In the first timeline of December 2024, I collected 115 events (7.67 events/day) with a threat landscape dominated by malware with 31%, up from 26.3% of the previous timeline, this time the second place is taken by targeted attacks with 16% up from 13.6%, ahead of ransomware, sliding at number three 14% but essentially in line with the previous timeline when it was 13.6%.
In terms of initial access, phishing emails were still the preferred weapon with 15%, slightly down from 16.8%, ahead of publicly-facing app vulnerabilities with 9% (up from 6.7%), which swapped the place with supply chain compromises at 6% down from 7.6%.
Cyber crime led the motivations chart with 66% down from 73.7% (it was 70.3%), once again ahead of cyber espionage (20% down from 12.7%), and cyber warfare up to 6% from 2.5%. Curiously no events driven by hacktivism were recorded in this period.
Multiple organizations led the sectors chart with 32% up from 29.8%, once again ahead of individuals with 13%, up from 9.2% and governments at 11%, even in this case up from 9.2%.
Besides these trends, as always the timeline is rich of interesting events, such as mega breaches (now the corresponding piost is updated with the events occurred in 2024) and attacks against organizations in the fintech space, so my final suggestion does not change: browse the timeline for the details of the events collected in this fortnight.
Feel free to share it to support my work and spread the risk awareness across the community. And last but not least, don’t forget to connect on Linkedin, or even follow @paulsparrows on X (formerly Twitter), psparrows.bsky.social on Bluesky, or @ppasseri@Infosec.exchange on Mastodon for the latest updates.
Geo Map December H1 2024
No Data Found
No Data Found
BE NOTIFIED OF NEW POSTS
SUPPORT MY WORK! MAKE A DONATION
Creating the timelines is a very time-consuming task.
In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
September 2026 saw 181 confirmed cyber incidents, roughly one every four hours. Cybercrime drove 73.8% of attacks and espionage 19.1%. Malware led the techniques with 53 campaigns, ahead of Remote Code Execution with 32. More than a quarter of breaches started with an exploited public-facing ...
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information
The ransomware group Trinity claims it stole 560 gigabytes of data from the Spanish Tax Administration Agency, known as AEAT. However the agency says that the thret actors have actually attacked a private firm that deals with tax and labor matters.
Ransomware
Public admin and defence, social security
Cyber Crime
ES
Unknown
2
02/12/2024
Since at least September 2024
During September 2024
?
Taiwanese companies across manufacturing, healthcare and IT sectors
Researchers at Fortinet discover a sophisticated malware campaign exploiting CVE 2017-11882 to deliver the SmokeLoader malware against Taiwanese companies across manufacturing, healthcare and IT sectors.
Malware
Multiple Industries
Cyber Crime
TW
Phishing Email
3
02/12/2024
-
-
?
Undisclosed organization(s)
Cisco warns customers of active exploitation of CVE-2014-2120, a decade-old security flaw impacting its Adaptive Security Appliance (ASA).
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
4
02/12/2024
Between August and October 2024
Between August and October 2024
?
Multiple Organizations
Researchers at Zscaler uncover campaigns that leveraged two new malware families – RevC2 and Venom Loader, deployed through Venom Spider malware-as-service (MaaS) tools.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
5
02/12/2024
-
-
Mauri
Multiple Organizations in South Korea
Researchers from AhnLab reveal that threat actors using the Mauri ransomware have been found exploiting the CVE-2023-46604 Apache ActiveMQ vulnerability to attack Korean systems.
Ransomware
Multiple Industries
Cyber Crime
KR
Public-facing App Vulnerability
6
02/12/2024
'In recent months'
Since 2013
Ar3s
Multiple Organizations
Researchers from Bitsight discover a Socks5Systemz botnet with 250,000 compromised systems at its peak, geographically dispersed across almost every country in the world.
Malware
Multiple Industries
Cyber Crime
AR
BD
BR
CO
DZ
EG
ID
IN
MA
MX
NG
PH
PK
RU
TH
TR
UA
US
VN
Misconfiguration
7
02/12/2024
-
25/11/2024
?
ENGlobal Corporation
ENGlobal Corporation, a major contractor for the energy industry confirms in a notice to regulators that it is dealing with a ransomware attack that has hindered operations.
Ransomware
Electricity, gas steam, air conditioning
Cyber Crime
US
Unknown
8
02/12/2024
From July 2023 to October 2024
From July 2023 to October 2024
Baku Initiative Group (BIG)
France
A report by VIGINUM, a French government agency, accuses the Baku Initiative Group (BIG), a state-sponsored organization based in Azerbaijan, of manipulating online users in France’s overseas constituencies and Corsica.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
FR
N/A
9
02/12/2024
Since March 2023
Since March 2023
?
Private Users, Retailers, and Service Businesses mainly located in Russia
Researchers at Kaspersky discover "Horns&Hooves", a new malware campaign targeting private users, retailers, and service businesses mainly located in Russia to deliver NetSupport RAT and BurnsRAT.
Malware
Multiple Industries
Cyber Crime
RU
Phishing Email
10
02/12/2024
Since October 2020
-
?
Multiple retailers in Japan
At least 100,000 customers' personal information, including credit cards, is believed to have been stolen from 11 e-commerce websites from multiple organizations in Japan including the coffee chain Tully's Coffee Japan and the national federation of fisheries cooperatives (JF Zengyoren).
Malicious Script Injection
Wholesale and retail
Cyber Crime
JP
Public-facing App Vulnerability
11
02/12/2024
Since July 2024
16/09/2024
?
Marin County Housing Authority
Threat actors steal $950,000 from Marin County Housing Authority.
Account Takeover
Public admin and defence, social security
Cyber Crime
US
Unknown
12
03/12/2024
Since mid-September 2024
During Mid-September 2024
Kimsuky
Multiple Organizations in South Korea
Researchers at Genians link the North Korea-aligned threat actor known as Kimsuky to a series of phishing attacks that involve sending email messages that originate from Russian sender addresses to ultimately conduct credential theft.
Account Takeover
Multiple Industries
Cyber Espionage
KR
Phishing Email
13
03/12/2024
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Trend Micro observe threat actors targeting misconfigured Docker Remote API servers with the Gafgyt (also known as Bashlite or Lizkebab) malware.
Malware
Multiple Industries
Cyber Crime
>1
Misconfiguration
14
03/12/2024
-
-
Unknown threat actors
Unknown Organization(s)
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) adds CVE-2023-45727, a North Grid Proself Improper Restriction of XML External Entity (XEE) Reference Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Security Appliance Vulnerability
15
03/12/2024
-
-
Unknown threat actors
Unknown Organization(s)
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) adds CVE-2024-11680, a ProjectSend Improper Authentication Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
16
03/12/2024
-
-
Unknown threat actors
Unknown Organization(s)
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) adds CVE-2024-11667, a Zyxel Firewalls Path Traversal Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Security Appliance Vulnerability
17
03/12/2024
-
-
?
Multiple Organizations
Researchers at Silent Push unveil a malicious threat actor group dubbed “Payroll Pirates,” responsible for an ongoing malicious campaign targeting companies’ employees with human resources (HR) phishing scams to carry out payroll redirects.
Malware
Multiple Industries
Cyber Crime
>1
Malvertising
18
03/12/2024
-
-
?
Individuals in the U.S.
The FBI warns that scammers are increasingly using artificial intelligence to improve the quality and effectiveness of their online fraud schemes, ranging from romance and investment scams to job hiring schemes.
Scam
Individual
Cyber Crime
US
Multiple Vectors
19
03/12/2024
-
-
?
Multiple Organizations
Researchers from Trellix discover samples belonging to Celestial Stealer, a JavaScript-based infostealer which is packaged either as an Electron application or as a NodeJS single application for Windows 10 and Windows 11 operating system.
Malware
Individual
Cyber Crime
>1
Unknown
20
03/12/2024
During 2024
During 2024
?
Organizations in South Korea
Researchers at AhnLab discover an uptick of phishing attacks impersonating the National Tax Service in South Korea.
Malware
Multiple Industries
Cyber Crime
KR
Phishing Email
21
03/12/2024
30/05/2024
15/12/2024
?
Chemonics
Chemonics, a large contractor for the U.S. government says a 2023 cyberattack exposed the critical personal information of more than 263,000 people.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
22
03/12/2024
-
-
Threat Actors from Iran
Kash Patel
President-elect Donald Trump’s FBI director pick, Kash Patel, is informed by the FBI itself that he’d been targeted by Iranian threat actors.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
US
Unknown
23
04/12/2024
03/12/2024
03/12/2024
?
Multiple Organizations in the Cryptocurrency Space
The legitimate Solana JavaScript SDK is temporarily compromised in a supply chain attack, with the library backdoored with malicious code to steal cryptocurrency private keys and drain wallets.
Malware
Fintech
Cyber Crime
>1
Supply Chain Compromise
24
04/12/2024
Since at least 13/11/2024
04/12/2024
Unknown threat actors
Unknown Organization(s)
Japan's CERT warns that threat actors are exploiting CVE-2024-45841, CVE-2024-47133, and CVE-2024-52564, three zero-day vulnerabilities in I-O Data router devices to modify device settings, execute commands, or even turn off the firewall.
Unknown
Unknown
Unknown
JP
Hardware Vulnerability
25
04/12/2024
Since 2022
Since Six Months
Salt Typhoon, a.k.a. Earth Estries, FamousSparrow, GhostEmperor, and UNC2286
Telecom Companies in the U.S. and Dozens of Other Nations
A joint advisory issued by Australia, Canada, New Zealand, and the U.S. warns of a broad cyber espionage campaign undertaken by People's Republic of China (PRC)-affiliated threat actors from Salt Typhoon, targeting telecommunications providers.
Targeted Attack
Information and communication
Cyber Espionage
US
Other Nations
Hardware Vulnerability
26
04/12/2024
-
-
Unknown threat actors
Unknown Organization(s)
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) adds the CyberPanel flaw CVE-2024-51378, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
27
04/12/2024
-
-
?
Multiple organizations
Researchers at Cybereason unveil the discovery of a new cluster of Command-and-Control (C2) servers linked to the infamous Andromeda (aka Gamarue) malware family.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
28
04/12/2024
Since January 2023
Since January 2023
Multiple organizations
Researchers from Lumen uncover a campaign orchestrated by the Russian-based threat actor known as “Secret Blizzard” (also referred to as Turla), abusing 33 separate command-and-control (C2) nodes used by Pakistani-based actor, “Storm-0156.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Unknown
29
04/12/2024
Since at least June 2024
Late October 2024
Threat Actors of Turkish Origin
Android Banking users
Researchers from Cleafy discover DroidBot, a new Android remote access trojan targeting as many as 77 banking institutions, cryptocurrency exchanges, and national organizations.
Malware
Finance and insurance
Cyber Crime
DE
ES
FR
GB
IT
PT
TK
Social Engineering
30
04/12/2024
Since Early October 2024
During Early October 2024
Black Basta
Multiple Organizations
Researchers from Rapid7 observe a resurgence of activity related to the ongoing social engineering campaign being conducted by Black Basta ransomware operators.
Ransomware
Multiple Industries
Cyber Crime
>1
Malspam
31
04/12/2024
'Recently'
'Recently'
Patchwork APT (a.k.a. Hangover and Dropping Elephant)
Scientific organizations in China
Researchers at Anheng Hunting Laboratory discover a new wave of cyberattacks targeting Chinese scientific organizations via the BadNews backdoor.
Targeted Attack
Multiple Industries
Cyber Espionage
CN
Phishing Email
32
04/12/2024
-
-
Black Basta
BT Group
BT Group (formerly British Telecom) has confirmed that its BT Conferencing business division shut down some of its servers following a Black Basta ransomware breach.
Ransomware
Information and communication
Cyber Crime
GB
Unknown
33
04/12/2024
Since November 2024
Since November 2024
Threat Actors from russia
Romania's Presidential Elections
Romania’s constitutional court annuls the first round of the country’s presidential election following the declassification of intelligence showing Russian interference influenced the result.
Coordinated Inauthentic Behavior
Public admin and defence, social security
Cyber Warfare
RO
N/A
34
04/12/2024
20/06/2024
07/05/2024
?
Express Services
Express Services experiences a data breach when an unauthorized party gained access to two company email accounts.
Account Takeover
Administration and support service
Cyber Crime
US
Phishing Email
35
04/12/2024
29/11/2024
-
?
Watsonville Community Hospital
Watsonville Community Hospital continues to work through what they refer to as a cyberattack on November 29. The hospital’s network has been offline since then with staff reverting to “downtime” procedures using paper.
Unknown
Human health and social work
Cyber Crime
US
Unknown
36
05/12/2024
Since at least 11/04/2024
11/04/2024
Threat actors from China
Undisclosed Large U.S. Organization
Researchers from Broadcom/Symantec reveal that a large U.S. organization with significant presence in China has been reportedly breached by China-based threat actors who persisted on its networks from April to August 2024.
Targeted Attack
Unknown
Cyber Espionage
US
Unknown
37
05/12/2024
-
-
?
Tech Executives in Multiple Organizations
Researchers at Cado Security discover a recent DocuSign spearphishing email campaign targeting tech executives.
Account Takeover
Unknown
Cyber Crime
Unknown
Phishing Email
38
05/12/2024
-
-
Earth Minotaur
Tibetans and Uyghurs Individuals
Researchers at Trend Micro discover a previously undocumented threat activity cluster dubbed Earth Minotaur, leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs.
Targeted Attack
Individual
Cyber Espionage
>1
Phishing Email
39
05/12/2024
'Recently'
'Recently'
?
Multiple Organizations in the Manufacturing Industry
Researchers from Cyble discover a malicious campaign targeting the manufacturing industry, using process injections to deliver Lumma Stealer and Amadey bot.
Malware
Manufacturing
Cyber Crime
>1
Phishing Email
40
05/12/2024
19/11/2024
19/11/2024
State-sponsored Threat Actors
Multiple Romanian election sites, including bec.ro (Central Election Bureau), roaep.ro, and registrulelectoral.ro (voter registration)
A report from Romania’s Intelligence Service (SRI) says that the country’s election infrastructure was targeted by more than 85,000 cyberattacks with threat actors also obtaining access credentials for election-related websites and leaked them on a Russian forum less than a week before the first presidential election round.
Unknown
Public admin and defence, social security
Cyber Warfare
RO
Unknown
41
05/12/2024
During November 2024
During November 2024
?
Romanian presidential election
The Romania's Intelligence Service (SRI) discover an influence campaign targeting the Romanian presidential election, where more than 100 TikTok Romanian influencers with over 8 million active followers were manipulated to distribute election content promoting presidential candidate Calin Georgescu.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
RO
N/A
42
05/12/2024
Since at least October 2023
Since at least October 2023
Gamaredon, a.k.a. BlueAlpha, Aqua Blizzard, Armageddon, Hive0051, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, UAC-0010, UNC530, and Winterflounder
Multiple Organizations in Ukraine
Researchers from Recorded Future observer the threat actor known as Gamaredon, leveraging Cloudflare Tunnels as a tactic to conceal its staging infrastructure hosting a malware called GammaDrop.
Targeted Attack
Multiple Industries
Cyber Espionage
UA
Phishing Email
43
05/12/2024
Since January 2024
Since January 2024
?
Multiple organizations in Russia
Researchers from Kaspersky reveal that Russian businesses using unlicensed software have been targeted by an ongoing RedLine info-stealer campaign. The pirated software is distributed via Russian online forums, attackers disguise the malware as a tool to bypass licensing for business automation software.
Malware
Multiple Industries
Cyber Crime
RU
Rogue App
44
05/12/2024
During June 2024
During June 2024
Russia's Federal Security Service (FSB)
Kirill Parubets
Researchers at Citizen Lab reveal that after Kirill Parubets, a Russian programmer, was detained by Russia's Federal Security Service (FSB) for fifteen days and his phone confiscated, it was discovered that a new spyware, derived from Monokle, was secretly installed on his device upon its return.
Malware
Individual
Cyber Espionage
RU
Rogue App
45
05/12/2024
21/11/2024
21/11/2024
Roaming Mantis
Multiple organizations in Japan
Researchers at Hunt.io discover a MoqHao (a.k.a. Wroba and XLoader) targeting Apple IDs and Android devices in Japan.
Account Takeover
Malware
Multiple Industries
Cyber Espionage
JP
Phishing Email
46
05/12/2024
05/12/2024
05/12/2024
Ukraine’s military intelligence agency (HUR)
Gazprombank
Russian users report difficulties accessing services at Gazprombank, one of the country’s largest privately owned banks, following an alleged cyberattack by Ukraine’s military intelligence agency.
DDoS
Finance and insurance
Cyber Warfare
RU
N/A
47
06/12/2024
Since September 2024
During September 2024
?
Users in the Cryptocurrency Space
Researchers at Cado Security discover Meeten, a campaign where cybercriminals are targeting people working in Web3 with fake business meetings using a fraudulent video conferencing platform that infects Windows and Macs with crypto-stealing malware.
Malware
Fintech
Cyber Crime
>1
Rogue Website
48
06/12/2024
-
-
Termite
Multiple organizations
Researchers at Cyble reveal the details of Termite, a variant of the Babuk ransomware, behind the Blue Yonder attack, and targeting multiple organizations worldwide.
Ransomware
Multiple Industries
Cyber Crime
CA
DE
FR
OM
US
Unknown
49
06/12/2024
-
-
?
High-value assets in Southern Asia
Researchers at Cyfirma reveal that high-value assets in Southern Asia have become the target of an Android malware campaign that delivers the SpyNote trojan.
Malware
Multiple Industries
Cyber Crime
>1
Instant Messaging App
50
06/12/2024
02/12/2024
-
?
Ito En
The Japanese corporation Ito En confirms that its U.S. subsidiary was hit with ransomware. The company is the largest producer of green tea in Japan and has subsidiaries in the U.S., Australia, China and Indonesia.
Ransomware
Accommodation and food service
Cyber Crime
US
Unknown
51
06/12/2024
-
-
8Base
Port of Rijeka
The 8Base ransomware group hits Croatia’s Port of Rijeka, stealing sensitive data, including contracts and accounting info.
Ransomware
Accommodation and food service
Cyber Crime
HR
Unknown
52
06/12/2024
-
21/11/2024
?
White Lake Township
White Lake Township officials disclose that a cyber attack has compromised at least some of its $29 million in infrastructure bond money.
Unknown
Public admin and defence, social security
Cyber Crime
US
Unknown
53
06/12/2024
-
-
Threat actors from Nigeria
Luxottica
A cyber attack carried out by Nigerian threat actors hits Luxottica, diverting funds to foreign accounts.
Unknown
Manufacturing
Cyber Crime
IT
Unknown
54
07/12/2024
04/12/2024
04/12/2024
?
Ukrainian Defense Companies and Security and Defense Forces
The Computer Emergency Response Team of Ukraine (CERT-UA) discover a series of phishing emails targeting Ukrainian defense companies and security and defense forces with a fake NATO standards conference.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
UA
Phishing Email
55
07/12/2024
-
-
UAC-0185
Ukrainian Defense Companies and Security and Defense Forces
The Computer Emergency Response Team of Ukraine (CERT-UA) detect a new series of cyberattacks targeting Ukrainian defense companies and security and defense force with phishing emails mimicking official messages from the Ukrainian League of Industrialists and Entrepreneurs and distributing the MESHAGENT malware.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
UA
Phishing Email
56
07/12/2024
29/11/2024
29/11/2024
?
Kurita Water
The U.S. subsidiary of Kurita Water, a Japanese water treatment company says ransomware actors have stolen data from systems and encrypted some servers.
Ransomware
Accommodation and food service
Cyber Crime
US
Unknown
57
07/12/2024
-
-
Salt Typhoon, a.k.a. Earth Estries, FamousSparrow, GhostEmperor, and UNC2286
Senior American Political Figures
The U.S. believes that the Chinese cyber espionage campaign Salt Typhoon targeted and recorded telephone calls of "very senior" American political figures.
Targeted Attack
Individual
Cyber Espionage
US
Unknown
58
08/12/2024
02/12/2024
02/12/2024
?
BeyondTrust
Privileged access management company BeyondTrust suffers a cyberattack after threat actors breached some of its Remote Support SaaS instances.
Compromised API Key
Professional, scientific and technical
Cyber Crime
US
Public-facing App Vulnerability
59
09/12/2024
04/12/2024
04/12/2024
?
Multiple Organizations
Researchers at ReversingLabs discover a malicious version of the popular AI library ultralytics — which has almost 60 million downloads — published to the Python Package Index (PyPI) package repository, and containing downloader code that was downloading the XMRig coinminer. The compromise of the project's build environment was achieved by exploiting a known and previously reported GitHub Actions script injection.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
60
09/12/2024
09/12/2024
09/12/2024
?
Electrica Group
Electrica Group, a key player in the Romanian electricity distribution and supply market, is investigating a ransomware attack.
Ransomware
Electricity, gas steam, air conditioning
Cyber Crime
RO
Unknown
61
09/12/2024
21/11/2024
21/11/2024
Lynx
Artivion
Artivion, a leading manufacturer of heart surgery medical devices, discloses q ransomware attack that disrupted its operations and forced it to take some systems offline.
Ransomware
Manufacturing
Cyber Crime
US
Unknown
62
09/12/2024
Since at least January 2024
During August 2024
ShinyHunters
Multiple Organizations
Terabytes of data belonging to thousands of AWS customers, including customer details, AWS credentials, and proprietary source code, are compromised in a large-scale cyber operation linked to the now-defunct ShinyHunters hacking group.
>1
Multiple Industries
Cyber Crime
>1
Misconfiguration
Public-facing App Vulnerability
63
09/12/2024
During mid-November 2024
During mid-November 2024
?
City of Clark Fork
The City of Clark Fork is scammed out of half a million dollars by a man posing as its construction contractor.
Business Email Compromise
Public admin and defence, social security
Cyber Crime
US
Unknown
64
10/12/2024
From late June to mid-July 2024
From late June to mid-July 2024
Suspected China-nexus cyber espionage group
Large business-to-business IT service providers in Southern Europe
Researchers from Sentinel One and Tinext Cyber reveal the details of Operation Digital Eye, a suspected China-nexus cyber espionage group attributed to an attacks targeting large business-to-business IT service providers in Southern Europe.
Targeted Attack
Administration and support service
Cyber Espionage
>1
Public-facing App Vulnerability
65
10/12/2024
-
-
Unknown threat actors
Unknown Organization(s)
Microsoft fixes CVE-2024-49138, a Windows Common Log File System Driver Elevation of Privilege vulnerability actively exploited.
Unknown
Unknown
Unknown
Unknown
OS Vulnerability
66
10/12/2024
Since at least 07/12/2024
07/12/2024
Multiple threat actors
Multiple organizations
Researchers from Huntress warn that CVE-2024-50623, a vulnerability in several file transfer products from Cleo is being exploited by threat actors, even after a patch was released by the developer.
Malware
Multiple Industries
Cyber Crime
>1
Public-facing App Vulnerability
67
10/12/2024
'Recently'
'Recently'
?
Android Banking Users in Spain, the U.S., Canada, Australia, Portugal, Poland
Researchers at Zimperium identify Applite, a sophisticated Mishing (mobile-targeted phishing) campaign delivering malware to the user’s Android mobile device, enabling a broad set of malicious actions including credential theft of banking, cryptocurrency and other critical applications.
Malware
Finance and insurance
Cyber Crime
AU
CA
ES
PL
PT
US
Phishing Email
68
10/12/2024
-
-
?
Multiple Organizations
Researchers at WPScan discover that threat actors are exploiting CVE-2024-11972, a critical vulnerability in the "Hunk Companion" plugin to install and activate other plugins with exploitable flaws directly from the WordPress.org repository.
Malicious WordPress Plugin
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
69
10/12/2024
-
-
?
Multiple Organizations
Researchers at Zscaler discover a new version of the ZLoader malware that employs a Domain Name System (DNS) tunnel for command-and-control (C2) communications.
Malware
Multiple Industries
Cyber Crime
>1
Social Engineering
70
10/12/2024
-
-
CyberAv3ngers
Multiple organizations in Iran and the U.S.
Researchers at Claroty reveal that Iranian threat actors are utilizing a new malware named IOCONTROL to compromise Internet of Things (IoT) devices and OT/SCADA systems used by critical infrastructure in Israel and the United States.
Malware
Multiple Industries
Cyber Warfare
IL
US
Unknown
71
10/12/2024
During December 2024
During December 2024
?
Multiple Organizations in Germany
The Germany's BSI cybersecurity agency warns of numerous reports that Citrix Netscaler devices are now targeted in password spray attacks to steal login credentials and breach networks.
Password-spray
Multiple Industries
Unknown
DE
Security Appliance Vulnerability
72
10/12/2024
-
29/11/2024
Play?
Krispy Kreme
US doughnut chain Krispy Kreme reveals it suffered a cyberattack in November that impacted portions of its business operations, including placing online orders. The Play ransomware gang claims responsibility for the attack.
Ransomware
Accommodation and food service
Cyber Crime
US
Unknown
73
10/12/2024
-
-
?
Businesses and Users Primarily in Southeast Asia
Researchers at Dr. Web identify an active Linux malware campaign leveraging eBPF technology and targeting businesses and users primarily in Southeast Asia.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
74
10/12/2024
-
-
?
Comisión Nacional de los Mercados y la Competencia (CNMC)
The Spanish authorities investigate the theft of two billion mobile phone account holder records in 240 gigabytes of data from the national market competition authority.
Unknown
Public admin and defence, social security
Cyber Crime
ES
Unknown
75
10/12/2024
-
09/12/2024
ExKase20
Peruvian University of Applied Sciences
The Peruvian University of Applied Sciences investigates a data breach, stating that hackers stole student data including names, emails and copies of university IDs.
Unknown
Education
Cyber Crime
PE
Unknown
76
11/12/2024
17/11/2024
-
?
Multiple Organizations
Researchers at Socket discover a malicious npm package targeting developers attempting to install the popular @typescript-eslint/eslint-plugin package, an ESLint plugin specifically for TypeScript code.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
77
11/12/2024
02/12/2024
02/12/2024
Smishing Triad
Individuals in the UAE
Researchers at Resecurity identify a wide-scale fraudulent campaign targeting consumers in the UAE by impersonating the Dubai law enforcement.
Scam
Individual
Cyber Crime
AE
Smishing
78
11/12/2024
Since at least October 2023
27/05/2024
Threat actors from China
Multiple organizations including government ministries in two different countries, an air traffic control organization, a telecoms company, and a media outlet.
Researchers from Symantec reveal that a suspected China-based threat actor has been linked to a series of cyber attacks targeting high-profile organizations in Southeast Asia since at least October 2023.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Unknown
79
11/12/2024
-
-
?
Individuals in South Korea
A South Korean law enforcement operation, dubbed Operation Midas, and carried out by the Korean Financial Security Institute (K-FSI), takes down a large-scale fraud network that extorted $6.3m from victims with fake online trading platforms.
Scam
Individual
Cyber Crime
KR
Unknown
80
11/12/2024
'During 2024'
'During 2024'
?
Retail Brands and Crypto Users
Researchers at Silent Push reveal the details of a threat actor dubbed “Aggressive Inventory Zombies” (AIZ) launching a large-scale phishing and pig-butchering campaign through a network targeting retail brands and also a crypto phishing campaign.
Account Takeover
Multiple Industries
Cyber Crime
>1
Unknown
81
11/12/2024
Since at least 2021 (BoneSpy) and since 2024 (PlainGnome)
Gamaredon, a.k.a. BlueAlpha, Aqua Blizzard, Armageddon, Hive0051, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, UAC-0010, UNC530, and Winterflounder
Russian-speaking Victims in Former Soviet States
Researchers at Lookout attribute the Russia-linked state-sponsored threat actor tracked as Gamaredon to two new Android spyware tools called BoneSpy and PlainGnome.
Malware
Individual
Cyber Espionage
>1
Social Engineering
82
11/12/2024
Since at least early July 2024
Early July 2024
?
Multiple organizations
Researchers at Group-IB discover a sophisticated phishing campaign targeting employees of 30+ companies across 12 industries worldwide, leveraging sophisticated techniques to bypass Secure Email Gateways (SEGs) and exploit trusted platforms.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
83
11/12/2024
During Q3 2024
During Q3 2024
?
Multiple Organizations
Researchers at McAfee discover two distinct Remcos RAT variants, each leveraging unique methods for delivery and execution.
Malware
Multiple Industries
Cyber Crime
>1
Malspam
84
11/12/2024
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Sublime discover a malicious campaign impersonating SharePoint to deliver malware via a link in the message.
Account Takeover
Multiple Industries
Cyber Crime
Unknown
Phishing Email
85
11/12/2024
Between March and April
Between March and April
Secret Blizzard
Multiple Organizations in Ukraine
Researchers at Microsoft reveal that the Russian state threat actor Secret Blizzard has leveraged resources and tools used by other groups, such as the Amadey botnet, to support the Kremlin’s military efforts in Ukraine, according to Microsoft.
Targeted Attack
Multiple Industries
Cyber Warfare
UA
Unknown
86
11/12/2024
Since at least 2017
25/09/2024
Law Enforcement in China
Individuals in China
Researchers at Lookout discover EagleMsgSpy, a novel surveillance program that's suspected to be used by Chinese police departments as a lawful intercept tool to gather a wide range of information from mobile devices.
Malware
Individual
Cyber Espionage
CN
Physical Installation
87
11/12/2024
16/02/2024
12/05/2024
?
Phreesia
Healthcare software as a service (SaaS) company Phreesia notifies over 910,000 people that their personal and health data was exposed in a May breach of its subsidiary ConnectOnCall, acquired in October 2023.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
88
11/12/2024
-
-
?
Multiple Organizations
Okta warns organizations of an increase in what it has described as “phishing social engineering attempts” that impersonate its support team.
Account Takeover
Multiple Industries
Cyber Crime
>1
Social Engineering
89
11/12/2024
-
06/10/2024
?
Center for Vein Restoration
Vein care provider Center for Vein Restoration notifies over 446,000 individuals that their personal, medical, and financial information was compromised in a recent cyberattack.
Unknown
Human health and social work
Cyber Crime
US
Unknown
90
11/12/2024
'Recently'
'Recently'
?
Multiple Organizations
Researchers at AhnLab reveal that poorly managed Linux servers, particularly publicly exposed SSH services, are being targeted by a previously undocumented DDoS malware family dubbed cShell.
Malware
Multiple Industries
Cyber Crime
KR
Misconfiguration
91
12/12/2024
'Recently'
'Recently'
?
Android Users in India
Researchers at McAfee discover a new Android banking trojan targeting Indian users in disguise of essential services, such as utility (e.g., gas or electricity) or banking apps, to get sensitive information from users.
Malware
Individual
Cyber Crime
IN
Instant Messaging App
92
12/12/2024
Since at least 04/09/2024
-
?
Multiple Organizations
Researchers at Elastic uncover a new Linux rootkit called PUMAKIT that comes with capabilities to escalate privileges, hide files and directories, and conceal itself from system tools, while simultaneously evading detection.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
93
12/12/2024
During 2019 and 2022
During 2022
Careto a.k.a. The Mask
Undisclosed Organization in Latin America
Researchers at Kaspersky link the cyber espionage actor known as The Mask to a new set of attacks targeting an unnamed organization in Latin America twice in 2019 and 2022.
Targeted Attack
Unknown
Cyber Espionage
Unknown
Unknown
94
12/12/2024
Since at least December 2023
29/04/2024
Winnti, a.k.a. APT41
Organizations in China and the U.S, and other Cybercriminal groups
Researchers at XLab reveal that the Chinese Winnti group is using a new PHP backdoor named 'Glutton' in attacks on organizations in China and the U.S., and also in attacks on other cybercriminals.
Targeted Attack
Multiple Industries
Cyber Espionage
CN
US
Unknown
95
12/12/2024
During 2024
During 2024
?
Individuals in the U.S.
The Federal Trade Commission (FTC) warns about a significant rise in gambling-like online job scams, known as "task scams," that draw people into earning cash through repetitive tasks, with the promises of earning more if they deposit their own money.
Scam
Individual
Cyber Crime
US
Social Engineering
96
12/12/2024
30/09/2024
18/11/2024
?
Byte Federal
US Bitcoin ATM operator Byte Federal discloses a data breach that exposed the data of 58,000 customers after its systems were breached using a GitLab vulnerability.
Unknown
Fintech
Cyber Crime
US
Public-facing App Vulnerability
97
12/12/2024
22/11/2024
05/09/2024
?
SRP Federal Credit Union
More than 240,000 people have information stolen during a cyberattack on SRP Federal Credit Union, one of the largest in South Carolina.
Unknown
Finance and insurance
Cyber Crime
US
Unknown
98
12/12/2024
17/09/2024
17/10/2024
?
Kitsap Mental Health Services
Kitsap Mental Health Services discloses to have suffered a cyberattack due to an unauthorized access to their network.
Unknown
Human health and social work
Cyber Crime
US
Unknown
99
13/12/2024
-
-
?
Undisclosed Organization
Researchers at Trend Micro discover an incident where an attacker used social engineering via a Microsoft Teams call to impersonate a user’s client and gain remote access to their system via the DarkGate malware.
Malware
Unknown
Cyber Crime
Unknown
Social Engineering
100
13/12/2024
-
-
MUT-1244
Multiple Organizations
Researchers at Datadog discover a malicious campaign stealing targeting offensive security researchers and stealing 390,000 credentials.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
Supply Chain Compromise
101
13/12/2024
-
-
?
Thai Government Officials
Researchers at Netskope discover a campaign targeting Thai government officials through DLL side-loading to deliver a previously undocumented backdoor dubbed Yokai.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
TH
Unknown
102
13/12/2024
-
-
?
Multiple Organizations
Researchers at Zscaler discover a malware campaign leveraging Node.js applications for Windows to distribute cryptocurrency miners and information stealers via a malware family dubbed NodeLoader,
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
103
13/12/2024
Since at least 06/11/2024
06/11/2024
?
Graphic Design Professionals
Researchers at Silent Push discover an ongoing series of malvertising campaigns abusing Google Search ads to target graphic design professionals.
Malware
Professional, scientific and technical
Cyber Crime
>1
Malvertising
104
13/12/2024
Since at least late June 2024
During late June 2024
?
Multiple Organizations
Researchers at Palo Alto Networks discover a new packer-as-a-service called HeartCrypt, used to protect malware.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
105
13/12/2024
During 2024
During 2024
TIDRONE
Multiple Organizations in South Korea
Researchers from AhnLab reveal that the TIDRONE threat actor is launching attacks against companies in South Korea exploiting an Enterprise Resource Planning (ERP) software to install a backdoor malware called CLNTEND.
Targeted Attack
Multiple Industries
Cyber Espionage
KR
Supply Chain Compromise
106
13/12/2024
-
-
REF3864
Chinese-speaking users
Researchers at Elastic discover GOSAR, a Golang-based rewrite of the widely recognized QUASAR Remote Access Trojan (RAT), targeting Chinese-speaking regions, with SADBRIDGE, a custom malware loader, to deploy GOSAR backdoor.
Targeted Attack
Individual
Cyber Espionage
CN
Unknown
107
13/12/2024
-
13/11/2024
?
LKQ Corporation
Automobile parts giant LKQ Corporation disclosed that one of its business units in Canada was hacked, allowing threat actors to steal data from the company.
Unknown
Manufacturing
Cyber Crime
CA
Unknown
108
13/12/2024
11/09/2024
20/09/2024
Rhysida
Granite School District
Granite School District discloses that a cyber attack affected all the students' records. The Rhysida ransomware gang claims responsibility for the attack.
Ransomware
Education
Cyber Crime
US
Unknown
109
13/12/2024
01/12/2024
-
?
PIH Health
Threat actors claim they stole 17 million patient records from PIH Health, a southern California regional healthcare provider that is still struggling with IT and phone systems outages that have been disrupting patient care since the organization was hit by a ransomware attack on Dec. 1.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
110
14/12/2024
-
05/12/2024
Brain Cipher
Rhode Island
Rhode Island is warning that its RIBridges system, managed by Deloitte, suffered a data breach exposing residents' personal information after the Brain Cipher ransomware gang hacked its systems.
Ransomware
Public admin and defence, social security
Cyber Crime
US
Unknown
111
14/12/2024
08/09/2024
08/09/2024
?
Boston University
Boston University’s renowned Framingham Heart Study (FHS) is breached by threat actors, who gained access to the data of participants—both living and deceased—of the country’s longest running, multigenerational heart study.
Unknown
Human health and social work
Cyber Crime
US
Unknown
112
15/12/2024
Mid-December 2024
Mid-December 2024
Multiple threat actors
Multiple Organizations
Threat actors exploit a critical vulnerability in the Apache Struts framework, CVE-2024-53677, just days after a proof-of-concept (PoC) exploit was published online.
Unknown
Unknown
Unknown
Unknown
Unknown
113
15/12/2024
Since at least 15/12/2024
15/12/2024
?
Kaiser Permanente employees
Researchers at Malwarebytes detect a malicious campaign targeting Kaiser Permanente employees via Google Search Ads.
Account Takeover
Human health and social work
Cyber Crime
US
Malvertising
114
15/12/2024
Since at least 07/12/2024
07/12/2024
Clop a.k.a. Cl0p
Multiple organizations
The Clop ransomware gang confirms to be behind the recent Cleo data-theft attacks, utilizing zero-day exploits tracked as CVE-2024-50623 and CVE-2024-55956 to breach corporate networks and steal data.
Ransomware
Multiple Industries
Cyber Crime
>1
Public-facing App Vulnerability
115
15/12/2024
During 2024
During 2024
Serbian Government
Two individuals in Serbia
A Serbian journalist and an activist have their phones hacked by local authorities using a cellphone-unlocking device made by forensic tool maker Cellebrite.
September 2026 Cyber Attacks Statistics
Mega Breaches in 2026
September 2026 Cyber Attacks Statistics Infographic
October 2026 Cyber Attacks Timeline
September 2026 Cyber Attacks Timeline