to target professionals at companies in Saudi Arabia, not only for financial fraud, but to convince employees in specific roles to provide sensitive corporate information.	Account Takeover	Multiple Industries	Cyber Crime	SA		Linkedin
86	11/12/2023	21/07/2023	16/08/2023	?	CareTree	CareTree files a notice of data breach after discovering that an unauthorized actor was able to access the CareTree platform	Unknown	Professional, scientific and technical	Cyber Crime	US		CareTree
87	11/12/2023	04/11/2023	10/11/2023	?	TRISTAR Insurance Group	TRISTAR Insurance Group (TRISTAR) files a notice of data breach after discovering that an unauthorized party was able to access its computer network through a cyberattack.	Account Takeover	Finance and insurance	Cyber Crime	US		TRISTAR Insurance Group
88	11/12/2023	18/08/2023	12/10/2023	?	HealthAlliance	HealthAlliance files a notice of data breach after discovering that an unauthorized party had gained access to the organization’s IT network.	Unknown	Human health and social work	Cyber Crime	US		HealthAlliance
89	12/12/2023	12/12/2023	12/12/2023	?	Kyivstar	Kyivstar, Ukraine's largest telecommunications service provider serving over 25 million mobile and home internet subscribers, suffers a cyberattack impacting mobile and data services.	Unknown	Information and communication	Cyber Warfare	UA		Kyivstar
90	12/12/2023	-	-	Ukraine's defense intelligence directorate (GUR)	Russian Federal Taxation Service	Ukraine's defense intelligence directorate (GUR) says it infected thousands of servers belonging to Russia's state tax service (Russian Federal Taxation Service - FNS) with malware, and destroyed databases and backups.	Malware	Public admin and defence, social security	Cyber Warfare	RU		Ukraine, Defense Intelligence Directorate, GUR, Russia, Russian Federal Taxation Service, FNS
91	12/12/2023	From July to November 2023	-	Multiple threat actors including Storm-1283	Multiple organizations	Researchers from Microsoft warn that financially-motivated threat actors are using OAuth applications to automate BEC and phishing attacks, push spam, and deploy VMs for cryptomining.	Account Takeover	Multiple Industries	Cyber Crime	>1		Storm-1283, Microsoft, OAuth
92	12/12/2023	28/09/2023	-	?	ESO Solutions	ESO Solutions, a provider of software products for healthcare organizations and fire departments, discloses that data belonging to 2.7 million patients has been compromised as a result of a ransomware attack.	Malware	Professional, scientific and technical	Cyber Crime	US		ESO Solutions, ransomware
93	12/12/2023	11/12/2023	11/12/2023	?	Central Bank of Lesotho	The central bank of southern African country Lesotho is facing severe outages due to a cyberattack that was discovered earlier this week.	Unknown	Finance and insurance	Cyber Crime	LS		Central Bank of Lesotho
94	12/12/2023	23/11/2023	23/11/2023	?	District Court of March	The District Court of March, in Switzerland, announces it was “the victim of a cyber attack,” likely ransomware.	Malware	Public admin and defence, social security	Cyber Crime	CH		District Court of March, ransomware.
95	12/12/2023	-	-	Rhysida	Grupo José Alves	Grupo José Alves is listed by the Rhysida ransomware group.	Malware	Administration and support service	Cyber Crime	BR		Grupo José Alves, Rhysida, ransomware
96	12/12/2023	Since at least October 2023,	'Recently'	TA4557	Multiple organizations	Researchers from Proofpoint discover a new campaign by the Russian threat actor TA4557 mimicking job applicants via email to siphon off valuable data from prospective employers.	Malware	Multiple Industries	Cyber Crime	>1		Proofpoint, Russia, TA4557
97	12/12/2023	-	-	Meow	Memorial Sloan Kettering Cancer Center	The Meow ransomware gang claims to have breached the Memorial Sloan Kettering Cancer Center (MSKCC.)	Malware	Human health and social work	Cyber Crime	US		Meow, ransomware, Memorial Sloan Kettering Cancer Center. MSKCC
98	12/12/2023	Since May 2023	Since May 2023	?	Multiple organizations	Researchers from ESET discover a cluster of malicious Python projects being distributed in PyPI, the official Python package repository, targeting both Windows and Linux systems and usually delivers a custom backdoor. In some cases, the final payload is a variant of the infamous W4SP Stealer.	Malware	Multiple Industries	Cyber Crime	>1		ESET, Python, PyPI, Windows, Linux, W4SP Stealer
99	12/12/2023	08/12/2023	08/12/2023	LockBit 3.0	Westpole	The LockBit 3.0 ransomware gang targets the Italian cloud service provider Westpole, which is specialized in digital services for public administration. The incident impacts PA Digitale, the government agency that offers services to various local and government organizations.	Malware	Professional, scientific and technical	Cyber Crime	IT		LockBit 3.0, ransomware, Westpole, PA Digitale
100	12/12/2023	21/08/2023	27/08/2023	?	Keenan & Associates	Keenan & Associates (Kennan) files a notice of data breach after discovering that it was the recent victim of a ransomware attack.	Malware	Finance and insurance	Cyber Crime	US		Keenan & Associates, Kennan, ransomware
101	12/12/2023	08/06/2023	26/06/2023	?	Regional Family Medicine	Regional Family Medicine files a notice of data breach after discovering that what initially appeared to be an IT outage was really a cyberattack.	Unknown	Human health and social work	Cyber Crime	US		Regional Family Medicine
102	12/12/2023	19/12/2022	23/12/2022	?	Southern Illinois Healthcare - Harrisburg Medical Center	Southern Illinois Healthcare - Harrisburg Medical Center (SIH HMC) files a notice of data breach after discovering that an unknown and unauthorized party was able to access its computer network.	Unknown	Human health and social work	Cyber Crime	US		Southern Illinois Healthcare - Harrisburg Medical Center, SIH HMC
103	12/12/2023	12/10/2023	13/10/2023	?	Cardiothoracic and Vascular Surgeons	Cardiothoracic and Vascular Surgeons (CTVS) files a notice of data breach after discovering that information on the company’s computer network was subject to unauthorized access.	Unknown	Human health and social work	Cyber Crime	US		Cardiothoracic and Vascular Surgeons, CTVS
104	12/12/2023	12/10/2023	13/10/2023	?	Health Diagnostic Management	Health Diagnostic Management (HDM), a provider of non-medical management services for diagnostic imaging centers, discloses a breach of its patient portal after valid credentials for a referring physician from Brooklyn Premiere Orthopedics were used to access the patient portal.	Account Takeover	Human health and social work	Cyber Crime	US		Health Diagnostic Management, (HDM, Brooklyn Premiere Orthopedics
105	13/12/2023	Since at least 13/12/2023	13/12/2023	Multiple threat actors	Multiple organizations	Researchers from Shadowserver reveal that threat actors are attempting to leverage a recently fixed critical vulnerability (CVE-2023-50164) in Apache Struts that leads to remote code execution, in attacks that rely on publicly available proof-of-concept exploit code.	CVE-2023-50164 Vulnerability	Multiple Industries	Cyber Crime	>1		Shadowserver, CVE-2023-50164, Apache Struts
106	13/12/2023	Since September 2023	Since September 2023	APT29 a.k.a. the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard	Multiple organizations in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) warn that the APT29 hacking group linked to Russia's Foreign Intelligence Service (SVR) has been targeting unpatched JetBrains TeamCity servers in widespread attacks since September 2023.	CVE-2023-42793 Vulnerability	Multiple Industries	Cyber Espionage	US		APT29, Russia, Foreign Intelligence Service, SVR, TeamCity, the Dukes, CozyBear, NOBELIUM, Midnight Blizzard, U.S. Cybersecurity and Infrastructure Security Agency, CISA, U.S. National Security Agency, NSA, Polish Military Counterintelligence Service, SKW, CERT Polska, CERT.PL, UK’s National Cyber Security Centre, NCSC, JetBrains, TeamCity
107	13/12/2023	Since at least late October 2023	During late October 2023	?	Multiple organizations	Researchers from Abnormal Security discover a new wave of BazarCall attacks using Google Forms to generate and send payment receipts to victims, attempting to make the phishing attempt appear more legitimate.	Malware	Multiple Industries	Cyber Crime	>1		Abnormal Security, BazarCall, Google Forms
108	13/12/2023	Since at least February 2022	Mid-November 2023	Volt Typhoon a.k.a. Bronze Silhouette	Multiple organizations	Researchers from Black Lotus discover a campaign by the Chinese state-sponsored APT group known as Volt Typhoon (Bronze Silhouette) linked to a sophisticated botnet named 'KV-botnet' to attack SOHO routers in high-value targets.	Malware	Multiple Industries	Cyber Espionage	US		Lumen Technologies, Black Lotus, China, Volt Typhoon, Bronze Silhouette, KV-botnet, SOHO
109	13/12/2023	13/12/2023	13/12/2023	?	London Public Library	The London Public Library in Ontario is forced to shut down most of its services due to a cyberattack.	Unknown	Education	Cyber Crime	CA		London Public Library, Ontario
110	13/12/2023	-	12/12/2023	Rhysida	Insomniac Games,	Sony says it is looking into reports of a ransomware attack on its subsidiary Insomniac Games, the studio behind popular titles like Spider-Man, Spyro the Dragon and more, after claims by the Rhysida ransomware gang.	Malware	Arts entertainment, recreation	Cyber Crime	US		Sony, Insomniac Games, Spider-Man, Spyro the Dragon, Rhysida, ransomware
111	13/12/2023	-	-	LockBit 3.0	CMS	CMS, one of the world’s largest law firms, is claimed by the LockBit 3.0 ransomware, with the attackers alleging a 500GB data theft.	Malware	Professional, scientific and technical	Cyber Crime	DE		CMS, LockBit 3.0, ransomware
112	13/12/2023	-	During November 2023	Hunters International	Covenant Care	Hunters International claims responsibility for a ransomware attack to Covenant Care.	Malware	Human health and social work	Cyber Crime	US		Hunters International, ransomware, Covenant Care
113	13/12/2023	-	21/11/2023	Cactus	Petersen Health Care	Petersen Health Care suffers a Cactus ransomware attack.	Malware	Human health and social work	Cyber Crime	US		Petersen Health Care, Cactus, ransomware
114	13/12/2023	-	-	DragonForce	Greater Cincinnati Behavioral Health Services	DragonForce adds Greater Cincinnati Behavioral Health Services (GCBHS) to its leak site, claiming to have exfiltrated 72.4 GB of files.	Malware	Human health and social work	Cyber Crime	US		DragonForce, Greater Cincinnati Behavioral Health Services, GCBHS, ransomware
115	13/12/2023	12/12/2023	12/12/2023	?	OKX	Decentralized exchange OKX falls victim to a hack after a private key belonging to the proxy admin owner is leaked. Total losses amount to approximately $2.7 million.	Vulnerability	Fintech	Cyber Crime	SC		OKX
116	13/12/2023	13/12/2023	13/12/2023	Meow	Tulane University	The Tulane University is hit with a cyber attack. The Meow ransomware gang claims respomsibility.	Malware	Education	Cyber Crime	US		Tulane University, Meow, ransomware
117	14/12/2023	14/12/2023	14/12/2023	?	Ledger	The Ledger hardware wallet warns users that a supply chain attack on the 'Ledger dApp Connect Kit' library was found pushing a JavaScript wallet drainer that stole $600,000 in crypto and NFTs.	Malware	Fintech	Cyber Crime	FR		Ledger. Ledger dApp Connect Kit, JavaScript
118	14/12/2023	During 2023	During 2023	?	Android users	Researchers from Zimperium discover ten new Android banking malware families, which collectively target 985 bank and fintech/trading apps from financial institutes across 61 countries.	Malware	Finance and insurance	Cyber Crime	>1		Zimperium, Android
119	14/12/2023	-	-	?	Organizations in Mexico, Colombia and Vietnam	Researchers from Kaspersky discover a novel Go-based malware named NKAbuse, which primarily targets Linux desktops in Mexico, Colombia, and Vietnam, abusing the NKN (New Kind of Network) peer-to-peer technology for data exchange.	Malware	Multiple Industries	Cyber Crime	CO MX VN		Kaspersky, Go, NKAbuse, Linux, NKN, New Kind of Network, peer-to-peer
120	14/12/2023	14/12/2023	16/08/2023	Snatch	Kraft Heinz Company	The Kraft Heinz Company says it is looking into recent claims of data theft made by the Snatch ransomware gang.	Malware	Accommodation and food service	Cyber Crime	US		Kraft Heinz Company, Snatch, ransomware
121	14/12/2023	-	-	Storm-0539,	Organizations in the retail space	Researchers from Microsoft observe a significant surge in activity associated with the threat actor Storm-0539, known to target retail organizations for gift card fraud and theft using highly sophisticated email and SMS phishing during the holiday shopping season.	Account Takeover	Wholesale and retail	Cyber Crime	>1		Microsoft, Storm-0539
122	14/12/2023	Since mid-2022	'Recently'	China	Individuals worldwide	The Australian Strategic Policy Institute (ASPI) reveals the details of 'Shadow Play,' a new influence campaign pushing pro-China and anti-United States narratives on at least 30 YouTube channels.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	>1		Australian Strategic Policy Institute, ASPI, Shadow Play, YouTube
123	14/12/2023	Since 2022	-	APT34 a.k.a. OilRig	Organizations in israel	Researchers from ESET discover a new campaign from the APT34 cyber-espionage group linked to the Iranian government against organizations in Israel and leveraging several new malware downloaders: ODAgent, OilCheck and OilBooster.	Targeted Attack	Multiple Industries	Cyber Espionage	IL		ESET, APT34, OilRig, Iran, Israel, ODAgent, OilCheck, OilBooster
124	14/12/2023	Since September 2023	Since September 2023	GambleForce	20 victims primarily located in Australia, China, Indonesia, the Philippines, India, South Korea, Thailand, and Brazil.	Researchers from Group-IB uncover GambleForce, a previously unknown group that uses simple and dated attack methods to target governments and businesses in the Asia-Pacific region.	SQLi	Multiple Industries	Cyber Crime	AU BR CN ID KR PH TH		Group-IB, GambleForce
125	14/12/2023	-	-	Chinese Threat Actors	United States Postal Service (USPS) users	Researchers from Uptycs uncover a phishing campaign targeting the United States Postal Service (USPS) with more than 1,400 live phishing websites discovered globally, potentially linked to Chinese threat actors.	Account Takeover	Individual	Cyber Crime	US		Uptycs, United States Postal Service, USPS, China
126	14/12/2023	Since May 2021	Since May 2021	Multiple threat actors	Crypto users	Researchers from Chainalysis reveal that threat actors have been leveraging approval phishing scams to steal at least $1BN in cryptocurrency since May 2021 ($374M so far in 2023.)	Crypto Scam	Fintech	Cyber Crime	>1		Chainalysis, approval phishing, crypto
127	14/12/2023	Since 2022	During 2023	TA402 a.k.a. Molerats, Gaza Cybergang, Frankenstein, WIRTE	Organizations in Palestine	Researchers from SentinelOne discover a new campaign by the pro-Hamas threat actor known as Gaza Cybergang, targeting Palestinian entities using Pierogi++, an updated version of a backdoor dubbed Pierogi.	Targeted Attack	Multiple Industries	Cyber Espionage	PS		SentinelOne, Palestine, Gaza Cybergang, Pierogi++, Pierogi, TA402, Molerats, Frankenstein, WIRTE
128	14/12/2023	SInce end of September 2023	SInce end of September 2023	8220 gang	Multiple organizations	Researchers from Imperva detect previously undocumented activity from the 8220 gang, exploiting the CVE-2020-14883, Remote Code Execution vulnerability in Oracle WebLogic Server.	CVE-2020-14883 Vulnerability	Multiple Industries	Cyber Crime	>1		Imperva, 8220, CVE-2020-14883, Remote Code Execution, Oracle WebLogic Server
129	14/12/2023	11/11/2023	11/11/2023	?	Asper Biogene	Personal and health data belonging to approximately 10,000 people is illegally downloaded from the genetic testing company Asper Biogene’s database.	Unknown	Human health and social work	Cyber Crime	EE		Asper Biogene
130	14/12/2023	Since at least 19/06/2023	Since at least 19/06/2023	?	Multiple organizations	Researchers from Mandiant identify an UNC2975 malvertising campaign presented to users in sponsored search engine results and social media posts, distributing DarkGate and Danabot.	Malware	Multiple Industries	Cyber Crime	>1		Mandiant, UNC2975, malvertising, DarkGate, Danabot
131	14/12/2023	02/05/2024	16/05/2024	?	Talus Pay	AMCP Payments Intermediate Company d/b/a Talus Pay files a notice of data breach after discovering that an unauthorized party had gained access to an employee email account.	Account Takeover	Professional, scientific and technical	Cyber Crime	US		AMCP Payments Intermediate Company, Talus Pay
132	14/12/2023	-	04/12/2023	Qilin	Neurology Center of Nevada	Neurology Center of Nevada is allegedly attacked by the Qilin ransomware gang.	Malware	Human health and social work	Cyber Crime	US		Neurology Center of Nevada, Qilin, ransomware
133	14/12/2023	10/12/2023	10/12/2023	?	EasyPark	Parking app developer EasyPark publishes a notice on its website warning of a data breach it discovered on December 10, 2023, which impacts an unknown number of its millions of users.	Unknown	Professional, scientific and technical	Cyber Crime	SE		EasyPark
134	15/12/2023	13/12/2023	13/12/2023	?	VF Corporation	American global apparel and footwear giant VF Corporation, the owner of brands like Supreme, Vans, Timberland, and The North Face, discloses a security incident that caused operational disruptions.	Unknown	Manufacturing	Cyber Crime	US		VF Corporation, Supreme, Vans, Timberland, The North Face
135	15/12/2023	Since at least July 2023	During July 2023	8Base	Publicly-traded Financial Services Firms	Researchers from Resecurity discover a joint extortion campaign where the BianLian, White Rabbit, and Mario ransomware gangs are collaborating targeting publicly-traded financial services firms.	Password spraying	Finance and insurance	Cyber Crime	>1		Resecurity, BianLian, White Rabbit, Mario, ransomware
136	15/12/2023	SInce mid-December 2023	SInce mid-December 2023	?	Multiple organizations	Researchers from Malwarebytes discover a new malvertising campaign delivering the PikaBot malware via malicious search ads.	Malware	Multiple Industries	Cyber Crime	>1		Malwarebytes, PikaBot, malicious search ads
137	15/12/2023	15/11/2023	15/11/2023	?	Newfound Area School District	Newfound Area School District is recovering from a ransomware attack.	Malware	Education	Cyber Crime	US		Newfound Area School District, ransomware
138	15/12/2023	-	-	Sidewinder (a.k.a. Rattlesnake, BabyElephant, APT Q4, APT Q39, Hardcore Nationalist, HN2, RAZOR Tiger, and GroupA21)	Nepalese government officials	Researchers from Cyfirma discover a malicious campaign by the threat actor known as Sidewinder targeting Nepalese government officials via the Nim backdoor.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	NP		Sidewinder, Rattlesnake, BabyElephant, APT Q4, APT Q39, Hardcore Nationalist, HN2, RAZOR Tiger, GroupA21, Cyfirma, Nepal, Nim
139	15/12/2023	25/10/2023	13/11/2023	?	Kahua	Kahua files a notice of data breach after discovering that the company had fallen victim to a ransomware attack.	Malware	Professional, scientific and technical	Cyber Crime	US		Kahua
140	15/12/2023	-	28/04/2023	?	Coos Health & Wellness	Coos Health & Wellness (CHW) discloses a security breach ùthat may have involved personal and protected health information belonging to individuals who received services at various programs that CHW supports.	Unknown	Human health and social work	Cyber Crime	US		Coos Health & Wellness, CHW
ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags

Creating the timelines is a very time-consuming task.

Any little helps!

No Data Found

The “Breachometer” compares the current number of events/day with the max and min values recorded in the previous 12 months.

October 2026 Cyber Attacks Timeline
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Mega Breaches in 2026
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
Rogue AI Agents
AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new ...
List Of Hacked Celebrities Who Had (Nude) Photos Leaked
During Summer we always try to spend our free time in a more profitable manner, for instance reading gossip chronicles. From this point of view, July 2012 has not been a particularly lucky month for Carly Rae Jepsen. On July the 7th, her website has been ...
September 2026 Cyber Attacks Statistics
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...