16-30 April 2024 Cyber Attacks Timeline

Last modified: July 30, 2024

Follow me on X

Connect on Linkedin

Connect on Mastodon

EVENTS

EVENTS/DAY

EVENTS

EVENTS/DAY

Motivations April H2 2024

Attack Techniques April H2 2024

In the second timeline of April 2024 I collected 107 events (7.13 events/day). And despite malware continued to dominate the threat landscape, but with a percentage (18.9%) lower than the previous fortnight (26.3%), the higher step of the podium is shared with ransomware with the same value, quite close to the one recorded in the first half of the month (19.6%).

Targeted attacks jumped at number three with 13.2%, ahead of the exploitation of account takeovers (11.3%) and the exploitation of vulnerabilities that slid at 8.5%.

Rogue AI Agents

AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a

In terms of mega breaches there were several organizations hit by massive leaks, such as the Bağcılar Training and Research Hospital in Turkey, an undisclosed Singapore-based firm (5.3 million records), Financial Business and Consumer Solutions (nearly 2 million records), Berry, Dunn, McNeil & Parker (1 million records).

Hedgey Finance is the fintech platform that suffered the most, being hit with a couple of exploits that led to a combined loss of $44.7 million worth of crypto assets.

In terms of Cyber Espionage, threat actors backed by the Russian government were particularly active in Ukraine (Sandworm and APT28), but also threat actors from North Korea (Kimsuky, Lazarus and Andariel) were quite busy. Another interesting event includes an attack against Mitre Corporation carried out exploiting the Ivanti vulnerabilities.

In terms of Hacktivism the temperature was particularly hot in Belarus, were hacktivists from the Belarusian Cyber-Partisans launched attacks against Grodno Azot, the country’s largest state-run manufacturer of fertilizers, and Belarus’ main security service agency (KGB).

For the details, feel free to browse the timeline, and obviously share it to support my work in spreading the risk awareness across the community. And don’t forget to follow @paulsparrows on X (formerly Twitter,) or even connect on Linkedin, or Mastodon for the latest updates.

Geo Map April H2 2024

No Data Found

ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags
1	16/04/2024	Since December 2023	Since December 2024	TA427, a.k.a. Emerald Sleet, APT43, THALLIUM or Kimsuky.	Foreign policy experts for insight into US and the Republic of Korea	Researchers from Proofpoint reveal the details of a campaign orchestrated by threat actors aligned with North Korea and targeting foreign policy experts for insight into US and the Republic of Korea.	Targeted Attack	Individual	Cyber Espionage	>1		TA427, Emerald Sleet, APT43, THALLIUM, Kimsuky, Proofpoint, North Korea
2	16/04/2024	Since early March 2024	Since early March 2024	Multiple threat actors	Multiple organizations	Researchers from Fortinet observe multiple botnets exploiting CVE-2023-1389, a vulnerability targeting TP-Link Archer AX21 (AX1800) routers.	CVE-2023-1389 Vulnerability	Multiple Industries	Cyber Crime	>1		Fortinet, CVE-2023-1389, TP-Link Archer AX21, AX1800
3	16/04/2024	Since February 2022	Since February 2022	Russia	Czech national railway operator České dráhy	Czech transport minister Martin Kupka warn that Russia conducted ‘thousands’ of attempts to sabotage railways, attempting to interfere with train networks and signals.	Unknown	Transportation and storage	Cyber Warfare	CZ		Martin Kupka, Russia, České dráhy
4	16/04/2024	Since at least 18/03/2024	16/04/2024	?	Multiple organizations	Researchers from Cisco Talos warn about a global surge in brute-force attacks targeting various devices, including Virtual Private Network (VPN) services, web application authentication interfaces, and SSH services.	Brute-force	Multiple Industries	Cyber Crime	>1		Cisco Talos, Virtual Private Network, VPN
5	16/04/2024	-	-	UAC-0184	Ukrainian armed forces	The Computer Emergency Team of Ukraine (CERT-UA) warns that threat actors from the group UAC-0184 are increasingly trying to plant data-stealing malware on messaging apps used by the Ukrainian armed forces.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	UA		Computer Emergency Team of Ukraine, CERT-UA, UAC-0184
6	16/04/2024	-	-	L00KUPRU	Multiple organizations	Researchers from Broadcom discover L00KUPRU, a new variant of the Xorist ransomware, encrypting user files with the .L00KUPRU extension.	Ransomware	Multiple Industries	Cyber Crime	>1		Broadcom, L00KUPRU, Xorist, Ransomware
7	16/04/2024	-	27/03/2024	8Base	United Nations Development Programme	The United Nations Development Programme (UNDP) investigates a cyberattack after threat actors breached its IT systems to steal human resources data. The 8Base ransomware operation claims responsibility for the attack.	Ransomware	Extraterritorial orgs and bodies	Cyber Crime	INT		United Nations Development Programme, UNDP, 8Base, ransomware
8	16/04/2024	-	-	?	Argentina's driver licenses	A threat actor allegedly hacks a database holding 5.7M Argentina’s driver’s licenses, requesting a payment of $3,000 USD for whoever wishes to purchase the images of Argentine licenses.	Unknown	Unknown	Cyber Crime	AR		Argentina's driver licenses
9	16/04/2024	Between 2017 and 2022	Between 2017 and 2022	?	Individuals in Poland	Poland’s national prosecutor Adam Bodnar declares that nearly 578 citizens were targeted with powerful commercial spyware Pegasus between 2017 and 2022.	Targeted Attack	Individual	Cyber Espionage	PL		Adam Bodnar, Pegasus
10	16/04/2024	-	15/04/2024	8Base	Atlantic States Marine Fisheries Commission	The Atlantic States Marine Fisheries Commission (ASMFC) suffers an 8Base ransomware attack.	Ransomware	Administration and support service	Cyber Crime	US		Atlantic States Marine Fisheries Commission, ASMFC, 8Base, ransomware
11	16/04/2024	21/12/2023	24/12/2023	?	Cherry Health Services	Cherry Health discloses a ransomware attack.	Ransomware	Human health and social work	Cyber Crime	US		Cherry Health, ransomware
12	16/04/2024	12/04/2024	-	?	Bağcılar Training and Research Hospital	A cyber attack on the Bağcılar Training and Research Hospital in Istanbul compromises the confidential medical records, including X-ray scans and test results, taken at the hospital since 2007. It is rumored that the attackers asked for 200,000 dollars in exchange for the medical records.	Ransomware	Human health and social work	Cyber Crime	TR		Bağcılar Training and Research Hospital, ransomware
13	16/04/2024	06/06/2023	09/04/2024	BlackByte	Kisco Senior Living	Kisco Senior Living discloses a BlackByte ransomware attack.	Ransomware	Human health and social work	Cyber Crime	US		Kisco Senior Living, BlackByte, ransomware
14	16/04/2024	-	15/04/2024	IntelBroker	Space-Eyes	“IntelBroker” claims to have breached Space-Eyes, a Miami-based geospatial intelligence firm.	Unknown	Professional, scientific and technical	Cyber Crime	US		IntelBroker, Space-Eyes
15	17/04/2024	-	-	Cerber (a.k.a C3RB3R)	Multiple organizations	Researchers from Cado Security reveal that threat actors are exploiting unpatched Atlassian servers to the CVE-2023-22518 vulnerability to deploy a Linux variant of Cerber (aka C3RB3R) ransomware.	CVE-2023-22518 Vulnerability	Multiple Industries	Cyber Crime	>1		Cado Security, Atlassian, CVE-2023-22518, Linux, Cerber, C3RB3R, ransomware
16	17/04/2024	Since at least mid-2022	Since at least mid-2022	Sandworm (a.k.a. BlackEnergy, Seashell Blizzard, Voodoo Bear, APT44)	Organizations across Ukraine, and Central and Eastern Europe	Researchers from WithSecure uncover Kapeka, a novel backdoor that has been used in attacks against victims in Eastern Europe since at least mid-2022.	Targeted Attack	Multiple Industries	Cyber Espionage	UA >1		Sandworm, WithSecure, Kapeka
17	17/04/2024	Since the beginning of April 2024	Since the beginning of April 2024	Chinese threat actors	Multiple organizations	Researchers from Microsoft warn that threat actors who appear to be Chinese are exploiting vulnerabilities in the OpenMetadata platform running as workloads on Kubernetes clusters to download cryptomining software onto the targeted systems.	CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254 Vulnerabilities	Multiple Industries	Cyber Crime	>1		Microsoft, China, OpenMetadata, Kubernetes, CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254
18	17/04/2024	Since March 2024	Since March 2024	?	Multiple organizations	Researchers from Zscaler observe a threat actor weaponizing a cluster of domains masquerading as legitimate IP scanner software sites to distribute "MadMxShell", a previously unseen backdoor.	Malvertising	Multiple Industries	Cyber Crime	>1		Zscaler, MadMxShell
19	17/04/2024	During late 2023	During late 2023	FIN7	Large U.S. car maker	Researchers from Blackberry reveal that the financially motivated threat actor FIN7 targeted a large U.S. car maker with spear-phishing emails for employees in the IT department to infect systems with the Anunak backdoor.	Malware	Manufacturing	Cyber Crime	US		Blackberry, FIN7, Anunak
20	17/04/2024	'Recently'	'Recently'	?	Banking users in South Korea	Researchers from Kaspersky discover SoumniBot, a new banking trojan targeting Korean users using obfuscation techniques targeting the Android operating system.	Malware	Finance and insurance	Cyber Crime	KR		Kaspersky, SoumniBot, Android
21	17/04/2024	'Recently'	'Recently'	?	LastPass users	LastPass warns of a malicious campaign targeting its users with the CryptoChameleon phishing kit.	Account Takeover	Multiple Industries	Cyber Crime	>1		LastPass, CryptoChameleon
22	17/04/2024	Since at least 2015	'Recently'	?	Government networks in Ukraine	Researchers from Cisco Talos reveal that select Ukrainian government networks have been infected with a malware called OfflRouter since 2015.	Targeted Attack	Public admin and defence, social security	N/A	UA		Cisco Talos, OfflRouter
23	17/04/2024	-	-	?	Individuals in multiple countries	Researchers from McAfee discover a new info-stealing malware linked to Redline posing as a game cheat called 'Cheat Lab,' promising downloaders a free copy if they convince their friends to install it too.	Malware	Individual	Cyber Crime	>1		McAfee, Redline, 'Cheat Lab'
24	17/04/2024	16/04/2024	16/04/2024	LockBit	Hospital Simone Veil in Cannes	The Hospital Simone Veil in Cannes (CHC-SV) announces that it was targeted by a cyberattack, severely impacting its operations and forcing staff to go back to pen and paper. The LockBit ransomware operation claims responsibility for the attack.	Ransomware	Human health and social work	Cyber Crime	FR		Hospital Simone Veil in Cannes, CHC-SV, LockBit, ransomware
25	17/04/2024	Since early April 2024	Since early April 2024	Israel?	Ogero	Lebanon's state internet provider Ogero comes under a 10-day cyber attack of suspected Israeli origin.	Unknown	Information and communication	Cyber Warfare	LB		Ogero, Israel
26	17/04/2024	'Over the last 45 days'	'Over the last 45 days'	Russia	United States	Researchers from Microsoft reveal that Russia’s disinformation operations around the U.S. elections have ramped up over the last month-and-a-half after a relatively slow start compared to previous cycles.	Coordinated Inauthentic Behavior	Individual	Cyber Warfare	US		Russia, U.S., Microsoft. U.S.Elections
27	17/04/2024	During January 2024	During January 2024	CyberArmyofRussia_Reborn	Muleshoe water facility	CyberArmyofRussia_Reborn, a group with ties to the Russian government is suspected of carrying out a cyberattack in the Muleshoe water facility that caused a tank at a Texas water facility to overflow.	Unknown	Water supply, waste mgmt, remediation	Cyber Warfare	US		CyberArmyofRussia_Reborn, Russia, Muleshoe Water Facility
28	17/04/2024	-	-	Threat actor with possible ties to Russia	Hale Center water facility	Threat actors try to unsuccessfully break into the town of Hale Center “firewall,” prompting the town to disable remote access to its SCADA system.	Unknown	Water supply, waste mgmt, remediation	Cyber Warfare	US		Hale Center, SCADA, Russia
29	17/04/2024	-	-	Threat actor with possible ties to Russia	Lockney water facility	Town officials in Lockney detect “suspicious activity” on the town’s SCADA system.	Unknown	Water supply, waste mgmt, remediation	Cyber Warfare	US		Lockney, SCADA, Russia
30	17/04/2024	-	-	?	Extern	Extern, a social justice charity, is hit with a ransomware attack.	Ransomware	Human health and social work	Cyber Crime	IE		Extern, ransomware
31	17/04/2024	-	15/04/2024	BlackSuit	The Post and Courier	The Post and Courier is hit with a BlackSuit ransomware attack.	Ransomware	Information and communication	Cyber Crime	US		Post and Courier, BlackSuit, Ransomware
32	17/04/2024	17/04/2024	17/04/2024	?	New York Bill Drafting Commission	The New York Bill Drafting Commission is taken down by a malware attack.	Malware	Public admin and defence, social security	Cyber Crime	US		New York Bill Drafting Commission
33	18/04/2024	18/04/2024	18/04/2024	?	Crypto users	A legitimate-looking Google Search advertisement for the crypto trading platform 'Whales Market' redirects visitors to a wallet-draining phishing site that steals all the crypto assets.	Account Takeover	Fintech	Cyber Crime	>1		Google Search, 'Whales Market'
34	18/04/2024	During February 2024	During February 2024	?	Government entities in the Middle East	Researchers from Kaspersky reveal the details of DuneQuixote, a previously undocumented campaign delivering a new backdoor dubbed CR4T.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	>1		Kaspersky, DuneQuixote, CR4T
35	18/04/2024	Since at least mid-March 2023	Mid-March 2023	?	Multiple organizations	Researchers from Perception Point discover a phishing campaign targeting users by exploiting an open redirect vulnerability from a domain belonging to coffee connoisseur, Nespresso.	Account Takeover	Multiple Industries	Cyber Crime	>1		Perception Point, Nespresso
36	18/04/2024	During Summer of 2023	During Summer of 2023	Lazarus	Individuals in the Asian region	Researchers from Avast uncover a new campaign by the North Korea-linked threat actor known as Lazarus Group employing fabricated job lures to deliver a new remote access trojan called Kaolin RAT, exploiting CVE-2024-21338, as part of attacks targeting specific individuals in the Asia region.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Avast, North Korea, Lazarus Group, Kaolin RAT, CVE-2024-21338
37	18/04/2024	14/04/2024	14/04/2024	RansomHub	Frontier Communications	American telecom provider Frontier Communications is hit by a cyberattack claimed by the RansomHub ransomware operation.	Ransomware	Information and communication	Cyber Crime	US		Frontier Communications, RansomHub, ransomware
38	18/04/2024	During March 2024	18/04/2024	GhostR	Undisclosed Singapore-based firm	GhostR, a financially motivated criminal group says it has stolen a confidential database containing 5.3 million of records that companies use for screening potential customers for links to sanctions and financial crime from World-Check.	Unknown	Unknown	Cyber Crime	SG		GhostR, World-Check
39	18/04/2024	-	13/04/2024	LockBit	Tyler Technologies?	The LockBit ransomware operation claims to have stolen data from the D.C. Department of Insurance, Securities and Banking (DISB), however the agencies denies the claims, and states that the leaked data is from a third-party technology provider.	Ransomware	Professional, scientific and technical	Cyber Crime	US		LockBit, ransomware, D.C. Department of Insurance, Securities and Banking, DISB, Tyler Technologies
40	18/04/2024	10/11/2023	11/03/2024	Hunters International	Blackstone Valley Community Health Care	Blackstone Valley Community Health Care discloses a Hunters International ransomware attack.	Ransomware	Human health and social work	Cyber Crime	US		Blackstone Valley Community Health Care, Hunters International
41	19/04/2024	During January 2024	-	state-backed threat actors	Mitre Corporation	The MITRE Corporation says that a state-backed threat actors breached its systems (MITRE's Networked Experimentation, Research, and Virtualization Environment - NERVE) in January 2024 by chaining the two Ivanti VPN zero-days CVE-2023-46805 and CVE-2024-21887.	CVE-2023-46805 and CVE-2024-21887 Vulnerabilities	Professional, scientific and technical	Cyber Espionage	US		MITRE Corporation, MITRE's Networked Experimentation, Research, and Virtualization Environment, NERVE, Ivanti, CVE-2023-46805, CVE-2024-21887
42	19/04/2024	-	-	?	Unknown organization(s)	CrushFTP warns customers in a private memo of CVE-2024-4040, an actively exploited zero-day vulnerability fixed in new versions released today, urging them to patch their servers immediately. Few days lated the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the vulnerability to its catalog of exploited vulnerabilities.	CVE-2024-4040 Vulnerability	Unknown	N/A	N/A		CrushFTP, CVE-2024-4040
43	19/04/2024	10/04/2024	12/04/2024	?	Multiple organizations	Researchers from Fortinet discover a malicious PyPI package named discordpy_bypass-1.7.	Malware	Multiple Industries	Cyber Crime	>1		Fortinet, PyPI, discordpy_bypass-1.7
44	19/04/2024	-	-	Sandworm (a.k.a. BlackEnergy, Seashell Blizzard, Voodoo Bear, APT44, UAC-0133)	20 critical infrastructures in Ukraine	The Ukraine Computer Emergency Response Team (CERT-UA) reveal that the Russian group Sandworm aimed to disrupt operations at around 20 critical infrastructure facilities in Ukraine.	Targeted Attack	Electricity, gas steam, air conditioning	Cyber Warfare	UA		Sandworm, BlackEnergy, Seashell Blizzard, Voodoo Bear, APT44, UAC-0133, Ukraine Computer Emergency Response Team, CERT-UA
45	19/04/2024	Mid-April 2024	Mid-April 2024	?	Individuals actively seeking out child pornography	A new malware campaign is targeting individuals who actively seek out child pornography via a malicious executable called 'CryptVPN'.	Malware	Individual	Cyber Crime	>1		CryptVPN
46	19/04/2024	18/04/2024	18/04/2024	BlackBasta	Synlab Italia	Synlab Italia suspends all its medical diagnostic and testing services after a ransomware attack forced its IT systems to be taken offline. The BlackBasta ransomware gang claims responsibility for the attack.	Ransomware	Human health and social work	Cyber Crime	IT		Synlab Italia, BlackBasta, Ransomware
47	19/04/2024	-	-	?	Mobile Guardian	The names and e-mail addresses of parents and teachers of 127 primary and secondary schools are leaked after Mobile Guardian, a mobile platform on students’ personal learning devices is hacked.	Unknown	Human health and social work	Cyber Crime	SG		Mobile Guardian
48	19/04/2024	29/07/2023	01/08/2023	?	Valley Mountain Regional Center	Valley Mountain Regional Center discloses a breach.	Unknown	Human health and social work	Cyber Crime	US		Valley Mountain Regional Center
49	19/04/2024	19/04/2024	19/04/2024	?	Hedgey Finance	Token infrastructure platform Hedgey Finance undergoes two simultaneous exploits that resulted in a combined loss of $44.7 million	Vulnerability	Fintech	Cyber Crime	US		Hedgey Finance
50	20/04/2024	Between 2011 and 2014	Between 2011 and 2014	Threat actors with ties to the Chinese government	Volkswagen	Threat actors associated with the Chinese government are believed to have hacked into Volkswagen systems in an effort to steal valuable data between 2011 and 2014.	Targeted Attack	Manufacturing	Cyber Espionage	DE		China, Volkswagen
51	20/04/2024	-	-	LockBit	Union Hospital	The Union Hospital in Hong Kong is hit with an alleged LockBit ransomware attack.	Ransomware	Human health and social work	Cyber Crime	HK		Union Hospital, LockBit, Ransomware
52	22/04/2024	-	17/04/2024	?	Users from the gamers' community	Researchers from G Data discover "Sharp Stealer", an infostealer focused on the gamers' community.	Malware	Arts entertainment, recreation	Cyber Crime	>1		G Data, "Sharp Stealer"
53	22/04/2024	Since November 2023	Since November 2023	?	Toncoin users	Researchers from Kaspersky reveal that scammers have been observed employing a sophisticated tactic to steal Toncoins (TON) from Telegram users globally.	Scam	Fintech	Cyber Crime	>1		Kaspersky, Toncoins, TON, Telegram
54	22/04/2024	Since at least June 2020 and possibly as early as April 2019	-	APT28 (a.k.a. Strontium, Forest Blizzard)	Ukrainian, Western European and North American government, non-governmental, education and transportation sector organizations	Researchers from Microsoft reveal that the notorious Russian APT28 group has been stealing credentials for years by exploiting the CVE-2022-38028 Windows Print Spooler bug and using a novel post-compromise tool known as “GooseEgg.”	CVE-2022-38028 Vulnerability	Multiple Industries	Cyber Espionage	UA >1		APT28, Strontium, Forest Blizzard, Microsoft, APT28, CVE-2022-38028, Windows Print Spooler, GooseEgg
55	22/04/2024	-	-	?	Individuals in South Korea	Researchers from AhnLab discover a campaign distributing phishing files identical to Korean portal website login screens.	Account Takeover	Individual	Cyber Crime	KR		AhnLab
56	22/04/2024	During Q1 2024	During Q1 2024	TA427, a.k.a. Emerald Sleet, APT43, THALLIUM or Kimsuky.	Multiple organizations in South Korea	Researchers from Genians uncover a campaign by APT43 exploiting Dropbox to evade detection.	Targeted Attack	Multiple Industries	Cyber Espionage	KR		TA427, Emerald Sleet, APT43, THALLIUM, Kimsuky, Dropbox
57	22/04/2024	-	17/04/2024	Belarusian Cyber-Partisans	Grodno Azot	Belarusian politically motivated hacktivists from the Belarusian Cyber-Partisans group claim to have attacked the country’s largest state-run manufacturer of fertilizers, Grodno Azot, for its alleged involvement in political repression, sanctions evasion, and human rights violations.	Unknown	Manufacturing	Hacktivism	BY		Belarus, Belarusian Cyber-Partisans, Grodno Azot
58	22/04/2024	Since at least 2020	Since at least 2020	ToddyCat	Government organizations in the Asia-Pacific region	Researchers from Kaspersky reveal the details of the latest campaign by the ToddyCat threat actors stealing “large volumes of data,” primarily from governmental targets in the Asia-Pacific region.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	>1		Kaspersky, ToddyCat, Asia-Pacific
59	22/04/2024	22/03/2024	22/03/2024	LockBit	Medios de Prevención Externos Sur SL	Medios de Prevención Externos Sur SL, a medical company servicing Spain's Guardia Civil, is hit with a LockBit ransomware attack.	Ransomware	Human health and social work	Cyber Crime	ES		Medios de Prevención Externos Sur SL, Guardia Civil, LockBit, ransomware
60	22/04/2024	20/06/2023	06/03/2024	?	Lamont Hanley & Associates	Almost 2,800 patients at Catholic Medical Center may have had their files containing personal and health information exposed in a third-party "data security incident" occurred to Lamont Hanley & Associates.	Account Takeover	Administration and support service	Cyber Crime	US		Catholic Medical Center, Lamont Hanley & Associates
61	23/04/2024	Since at least 2018.	-	Threat actor with possible ties to Kimsuky	Multiple organizations	Researchers from Avast uncover a campaign where North Korean threat actors have been exploiting the updating mechanism of the eScan antivirus to plant backdoors on big corporate networks and deliver cryptocurrency miners through GuptiMiner malware.	Malware	Multiple Industries	Cyber Crime	>1		Kimsuky, Avast, North Korea, GuptiMiner
62	23/04/2024	Since at least February 2024	Since at least February 2024	CoralRaider	Organizations in multiple countries, including the U.S., Nigeria, Pakistan, Ecuador, Germany, Egypt, the U.K., Poland, the Philippines, Norway, Japan, Syria and Turkey	Researchers from Cisco Talos discover a new ongoing malware campaign distributing three different stealers, such as CryptBot, LummaC2, and Rhadamanthys hosted on Content Delivery Network (CDN) cache domains.	Malware	Multiple Industries	Cyber Crime	DE EC EG GB JP NG NO PH PK PL SY TR US		CoralRaider, Cisco Talos, CryptBot, LummaC2, Rhadamanthys, CDN
63	23/04/2024	Between October 2022 and July 2023	Between October 2022 and July 2023	Lazarus, Kimsuky and Andariel.	83 defense contractors in South Korea	The Korean National Police Agency (KNPA) reveal the details of a major campaign carried out by threat actors from North Korea, and targeting as many as 83 defense contractors and subcontractors, 10 of which had sensitive information stolen.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	KR		Lazarus, Kimsuky, Andariel, Korean National Police Agency, KNPA, North Korea, South Korea
64	23/04/2024	23/04/2024	23/04/2024	?	Czech News Agency (CTK)	An unidentified threat actor hacks the website of Czech News Agency (CTK) a government-owned Czech news service, and publishes a fake story claiming that an assassination attempt had been made against the newly elected Slovak president, Petr Pellegrini.	Unknown	Information and communication	Cyber Crime	CZ		Czech News Agency, CTK, Petr Pellegrini, Slovakia
65	23/04/2024	-	-	?	Facebook users	Researchers from Malwarebytes uncover a malicious ad campaign targeting Facebook users via Google search.	Malvertising	Individual	Cyber Crime	>1		Malwarebytes, Facebook, Google
66	23/04/2024	15/04/2024	15/04/2024	?	Meduza	The Russian independent news website Meduza faces repeated attempts to disrupt its digital infrastructure.	DDoS	Information and communication	Cyber Crime	RU		Meduza, Russia
67	23/04/2024	-	-	?	Multiple organizations	Researchers from SonicWall discover a malware campaign using a VBA macro in a Word document to download and execute a 64-bit Rust binary. This binary employs fileless injection techniques to load a malicious AgentTesla payload.	Malware	Multiple Industries	Cyber Crime	>1		SonicWall, AgentTesla, VBA
68	23/04/2024	-	-	?	Skanlog	Skanlog, the Swedish logistics company that works with Sweden’s alcohol retail monopoly Systembolagethas, is hit with a ransomware attacks and prompts warnings from the country’s sole liquor retailer that its top shelves in stores around the country may be empty by the end of the week.	Ransomware	Transportation and storage	Cyber Crime	SE		Skanlog, Systembolagethas, ransomware
69	23/04/2024	-	20/04/2024	Cyber Army of Russia	Tipton Wastewater Treatment Plant	The Cyber Army of Russia claims responsibility for a cyber attack to the Tipton Wastewater Treatment Plant.	Unknown	Water supply, waste mgmt, remediation	Hacktivism	US		Cyber Army of Russia, Tipton Wastewater Treatment Plant
70	23/04/2024	During February 2024	During February 2024	?	Lincoln Project	The anti-Donald Trump super PAC Lincoln Project discloses to have lost $35,000 to a business email compromise (BEC) scam.	Business Email Compromise	Other service activities	Cyber Crime	US		Donald Trump, Lincoln Project
71	23/04/2024	-	-	CiberInteligenciaSV	Chivo	The threat group CiberInteligenciaSV releases what it says is sensitive information linked to El Salvador's state-operated bitcoin wallet Chivo, releasing source code on the criminal forum BreachForums.	Unknown	Fintech	Cyber Crime	SV		CiberInteligenciaSV, Chivo, BreachForums
72	24/04/2024	Since November 2023	Early 2024	UAT4356 a.k.a. STORM-1849	Government networks worldwide	Cisco warns about ArcaneDoor, a campaign where a state-backed group tracked as UAT4356 has been exploiting two zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls to breach government networks worldwide via two malware implants dubbed Line Dancer, and Line Runner.	CVE-2024-20353 and CVE-2024-20359 Vulnerabilities	Public admin and defence, social security	Cyber Espionage	>1		UAT4356, STORM-1849,Cisco, ArcaneDoor, CVE-2024-20353, CVE-2024-20359, Adaptive Security Appliance, ASA, Firepower Threat Defense, FTD, Line Dancer, Line Runner
73	24/04/2024	'Recently''	'Recently''	?	Multiple organizations	Researchers from Zscaler discover a significant number of websites associated with fraudulent activities being hosted on popular web hosting and blogging platforms, distributing malware via SEO poisoning.	Malware	Multiple Industries	Cyber Crime	>1		Zscaler, SEO poisoning
74	24/04/2024	'Recently''	'Recently''	?	Multiple organizations	Researchers from WPScan reveal that threat actors are attempting to actively exploit CVE-2024-27956, a critical security flaw in the ValvePress Automatic plugin for WordPress that could allow site takeovers.	CVE-2024-27956 Vulnerability	Multiple Industries	Cyber Crime	>1		WPScan, CVE-2024-27956, ValvePress Automatic, WordPress
75	24/04/2024	-	-	?	Multiple organizations	Researchers from Netcraft discover a campaign where threat actors are using compromised email accounts to send phishing emails containing links to PDF files hosted on Autodesk Drive.	Account Takeover	Multiple Industries	Cyber Crime	>1		Netcraft, Autodesk Drive
76	24/04/2024	-	-	?	Multiple organizations	Researchers from AhnLab discover an Infostealer strain made with Electron.	Malware	Multiple Industries	Cyber Crime	>1		AhnLab, Electron
77	24/04/2024	17/04/2024	17/04/2024	BlackSuit	Octapharma	The plasma donation company Octapharma suffers a BlackSuit ransomware attack.	Ransomware	Human health and social work	Cyber Crime	CH		Octapharma, BlackSuit, Ransomware
78	24/04/2024	15/04/2024	-	Medusa	Northeast Ohio Neighborhood Health	The Medusa ransomware group claims responsibility for a cyberattack on the servers of Northeast Ohio Neighborhood Health (NEON), a company providing healthcare services, and the exfiltration of nearly 51GB of data.	Ransomware	Human health and social work	Cyber Crime	US		Northeast Ohio Neighborhood Health, NEON, Ransomware
79	24/04/2024	-	-	?	Organizations in the education and government sectors in the U.S.	Researchers from Veriti discover a campaign targeting the education and government sectors in the U.S. through the Agent Tesla and Taskun malware.	Malware	Multiple Industries	Cyber Crime	US		Veriti, Agent Tesla, Taskun
80	24/04/2024	-	-	?	Multiple organizations	Researchers from Securonix reveal the details of FROZEN#SHADOW, an ongoing campaign that's leveraging phishing emails to deliver the SSLoad malware.	Malware	Multiple Industries	Cyber Crime	>1		Securonix, FROZEN#SHADOW, SSLoad
81	25/04/2024	-	-	?	Android users	Researchers from ThreatFabric discover a new Android banking trojan named Brokewell that can capture every event on the device, from touches and information displayed to text input and the applications the user launches.	Malware	Individual	Cyber Crime	>1		ThreatFabric, Android, Brokewell
82	25/04/2024	Toward the end of 2023	Toward the end of 2023	?	Government entities in Ukraine	Researchers from Deep Instinct reveal that an unknown threat actor targeted government entities in Ukraine toward the end of 2023 using an old Microsoft Office remote code execution (RCE) exploit from 2017 (CVE-2017-8570) as the initial vector and military vehicles as the lure.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	UA		Deep Instinct, Ukraine, Microsoft Office, Remote Code Execution, RCE, CVE-2017-8570
83	25/04/2024	-	-	?	Users of dating websites and applications in the U.S.	The FBI publishes a warning about cyber criminals taking advantage of people’s fears about online dating by getting them to download fake “verification” sites that allow them to steal information and money.	Account Takeover	Individual	Cyber Crime	US		FBI, online dating
84	25/04/2024	During the 2023 holiday season	During the 2023 holiday season	?	Individuals in the U.S.	Researchers from Akamai uncover a significant amount of highly likely malicious activity and domains purporting to be associated with the United States Postal Service (USPS).	Account Takeover	Individual	Cyber Crime	US		Akamai, United States Postal Service, USPS
85	25/04/2024	-	-	Belarusian Cyber-Partisans	Belarus’ main security service agency (KGB)	The website of Belarus’ main security service agency (KGB) has reportedly been down for two months following a cyberattack by Belarusian politically motivated threat actors.	Unknown	Public admin and defence, social security	Hacktivism	BY		Belarusian Cyber-Partisans, KGB
86	25/04/2024	Since late March 2024	Since late March 2024	KageNoHitobito	Organizations in Chile, China, Cuba, Germany, Iran, Lithuania, Peru, Romania, Sweden, Taiwan, the United Kingdom, and the United States	Researchers from Fortinet reveal the details of KageNoHitobito, a new ransomware strain targeting Windows users across various countries.	Ransomware	Multiple Industries	Cyber Crime	CL CN CU DE GB IR LT PE RO SE TW US		Fortinet, KageNoHitobito, ransomware, Windows
87	25/04/2024	19/02/2024	-	?	Los Angeles County Department of Health Services	The Los Angeles County Department of Health Services discloses a data breach after thousands of patients' personal and health information was exposed in a phishing attack impacting over two dozen employees.	Account Takeover	Human health and social work	Cyber Crime	US		Los Angeles County Department of Health Services
88	25/04/2024	12/09/2023	02/04/2024	?	Berry, Dunn, McNeil & Parker	Berry, Dunn, McNeil & Parker, a consulting firm with a medical data analytics business notifies more than 1 million individuals that threat actors stole their information from company servers.	Unknown	Professional, scientific and technical	Cyber Crime	US		Berry, Dunn, McNeil & Parker
89	26/04/2024	14/02/2024	26/02/2024	?	Financial Business and Consumer Solutions	Financial Business and Consumer Solutions (FBCS) warns initially 1,955,385 impacted individuals in the United States that the company suffered a data breach after discovering unauthorized access to specific systems in its network. One month later the company says over 3.2 million people have been impacted.	Unknown	Finance and insurance	Cyber Crime	US		Financial Business and Consumer Solutions, FBCS
90	26/04/2024	01/03/2024	09/02/2024	?	California Statewide Automated Welfare System	The California Statewide Automated Welfare System discloses that more than 19,000 online accounts may have been accessed by threat actors for nearly a year.	Account Takeover	Human health and social work	Cyber Crime	US		California Statewide Automated Welfare System
91	26/04/2024	18/01/2024	13/03/2024	?	Designed Receivable Solutions	Designed Receivable Solutions (DRS), confirms the details of a data breach affecting 585,204 individuals.	Unknown	Professional, scientific and technical	Cyber Crime	US		Designed Receivable Solutions, DRS
92	26/04/2024	15/04/2024	15/04/2024	?	Coffee County	Coffee County is hit with a cyber attack.	Unknown	Public admin and defence, social security	Cyber Crime	US		Coffee County
93	27/04/2024	-	-	North Korean threat actors	Developers in multiple countries	Researchers from Securonix uncover a new ongoing social engineering attack campaign, tracked as DEV#POPPER, likely associated with North Korean threat actors, targeting developers using fake interviews to deliver a Python-based RAT.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Securonix, DEV#POPPER, North Korea
94	27/04/2024	From 19/04/2024 to 26/04/2024	From 19/04/2024 to 26/04/2024	?	Multiple organizations	Researchers from Okta observe a spike in credential stuffing activity against user accounts of online services.	Account Takeover	Multiple Industries	Cyber Crime	>1		Okta
95	28/04/2024	28/04/2024	28/04/2024	LockBit	London Drugs	Canadian pharmacy chain London Drugs closes all its retail stores to contain what it described as a "cybersecurity incident." One month later the LockBit ransomware operation claims responsibility for the attack.	Ransomware	Human health and social work	Cyber Crime	CA		London Drugs, LockBit, ransomware
96	29/04/2024	'Recently'	'Recently'	?	Multiple organizations	Researchers from McAfee uncover a novel infection chain associated with DarkGate malware, commencing with an HTML-based entry point and progressing exploiting the AutoHotkey utility in its subsequent stages.	Malware	Multiple Industries	Cyber Crime	>1		McAfee, DarkGate, HTML, AutoHotkey
97	29/04/2024	Since October 2019	During September 2023	Muddling Meerkat	Multiple organizations	Researchers from Infoblox discover a new cluster of activity tracked as "Muddling Meerkat", believed to be linked to a Chinese state-sponsored threat actor's manipulation of DNS to probe networks globally.	DNS Manipulation	Multiple Industries	N/A	>1		Infoblox, Muddling Meerkat, China, DNS
98	29/04/2024	18/04/2024	Between 18/04/2024 and 22/04/2024	?	Android users	Researchers from QAX discover a new Android backdoor malware named 'Wpeeper' in at least two unofficial app stores mimicking the Uptodown App Store, a popular third-party app store for Android devices with over 220 million downloads. The malware uses compromised WordPress sites to act as relays for its actual command and control (C2) servers, acting as an evasion mechanism.	Malware	Individual	Cyber Crime	N/A		QAX, Android, Wpeeper, Uptodown App Store, WordPress
99	29/04/2024	-	-	?	Android users	Researchers from SonicWall discover malicious Android apps masquerading as Google, Instagram, Snapchat, WhatsApp, and X (formerly Twitter) aimed to steal users' credentials from compromised devices.	Malware	Individual	Cyber Crime	>1		SonicWall, Android, Google, Instagram, Snapchat, WhatsApp, X, Twitter
100	29/04/2024	-	-	?	Multiple organizations	Researchers from Inky discover a phishing campaign using Rich Text Format (RTF) attachment files to harvest Microsoft credentials.	Account Takeover	Multiple Industries	Cyber Crime	>1		Inky, Rich Text Format, RTF, Microsoft
101	29/04/2024	26/04/2024	26/04/2024	Ukraine’s military intelligence agency, the GUR	United Russia	Ukraine’s military intelligence agency, the GUR, launches a DDoS attack against the website of Russia's ruling party United Russia.	DDoS	Other service activities	Cyber Warfare	RU		Ukraine, GUR, United Russia
102	29/04/2024	25/04/2024	25/04/2024	?	Kansas City Scout System	The Kansas City Scout System is taken down by a cyberattack.	Unknown	Transportation and storage	Cyber Crime	US		Kansas City Scout System
103	29/04/2024	During April 2024	During April 2024	Russia	Estonia and Lithuania	State officials from Lithuania and Estonia blame Russia for GPS jamming of commercial flights.	GPS Jamming	Transportation and storage	Cyber Warfare	EE LT		Lithuania, Estonia, Russia, GPS
104	30/04/2024	Since 2021	Since 2021	?	Multiple organizations	Security researchers at JFrog identify three large-scale campaigns targeting Docker Hub with repositories that did not contain container images but featured malicious metadata instead.	Malware	Multiple Industries	Cyber Crime	>1		JFrog, Docker Hub
105	30/04/2024	-	-	?	Multiple organizations	A new campaign distributes the Latrodectus (a.k.a. Unidentified 111 and IceNova) malware using Microsoft Azure and Cloudflare lures to appear legitimate.	Malware	Multiple Industries	Cyber Crime	>1		Latrodectus, Unidentified 111, IceNova, Microsoft Azure, Cloudflare
106	30/04/2024	07/03/2024	10/03/2024	?	Panda Restaurant Group	Panda Restaurant Group discloses a data breach after threat actors compromised its corporate systems and stole the personal information of an undisclosed number of associates.	Unknown	Accommodation and food service	Cyber Crime	US		Panda Restaurant Group
107	30/04/2024	Since at least 24/04/2024	24/04/2024	?	Multiple organizations	Researchers from Kanji discover Cuckoo, a new information stealer targeting Apple macOS systems that's designed to set up persistence on the infected hosts and act as a spyware.	Malware	Multiple Industries	Cyber Crime	>1		Kanji, Cuckoo, Mac
ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags

Creating the timelines is a very time-consuming task.

Any little helps!

CVEs Targeting Remote Access Technologies

In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.

October 2026 Cyber Attacks Timeline
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Rogue AI Agents
AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new ...
September 2026 Cyber Attacks Timeline
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
Mega Breaches in 2026
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
September 2026 Cyber Attacks Statistics Infographic
September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%. Malware led the techniques with 53 campaigns, ahead of Remote Code Execution with 32. More than a quarter of breaches started with an exploited public-facing ...