In terms of mega breaches, this fortnight AT&T was hit hard, confirming a breach carried out simultaneously by two threat actors who put on sale 71 million records allegedly stolen in 2021. Other organizations hit by massive breaches include Giant Tiger (2.8 million), the Pakistan National Database and Registration Authority (Nadra – 2.7 million), and MediaWorks (2.4 million).

The fintech sector continued to be particularly targeted by cyber criminals. The most curious case is the one related to Munchables, a blockchain-based game, which (sort of) lost about $62 million worth of cryptocurrency that were returned few hours later. Unfortunately other platform like Curio ($16M losses) and Prisma Finance ($11M losses) were not so lucky.

And multiple campaigns were also uncovered in the cyber espionage front carried out by threat actors from North Korea (Kimsuky), Russia (APT29, one in particular targeting political parties in Germany), Iran (MuddyWater) and China (UNC5174 and UNC302 very busy in exploiting vulnerabilities at scale, Mustang Panda, and Earth Krahang).

Russian forces were also particularly active in the cyber warfare space: multiple service providers in Ukraine were taken down by threat actors affiliated to Russia, threat actors affiliated to Russia (and in particular, linked to Yevgeniy Prigozhin) were also behind some disinformation campaigns active also the death of the leader of the Wagner, and finally a new wiper malware named AcidPour was discovered.

For the details, feel free to browse the timeline, and obviously share it to support my work in spreading the risk awareness across the community. And don’t forget to follow @paulsparrows on X (formerly Twitter,) or even connect on Linkedin, or Mastodon for the latest updates.