16-31 July 2024 Cyber Attacks Timeline

Last modified: October 24, 2024

Follow me on X

Connect on Linkedin

Connect on Mastodon

EVENTS

EVENTS/DAY

EVENTS

EVENTS/DAY

Motivations July H2 2024

Attack Techniques July H2 2024

In the second timeline of July 2024 I collected 116 events (7.25 events/day) with a threat landscape dominated by malware with 27.7% ahead of targeted attacks (15.1%) and the exploitation of vulnerabilities (11.8%). It is interesting to notice the drop of ransomware (“only” at number four with 10.1%).

Cyber crime led the motivations with 66.7%, nearly eight points less than the previous timeline, when it was 74.3%, and once again ahead of cyber espionage up to 16.7% from 14.9% of the previous timeline. It is also interested to note the 5% of events characterized by hacktivism.

Besides these trends, as always the timeline is rich of interesting events, such as mega breaches, and attacks against organizations in the fintech space, so my final suggestion does not change.

September 2026 Cyber Attacks Statistics Infographic

September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%.

Feel free to share it to support my work and spread the risk awareness across the community. And last but not least, don’t forget to follow @paulsparrows on X (formerly Twitter), or even connect on Linkedin, or Mastodon for the latest updates.

Geo Map July H2 2024

No Data Found

ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags
1	16/07/2024	Between June 2023 and June 2024	Between June 2023 and June 2024	?	Android users	Researchers from Palo Alto Networks reveal a surge in attacks using the Android BadPack malware.	Malware	Individual	Cyber Crime	>1		Palo Alto Networks, Android, BadPack
2	16/07/2024	Since 2022	Since 2022	MirrorFace	Multiple organizations in Japan	Researchers from the JPCERT/CC observe attack activities by MirrorFace LODEINFO and NOOPDOOR malware (since 2022) with the actor's targets initially media, political organisations, think tanks and universities, but then shifted to manufacturers and research institutions since 2023.	Targeted Attack	Multiple Industries	Cyber Espionage	JP		JPCERT/CC, MirrorFace, LODEINFO, NOOPDOOR
3	16/07/2024	Since 02/06/2024	Since 02/06/2024	Multiple threat actors	Multiple organizations in Romania	Researchers from Netscout discover a spike in DDoS attacks targeting multiple organizations in Romania.	DDoS	Multiple Industries	Hacktivism	RO		DDoS, Romania
4	16/07/2024	-	-	?	Individuals in Russia	Researchers from HUMAN discover "Konfety", a "massive ad fraud operation" that leverages 250 apps on the Google Play Store to perform "ad fraud".	Ad Fraud	Individual	Cyber Crime	RU		HUMAN, "Konfety", Google Play Store
5	16/07/2024	Since at least February 2024	Since at least February 2024	TAG-100	Government and private sector organizations, mostly in the Asia-Pacific region	Researchers at Recorded Future discover TAG-100, a newly identified group targeting "high-profile" government and private sector organizations, mostly in the Asia-Pacific region, in a suspected cyberespionage campaign.	Targeted Attack	Multiple Industries	Cyber Espionage	DJ DO FJ GB ID KH NL TW US VN		Recorded Future, TAG-100
6	16/07/2024	Since at least June 2024	16/07/2024	Multiple threat actors	Multiple organizations	Researchers at the Shadowserver Foundation observe multiple attempts to exploit the Apache HugeGraph-Server CVE-2024-27348 RCE "POST /gremlin" vulnerability.	CVE-2024-27348 Vulnerability	Unknown	N/A	N/A		Shadowserver Foundation, Apache HugeGraph-Server, CVE-2024-27348, RCE "POST /gremlin"
7	16/07/2024	16/07/2024	16/07/2024	?	LI.FI	Decentralized finance platform LI.FI protocol suffers an $11 million exploit following suspicious withdrawals.	Vulnerability	Fintech	Cyber Crime	N/A		LI.FI
8	17/07/2024	During late 2023	During late 2023	GhostEmperor	Undisclosed organizations	Researchers from Sygnia discover a new campaign from the elusive and highly covert Chinese group tracked as GhostEmperor, for the first time in more than two years.	Targeted Attack	Unknown	Cyber Espionage	N/A		Sygnia, China, GhostEmperor
9	17/07/2024	Since 16/07/2024	Since 16/07/2024	?	Multiple organizations	Researchers from Bitdefender reveal that cybercriminals are exploiting Trump’s assassination attempt to lure victims into a crypto doubling scam using deepfake Elon Musk videos on hijacked YouTube channels.	Scam	Individual	Cyber Crime	US		Bitdefender, Donald Trump, Elon Musk, YouTube
10	17/07/2024	Since 07/10/2023	Since 07/10/2023	Multiple threat actors	Multiple organizations in Israel	Military officials and cybersecurity researchers in Israel reveal that organizations in the same country have seen a "dramatic increase" in cyberattacks since the October 7 terrorist attack.	>1	Multiple Industries	>1 (Cyber Warfare and Hacktivism)	IL		Israel
11	17/07/2024	'Recently'	'Recently'	Revolver Rabbit	Multiple organizations	Researchers at Infoblox discover a cybercriminal gang tracked as Revolver Rabbit, which registered more than 500,000 domain names for infostealer campaigns that target Windows and macOS systems.	Malware	Multiple Industries	Cyber Crime	>1		Infoblox, Revolver Rabbit, DGA
12	17/07/2024	-	-	?	Individuals involved in the cryptocurrency market	Researchers at Cyble discover a campaign targeting individuals involved in the cryptocurrency market, and leveraging RDPWrapper and Tailscale to facilitate unauthorized access and establish control over victim systems.	Malware	Fintech	Cyber Crime	>1		Cyble, RDPWrapper, Tailscale
13	17/07/2024	-	-	emo	Life360	A threat actor has leaked a database containing the personal information of 442,519 Life360 customers collected by abusing a flaw in the login API.	Vulnerability	Professional, scientific and technical	Cyber Crime	US		Life360, emo
14	17/07/2024	-	-	Multiple threat actors	Undisclosed organization(s) in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2022-22948 VMware vCenter Server Incorrect Default File Permissions Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.	CVE-2022-22948 Vulnerability	Unknown	N/A	US		U.S. Cybersecurity and Infrastructure Security Agency, CISA, CVE-2022-22948, VMware vCenter Server Incorrect Default File Permissions Vulnerability, Known Exploited Vulnerabilities, KEV
15	17/07/2024	04/07/2024	04/07/2024	?	Multiple organizations	Researchers at Huntress reveal that the JavaScript downloader malware known as SocGholish (aka FakeUpdates) is being used to deliver a remote access trojan called AsyncRAT as well as a legitimate open-source project called BOINC (Berkeley Open Infrastructure Network Computing Client).	Malware	Multiple Industries	Cyber Crime	>1		Huntress, JavaScript, SocGholish, FakeUpdates, AsyncRAT, BOINC, Berkeley Open Infrastructure Network Computing Client
16	17/07/2024	-	-	UAC-0180	Defense organizations in Ukraine	The Ukraine Computer Emergency Response Team (CERT-UA) discovers a campaign using fake drone contracts to infect Ukrainian defense enterprises.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	UA		UAC-0180, Ukraine Computer Emergency Response Team, CERT-UA, Drone
17	17/07/2024	During Q2 2024	During Q2 2024	Multiple threat actors	Multiple organizations	Researchers from Cofense observe a surge in attacks where threat actors use Secure Email Gateways (SEGs) to encode or to rewrite malicious URLs embedded in their emails to potential victims and bypass the security controls.	>1 (Account Takeover, Malware)	Multiple Industries	Cyber Crime	>1		Cofense, Secure Email Gateways, SEG
18	17/07/2024	-	27/04/2024	?	Pueblo County School District 70	Pueblo County School District 70 is the victim of a ransomware attack.	Ransomware	Education	Cyber Crime	US		Pueblo County School District 70, ransomware
19	17/07/2024	28/09/2022	29/09/2022	?	Dell & Dean	Dell & Dean notifies about a breach in September 2022 that affected 6,803 people.	Unknown	Professional, scientific and technical	Cyber Crime	US		Dell & Dean
20	18/07/2024	End of 2023	Since at least end 2023	?	Multiple organizations	Researchers at ESET uncover a new form of malware called HotPage.exe, masquerading as an installer that ostensibly improves web browsing by blocking ads and malicious websites.	Malware	Multiple Industries	Cyber Crime	N/A		ESET; HotPage
21	18/07/2024	18/07/2024	18/07/2024	Threat actors from North Korea	WazirX	Indian crypto exchange WazirX has revealed it lost virtual assets valued at over $230 million after a cyber attack that has since been linked to North Korea.	Vulnerability	Fintech	Cyber Crime	IN		WazirX, North Korea
22	18/07/2024	Since at least 2023	Since at least 2023	APT41	Organizations in the shipping, logistics, technology, and automotive sectors in Europe and Asia	Researchers at Mandiant flag a significant resurgence in attacks by APT41, a prolific Chinese government-backed hacking team caught breaking into organizations in the shipping, logistics, technology, and automotive sectors in Europe and Asia.	Targeted Attack	Multiple Industries	Cyber Espionage	ES GB IT TH TR TW		Mandiant, APT41, China
23	18/07/2024	'Recently'	'Recently'	Patchwork, a.k.a. APT-C-09, Dropping Elephant, Operation Hangover, Viceroy Tiger, and Zinc Emerson	Organizations with ties to Bhutan	Researchers at Knownsec 404 link the threat actor known as Patchwork to a cyber attack targeting entities with ties to Bhutan to deliver the Brute Ratel C4 framework and an updated version of a backdoor called PGoShell.	Targeted Attack	Multiple Industries	Cyber Espionage	BT		Patchwork, APT-C-09, Dropping Elephant, Operation Hangover, Viceroy Tiger, Zinc Emerson, Knownsec 404, Brute Ratel C4, PGoShell
24	19/07/2024	19/07/2024	19/07/2024	Multiple threat actors	Multiple organizations in the U.S.	The U.S. cybersecurity agency Cybersecurity and Infrastructure Security Agency (CISA) says that though the CrowdStrike outage was not linked to a cyberattack or malicious activity, it has “observed threat actors taking advantage of this incident for phishing and other malicious activity.”	>1	Multiple Industries	Cyber Crime	US		U.S. Cybersecurity and Infrastructure Security Agency, CISA, CrowdStrike
25	19/07/2024	19/07/2024	19/07/2024	Multiple threat actors	Multiple organizations in the U.K	The U.K. National Cyber Security Center (NCSC) also warns that it observed an increase in phishing messages aiming to take advantage of the Crowdstrike outage.	>1	Multiple Industries	Cyber Crime	GB		U.K. National Cyber Security Center, NCSC, Crowdstrike
26	19/07/2024	Since February 2024	-	?	Multiple e-commerce sites	Researchers at Sucuri observe threat actors using swap files in compromised websites to conceal a persistent credit card skimmer and harvest payment information.	Malicious script injection	Wholesale and retail	Cyber Crime	>1		Sucuri, Magento, swap files
27	19/07/2024	Between 16/07/2024 and 18/07/2024	Between 16/07/2024 and 18/07/2024	?	Users in Europe, including France, Poland, Romania, Germany, Spain, Hungary, Italy, Greece, the Netherlands, and Sweden	Researchers at Bitdefender discover highly suspicious Facebook ads promoting fake GTA VI beta versions that are free to download on PC and deliver malware.	Malware	Arts entertainment, recreation	Cyber Crime	DE FR GR NL PL RO SE		Bitdefender, Facebook, Grand Theft Auto, GTA VI
28	19/07/2024	-	-	Play	Multiple organizations	Researchers from Trend Micro discover a Play ransomware variant deploying a dedicated Linux locker for encrypting VMware ESXi virtual machines.	Ransomware	Multiple Industries	Cyber Crime	CA DE GB NL US		Trend Micro, Play, ransomware, Linux, VMware ESXi
29	19/07/2024	Early July 2024	Early July 2024	?	Greek Land Registry Agency	The Land Registry agency in Greece announces that it suffered a limited-scope data breach following a wave of 400 cyberattacks targeting its IT infrastructure with the attackers able to steal steal 1.2 GB of data.	Unknown	Public admin and defence, social security	Cyber Crime	GR		Land Registry Agency
30	19/07/2024	15/07/2024	15/07/2024	?	Cadre Holdings	Florida-based safety equipment giant Cadre Holdings discloses a cyberattack that has impacted some of the company’s operations.	Ransomware	Manufacturing	Cyber Crime	US		Cadre Holdings, Ransomware
31	19/07/2024	14/07/2024	14/07/2024	?	Fractal ID	Web3 identity solutions provider Fractal ID reveals that a threat actor recently managed to exfiltrate data belonging to 6,300 users after compromising credentials for an operator account that had admin privileges.	Account Takeover	Professional, scientific and technical	Cyber Crime	DE		Fractal ID
32	19/07/2024	22/05/2024	13/05/2024	Hunters International	Northeast Rehabilitation Hospital Network	Northeast Rehabilitation Hospital Network (“NRHN”) suffers a Hunters International ransomware attack.	Ransomware	Human health and social work	Cyber Crime	US		Northeast Rehabilitation Hospital Network, NRHN, Hunters International, ransomware
33	20/07/2024	19/07/2024	19/07/2024	?	BBVA Bank customers	A malicious campaign delivers the Remcos RAT as a fake Crowdstrike Hotfix, targeting BBVA Bank customers.	Malware	Finance and insurance	Cyber Crime	>1		Remcos RAT, Crowdstrike, BBVA Bank
34	20/07/2024	19/07/2024	19/07/2024	Handala	Multiple organizations in Israel	The pro-Iranian hacktivist group Handala distributes a data wiper under the pretense of delivering an update from CrowdStrike to Israeli companies.	Malware	Multiple Industries	Hacktivism	IL		Iran, Israel, Handala, CrowdStrike
35	20/07/2024	19/07/2024	19/07/2024	?	Crowdstrike customers in LATAM	Researchers at Crowdstrike warm that threat actors are exploiting the situation to distribute Remcos RAT to its customers in Latin America under the guise of providing a hotfix.	Malware	Multiple Industries	Cyber Crime	>1		Crowdstrike, Remcos RAT, LATAM
36	21/07/2024	21/07/2024	21/07/2024	?	FleepBot	Several popular Ukrainian news channels on Telegram are hacked over the weekend to spread “provocative messages,” after the Russia-owned service called FleepBot, used to schedule posts, automate responses and manage content is compromised.	Unknown	Professional, scientific and technical	Cyber Warfare	UA		Ukraine, Telegram, FleepBot
37	21/07/2024	During July 2024	During July 2024	UAC-0063 linked to APT28 a.k.a.Fancy Bear, Strontium, Forest Blizzard, Blue Delta	Scientific and research institutions in Ukraine	The Ukraine Computer Emergency Response Team (CERT-UA) discovers a new cyber-espionage campaign against Ukraine’s scientific and research institutions using the known malware strains Hatvibe and Cherryspy.	Targeted Attack	Professional, scientific and technical	Cyber Espionage	UA		UAC-0063, APT28, Fancy Bear, Strontium, Forest Blizzard, Blue Delta, Ukraine Computer Emergency Response Team, CERT-UA, Hatvibem, Cherryspy
38	21/07/2024	19/07/2024	19/07/2024	?	Multiple organizations	Researchers at Cyfirma warn that the Crowdstrike incident is being used for conducting scams and malware delivery worldwide.	>1 (Malware and scam)	Multiple Industries	Cyber Crime	>1		Cyfirma, Crowdstrike
39	22/07/2024	Since 19/07/2024	Since 19/07/2024	?	Multiple organizations	CrowdStrike warns that a fake recovery manual to repair Windows devices is installing a new information-stealing malware called Daolpu.	Malware	Multiple Industries	Cyber Crime	>1		CrowdStrike, Daolpu
40	22/07/2024	19/07/2024	19/07/2024	?	Superior Court of Los Angeles County (LASC)	The largest trial court in the United States, the Superior Court of Los Angeles County, closed all 36 courthouse locations on Monday to restore systems affected by a Friday ransomware attack.	Ransomware	Public admin and defence, social security	Cyber Crime	US		Superior Court of Los Angeles County, LASC, ransomware
41	22/07/2024	23/05/2024 and 29/05/2024	-	?	Michigan Medicine	Michigan Medicine, the academic medical center of the University of Michigan, notifies roughly 57,000 individuals that their personal and health information might have been compromised in a data breach.	Account Takeover	Human health and social work	Cyber Crime	US		Michigan Medicine, University of Michigan
42	23/07/2024	Since January 2024	During April 2024	?	Municipal district energy company in Lviv, Ukraine	Researchers at Dragos reveal that a previously unseen malware, dubbed FrostyGoop, able to disrupt industrial processes, was used in a cyberattack against a district energy company in Ukraine, resulting in two days without heat for hundreds of people during sub-zero temperatures.	Malware	Electricity, gas steam, air conditioning	Cyber Warfare	UA		Dragos, FrostyGoop, Ukraine
43	23/07/2024	-	-	?	Organizations in Spain, Thailand, and the U.S	Researchers at Fortinet reveal that CVE-2024-21412, a now-patched security flaw in the Microsoft Defender SmartScreen has been exploited as part of a new campaign designed to deliver information stealers such as ACR Stealer, Lumma, and Meduza.	CVE-2024-21412 Vulnerability	Multiple Industries	Cyber Crime	ES TH US		Fortinet, CVE-2024-21412, Microsoft Defender SmartScreen, ACR Stealer, Lumma, Meduza
44	23/07/2024	'Recently'	'Recently'	Daggerfly (a.k.a. Evasive Panda, Bronze Highland)	Organizations in Taiwan and a U.S. NGO based in China	Researchers at Symantec reveal that the Daggerfly (aka Evasive Panda, Bronze Highland) espionage group has extensively updated its toolset, introducing several new versions of its malware, MgBot and Macma.	Targeted Attack	Multiple Industries	Cyber Espionage	CN TW		Daggerfly, Evasive Panda, Bronze Highland, MgBot, Macma
45	23/07/2024	23/07/2024	23/07/2024	?	dYdX	Decentralized finance (DeFi) crypto exchange dYdX announces that the website for its older v3 trading platform has been compromised.	DNS Hijacking	Fintech	Cyber Crime	US		dYdX
46	23/07/2024	-	-	?	Hamster Kombat players	Researchers at ESET identify several threats targeting Hamster Kombat players, including Android malware distributed through the game’s unofficial Telegram channel, fake app stores that deliver unwanted advertisements and GitHub repositories distributing Lumma Stealer under the guise of offering automation tools for the game.	Malware	Arts entertainment, recreation	Cyber Crime	>1		ESET, Hamster Kombat, Android, Telegram, GitHub, Lumma Stealer
47	23/07/2024	-	-	Multiple threat actors	Undisclosed organization(s) in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2012-4792 Microsoft Internet Explorer Use-After-Free Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.	CVE-2024-4792 Vulnerability	Unknown	N/A	US		U.S. Cybersecurity and Infrastructure Security Agency, CISA, CVE-2012-4792, Microsoft Internet Explorer Use-After-Free, Known Exploited Vulnerabilities, KEV
48	23/07/2024	-	-	Multiple threat actors	Undisclosed organization(s) in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2024-39891 Twilio Authy Information Disclosure Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.	CVE-2024-39891 Vulnerability	Unknown	N/A	US		U.S. Cybersecurity and Infrastructure Security Agency, CISA, CVE-2012-39891, Twilio, Authy, Information Disclosure, Known Exploited Vulnerabilities, KEV
49	23/07/2024	'Recently'	'Recently'	?	Individuals in the crypto space	Researchers at Check Point reveal that fraudsters have evolved to become increasingly sophisticated, exploiting legitimate blockchain protocols to conduct their scams.	Scam	Fintech	Cyber Crime	>1		Check Point, Crypto
50	23/07/2024	15/07/2024	15/07/2024	Threat actors from North Korea	KnowBe4	Cybersecurity awareness training company KnowBe4 has reveals it was duped into hiring a fake IT worker from North Korea, resulting in attempted insider threat activity.	Targeted Attack	Professional, scientific and technical	Cyber Espionage	US		KnowBe4, North Korea
51	23/07/2024	22/07/2024	22/07/2024	Akira	Split St Jerome Airport	The Split St Jerome Airport is hit with an Akira ransomware attack.	Ransomware	Transportation and storage	Cyber Crime	HR		Split, St Jerome Airport, Akira, Ransomware
52	23/07/2024	21/06/2024	21/06/2024	Daixin	Acadian Ambulance	Acadian Ambulance is hit with a Daixin ransomware attack. The threat actors claim to have stolen 10 million records.	Ransomware	Human health and social work	Cyber Crime	US		Acadian Ambulance, Daixin, ransomware
53	23/07/2024	-	22/07/2024	?	Jefferson County Clerk’s Office	A cyber attack forces the Jefferson County Clerk’s Office to close eight branches.	Unknown	Public admin and defence, social security	Cyber Crime	US		Jefferson County Clerk’s Office
54	24/07/2024	24/07/2024	24/07/2024	Ukraine’s military intelligence (HUR)	Several large Russian banks including Dom.RF, VTB Bank, Alfa-Bank, Sberbank, Raiffeisen Bank, RSHB Bank, Rosbank, Gazprombank, Tinkoff Bank and iBank.	Several large Russian banks confirm that they suffered distributed denial-of-service (DDoS) attacks that temporarily disrupted their mobile apps and websites. Ukraine’s military intelligence (HUR) claims responsibility for the attack.	DDoS	Finance and insurance	Cyber Warfare	RU		Dom.RF, VTB Bank, Alfa-Bank, Sberbank, Raiffeisen Bank, RSHB Bank, Rosbank, Gazprombank, Tinkoff Bank, iBank., Ukraine’s military intelligence, HUR
55	24/07/2024	24/07/2024	24/07/2024	Ukraine’s military intelligence (HUR)	Several large telecom operators in Russia, including Beeline, Megafon, Tele2 and Rostelecom.	Ukraine’s military intelligence (HUR) also claims responsibility for a DDoS attack to several large telecom operators in Russia.	DDoS	Information and communication	Cyber Warfare	RU		Beeline, Megafon, Tele2, Rostelecom, Ukraine’s military intelligence, HUR
56	24/07/2024	-	-	BlackMeta, a.k.a. SN_BlackMeta, DarkMeta	Financial institution in the Middle East	Researchers at Radware reveal that a financial institution in the Middle East suffered a DDoS attack lasting more than 100 hours in total, averaging 4.5 million requests per second.	DDoS	Finance and insurance	Hacktivism	N/A		BlackMeta, SN_BlackMeta, DarkMeta, Radware
57	24/07/2024	Since 08/07/2024	Since 08/07/2024	Stargazer Goblin	Multiple organizations	Researchers at Check Point discover a network of GitHub accounts (dubbed Stargazers Ghost Network) that distribute malware or malicious links via phishing repositories.	Malware	Multiple Industries	Cyber Crime	>1		Check Point, GitHub accounts, Stargazers Ghost Network, Stargazer Goblin
58	24/07/2024	02/02/2024	02/02/2024	TransparentTribe, a.k.a. ProjectM or APT 36	Indian government departments	Researchers at NSFOCUS discover spear-phishing email attacks by the Pakistani APT group TransparentTribe targeting Indian government departments.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	IN		NSFOCUS, TransparentTribe, APT36, Project M
59	24/07/2024	Since 10/07/2024	Since 10/07/2024	?	Government agencies and private firms	Researchers from Resecurity reveal that threat actors are chaining together CVE-2024-4879 and CVE-2024-5217, two ServiceNow flaws using publicly available exploits to breach government agencies and private firms in data theft attacks.	CVE-2024-4879 and CVE-2024-5217 vulnerabilities	Multiple Industries	Cyber Crime	>1		Resecurity, CVE-2024-4879, CVE-2024-5217, ServiceNow
60	24/07/2024	-	-	Threat actors from Nigeria (Yahoo Boys)	Individuals in the U.S.	Meta removes 63,000 Instagram accounts from Nigeria that were involved in sextortion scams, including a coordinated network of 2,500 accounts linked to 20 individuals targeting primarily adult men in the United States.	Scam	Individual	Cyber Crime	US		Meta, Nigeria, United States, Yahoo Boys
61	24/07/2024	Early June 2024	Early June 2024	?	Chinese-speaking Windows users	Researchers from eSentire reveal that the remote access trojan known as Gh0st RAT has been observed being delivered by an "evasive dropper" called Gh0stGambit as part of a drive-by download scheme targeting Chinese-speaking Windows users.	Malware	Individual	Cyber Crime	CN		eSentire, Gh0st RAT, Gh0stGambit, China, Windows
62	24/07/2024	-	-	?	Multiple organizations	Acronis warns customers to patch CVE-2023-45249, a critical flaw that lets attackers bypass authentication on vulnerable servers using default credentials exploited in attacks.	CVE-2023-45249 Vulnerability	Multiple Industries	N/A	>1		Acronis, CVE-2023-45249
63	24/07/2024	21/06/2024	21/06/2024	?	Individuals in the U.S.	Researchers at Rapid7 observe a campaign targeting users searching for W2 forms using the Microsoft search engine Bing, delivering and executing a Dynamic Link Library (DLL) containing the Brute Ratel Badger.	Malware	Individual	Cyber Crime	US		Rapid7, W2, Bing,Brute Ratel Badger
64	24/07/2024	Since 13/07/2024	-	Threat actors from Russia, Iran And China	Audience in the U.S.	Foreign state-sponsored actors spread misinformation about the attempted shooting of Donald Trump, amplifying home-grown conspiracy theories as well as pushing their own narratives.	Coordinated Inauthentic Behavior	Information and communication	Cyber Warfare	US		Russia, Iran, China, Donald Trump
65	24/07/2024	14/06/2024	28/06/2024	GhostR	Ezynetic Pte. Ltd	Threat actors known as GhostR claim to have stolen more than 50 GB of files on loan borrowers from the Singapore MLCB (the Moneylenders Credit Bureau). The attack was carried out on Ezynetic Pte. Ltd and affected 12 moneylenders using their services.	Unknown	Professional, scientific and technical	Cyber Crime	SG		GhostR, Singapore MLCB, Moneylenders Credit Bureau, Ezynetic Pte. Ltd
66	25/07/2024	-	-	APT45 a.k.a. Andariel, Onyx Sleet, Stonefly, and Silent Chollima	Organizations in the healthcare, energy and financial sectors	Researchers at Mandiant reveal that the North Korean group APT45 is expanding its operations to target the healthcare, energy and financial sectors.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		APT45, Andariel, Onyx Sleet, Stonefly, Silent Chollima, Mandiant, North Korea
67	25/07/2024	-	-	?	Multiple organizations	Researchers from Wiz discover SeleniumGreed, an ongoing campaign that's leveraging internet-exposed Selenium Grid services for illicit cryptocurrency mining.	Misconfiguration	Multiple Industries	Cyber Crime	>1		Wiz, SeleniumGreed, Selenium Grid
68	25/07/2024	Since at least 19/07/2024	24/07/2024	?	Multiple organizations in Germany	CrowdStrike alerts about an unfamiliar threat actor attempting to capitalize on the Falcon Sensor update incident to distribute dubious installers targeting German customers as part of a highly targeted campaign.	Malware	Multiple Industries	Cyber Crime	DE		CrowdStrike, Falcon Sensor, Germany
69	25/07/2024	Between 12/07/2024 and 18/07/2024	Between 12/07/2024 and 18/07/2024	UAC-0057 a.k.a. GhostWriter	Government organizations in Ukraine	The Ukraine Computer Emergency Response Team (CERT-UA) reveals that the suspected Belarusian state-sponsored threat actor GhostWriter targeted Ukrainian organizations and local government agencies with PicassoLoader malware.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	UA		Ukraine Computer Emergency Response Team, CERT-UA, Belarus, GhostWriter, Ukraine, PicassoLoader
70	25/07/2024	Between January and July 2024	Between January and July 2024	Smishing Triad	iPhone users in India	Researchers at Fortinet discover a campaign against individuals in India, carried out by the Chinese threat actor Smishing Triad, and using the country's government-operated postal system India Post, as a lure.	Account Takeover	Individual	Cyber Crime	IN		Fortinet, China, Smishing Triad, India Post
71	25/07/2024	'Recently'	'Recently'	CyberCartel	Government offices and financial institutions	Researchers at IBM reveal the details of the latest campaign from the CyberCartel group, targeting government offices and financial institutions Multiple organizations via malicious Chrome extensions.	Malware	Multiple Industries	Cyber Crime	>1		IBM, CyberCartel, Chrome
72	25/07/2024	'Recently'	'Recently'	?	Multiple organizations	Researchers from ThreatDown discover a new phishing campaign using Discord’s Content Delivery Network (CDN) infrastructure to deliver malicious payloads.	Malware	Multiple Industries	Cyber Crime	>1		ThreatDown, Discord
73	25/07/2024	-	-	?	Multiple organizations	Researchers from Perception Point identify a new phishing campaign abusing Microsoft Office Forms to launch sophisticated two-step phishing attacks.	Account Takeover	Multiple Industries	Cyber Crime	>1		Perception Point, Microsoft Office Forms
74	25/07/2024	Since at least June 2024	-	SideWinder a.k.a. APT-C-17, Baby Elephant, Hardcore Nationalist, Leafperforator, Rattlesnake, and Razor Tiger	Ports and maritime facilities in the Indian Ocean and Mediterranean Sea	Researchers from Blackberry discover a new campaign by the nation-state threat actor known as SideWinder targeting ports and maritime facilities in the Indian Ocean and Mediterranean Sea.	Targeted Attack	Transportation and storage	Cyber Espionage	BD EG LK MM MV NP PK		SideWinder, APT-C-17, Baby Elephant, Hardcore Nationalist, Leafperforator, Rattlesnake, Razor Tiger, Blackberry
75	25/07/2024	Since May 2024	Since May 2024	Threat actors primarily from Russia	Corporate and institutional networks across Europe	Researchers from Heimdal show a huge spike in brute force attacks against corporate and institutional networks across Europe, with most of the attacks originating in Russia.	Brute force	Public admin and defence, social security	Cyber Warfare	EU		Heimdal, Europe, Russia
76	25/07/2024	Between 03/06/2024 and 07/06/2024	Between 03/06/2024 and 07/06/2024	?	Gemini	Cryptocurrency exchange Gemini warns it suffered a data breach incident caused by a cyberattack at its Automated Clearing House (ACH) service provider, whose name was not disclosed.	Unknown	Fintech	Cyber Crime	US		Gemini
77	25/07/2024	During September 2023	SInce January 2023	GXC Team	Users of more than 36 Spanish banks, governmental bodies, and 30 institutions worldwide.	Researchers from Group-IB expose GXC Team, a Spanish-speaking cybercrime group observed bundling phishing kits with malicious Android applications.	>1 (Account Takeover, Malware)	Finance and insurance	Cyber Crime	BR ES GB SK US		Group-IB, GXC Team, Android
78	25/07/2024	27/05/2024	27/05/2024	?	Daniel Freund	Daniel Freund, a German member of Europe’s Parliament says his mobile phone was targeted with the Candiru mobile spyware on May.	Targeted Attack	Individual	Cyber Espionage	DE		Daniel Freund, Europe’s Parliament, Candiru
79	25/07/2024	-	-	?	Spytech	Spytech, a little-known spyware maker is hacked, revealing thousands of devices around the world under its stealthy remote surveillance.	Unknown	Professional, scientific and technical	Cyber Crime	US		Spytech
80	26/07/2024	Early June 2024	Early June 2024	?	Multiple organizations	Researchers from Checkmarx discover a Python package dubbed “lr-utils-lib”, containing hidden malicious code. The code, activated upon installation, targets macOS systems and attempts to steal Google Cloud Platform credentials by sending them to a remote server.	Malware	Multiple Industries	Cyber Crime	>1		Checkmarx, Python, “lr-utils-lib”, macOS, Google Cloud Platform
81	26/07/2024	'Recently'	'Recently'	Multiple threat actors	Individuals	Google says it recently fixed an authentication weakness that allowed threat actors to circumvent the email verification required to create a Google Workspace account, and leverage that to impersonate a domain holder at third-party services that allow logins through Google’s “Sign in with Google” feature.	Vulnerability	Individual	Cyber Crime	>1		Google Workspace
82	26/07/2024	Earlier in July 2024	Earlier in July 2024	XDSpy	Organizations in Russia and Moldova	Researchers at F.A.C.C.T. reveal that the cyberespionage group known as XDSpy recently targeted victims in Russia and Moldova with a new malware variant called XDSpy.DSDownloader.	Targeted Attack	Individual	Cyber Espionage	MD RU		F.A.C.C.T., XDSpy, XDSpy.DSDownloader
83	26/07/2024	-	-	?	Individuals	Researchers at Ontinue share details on a new PlugX RAT campaign that leverages the Steam gaming platform.	Malware	Individual	Cyber Crime	>1		Ontinue, PlugX RAT., Steam
84	26/07/2024	-	-	APT45 a.k.a. Andariel, Onyx Sleet, Stonefly, and Silent Chollima	Defense, aerospace, nuclear, and engineering organizations in the US, Japan, South Korea, and India	The UK, US and South Korea warn of a global espionage campaign by the North Korean sponsored cyber threat actor Andariel, designed to further the regime’s military and nuclear ambitions.	Targeted Attack	Electricity, gas steam, air conditioning	Cyber Espionage	IN JP KR US		APT45, Andariel, Onyx Sleet, Stonefly, Silent Chollima, Critical National Infrastructure, CNI, UK, US, South Korea, North Korea
85	28/07/2024	26/07/2024	26/07/2024	Cyber Anarchy Squad	Avanpost	A pro-Ukrainian hacker group, known as Cyber Anarchy Squad, claims it hacked the Russian information security firm Avanpost and leaked a trove of its data.	Unknown	Professional, scientific and technical	Hacktivism	RU		Ukraine, Russia, Cyber Anarchy Squad, Avanpost
86	29/07/2024	Since at least 25/06/2024	Since at least 25/06/2024	Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest	Multiple organizations	Microsoft warns that ransomware gangs are actively exploiting CVE-2024-37085, a VMware ESXi authentication bypass vulnerability in attacks delivering the Akira and Black Basta ransomware strains.	CVE-2024-37085 Vulnerability	Multiple Industries	Cyber Crime	>1		Storm-0506, Storm-1175, Octo Tempest, Manatee Tempest, CVE-2024-37085, VMware ESXi, Akira, Black Basta, ransomware
87	29/07/2024	Since January 2024	Since January 2024	?	Multiple organizations	Researchers from Guardio Labs discover EchoSpoofing, a massive phishing campaign exploiting now-fixed, weak permissions in Proofpoint's email protection service to dispatch millions of spoofed emails impersonating big entities like Disney, Nike, IBM, and Coca-Cola, to target Fortune 100 companies.	Misconfiguration	Multiple Industries	Cyber Crime	>1		Guardio Labs, EchoSpoofing, Proofpoint, Disney, Nike, IBM, Coca-Cola, Fortune 100
88	29/07/2024	'Over the past few weeks'	'Over the past few weeks'	?	Multiple organizations	Researchers from Trellix discover a sophisticated phishing campaign targeting Microsoft OneDrive users. Threat actors rely on social engineering tactics to trick users into executing a PowerShell script, which leads to their systems being compromised.	Account Takeover	Multiple Industries	Cyber Crime	DE IN KR US		Trellix, Microsoft OneDrive, PowerShell
89	29/07/2024	-	-	?	Multiple organizations	Researchers from Walmart discover an unknown PowerShell backdoor alongside a new variant of the Zloader/SilentNight malware.	Malware	Multiple Industries	Cyber Crime	>1		Walmart, PowerShell, Zloader, SilentNight
90	29/07/2024	-	-	UNC4393	Multiple organizations	Researchers at Mandiant reveal that the threat group UNC4393 behind the Black Basta ransomware is shifting to new tools such as the SILENTNIGHT backdoor.	Malware	Multiple Industries	Cyber Crime	>1		Mandiant, UNC4393, Black Basta, ransomware, SILENTNIGHT
91	29/07/2024	Since 2022	During April 2024	?	Android users	Researchers at Kaspersky discover a new version of Mandrake, a sophisticated Android cyber-espionage malware tool, distributed via five applications on Google Play from 2022 to 2024, and downloaded over 32,000 times while remaining undetected by other cybersecurity vendors.	Malware	Individual	Cyber Espionage	>1		Kaspersky, Mandrake, Android, Google Play
92	29/07/2024	18/07/2024	18/07/2024	?	City of Columbus	The City of Columbus, Ohio, says it's investigating whether personal data was stolen in a ransomware attack that disrupted the City's services.	Ransomware	Public admin and defence, social security	Cyber Crime	US		City of Columbus, Ransomware
93	29/07/2024	26/07/2024	26/07/2024	Zeus	Israeli athletes in the Paris Olympic Games	The sensitive data of several Israeli athletes in the Paris Olympic Games is published on Telegram in an alleged doxing attack by a group calling itself "Zeus".	Unknown	Individual	Hacktivism	IL		Paris Olympic Games, Israel, Palestine, Telegram, Zeus
94	29/07/2024	Since 31/05/2024	31/05/2024	Threat actors allegedly traced back to China	Supporters of Donald Trump’s 2024 campaign	Researchers at Veriti uncover a phishing campaign, allegedly traced back to China, targeting supporters of Donald Trump’s 2024 campaign.	Account Takeover	Individual	Cyber Crime	US		Veriti, China, Donald Trump
95	30/07/2024	SInce at least May 2024	During May 2024	?	Multiple organizations Poland, Romania, and Italy	Researchers at ESET discover multiple phishing campaigns targeting SMBs in Poland, Romania and Italy, relying on ModiLoader (aka DBatLoader) to distribute various malware families like Agent Tesla, Formbook, and Remcos RAT.	Malware	Multiple Industries	Cyber Crime	IT PL RO		ESET, ModiLoader, DBatLoader. Agent Tesla, Formbook, Remcos RAT
96	30/07/2024	-	-	?	Multiple organizations	Researchers from Malwarebytes discover a new malvertising campaign where threat actors created ads that display an advertisement for Google Authenticator when users search for the software in Google search.	Malware	Multiple Industries	Cyber Crime	>1		Malwarebytes, Google Authenticator, Google ad
97	30/07/2024	Early in 2024	Early in 2024	Dark Angels	Undisclosed Fortune 50 company	Researchers from Zscaler reveal that a Fortune 50 company paid a record-breaking $75 million ransom payment to the Dark Angels ransomware gang.	Ransomware	Unknown	Cyber Crime	N/A		Zscaler, Fortune 50, Dark Angels, ransomware
98	30/07/2024	-	17/04/2024	?	Individuals	Researchers from Recorded Future discover a malicious fraud campaign dubbed "ERIAKOS", promoting more than 600 fake web shops through Facebook advertisements to steal visitors' personal and financial information.	Scam	Individual	Cyber Crime	>1		Recorded Future, ERIAKOS, Facebook
99	30/07/2024	'Recently'	'Recently'	?	Fresnillo	Fresnillo PLC, the world's largest silver producer and a top global producer of gold, copper, and zinc, said attackers gained access to data stored on its systems during a recent cyberattack.	Unknown	Mining and quarrying	Cyber Crime	GB		Fresnillo
100	30/07/2024	-	-	Sp1d3rHunters	Bausch Health	The threat actor known as Sp1d3rHunters claims to have stolen extensive data from Bausch Health (1.6 Million DEA Numbers and Prescriber Details) and attempts to extort the company. The breach seems to be linked to compromised Snowflake accounts.	Account Takeover	Human health and social work	Cyber Crime	US		Bausch Health, Sp1d3rHunters, Snowflake
101	31/07/2024	-	-	?	Multiple organizations	A sophisticated phishing campaign exploiting the Tycoon 2FA Phishing-kit leverages Amazon Simple Email Service (SES) and a series of high-profile redirects to steal user credentials.	Account Takeover	Multiple Industries	Cyber Crime	>1		Tycoon 2FA Phishing-kit, Amazon Simple Email Service, SES
102	31/07/2024	30/07/2024	30/07/2024	?	Microsoft	Microsoft says that a DDoS attack led to an eight hour outage involving its Azure portal, as well as some Microsoft 365 and Microsoft Purview services.	DDoS	Professional, scientific and technical	N/A	US		Microsoft, Azure Purview
103	31/07/2024	Since February 2022	Since February 2022	-	Android devices worldwide	Researchers from Zimperium discover a malicious campaign targeting Android devices worldwide, and utilizing thousands of Telegram bots to infect devices with SMS-stealing malware and steal one-time 2FA passwords (OTPs) for over 600 services.	Malware	Individual	Cyber Crime	>1		Zimperium, SMS Stealer
104	31/07/2024	-	-	RansomEXX	Brontoo Technology Solutions	A RansomEXX ansomware attack on Brontoo Technology Solutions, a partner of C-Edge Technologies, a technology service provider, forces payment systems across nearly 300 small local banks in India to shut down temporarily.	Ransomware	Professional, scientific and technical	Cyber Crime	IN		Ransomware, C-Edge Technologies, RansomEXX, Brontoo Technology Solutions
105	31/07/2024	Since 29/06/2024	03/07/2024	?	Multiple organizations	Researchers at Fortinet discover A dangerous package on the PyPI repository named zlibxjson version 8.2.	Malware	Multiple Industries	Cyber Crime	>1		Fortinet, PyPI, zlibxjson
106	31/07/2024	End of 2021	End of 2021	Threat actors from China	German Federal Agency for Cartography and Geodesy (BKG)	German authorities say that a Beijing-backed threat actor was behind a cyberattack three years ago on the country’s state cartography agency, and summon the Chinese ambassador to Berlin for further discussions.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	DE		German Federal Agency for Cartography and Geodesy, BKG, China
107	31/07/2024	Since 27/07/2024	Since 27/07/2024	?	Multiple organizations	The SANS Technology Institute’s Internet Storm Center reports seeing increasing exploitation attempts of the Apache OFBiz CVE-2024-32113 vulnerability.	CVE-2024-32113 Vulnerability	Multiple Industries	N/A	>1		SANS Technology Institute, Internet Storm Center, Apache OFBiz, CVE-2024-32113, Mirai
108	31/07/2024	Since at least of May 2024	End of May 2024	?	Banking users in UK, Italy, and Romania	Researchers from Cleafy discover a new Android malware dubbed 'BingoMod', able to wipe devices after successfully stealing money from the victims' bank accounts using the on-device fraud technique.	Malware	Finance and insurance	Cyber Crime	GB IT RO		Cleafy, Android, BingoMod
109	31/07/2024	29/07/2024	29/07/2024	?	OneBlood	OneBlood, a large not-for-profit blood center that serves hospitals and patients in the United States, is dealing with an IT systems outage caused by a ransomware attack.	Ransomware	Human health and social work	Cyber Crime	US		OneBlood, Ransomware
110	31/07/2024	Since at least 21/07/2024	21/07/2024	?	Shopify users	People worldwide report seeing mysterious $1 or $0 charges from Shopify-charge.com appearing on their credit card bills, even when they did not attempt to purchase anything.	Scam	Wholesale and retail	Cyber Crime	>1		Shopify, Shopify-charge.com
111	31/07/2024	Since 2018	Since 2018	Over a dozen Russian-nexus cybercriminal actors	Multiple organizations	Researchers at Infoblox and Eclypsium discover that threat actors have hijacked more than 35,000 registered domains in so-called Sitting Ducks attacks that allow claiming a domain without having access to the owner's account at the DNS provider or registrar.	Misconfiguration	Multiple Industries	Cyber Crime	>1		Infoblox, Eclypsium, Sitting Ducks, DNS
112	31/07/2024	-	-	Threat actors from North Korea	Multiple organizations across South Korea, North America, Europe, and the Middle East	Researchers at Securonix reveal that the threat actors behind the ongoing DEV#POPPER malware campaign targeting software developers have demonstrated new malware and tactics, expanding their focus to include Windows, Linux, and macOS systems.	Malware	Multiple Industries	Cyber Crime	KR >1		Securonix, DEV#POPPER, North Korea, Windows, Linux, macOS
113	31/07/2024	During July 2024	During July 2024	?	Multiple organizations	Researchers from eSentire and Proofpoint warn about an uptick in the abuse of Cloudflare's TryCloudflare free service to distribute malware payloads such as AsyncRAT, GuLoader, PureLogs Stealer, Remcos RAT, Venom RAT, and XWorm.	Malware	Multiple Industries	Cyber Crime	>1		eSentire, Proofpoint, Cloudflare, TryCloudflare, AsyncRAT, GuLoader, PureLogs Stealer, Remcos RAT, Venom RAT, XWorm
114	31/07/2024	Since late 2023	Since late 2023	Bloody Wolf	Organizations in Kazakhstan	Researchers from BI.ZONE reveal that organizations in Kazakhstan are the target of a threat activity cluster dubbed Bloody Wolf that delivers a commodity malware called STRRAT (aka Strigoi Master).	Targeted Attack	Multiple Industries	Cyber Espionage	KZ		BI.ZONE, Kazakhstan, Bloody Wolf, STRRAT, Strigoi Master
115	31/07/2024	07/07/2024	07/07/2024	Moonstone Sleet	Multiple organizations	Researchers from Datadog reveal that the North Korea-linked threat actor known as Moonstone Sleet has continued to push malicious npm packages to the JavaScript package registry with the aim of infecting Windows systems.	Malware	Multiple Industries	Cyber Espionage	>1		Datadog, North Korea, Moonstone Sleet, JavaScript
116	31/07/2024	-	-	BianLian	Sable International	Sable International, a prominent U.K.-based company offering immigration services and legal resources, warns officials in multiple countries that a recent cyberattack may have exposed sensitive customer information. The BianLian ransomware gang claims responsibility for the attack and starts emailing customers about the incident, likely to put pressure on the firm to pay a ransom.	Ransomware	Professional, scientific and technical	Cyber Crime	GB		Sable International, BianLian, ransomware
ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags

Creating the timelines is a very time-consuming task.

Any little helps!

CVEs Targeting Remote Access Technologies

In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.

September 2026 Cyber Attacks Statistics
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...
Mega Breaches in 2026
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
September 2026 Cyber Attacks Statistics Infographic
September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%. Malware led the techniques with 53 campaigns, ahead of Remote Code Execution with 32. More than a quarter of breaches started with an exploited public-facing ...
October 2026 Cyber Attacks Timeline
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
AI-Assisted Malicious Campaigns
In this blog post I am collecting the campaigns that show evidence of being AI-generated, or make use of AI tools to increase their impact. As always I will continue to update the list as soon as new campaigns emerge.